- Sync mirror domains with official hub (anikoto.site): replace dead
anikoto.se with official anikototv.se (dataUrl.js, render.yaml, README)
- Fix redesigned #hotest spotlight carousel selectors in homeInfo and
spotlight extractors (dual-selector fallback for old layout)
- New GET /api/stream/embeds: iframe-ready Megavid/AniXo/MegaPlay URLs
that bypass Cloudflare; ?slug= auto-resolves MAL/AniList IDs (cached),
or pass ?mal=/?anilist= directly with zero scraping
- GET /api/info now returns externalIds { animeId, malId, anilistId }
for direct feed into /api/stream/embeds (best-effort, 60min cache)
- New GET /api/episodes/latest?slug=: newest-episode checker for bot
polling — latest episode + counts only (10min cache), registered
before /episodes/:id so the literal path wins
- Top rankings ?sort=day|week|month verified already supported (docs)
- Full repo-style documentation on all new modules (box headers, FEATURE
markers, NOTE/TIP inline notes, JSDoc, footers)
- Diagnostic sweep: all counts synced to 40 endpoints / 30 handlers /
29 scrapers, stale badges and sample responses fixed, render.yaml EOF,
Dockerfile node:18-alpine (EOL) -> node:22-alpine
- Tests: 38 passed / 0 failed / 2 optional skips; 77 JS files syntax-OK
- Added Maintenance Active badge to README
- Added Security Contributors section crediting jamil182 for SSRF fix
- Added Credits section to CHANGELOG.md for v2.4.1
Security:
- Fixed unauthenticated SSRF in /api/stream/proxy and /api/stream/ts-proxy
- proxy allowlist had escape hatch via pathname.endsWith('.m3u8') bypass
- ts-proxy had no destination validation at all
- Both could fetch internal services (127.0.0.1, 169.254.169.254)
- Added streamProxy.helper.js with domain allowlist, private IP blocking,
and http(s)-only enforcement applied to both endpoints
- Removed dead megaplay-1.buzz; added vid-tube.site, norami.top,
kryntal.top, akirax.buzz to allowlist
- Added SECURITY.md with vulnerability reporting policy
Bug fix:
- Fixed dotenv.config() loading after static imports -- helpers reading
process.env at top level never received .env values. Changed to
import 'dotenv/config' as first import
Config:
- Added STREAM_PROXY_DOMAINS env var for custom allowlist
- Added STREAM_PROXY_REFERER env var for custom CDN Referer
Root cause: upstream /ajax/server and /ajax/server/list endpoints require
session cookies set by visiting the watch page. fetchWithMirror() didn't
persist cookies between requests, causing upstream to return 500.
- Extract cookies from set-cookie headers when fetching watch/home page
- Pass cookies with AJAX requests for stream info and server list
- Accept optional slug query param in /api/stream for targeted session
- Both extractors now use cookie-aware axios for session establishment
- Fix extractServerList JSON parsing: fetchWithMirror returns raw text but code treated it as parsed object, causing Cheerio to parse JSON string as HTML resulting in empty server arrays
- Fix extractMapperServers JSON parsing: same raw text issue caused data processing loop to be skipped, returning empty arrays
- Fix streamInfo controller to return 404 with error message when stream URL is null instead of silently returning null values
- Fix server list controller to use proper TTL and handle empty results
- Fix JSON.parse error handling in episodeList and episodeListAjax extractors
- Update CHANGELOG.md with v2.2.1 bug fixes
New Endpoints (4 new routes):
- GET /api/upcoming — upcoming anime releases from homepage
- GET /api/top-rankings?sort=top|newest — ranked anime with sort modes
- GET /api/recently-updated?tab=all|dub|sub — filtered recent updates
- GET /api/completed — finished anime series from homepage
Enhanced Filter (/api/filter):
- Added source parameter (18 source material types)
- Added epMin/epMax for episode range filtering
- Added excludeWatchlist parameter for logged-in users
- Added season parameter (spring/summer/fall/winter)
New Config IDs:
- SOURCE_IDS: 18 source material type mappings
- SEASON_IDS: 4 broadcast season mappings
- EXTENDED_TYPE_IDS: Added tv-short and tv-special types
Total endpoints: 34 (was 30)
OpenAPI spec updated with new endpoints
CHANGELOG.md updated with comprehensive change history
Major Changes:
- Add shared parseListItem.helper.js for unified list parsing (DRY)
- Migrate all 22 extractors to use fetchWithMirror() for consistent mirror fallback
- Remove unused cors dependency (custom CORS middleware handles it)
- Fix middleware ordering: timeout now registered before routes
- Fix CORS to allow POST for /api/mirrors/reset endpoint
- Remove redundant cache check in homeInfo extractor
New Features:
- Request ID tracking (X-Request-Id header) for debugging
- Graceful shutdown handling (SIGTERM/SIGINT) with 10s timeout
- CSP and HSTS security headers
- Rate limiter cleanup interval (every 5 min) to prevent memory leak
- Request body size limits (10kb) via express.json()
Security:
- Content-Security-Policy header for XSS protection
- Strict-Transport-Security for HTTPS enforcement
- X-Permitted-Cross-Domain-Policies: none
- Body size limits to prevent large payload attacks
Code Quality:
- All files follow strict documentation style (box headers, section separators,
feature markers, JSDoc params/returns, inline notes, module footers)
- Eliminated ~200 lines of duplicated code across 8+ extractors
- Updated CHANGELOG.md with comprehensive change history
- All examples now use real responses from live API
- Streaming flow tested end-to-end (episodeList -> servers -> stream)
- All code examples verified working
- Real titles: Wistoria, Witch Hat Atelier, Road of Naruto, etc.
- Real stream URLs from megaplay.buzz
- Real CDN URLs from anipixcdn.co
- Fixed streaming endpoints: proper JSON/HTML parsing
- Box-style header comments (Project, Author, License) on every file
- Section headers using double-line box decorators
- Feature markers (// ---- FEATURE: XYZ ----) before every major function
- JSDoc comments for EVERY function with @param, @returns, @example
- Inline notes (NOTE, WARNING, TIP) for non-obvious logic
- Footer END markers on every module
- Matched code style to AlisaReactionBot repository
- All files now searchable by feature name via grep
Author: Shinei Nouzen <157171073+Shineii86@users.noreply.github.com>
- Add /api/watch endpoint for watch page data
- Add /api/az-list for alphabetical browsing
- Add /api/new-release and /api/newly-added
- Add /api/status for ongoing/completed lists
- Add /api/trending-sidebar for sidebar data
- Update README with all new endpoints
- Update CHANGELOG
- Analyzed actual HTML structure of anikototv.to
- Updated all extractors with correct CSS selectors
- Changed ID-based to slug-based lookups
- Updated URL patterns to match actual website
- Fixed stream info to use AJAX server list
- Improved error handling
- Express.js server with Vercel deployment support
- Complete API endpoints for anikototv.to anime data
- Home, search, info, episodes, stream, schedule endpoints
- Category filtering and genre support
- Caching system with 5-minute TTL
- CORS configuration
- Public documentation page
- Docker and Render deployment configs
- MIT License
Shinei Nouzen