Skip to content

LinkBreeze v1.1.2

Choose a tag to compare

View all tags
@Manak-hash Manak-hash released this 11 Jul 22:44
v1.1.2
3794d01

Security

  • Forgeable admin sessions when SECRET_KEY unset (HIGH) — getSecret() now throws in production if SECRET_KEY is not configured, instead of falling back to a public default. Dev mode still uses a dev-only secret.
  • XFF-spoofing brute-force bypass (HIGH) — Added a global login rate limit (15/min) on top of the existing per-IP limit (5/min). Closes the vector where rotating X-Forwarded-For bypasses per-IP throttling.
  • Subscriber email DoS (HIGH) — subscribers.email now has a UNIQUE constraint. Migration 0005 dedupes existing rows before creating the index. Per-IP rate limit (10/min) added to the subscribe endpoint.
  • Stored XSS via backup restore (MEDIUM) — restoreBackup() now filters javascript: URLs through isAllowedLinkUrl(). Malicious links are silently dropped.
  • Host-header injection for QR/OG/canonical URLs (MEDIUM) — Optional BASE_URL env var takes priority over all forwarded headers when generating absolute URLs.

Fixed

  • Themes not seeding on fresh deploy — only Aurora appears (#35) — getActiveTheme() had an inline fallback that seeded a single Aurora theme when the DB was empty. Because the public page calls it before the admin page is visited, the other 8 presets never got seeded. Fixed: getActiveTheme() now delegates to seedThemesIfEmpty().
  • Theme changes silently not saved (#35) — density column defaulted to "comfortable" but the Zod validator only accepts compact/normal/relaxed. The entire save payload was rejected by safeParse and the error was swallowed client-side. Fixed: schema default, migration 0006, and errors now surfaced in the UI.
  • Floating promise — clearSubscribers() now properly awaited.
  • CSV export lint — Added download attribute.
  • Stale eslint-disable — Removed from OG image route.
  • CI — Added npm run lint step to CI pipeline.

Added

  • Unique visitor count — Dashboard now shows distinct visitor count alongside total views.
  • /go/:id redirect endpoint — Server-side click tracking via 302 redirect. Works without JavaScript. http(s) links now use this path automatically.
  • vCard + File link types — Exposed in the link type dropdown (backend already supported them).
  • npm run seed — Seeds demo data for local development.
  • Skip-to-content link — Accessibility improvement on public pages.
  • prefers-reduced-motion — CSS-based hover effects now respect this media query.

Changed

  • Dependency updates — recharts 3.9.2, shadcn/ui 4.13, @types/node 26, @types/bcryptjs 3.0.
  • next.config — poweredByHeader: false, optimizePackageImports for lucide-react/recharts/@dnd-kit.
  • .env.example — SECRET_KEY marked REQUIRED, BASE_URL documented.

Full Changelog: v1.1.1...v1.1.2

Contributors

dnd-kit
Assets 2
Loading