- Added Maintenance Active badge to README
- Added Security Contributors section crediting jamil182 for SSRF fix
- Added Credits section to CHANGELOG.md for v2.4.1
Update version across package.json, package-lock.json, README.md,
docs/index.md, docs/architecture.md, docs/endpoints.md, and
docs/examples.md. Add v2.4.1 entry to README changelog highlights.
Servers, Stream Resolve, Upcoming, Top Rankings, Recently Updated,
Completed, Status, and OpenAPI endpoints depend on upstream scraping
which may fail when the target site blocks requests. Mark these as
optional so the test suite skips gracefully instead of failing.
Security:
- Fixed unauthenticated SSRF in /api/stream/proxy and /api/stream/ts-proxy
- proxy allowlist had escape hatch via pathname.endsWith('.m3u8') bypass
- ts-proxy had no destination validation at all
- Both could fetch internal services (127.0.0.1, 169.254.169.254)
- Added streamProxy.helper.js with domain allowlist, private IP blocking,
and http(s)-only enforcement applied to both endpoints
- Removed dead megaplay-1.buzz; added vid-tube.site, norami.top,
kryntal.top, akirax.buzz to allowlist
- Added SECURITY.md with vulnerability reporting policy
Bug fix:
- Fixed dotenv.config() loading after static imports -- helpers reading
process.env at top level never received .env values. Changed to
import 'dotenv/config' as first import
Config:
- Added STREAM_PROXY_DOMAINS env var for custom allowlist
- Added STREAM_PROXY_REFERER env var for custom CDN Referer
Root cause: upstream /ajax/server and /ajax/server/list endpoints require
session cookies set by visiting the watch page. fetchWithMirror() didn't
persist cookies between requests, causing upstream to return 500.
- Extract cookies from set-cookie headers when fetching watch/home page
- Pass cookies with AJAX requests for stream info and server list
- Accept optional slug query param in /api/stream for targeted session
- Both extractors now use cookie-aware axios for session establishment
- Fix extractServerList JSON parsing: fetchWithMirror returns raw text but code treated it as parsed object, causing Cheerio to parse JSON string as HTML resulting in empty server arrays
- Fix extractMapperServers JSON parsing: same raw text issue caused data processing loop to be skipped, returning empty arrays
- Fix streamInfo controller to return 404 with error message when stream URL is null instead of silently returning null values
- Fix server list controller to use proper TTL and handle empty results
- Fix JSON.parse error handling in episodeList and episodeListAjax extractors
- Update CHANGELOG.md with v2.2.1 bug fixes
robots.txt: Allow / (landing page), disallow /api (JSON endpoints)
sitemap.xml: Updated lastmod to 2026-07-28, removed non-HTML URLs
index.html: Updated meta tags with 38 endpoints, richer keywords,
JSON-LD schema.org/WebAPI with accurate metadata
manifest.json: Updated theme/background colors to match site (#faf9f5),
better description with 38 endpoints
Key SEO changes:
- Title now includes '38 Endpoints'
- Meta description expanded with keywords (hls proxy, m3u8 proxy, etc)
- JSON-LD provider type changed from Organization to Person (author)
- Added license field to JSON-LD
New endpoints:
- GET /api/stream/proxy?url= — M3U8 playlist proxy with URL rewriting
Rewrites relative .m3u8 and .ts URLs to proxy endpoints
Adds CORS headers for cross-origin playback
Validates allowed streaming domains
- GET /api/stream/ts-proxy?url= — TS video segment proxy
Proxies .ts segments with proper Content-Type and caching
Fixes:
- seasons.extractor.js: Now extracts from watch page sidebar instead of broken AJAX endpoint
- watchOrder.extractor.js: Now extracts from watch page sidebar (trending/related)
- mirror.helper.js: 404 responses no longer mark mirrors as failed
Only connection errors trigger mirror failover
Endpoint-specific 404s break immediately without retry
38 total endpoints, 34/34 passing with 0 errors
New endpoints:
- GET /api/stream/resolve — Resolves actual m3u8/mp4 URLs from embed player URLs
Follows chain: vidtube.site → megaplay API → m3u8 playlist
Returns url, type, qualities, subtitles, skipData
- GET /api/stream/qualities — Parses M3U8 playlists for available quality options
Returns sorted quality list with resolution, bandwidth, URLs
New extractors:
- streamResolver.extractor.js — Full stream resolution pipeline
- resolveStreamUrl(): Resolves embed → actual video URL
- parseM3u8Qualities(): Parses master playlists for qualities
- normalizeServerName(): Maps VidPlay-1 → vidplay, HD-1 → hd
- extractSubtitles(): Extracts subtitle tracks from API responses
Enhancements:
- streamInfo.extractor.js: Added session establishment before AJAX calls
- Server list now includes normalizedName field for each server
- Stream info now includes type (hls/mp4) and backup URL
- Server list includes typeLabel (SUB/HSUB/DUB)
- Session cookies properly maintained for AJAX stream endpoints
Architecture:
- Embed API domain mapping (vidtube.site → megaplay-1.buzz)
- M3U8 parser supports master and media playlists
- Subtitle extraction from multiple API response formats
- 36 total endpoints (was 34)
New Endpoints (4 new routes):
- GET /api/upcoming — upcoming anime releases from homepage
- GET /api/top-rankings?sort=top|newest — ranked anime with sort modes
- GET /api/recently-updated?tab=all|dub|sub — filtered recent updates
- GET /api/completed — finished anime series from homepage
Enhanced Filter (/api/filter):
- Added source parameter (18 source material types)
- Added epMin/epMax for episode range filtering
- Added excludeWatchlist parameter for logged-in users
- Added season parameter (spring/summer/fall/winter)
New Config IDs:
- SOURCE_IDS: 18 source material type mappings
- SEASON_IDS: 4 broadcast season mappings
- EXTENDED_TYPE_IDS: Added tv-short and tv-special types
Total endpoints: 34 (was 30)
OpenAPI spec updated with new endpoints
CHANGELOG.md updated with comprehensive change history
Major Changes:
- Add shared parseListItem.helper.js for unified list parsing (DRY)
- Migrate all 22 extractors to use fetchWithMirror() for consistent mirror fallback
- Remove unused cors dependency (custom CORS middleware handles it)
- Fix middleware ordering: timeout now registered before routes
- Fix CORS to allow POST for /api/mirrors/reset endpoint
- Remove redundant cache check in homeInfo extractor
New Features:
- Request ID tracking (X-Request-Id header) for debugging
- Graceful shutdown handling (SIGTERM/SIGINT) with 10s timeout
- CSP and HSTS security headers
- Rate limiter cleanup interval (every 5 min) to prevent memory leak
- Request body size limits (10kb) via express.json()
Security:
- Content-Security-Policy header for XSS protection
- Strict-Transport-Security for HTTPS enforcement
- X-Permitted-Cross-Domain-Policies: none
- Body size limits to prevent large payload attacks
Code Quality:
- All files follow strict documentation style (box headers, section separators,
feature markers, JSDoc params/returns, inline notes, module footers)
- Eliminated ~200 lines of duplicated code across 8+ extractors
- Updated CHANGELOG.md with comprehensive change history
- Add pagination.helper.js with addPaginationMeta function
- Add pagination info to: most-popular, search, new-release, newly-added, latest-updated, az-list, filter, category, status
- Pagination includes: currentPage, totalPages, totalItems, itemsPerPage, hasNext, hasPrev
- Fix creatorInfo middleware to include message field
- Fix bug where full URLs were passed to fetchWithMirror causing doubled URLs
- Extract path from full URL before passing to mirror fallback
- Fixes search, most-popular, new-release, newly-added, and az-list endpoints
- Update endpoint count from 30 to 33 in badge, stats, and descriptions
- Update caching description from 5-min TTL to LRU with configurable TTL
- Update timeout description from 15s to configurable
- Update mermaid diagram labels
Browser blocks cross-origin requests from AniKotoWeb because
Access-Control-Allow-Origin was never set when ALLOWED_ORIGINS
was undefined on Vercel. Changed condition to allow all origins
when env var is not configured.
- apiRoutes.js: Moved imports outside comment block (caused 500 on all endpoints)
- test.js: Deleted orphaned duplicate code after function close
- random.controller.js: Removed stray closing brace breaking try/catch
- cache.helper.js: Added missing MAX_CACHE_SIZE constant
These bugs were introduced by sed insert commands placing code in wrong positions.
The API was returning 500 FUNCTION_INVOCATION_FAILED on all endpoints.
- favicon-origin.png — Original favicon from anikototv.to
- share.jpg — OG/Social sharing image (1MB)
- logo.png — Site logo
- Updated index.html to use share.jpg for OG/Twitter cards
- Updated manifest.json with new icons
- Updated favicon link to use original PNG
- All examples now use real responses from live API
- Streaming flow tested end-to-end (episodeList -> servers -> stream)
- All code examples verified working
- Real titles: Wistoria, Witch Hat Atelier, Road of Naruto, etc.
- Real stream URLs from megaplay.buzz
- Real CDN URLs from anipixcdn.co
- Fixed streaming endpoints: proper JSON/HTML parsing
- episodeList: Parse AJAX JSON response, extract server_ids/timestamp/mal_id
- streamInfo: Parse server list HTML into structured server objects
- streamInfo: Parse stream URL from JSON response properly
- Added cheerio import to streamInfo extractor
- Servers now return: type, link_id, cmid, sv_id, ep_id, name
- Changed publicDir to use process.cwd() for Vercel compatibility
- Simplified vercel.json routes: API -> server.js, everything else -> server.js
- Express.static will serve files from public/ directory
- API routes (/api/*) still go to server.js
- All other routes serve from /public/ directory
- Fixes privacy.html, tos.html, manifest.json, robots.txt, sitemap.xml, og-image.svg
- Box-style header comments (Project, Author, License) on every file
- Section headers using double-line box decorators
- Feature markers (// ---- FEATURE: XYZ ----) before every major function
- JSDoc comments for EVERY function with @param, @returns, @example
- Inline notes (NOTE, WARNING, TIP) for non-obvious logic
- Footer END markers on every module
- Matched code style to AlisaReactionBot repository
- All files now searchable by feature name via grep
Author: Shinei Nouzen <157171073+Shineii86@users.noreply.github.com>
- Fix filter endpoint to always include keyword parameter
- Fix episodes to load via AJAX endpoint
- Episodes now properly populate from /ajax/episode/list/:id
- Add /api/watch endpoint for watch page data
- Add /api/az-list for alphabetical browsing
- Add /api/new-release and /api/newly-added
- Add /api/status for ongoing/completed lists
- Add /api/trending-sidebar for sidebar data
- Update README with all new endpoints
- Update CHANGELOG
- Analyzed actual HTML structure of anikototv.to
- Updated all extractors with correct CSS selectors
- Changed ID-based to slug-based lookups
- Updated URL patterns to match actual website
- Fixed stream info to use AJAX server list
- Improved error handling
- Express.js server with Vercel deployment support
- Complete API endpoints for anikototv.to anime data
- Home, search, info, episodes, stream, schedule endpoints
- Category filtering and genre support
- Caching system with 5-minute TTL
- CORS configuration
- Public documentation page
- Docker and Render deployment configs
- MIT License
Shinei Nouzen