LinkBreeze v1.1.3

What's Changed

🐛 Fixed

• Fresh Docker deploy crash (migration 0005 fails on startup) — Migrations 0005 and 0006 were missing --> statement-breakpoint markers. better-sqlite3 only accepts one statement per prepare() call, so the multi-statement files crashed the server on every fresh deploy. Added the missing breakpoints. Fixes #38.
• Preset themes ignored numeric fontScale values — Presets like Editorial Paper (110%), Retro Sunset (120%) silently fell through to the default 15px. Now correctly treated as percentages.
• Pastel Soft preset rendered with wrong shadow — resolveShadow() was missing the "soft" case. Added.
• resolveSpacing() density values mismatched the enum — "relaxed" was dead code (fell to default alongside "normal"). Now correctly returns 16px for more spacing.
• Theme name conflicts on duplicate and import — Both operations now reject names already in use instead of creating silent duplicates.

🔒 Security

• Password complexity requirements — Setup and change-password now require at least one lowercase letter, one uppercase letter, and one number. Closes #7.
• Open-redirect hardening on /go/:id — Runtime protocol check added; only http: and https: URLs are accepted for redirect.
• OG image and sitemap routes now respect BASE_URL env var — Both routes were missed in the v1.1.2 host-header injection fix. They fully trusted x-forwarded-host. Now fixed.

Changed

• Theme export schema density default: "comfortable" → "normal" (matching the DB schema and Zod enum).

---

Full changelog: https://github.com/Manak-hash/LinkBreeze/blob/v1.1.3/CHANGELOG.md