Core v6.3.9

Release Date: April 24, 2026 Tags: BUILDER, TEMPLATES, SECURITY, UI, UX, BUG-FIXES, AUDIT, RENDER-PARITY

Overview

Version 6.3.9 is the page-builder release. A full audit of /admin/builder turned up ninety-plus findings ranging from silent data loss on every undo, to multiple stored-XSS vectors, to a template library where most of the "premium" catalog was empty stubs. This release closes all of them in one pass and rebuilds the template library from scratch.

Nothing on your existing pages changes when you update. The new templates sit alongside the ones you already have.

Update Instructions

After updating, run the following command in terminal:

pnpm updator

No environment variables are required. No database migration is needed.

Added

Template library rebuild — 250 premium templates

The old template directory was a mix of thirty rich templates and nineteen stubs that rendered as empty sections. It has been replaced in its entirety.

25 categories × 10 templates

Universal structure (80): Header · Hero · Features · CTA · Pricing · Testimonials · Stats · Footer.

Universal content (70): About · Team · Contact · FAQ · Logo Cloud · Newsletter · Blog.

Extension showcases (100): Trading · Forex & Futures · Copy Trading · NFT · Staking · ICO Launchpad · P2P · E-commerce · Affiliate · AI Features. Each extension category contains ten premium sections specifically tailored to that extension — e.g. the NFT category has a collection-hero banner, trending-now scroll, mint-countdown hero, creator-spotlight, rarity showcase, activity feed preview, and so on; the ICO category has upcoming-sales grid, active-sale countdown, tokenomics breakdown, KYC process steps, etc.

Shared design foundation

• Added a common set of building blocks behind every template — headings, text, buttons, images, icons, dividers, spacers, lists, cards, links and quotes — so every section is built the same way and behaves consistently.
• Added premium theme colours in both light and dark variants, so every section is theme-aware by default.
• Added five gradient presets — indigo/violet, sky/emerald, amber/rose, night sky and aurora — each with its own light and dark stops.
• Added section padding presets (hero, standard, compact, bar) and row width presets (contained, wide, narrow), so spacing is consistent across the catalog.

Real previews in the selector

• Added real previews to the Add Section modal tiles, replacing the previous solid-colour placeholder. Each tile now shows the actual pixels you get when you insert the section.

Category selector

• Added 25 categories with proper metadata — label, description, icon and an extension hint.
• Fixed the per-category search filter doing nothing. Typing in the search box now filters the list.

Changed

Content tab hidden for structure selections

Selecting a section, row, or column used to show all three tabs — Content / Design / Advanced — but the Content tab just read "Select an element to edit its structure" since structure types have no content UI. Structure selections now show only Design · Advanced, with Design opening by default. Element selections still show all three tabs.

No auto-selection on template insert

Inserting a section template via the Add Section modal used to auto-select the section, auto-open the settings panel, and flash all the edit overlays on. It now drops the section in silently — the canvas stays clean and the user selects deliberately.

Fixed

Undo no longer empties the page

Every structural action — row, column and section adds, moves, reorders and resizes, twelve in total — was recording its undo step as "the current page becomes an empty page". The first undo after any of them quietly emptied the page. Users lost work on every Ctrl+Z that followed a structural change.

• Fixed all twelve structural actions to record the same kind of undo step that element actions already used, so an undo restores exactly the state before the change.
• Fixed the redo stack not being cleared consistently when a new action was taken.
• Fixed an internal copy operation that returned the original rather than a copy, which silently made saved history point at the live page.
• Changed the history to cap at 100 entries, so a long editing session no longer grows without bound.
• Fixed selecting an element, row or column not recording which parent it sat in, so the ancestor was always reported as empty.
• Fixed a timing race when adding an element, which deferred the selection by a tick.

Security

Every place the builder emitted HTML is now sanitized

Eight render paths — Heading, Text, List, Quote, Link, Button, inline editable content, and the AI-generated section preview — were injecting admin-authored HTML into the public site without any sanitization. All eight now pass through a sanitizing wrapper.

• Fixed the cursor jumping to the start while inline-editing text, because the content was being rewritten on every parent update.
• Fixed external links and pop-out windows not being isolated from the page that opened them, which allowed tabnabbing. Every external link and target="_blank" now carries the appropriate protection.
• Fixed the HTML id and CSS class fields in the editor writing to one place while the renderer read another, so custom ids and classes never took effect. Classes now store as space-separated strings.

Admin page-content API

• Fixed the public page list and detail responses including DRAFT content, which leaked unpublished pages to anonymous visitors. Only published pages are returned.
• Fixed saving a page from the admin returning only a confirmation message, which the editor then stored as the page's own metadata — silently corrupting local state on every save. The full record is returned now.
• Fixed the public page list shipping every page's full content, custom CSS, custom JavaScript and settings — rows of up to 16 MB each — in the list response.
• Fixed public caches not being invalidated when an admin saved, which left a 12-hour stale window after any edit.
• Fixed a race between demoting the previous home page and promoting the new one, which could leave two pages marked as home or none at all.
• Fixed the visit count and last-modified-by fields being writable from the request. Last-modified-by is now always taken from the signed-in admin.
• Fixed reserved slugs such as admin and api being accepted as page addresses.

Render parity — edit mode now matches preview

A batch of rendering fixes closed the gap between what the canvas showed during editing and what the preview rendered.

Gradients with hex stops now actually paint

• Fixed templates using gradients with raw hex colour stops rendering as a black background, because the generated style was discarded before it reached the browser. Hex, RGB and HSL stops now emit real gradient CSS; named-colour gradients keep the previous path.

Buttons now honor theme colours

• Fixed every premium button rendering as an unstyled purple default. Button background and text colour accepted only plain strings while every template supplied a light/dark theme pair, which the browser then ignored. Buttons now accept plain colours, theme pairs and gradients, resolved to the current theme as they render.
• Fixed the button size presets not being applied, so a large button rendered at the tiny default instead of 48 px with real padding.

Inline layout for links and icons

• Fixed multiple links or icons stacked in one column rendering vertically in edit mode, which produced the "nav links stacked one per line" bug visible in header templates. They now flow horizontally by default, while footer link columns keep their explicit stacked override.

Inline-group alignment synced between canvas and preview

The canvas hardcoded centre alignment for inline groups while the preview took its alignment from the first element — so the same template looked different in edit and preview. Both now share one order of precedence:

1. The column's own explicit alignment override.
2. The column's text alignment (center / right / left / justify / around).
3. The first inline element's text alignment.
4. Left, as the default.

Justify and around map to spread-out spacing, so headers and footers can space nav items across the full width when desired.

Inline group wraps a lone button

• Fixed a single inline element — a lone "Get started" CTA, for instance — falling through to block rendering and ignoring its column's alignment, so it sat left in edit mode while the preview right-aligned it correctly. Both paths now treat one element the same as several.

Edit-mode overlays no longer push content

• Fixed the section, row and column selection and hover rings being drawn as borders, which took up layout space and nudged everything beside them by a pixel or two. They are now drawn inside the content box.
• Fixed two extra wrapper layers that existed only on the edit path, which introduced subtle height and flex differences against the preview.

Section container width aligned

• Fixed the canvas and the preview using different maximum widths for non-fullwidth sections. Both now apply the same width per section type — regular, specialty and fullwidth. This was the main reason edit and preview widths differed.

Forced column min-height removed

• Fixed every non-empty column in the canvas being forced to at least 100 px tall, which rendered nav bars at 100 px when their content needed only 60 and made them visibly taller than the preview. Non-empty columns now use their content height; empty columns keep an 80 px minimum so the "Add Content" affordance stays clickable.

Button clicks select instead of being swallowed

• Fixed clicking a button in edit mode doing nothing. The click is no longer stopped before it reaches the wrapper that opens the settings panel, while link navigation is still suppressed.

Settings panel and UX polish

Panel title spacing

• Fixed the right-sidebar header rendering the element type and the word "Settings" with no space between them. It now reads "Column Settings", "Row Settings", "Section Settings".

Gradient-conflict alert text spacing

• Fixed the Appearance editor's gradient-conflict alert running its words together. It read:

A gradient is currently applied toBackground ColorYou can only apply gradients…

and now reads:

A gradient is currently applied to Background Color. You can only apply gradients…

Click empty canvas to deselect

• Fixed clicking the margin around the canvas, or empty space within it, not clearing the selection. Clicking either now clears every selection — element, column, row and section — and closes the settings panel. Clicks inside the settings panel are unaffected, so editing values keeps the current selection intact.

Gallery element fixed

• Fixed a stray character at the top of the gallery settings file, which broke the settings panel entirely whenever a gallery element was selected.
• Removed two unused element types that had a renderer but no editor and no template, to prevent them being created by accident.

Keyboard hook hardened

• Fixed the global Ctrl+Z / Ctrl+Y listener hijacking the browser's own undo while the user was inline-editing text. It now stands aside during inline editing, and binds once rather than rebinding on every change.

AI section generator

• Fixed the "Generate" prompt box being reset to the literal word "untitled" after each generation. It now resets to empty.
• Fixed the "Thumbs up / Needs work" feedback buttons in the generated-section preview being decorative. They now record the feedback and confirm it.

Modal backdrop hardening

• Fixed the shared modal closing as soon as the pointer went down outside the dialog, so dragging a text selection out of the modal dismissed it mid-drag. Closing now requires the press and the release to both land on the backdrop.
• Fixed scroll-lock restoring the page to a hard-coded scroll behaviour instead of whatever it had before the modal opened.