From 6abfeb4577114ea6c93bbc9fdb6a54aeface1f30 Mon Sep 17 00:00:00 2001 From: oxpoe Date: Tue, 13 Oct 2026 00:11:22 +0700 Subject: [PATCH] chore(release): siapkan v0.5.1 (versi, CHANGELOG, release notes) --- CHANGELOG.md | 13 ++++++++++++- README.md | 2 +- app-customer.js | 4 ++-- docs/RELEASE_NOTES_v0.5.1.md | 31 +++++++++++++++++++++++++++++++ package-lock.json | 4 ++-- package.json | 2 +- views/admin/partials/sidebar.ejs | 2 +- views/donate.ejs | 2 +- views/landing.ejs | 2 +- 9 files changed, 52 insertions(+), 10 deletions(-) create mode 100644 docs/RELEASE_NOTES_v0.5.1.md diff --git a/CHANGELOG.md b/CHANGELOG.md index 5e192a2..3bcd07e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,7 +2,7 @@ Format mengikuti [Keep a Changelog](https://keepachangelog.com/) dan [Semantic Versioning](https://semver.org/). -## [Unreleased] — setelah v0.5.0 +## [0.5.1] — 2026-10-13 — "pickle-lime" ### Diubah - **WhatsApp** kini **notifikasi keluar saja** (interaksi/bot perintah dimatikan); interaksi dipindah ke **Telegram**. @@ -19,6 +19,17 @@ Format mengikuti [Keep a Changelog](https://keepachangelog.com/) dan [Semantic V - `getTechById` (notifikasi tiket oleh admin yang sebelumnya gagal). - Tabel `discount_logs` dibuat saat fresh-install (500 di `/admin/discounts`). - `.devcontainer` + `.nvmrc` untuk Codespaces (Node 22). +- **Backup DB** memakai `VACUUM INTO` (konsisten walau mode WAL) dan **restore diterapkan saat startup** (sebelum koneksi DB dibuka); app restart otomatis untuk menerapkan. +- **Logger** memutar berkas otomatis (10MB × 5) dan `console.*` sisi server diarahkan ke logger (log seragam di `logs/`). +- `settings.json` permission di-set `600`. + +### Keamanan +- **`npm audit`: 16 → 0** kerentanan. + - Hapus `@whiskeysockets/baileys` (tidak dipakai). + - Perbarui `axios`, `multer`, `brace-expansion`, `proxy-addr`. + - `xlsx` → build resmi **SheetJS 0.20.3**. + - `node-telegram-bot-api` 0.66 → **2.1.0** (via adapter v1→v2 internal). +- Perbaiki bug **`trust proxy`** (`X-Forwarded-For` terbalik → IP bisa dipalsukan). ## [0.5.0] — 2026-10-09 — "pickle-lime" diff --git a/README.md b/README.md index e7fc8f9..bea60d9 100644 --- a/README.md +++ b/README.md @@ -9,7 +9,7 @@

Lisensi: ISC - Versi 0.5 (pickle-lime) + Versi 0.5.1 (pickle-lime) Node.js >= 20 Docker Stars diff --git a/app-customer.js b/app-customer.js index e7868c6..0740472 100644 --- a/app-customer.js +++ b/app-customer.js @@ -177,7 +177,7 @@ app.use((req, res, next) => { res.locals.uptimeUrl = getSetting('uptime_url', ''); res.locals.heroVer = getSetting('landing_hero_version', ''); res.locals.projectUrl = String(getSetting('project_url', 'https://github.com/oxpoe/open-isp') || '').replace(/\/+$/, ''); - res.locals.appVersion = String(getSetting('app_version', '0.5') || '0.5'); + res.locals.appVersion = String(getSetting('app_version', '0.5.1') || '0.5.1'); res.locals.appVersionName = String(getSetting('app_version_name', 'pickle-lime') || 'pickle-lime'); res.locals.pwaVersion = String(getSetting('pwa_version', '2.0') || '2.0'); next(); @@ -1661,7 +1661,7 @@ function buildPwaManifest(scope, startUrl, desc, orientation) { app.get('/version.txt', (req, res) => { res.type('text/plain; charset=utf-8'); res.set('Cache-Control', 'no-store, no-cache, must-revalidate'); - const billing = String(getSetting('app_version', '0.5') || '0.5'); + const billing = String(getSetting('app_version', '0.5.1') || '0.5.1'); const nameV = String(getSetting('app_version_name', 'pickle-lime') || 'pickle-lime'); const pwaV = String(getSetting('pwa_version', '2.0') || '2.0'); const stUrl = String(getSetting('speedtest_url', '') || ''); diff --git a/docs/RELEASE_NOTES_v0.5.1.md b/docs/RELEASE_NOTES_v0.5.1.md new file mode 100644 index 0000000..43b08ae --- /dev/null +++ b/docs/RELEASE_NOTES_v0.5.1.md @@ -0,0 +1,31 @@ +# OPEN-ISP v0.5.1 (pickle-lime) — Patch Keamanan & Stabilitas + +Tanggal: 2026-10-13 + +Rilis patch yang menutup seluruh temuan kerentanan dependensi, sekaligus memperkuat **backup/restore** dan **logging**. + +## Keamanan +- `npm audit`: **16 → 0** kerentanan. + - Menghapus `@whiskeysockets/baileys` (tidak dipakai). + - Memperbarui `axios`, `multer`, `brace-expansion`, `proxy-addr`. + - `xlsx` → build resmi **SheetJS 0.20.3** (API sama). + - `node-telegram-bot-api` **0.66 → 2.1.0** (memakai adapter v1→v2 internal; modul bot tidak dirombak). +- Memperbaiki bug **`trust proxy`**: `X-Forwarded-For` terbalik sehingga IP bisa dipalsukan (berdampak pada rate-limit/login). +- `cookie_secure` sebaiknya diaktifkan saat aplikasi dipublikasikan via **HTTPS**. + +## Backup & Restore +- Backup database memakai **`VACUUM INTO`** → snapshot **konsisten** walau database berjalan di mode **WAL** (sebelumnya menyalin file mentah berisiko kehilangan transaksi terbaru). +- **Restore diterapkan saat startup** (sebelum koneksi DB dibuka) → menghindari kerusakan data karena menimpa file DB di bawah koneksi hidup. Aplikasi **restart otomatis** untuk menerapkan restore. +- Restore settings memakai pemuatan ulang otomatis (tanpa restart). + +## Logging +- Berkas log **diputar otomatis** (10MB × 5) — tidak lagi menumpuk memenuhi disk. +- Seluruh `console.*` sisi server diarahkan ke **logger** → log **seragam** dan tersimpan di `logs/`. + +## Lainnya +- `settings.json` di-set permission `600` (rahasia tidak world-readable). +- Versi dinaikkan ke **0.5.1**. + +## Cara Update +- **Docker:** `docker compose pull` / `docker compose up -d --build`. +- **Manual:** `git pull` lalu `npm ci --omit=dev` dan restart aplikasi. diff --git a/package-lock.json b/package-lock.json index 4362d1e..ea4224a 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "open-isp", - "version": "0.5.0", + "version": "0.5.1", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "open-isp", - "version": "0.5.0", + "version": "0.5.1", "hasInstallScript": true, "license": "ISC", "dependencies": { diff --git a/package.json b/package.json index 0b5688c..e76beee 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "open-isp", - "version": "0.5.0", + "version": "0.5.1", "description": "OPEN-ISP — sistem billing & manajemen ISP open-source (PWA pelanggan, multi-OLT, RADIUS, WhatsApp, QRIS)", "main": "app-customer.js", "scripts": { diff --git a/views/admin/partials/sidebar.ejs b/views/admin/partials/sidebar.ejs index 6b6823b..157bd14 100644 --- a/views/admin/partials/sidebar.ejs +++ b/views/admin/partials/sidebar.ejs @@ -133,7 +133,7 @@ document.addEventListener('DOMContentLoaded', () => { OPEN-ISP BILLING SYSTEM

- v<%= (typeof appVersion !== 'undefined' ? appVersion : '0.5') %> (pickle-lime) · ISC · oxpoe + v<%= (typeof appVersion !== 'undefined' ? appVersion : '0.5.1') %> (pickle-lime) · ISC · oxpoe
diff --git a/views/donate.ejs b/views/donate.ejs index 18406a9..8f0aea4 100644 --- a/views/donate.ejs +++ b/views/donate.ejs @@ -180,7 +180,7 @@
- © <%= new Date().getFullYear() %> • <%= settings.company_header || 'OPEN-ISP' %> • <%= settings.company_header || 'OPEN-ISP' %> v0.5 (pickle-lime) · ISC · oxpoe — terima kasih atas dukungan Anda. + © <%= new Date().getFullYear() %> • <%= settings.company_header || 'OPEN-ISP' %> • <%= settings.company_header || 'OPEN-ISP' %> v<%= (typeof appVersion !== 'undefined' ? appVersion : '0.5.1') %> (<%= (typeof appVersionName !== 'undefined' ? appVersionName : 'pickle-lime') %>) · ISC · oxpoe — terima kasih atas dukungan Anda.
<%= t('donate.admin_panel','Admin Panel') %>  •  diff --git a/views/landing.ejs b/views/landing.ejs index d764f17..791c211 100644 --- a/views/landing.ejs +++ b/views/landing.ejs @@ -352,7 +352,7 @@
© <%= brand %>. Seluruh hak cipta dilindungi. - <%= (typeof settings !== 'undefined' && settings && settings.company_header) ? settings.company_header : 'OPEN-ISP' %> v<%= (typeof appVersion !== 'undefined' ? appVersion : '0.5') %> (<%= (typeof appVersionName !== 'undefined' ? appVersionName : 'pickle-lime') %>) · ISC · oxpoe + <%= (typeof settings !== 'undefined' && settings && settings.company_header) ? settings.company_header : 'OPEN-ISP' %> v<%= (typeof appVersion !== 'undefined' ? appVersion : '0.5.1') %> (<%= (typeof appVersionName !== 'undefined' ? appVersionName : 'pickle-lime') %>) · ISC · oxpoe