chore: bump version to 2026.0.101, update changelog and update news

CHANGELOG.md

@@ -2,6 +2,25 @@
 
 All notable changes to DeckyVault will be documented in this file.
 
+## [2026.0.101] - 2026-05-14
+
+### Added
+- SteamDB version auto-fetch — latest game version/build surfaced in submit wizard version selector
+- Landing page: Trending This Week, Best Performing New Releases, Most Tested, and Most Reported sections
+- Tiered API rate limiting with 5 categories (auth, read, write, strict, default)
+- Comment anti-spam: duplicate detection, 50KB content cap, 30/hr per-user limit
+- Submission cooldown: 60-second minimum between benchmark entries per user
+- Submission validation hardening: FPS bounds (1-500), TDP bounds, settings size caps, userNotes length cap
+
+### Changed
+- Landing hero height adjusted to `calc(100svh - 10svh)` for content "peek" effect
+- Rate limiter now uses named categories instead of a single global bucket
+
+### Security
+- Hardened validation on performance entry submission (fps bounds, settings size caps)
+- Server-side sanitization of comment content before storage
+- Per-route rate limiting categories for granular abuse prevention
+
 ## [2026.0.100] - 2026-05-10
 
 ### Added

content/updates/2026-05-14-v2026.0.101.md

@@ -0,0 +1,32 @@
+---
+title: "Landing Page, SteamDB Version Sync, and Security Hardening"
+date: "2026-05-14"
+version: "2026.0.101"
+summary: "Discover trending games on the new landing page, auto-fetch latest game versions from SteamDB, and enjoy improved API security."
+---
+
+### New Landing Page
+
+The homepage now showcases what's happening in the DeckyVault community:
+
+- **Trending This Week** — games with the most benchmarks, comments, and upvotes in the last 7 days
+- **Best Performing New Releases** — recently added games with the highest average FPS
+- **Most Tested Games** — the most benchmarked games across all devices
+- **Most Reported Games** — games with active reports (sunlight as disinfectant!)
+
+Each section shows compact game cards with cover art, playability status, and relevant stats. Click any card to jump straight to the game's detail page.
+
+### SteamDB Version Auto-Fetch
+
+When submitting a benchmark, the wizard now automatically checks SteamDB for the latest game version and build ID. If found, it appears as a recommended option at the top of the version selector — no more guessing which version you're on.
+
+This feature is best-effort and can be disabled via the `STEAMDB_SCRAPING_ENABLED` environment variable.
+
+### API Security Hardening
+
+We've tightened up the API with several layers of protection:
+
+- **Tiered rate limiting** — different limits for authentication, reads, writes, and public forms
+- **Comment anti-spam** — duplicate detection, size limits, and hourly caps
+- **Submission validation** — FPS must be within realistic bounds, settings payloads have size caps
+- **Content sanitization** — comment content is cleaned server-side before storage

lib/api/app.ts

@@ -69,7 +69,7 @@ export const app = new Elysia({ prefix: "/api" })
       documentation: {
         info: {
           title: "DeckyVault API",
-          version: "2026.0.100",
+          version: "2026.0.101",
           description:
             "API for DeckyVault — Steam Deck game compatibility, performance reports, and community features.",
         },
@@ -206,7 +206,7 @@ export const app = new Elysia({ prefix: "/api" })
   .use(rateLimit("default"))
   .get("/", () => ({
     name: "DeckyVault API",
-    version: "2026.0.9",
+    version: "2026.0.101",
   }))
 
 export type App = typeof app

package.json

@@ -1,6 +1,6 @@
 {
   "name": "deckyvault",
-  "version": "2026.0.100",
+  "version": "2026.0.101",
   "private": true,
   "scripts": {
     "dev": "next dev --experimental-https --webpack",