diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5e192a2..3bcd07e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,7 +2,7 @@
Format mengikuti [Keep a Changelog](https://keepachangelog.com/) dan [Semantic Versioning](https://semver.org/).
-## [Unreleased] — setelah v0.5.0
+## [0.5.1] — 2026-10-13 — "pickle-lime"
### Diubah
- **WhatsApp** kini **notifikasi keluar saja** (interaksi/bot perintah dimatikan); interaksi dipindah ke **Telegram**.
@@ -19,6 +19,17 @@ Format mengikuti [Keep a Changelog](https://keepachangelog.com/) dan [Semantic V
- `getTechById` (notifikasi tiket oleh admin yang sebelumnya gagal).
- Tabel `discount_logs` dibuat saat fresh-install (500 di `/admin/discounts`).
- `.devcontainer` + `.nvmrc` untuk Codespaces (Node 22).
+- **Backup DB** memakai `VACUUM INTO` (konsisten walau mode WAL) dan **restore diterapkan saat startup** (sebelum koneksi DB dibuka); app restart otomatis untuk menerapkan.
+- **Logger** memutar berkas otomatis (10MB × 5) dan `console.*` sisi server diarahkan ke logger (log seragam di `logs/`).
+- `settings.json` permission di-set `600`.
+
+### Keamanan
+- **`npm audit`: 16 → 0** kerentanan.
+ - Hapus `@whiskeysockets/baileys` (tidak dipakai).
+ - Perbarui `axios`, `multer`, `brace-expansion`, `proxy-addr`.
+ - `xlsx` → build resmi **SheetJS 0.20.3**.
+ - `node-telegram-bot-api` 0.66 → **2.1.0** (via adapter v1→v2 internal).
+- Perbaiki bug **`trust proxy`** (`X-Forwarded-For` terbalik → IP bisa dipalsukan).
## [0.5.0] — 2026-10-09 — "pickle-lime"
diff --git a/README.md b/README.md
index e7fc8f9..bea60d9 100644
--- a/README.md
+++ b/README.md
@@ -9,7 +9,7 @@
- 
+ 
diff --git a/app-customer.js b/app-customer.js
index e7868c6..0740472 100644
--- a/app-customer.js
+++ b/app-customer.js
@@ -177,7 +177,7 @@ app.use((req, res, next) => {
res.locals.uptimeUrl = getSetting('uptime_url', '');
res.locals.heroVer = getSetting('landing_hero_version', '');
res.locals.projectUrl = String(getSetting('project_url', 'https://github.com/oxpoe/open-isp') || '').replace(/\/+$/, '');
- res.locals.appVersion = String(getSetting('app_version', '0.5') || '0.5');
+ res.locals.appVersion = String(getSetting('app_version', '0.5.1') || '0.5.1');
res.locals.appVersionName = String(getSetting('app_version_name', 'pickle-lime') || 'pickle-lime');
res.locals.pwaVersion = String(getSetting('pwa_version', '2.0') || '2.0');
next();
@@ -1661,7 +1661,7 @@ function buildPwaManifest(scope, startUrl, desc, orientation) {
app.get('/version.txt', (req, res) => {
res.type('text/plain; charset=utf-8');
res.set('Cache-Control', 'no-store, no-cache, must-revalidate');
- const billing = String(getSetting('app_version', '0.5') || '0.5');
+ const billing = String(getSetting('app_version', '0.5.1') || '0.5.1');
const nameV = String(getSetting('app_version_name', 'pickle-lime') || 'pickle-lime');
const pwaV = String(getSetting('pwa_version', '2.0') || '2.0');
const stUrl = String(getSetting('speedtest_url', '') || '');
diff --git a/docs/RELEASE_NOTES_v0.5.1.md b/docs/RELEASE_NOTES_v0.5.1.md
new file mode 100644
index 0000000..43b08ae
--- /dev/null
+++ b/docs/RELEASE_NOTES_v0.5.1.md
@@ -0,0 +1,31 @@
+# OPEN-ISP v0.5.1 (pickle-lime) — Patch Keamanan & Stabilitas
+
+Tanggal: 2026-10-13
+
+Rilis patch yang menutup seluruh temuan kerentanan dependensi, sekaligus memperkuat **backup/restore** dan **logging**.
+
+## Keamanan
+- `npm audit`: **16 → 0** kerentanan.
+ - Menghapus `@whiskeysockets/baileys` (tidak dipakai).
+ - Memperbarui `axios`, `multer`, `brace-expansion`, `proxy-addr`.
+ - `xlsx` → build resmi **SheetJS 0.20.3** (API sama).
+ - `node-telegram-bot-api` **0.66 → 2.1.0** (memakai adapter v1→v2 internal; modul bot tidak dirombak).
+- Memperbaiki bug **`trust proxy`**: `X-Forwarded-For` terbalik sehingga IP bisa dipalsukan (berdampak pada rate-limit/login).
+- `cookie_secure` sebaiknya diaktifkan saat aplikasi dipublikasikan via **HTTPS**.
+
+## Backup & Restore
+- Backup database memakai **`VACUUM INTO`** → snapshot **konsisten** walau database berjalan di mode **WAL** (sebelumnya menyalin file mentah berisiko kehilangan transaksi terbaru).
+- **Restore diterapkan saat startup** (sebelum koneksi DB dibuka) → menghindari kerusakan data karena menimpa file DB di bawah koneksi hidup. Aplikasi **restart otomatis** untuk menerapkan restore.
+- Restore settings memakai pemuatan ulang otomatis (tanpa restart).
+
+## Logging
+- Berkas log **diputar otomatis** (10MB × 5) — tidak lagi menumpuk memenuhi disk.
+- Seluruh `console.*` sisi server diarahkan ke **logger** → log **seragam** dan tersimpan di `logs/`.
+
+## Lainnya
+- `settings.json` di-set permission `600` (rahasia tidak world-readable).
+- Versi dinaikkan ke **0.5.1**.
+
+## Cara Update
+- **Docker:** `docker compose pull` / `docker compose up -d --build`.
+- **Manual:** `git pull` lalu `npm ci --omit=dev` dan restart aplikasi.
diff --git a/package-lock.json b/package-lock.json
index 4362d1e..ea4224a 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
{
"name": "open-isp",
- "version": "0.5.0",
+ "version": "0.5.1",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "open-isp",
- "version": "0.5.0",
+ "version": "0.5.1",
"hasInstallScript": true,
"license": "ISC",
"dependencies": {
diff --git a/package.json b/package.json
index 0b5688c..e76beee 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
{
"name": "open-isp",
- "version": "0.5.0",
+ "version": "0.5.1",
"description": "OPEN-ISP — sistem billing & manajemen ISP open-source (PWA pelanggan, multi-OLT, RADIUS, WhatsApp, QRIS)",
"main": "app-customer.js",
"scripts": {
diff --git a/views/admin/partials/sidebar.ejs b/views/admin/partials/sidebar.ejs
index 6b6823b..157bd14 100644
--- a/views/admin/partials/sidebar.ejs
+++ b/views/admin/partials/sidebar.ejs
@@ -133,7 +133,7 @@ document.addEventListener('DOMContentLoaded', () => {
OPEN-ISP BILLING SYSTEM
- v<%= (typeof appVersion !== 'undefined' ? appVersion : '0.5') %> (pickle-lime) · ISC · oxpoe
+ v<%= (typeof appVersion !== 'undefined' ? appVersion : '0.5.1') %> (pickle-lime) · ISC · oxpoe
diff --git a/views/donate.ejs b/views/donate.ejs
index 18406a9..8f0aea4 100644
--- a/views/donate.ejs
+++ b/views/donate.ejs
@@ -180,7 +180,7 @@