chore(release): siapkan v0.5.1 (versi, CHANGELOG, release notes)

CHANGELOG.md

@@ -2,7 +2,7 @@
 
 Format mengikuti [Keep a Changelog](https://keepachangelog.com/) dan [Semantic Versioning](https://semver.org/).
 
-## [Unreleased] — setelah v0.5.0
+## [0.5.1] — 2026-10-13 — "pickle-lime"
 
 ### Diubah
 - **WhatsApp** kini **notifikasi keluar saja** (interaksi/bot perintah dimatikan); interaksi dipindah ke **Telegram**.
@@ -19,6 +19,17 @@ Format mengikuti [Keep a Changelog](https://keepachangelog.com/) dan [Semantic V
 - `getTechById` (notifikasi tiket oleh admin yang sebelumnya gagal).
 - Tabel `discount_logs` dibuat saat fresh-install (500 di `/admin/discounts`).
 - `.devcontainer` + `.nvmrc` untuk Codespaces (Node 22).
+- **Backup DB** memakai `VACUUM INTO` (konsisten walau mode WAL) dan **restore diterapkan saat startup** (sebelum koneksi DB dibuka); app restart otomatis untuk menerapkan.
+- **Logger** memutar berkas otomatis (10MB × 5) dan `console.*` sisi server diarahkan ke logger (log seragam di `logs/`).
+- `settings.json` permission di-set `600`.
+
+### Keamanan
+- **`npm audit`: 16 → 0** kerentanan.
+  - Hapus `@whiskeysockets/baileys` (tidak dipakai).
+  - Perbarui `axios`, `multer`, `brace-expansion`, `proxy-addr`.
+  - `xlsx` → build resmi **SheetJS 0.20.3**.
+  - `node-telegram-bot-api` 0.66 → **2.1.0** (via adapter v1→v2 internal).
+- Perbaiki bug **`trust proxy`** (`X-Forwarded-For` terbalik → IP bisa dipalsukan).
 
 ## [0.5.0] — 2026-10-09 — "pickle-lime"
 

README.md

@@ -9,7 +9,7 @@
 
 <p align="center">
   <img src="https://img.shields.io/badge/lisensi-ISC-ADFF2F" alt="Lisensi: ISC">
-  <img src="https://img.shields.io/badge/versi-0.5_pickle--lime-ADFF2F" alt="Versi 0.5 (pickle-lime)">
+  <img src="https://img.shields.io/badge/versi-0.5.1_pickle--lime-ADFF2F" alt="Versi 0.5.1 (pickle-lime)">
   <img src="https://img.shields.io/badge/Node.js-%E2%89%A520-339933" alt="Node.js >= 20">
   <img src="https://img.shields.io/badge/docker-ready-2496ED?logo=docker&logoColor=white" alt="Docker">
   <img src="https://img.shields.io/github/stars/oxpoe/open-isp?style=flat" alt="Stars">

app-customer.js

@@ -177,7 +177,7 @@ app.use((req, res, next) => {
   res.locals.uptimeUrl = getSetting('uptime_url', '');
   res.locals.heroVer = getSetting('landing_hero_version', '');
   res.locals.projectUrl = String(getSetting('project_url', 'https://github.com/oxpoe/open-isp') || '').replace(/\/+$/, '');
-  res.locals.appVersion = String(getSetting('app_version', '0.5') || '0.5');
+  res.locals.appVersion = String(getSetting('app_version', '0.5.1') || '0.5.1');
   res.locals.appVersionName = String(getSetting('app_version_name', 'pickle-lime') || 'pickle-lime');
   res.locals.pwaVersion = String(getSetting('pwa_version', '2.0') || '2.0');
   next();
@@ -1661,7 +1661,7 @@ function buildPwaManifest(scope, startUrl, desc, orientation) {
 app.get('/version.txt', (req, res) => {
   res.type('text/plain; charset=utf-8');
   res.set('Cache-Control', 'no-store, no-cache, must-revalidate');
-  const billing = String(getSetting('app_version', '0.5') || '0.5');
+  const billing = String(getSetting('app_version', '0.5.1') || '0.5.1');
   const nameV = String(getSetting('app_version_name', 'pickle-lime') || 'pickle-lime');
   const pwaV = String(getSetting('pwa_version', '2.0') || '2.0');
   const stUrl = String(getSetting('speedtest_url', '') || '');

docs/RELEASE_NOTES_v0.5.1.md

@@ -0,0 +1,31 @@
+# OPEN-ISP v0.5.1 (pickle-lime) — Patch Keamanan & Stabilitas
+
+Tanggal: 2026-10-13
+
+Rilis patch yang menutup seluruh temuan kerentanan dependensi, sekaligus memperkuat **backup/restore** dan **logging**.
+
+## Keamanan
+- `npm audit`: **16 → 0** kerentanan.
+  - Menghapus `@whiskeysockets/baileys` (tidak dipakai).
+  - Memperbarui `axios`, `multer`, `brace-expansion`, `proxy-addr`.
+  - `xlsx` → build resmi **SheetJS 0.20.3** (API sama).
+  - `node-telegram-bot-api` **0.66 → 2.1.0** (memakai adapter v1→v2 internal; modul bot tidak dirombak).
+- Memperbaiki bug **`trust proxy`**: `X-Forwarded-For` terbalik sehingga IP bisa dipalsukan (berdampak pada rate-limit/login).
+- `cookie_secure` sebaiknya diaktifkan saat aplikasi dipublikasikan via **HTTPS**.
+
+## Backup & Restore
+- Backup database memakai **`VACUUM INTO`** → snapshot **konsisten** walau database berjalan di mode **WAL** (sebelumnya menyalin file mentah berisiko kehilangan transaksi terbaru).
+- **Restore diterapkan saat startup** (sebelum koneksi DB dibuka) → menghindari kerusakan data karena menimpa file DB di bawah koneksi hidup. Aplikasi **restart otomatis** untuk menerapkan restore.
+- Restore settings memakai pemuatan ulang otomatis (tanpa restart).
+
+## Logging
+- Berkas log **diputar otomatis** (10MB × 5) — tidak lagi menumpuk memenuhi disk.
+- Seluruh `console.*` sisi server diarahkan ke **logger** → log **seragam** dan tersimpan di `logs/`.
+
+## Lainnya
+- `settings.json` di-set permission `600` (rahasia tidak world-readable).
+- Versi dinaikkan ke **0.5.1**.
+
+## Cara Update
+- **Docker:** `docker compose pull` / `docker compose up -d --build`.
+- **Manual:** `git pull` lalu `npm ci --omit=dev` dan restart aplikasi.

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "open-isp",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "open-isp",
-      "version": "0.5.0",
+      "version": "0.5.1",
       "hasInstallScript": true,
       "license": "ISC",
       "dependencies": {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "open-isp",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "OPEN-ISP — sistem billing & manajemen ISP open-source (PWA pelanggan, multi-OLT, RADIUS, WhatsApp, QRIS)",
   "main": "app-customer.js",
   "scripts": {

views/admin/partials/sidebar.ejs

@@ -133,7 +133,7 @@ document.addEventListener('DOMContentLoaded', () => {
         OPEN-ISP BILLING SYSTEM
       </a>
       <div style="color:#64748b;font-size:10px;margin-top:3px;line-height:1.5">
-        v<%= (typeof appVersion !== 'undefined' ? appVersion : '0.5') %> (pickle-lime) · ISC · oxpoe
+        v<%= (typeof appVersion !== 'undefined' ? appVersion : '0.5.1') %> (pickle-lime) · ISC · oxpoe
       </div>
     </div>
   </nav>

views/donate.ejs

@@ -180,7 +180,7 @@
     </div>
 
     <div class="iso-foot">
-      &copy; <%= new Date().getFullYear() %> • <%= settings.company_header || 'OPEN-ISP' %> • <%= settings.company_header || 'OPEN-ISP' %> v0.5 (pickle-lime) · ISC · oxpoe — terima kasih atas dukungan Anda.
+      &copy; <%= new Date().getFullYear() %> • <%= settings.company_header || 'OPEN-ISP' %> • <%= settings.company_header || 'OPEN-ISP' %> v<%= (typeof appVersion !== 'undefined' ? appVersion : '0.5.1') %> (<%= (typeof appVersionName !== 'undefined' ? appVersionName : 'pickle-lime') %>) · ISC · oxpoe — terima kasih atas dukungan Anda.
       <div style="margin-top:6px">
         <a href="/admin" style="color:var(--muted)"><i class="bi bi-speedometer2"></i> <%= t('donate.admin_panel','Admin Panel') %></a>
         &nbsp;•&nbsp;

views/landing.ejs

@@ -352,7 +352,7 @@
     </div>
     <div class="foot-bottom">
       <span>&copy; <span id="year"></span> <%= brand %>. Seluruh hak cipta dilindungi.</span>
-      <span class="mono"><%= (typeof settings !== 'undefined' && settings && settings.company_header) ? settings.company_header : 'OPEN-ISP' %> v<%= (typeof appVersion !== 'undefined' ? appVersion : '0.5') %> (<%= (typeof appVersionName !== 'undefined' ? appVersionName : 'pickle-lime') %>) · ISC · oxpoe</span>
+      <span class="mono"><%= (typeof settings !== 'undefined' && settings && settings.company_header) ? settings.company_header : 'OPEN-ISP' %> v<%= (typeof appVersion !== 'undefined' ? appVersion : '0.5.1') %> (<%= (typeof appVersionName !== 'undefined' ? appVersionName : 'pickle-lime') %>) · ISC · oxpoe</span>
     </div>
   </div>
 </footer>