Bump version to 15.3.0

* patch unenv

* replaces debug with obug

reverts unenv patch

.github/workflows/lint.yml

@@ -16,7 +16,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v6
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v6
         name: Install pnpm
         with:
           run_install: false
@@ -49,7 +49,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v6
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v6
         name: Install pnpm
         with:
           run_install: false

CHANGELOG.md

@@ -14,11 +14,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - CLI: Show QR code (https://github.com/wg-easy/wg-easy/pull/2518)
 - Copy QR code to clipboard / save as png (https://github.com/wg-easy/wg-easy/pull/2521)
 
+### Fixed
+
+- Add trailing newline to Prometheus metrics output (https://github.com/wg-easy/wg-easy/pull/2573)
+- Correctly use DEBUG env var (https://github.com/wg-easy/wg-easy/pull/2619)
+
 ### Changed
 
 - Hooks are now Textareas (https://github.com/wg-easy/wg-easy/pull/2522)
 - Update to Node Krypton (24) (https://github.com/wg-easy/wg-easy/pull/2536)
 - Mobile UI (https://github.com/wg-easy/wg-easy/pull/2569)
+- Prevent enabling client when expired (https://github.com/wg-easy/wg-easy/pull/2594)
 
 ## [15.2.2] - 2026-02-06
 

Dockerfile

@@ -7,7 +7,7 @@ RUN npm install --global corepack@latest
 RUN corepack enable pnpm
 
 # Copy Web UI
-COPY src/package.json src/pnpm-lock.yaml ./
+COPY src/package.json src/pnpm-lock.yaml src/pnpm-workspace.yaml ./
 RUN pnpm install
 
 # Build UI
@@ -23,6 +23,10 @@ RUN apk add linux-headers build-base go git && \
     cd ../amneziawg-tools/src && \
     make
 
+FROM docker.io/library/node:krypton-alpine AS build-libsql
+WORKDIR /app
+RUN npm install --no-save --omit=dev libsql
+
 # Copy build result to a new image.
 # This saves a lot of disk space.
 FROM docker.io/library/node:krypton-alpine
@@ -35,9 +39,8 @@ COPY --from=build /app/.output /app
 # Copy migrations
 COPY --from=build /app/server/database/migrations /app/server/database/migrations
 # libsql (https://github.com/nitrojs/nitro/issues/3328)
-RUN cd /app/server && \
-    npm install --no-save --omit=dev libsql && \
-    npm cache clean --force
+COPY --from=build-libsql /app/node_modules /app/server/node_modules
+
 # cli
 COPY --from=build /app/cli/cli.sh /usr/local/bin/cli
 RUN chmod +x /usr/local/bin/cli
@@ -69,7 +72,7 @@ RUN update-alternatives --install /usr/sbin/iptables iptables /usr/sbin/iptables
 RUN update-alternatives --install /usr/sbin/ip6tables ip6tables /usr/sbin/ip6tables-legacy 10 --slave /usr/sbin/ip6tables-restore ip6tables-restore /usr/sbin/ip6tables-legacy-restore --slave /usr/sbin/ip6tables-save ip6tables-save /usr/sbin/ip6tables-legacy-save
 
 # Set Environment
-ENV DEBUG=Server,WireGuard,Database,CMD
+ENV DEBUG=Server,WireGuard,Database,CMD,Firewall
 ENV PORT=51821
 ENV HOST=0.0.0.0
 ENV INSECURE=false

Dockerfile.dev

@@ -24,7 +24,7 @@ RUN update-alternatives --install /usr/sbin/iptables iptables /usr/sbin/iptables
 RUN update-alternatives --install /usr/sbin/ip6tables ip6tables /usr/sbin/ip6tables-legacy 10 --slave /usr/sbin/ip6tables-restore ip6tables-restore /usr/sbin/ip6tables-legacy-restore --slave /usr/sbin/ip6tables-save ip6tables-save /usr/sbin/ip6tables-legacy-save
 
 # Set Environment
-ENV DEBUG=Server,WireGuard,Database,CMD
+ENV DEBUG=Server,WireGuard,Database,CMD,Firewall
 ENV PORT=51821
 ENV HOST=0.0.0.0
 ENV INSECURE=true
@@ -32,7 +32,7 @@ ENV INIT_ENABLED=false
 ENV DISABLE_IPV6=false
 
 # Install Dependencies
-COPY src/package.json src/pnpm-lock.yaml ./
+COPY src/package.json src/pnpm-lock.yaml src/pnpm-workspace.yaml ./
 RUN pnpm install
 
 # Copy Project

package.json

@@ -11,7 +11,7 @@
     "format:check:docs": "prettier --check docs"
   },
   "devDependencies": {
-    "prettier": "^3.8.1"
+    "prettier": "^3.8.3"
   },
-  "packageManager": "pnpm@10.32.1"
+  "packageManager": "pnpm@11.1.2"
 }

pnpm-lock.yaml

@@ -9,16 +9,16 @@ importers:
   .:
     devDependencies:
       prettier:
-        specifier: ^3.8.1
-        version: 3.8.1
+        specifier: ^3.8.3
+        version: 3.8.3
 
 packages:
 
-  prettier@3.8.1:
-    resolution: {integrity: sha512-UOnG6LftzbdaHZcKoPFtOcCKztrQ57WkHDeRD9t/PTQtmT0NHSeWWepj6pS0z/N7+08BHFDQVUrfmfMRcZwbMg==}
+  prettier@3.8.3:
+    resolution: {integrity: sha512-7igPTM53cGHMW8xWuVTydi2KO233VFiTNyF5hLJqpilHfmn8C8gPf+PS7dUT64YcXFbiMGZxS9pCSxL/Dxm/Jw==}
     engines: {node: '>=14'}
     hasBin: true
 
 snapshots:
 
-  prettier@3.8.1: {}
+  prettier@3.8.3: {}

src/.nuxtrc

@@ -1 +1 @@
-setups.@nuxt/test-utils="4.0.0"
+setups.@nuxt/test-utils="4.0.3"

src/app/components/ClientCard/Charts.vue

@@ -16,7 +16,7 @@
 </template>
 
 <script setup lang="ts">
-import type { ApexOptions } from 'apexcharts';
+import type { ApexChart, ApexOptions } from 'apexcharts';
 
 defineProps<{
   client: LocalClient;

src/i18n/locales/zh-HK.json

@@ -45,9 +45,9 @@
   },
   "setup": {
     "welcome": "歡迎首次設定wg-easy",
-    "welcomeDesc": "這是最簡單的方法讓你在任何Linux主機上安裝及管理WireGuard",
+    "welcomeDesc": "這是在任何Linux主機上安裝與管理WireGuard最簡單的方法。",
     "existingSetup": "你有現存設定嗎？",
-    "createAdminDesc": "請輸入管理員用戶名及一個高強度密碼。這些資料將用於登入管理員版面。",
+    "createAdminDesc": "請輸入管理員用戶名及高強度密碼。這些資料將用於登入管理員版面。",
     "setupConfigDesc": "請輸入主機及連接埠資料。這將用於客戶端設定，以便在他們的裝置上設定WireGuard。",
     "setupMigrationDesc": "如果你想將舊版wg-easy的資料轉移到新設定，請提供備份檔案。",
     "upload": "上傳",
@@ -88,6 +88,7 @@
     "name": "名稱",
     "expireDate": "有效期",
     "expireDateDesc": "客戶端將於此日期停用。留空則為永久有效",
+    "delete": "刪除",
     "deleteClient": "刪除客戶端",
     "deleteDialog1": "你確定要刪除",
     "deleteDialog2": "此操作無法還原。",
@@ -114,21 +115,31 @@
     "hooksDescription": "掛鉤僅適用於wg-quick",
     "hooksLeaveEmpty": "僅適用於wg-quick，否則請留空",
     "dnsDesc": "客戶端使用的域名系統伺服器（取代全局配置）",
-    "search": "搜尋客戶端..."
+    "notConnected": "客戶端尚未連接",
+    "endpoint": "端點",
+    "endpointDesc": "建立WireGuard連線的客戶端IP地址",
+    "search": "搜尋客戶端...",
+    "config": "配置",
+    "viewConfig": "檢視配置",
+    "firewallIps": "防火牆IP白名單",
+    "firewallIpsDesc": "此客戶端可存取的目的地IP/CIDR（伺服器端強制執行）。留空則使用「IP白名單」。支援選填的連接埠及協定過濾，語法請參閱說明文件。",
+    "downloadPng": "正在下載PNG",
+    "copyPng": "複製PNG"
   },
   "dialog": {
     "change": "更改",
     "cancel": "取消",
-    "create": "創建"
+    "create": "建立"
   },
   "toast": {
     "success": "成功",
-    "saved": "已保存",
-    "error": "錯誤"
+    "saved": "已儲存",
+    "error": "錯誤",
+    "unknown": "未知錯誤。詳情請參閱主控台。"
   },
   "form": {
     "actions": "操作",
-    "save": "保存",
+    "save": "儲存",
     "revert": "重置",
     "sectionGeneral": "一般設定",
     "sectionAdvanced": "進階",
@@ -169,7 +180,10 @@
       "restart": "重啟介面",
       "restartDesc": "重啟WireGuard介面",
       "restartWarn": "你確定要重新啟動介面嗎？這將中斷所有客戶端連線。",
-      "restartSuccess": "介面已重啟"
+      "restartSuccess": "介面已重啟",
+      "firewall": "流量過濾",
+      "firewallEnabled": "啟用獨立客戶端防火牆",
+      "firewallEnabledDesc": "使用iptables以限制客戶端流量至特定的目的地IP。啟用後，即可為每個客戶端單獨設定允許目的地。"
     },
     "introText": "歡迎來到管理員版面。\n\n你可以在側邊欄中管理一般、配置、介面和掛鉤設定。"
   },
@@ -177,6 +191,7 @@
     "generic": {
       "required": "{0}為必填項",
       "validNumber": "{0}必須是有效的數字",
+      "validNumberRange": "{0}必須是有效的數字或數字範圍",
       "validString": "{0}必須是有效的字串",
       "validBoolean": "{0}必須是有效的布林值",
       "validArray": "{0}必須是有效的陣列",
@@ -189,7 +204,9 @@
       "expiresAt": "到期於",
       "address4": "IPv4地址",
       "address6": "IPv6地址",
-      "serverAllowedIps": "伺服器IP白名單"
+      "serverAllowedIps": "伺服器IP白名單",
+      "firewallIps": "防火牆IP白名單",
+      "firewallIpsInvalid": "防火牆IP輸入格式無效。請參閱說明文件以查看支援語法。"
     },
     "user": {
       "username": "用戶名",
@@ -234,5 +251,47 @@
     "postUp": "PostUp",
     "preDown": "PreDown",
     "postDown": "PostDown"
+  },
+  "copy": {
+    "notSupported": "不支援複製",
+    "copied": "已複製！",
+    "failed": "複製失敗",
+    "copy": "複製"
+  },
+  "awg": {
+    "jCLabel": "填充封包數量 (Jc)",
+    "jCDescription": "要傳送的填充封包數量 (1-128，建議: 4-12)",
+    "jMinLabel": "填充封包最小大小 (Jmin)",
+    "jMinDescription": "填充封包的最小大小 (0-1279*，建議: 8，必須<Jmax)",
+    "jMaxLabel": "填充封包最大大小 (Jmax)",
+    "jMaxDescription": "填充封包的最大大小 (1-1280*，建議: 80，必須>Jmin)",
+    "s1Label": "初始封包填充大小 (S1)",
+    "s1Description": "初始封包填充大小 (0-1132 [1280* - 148 = 1132]，建議: 15-150，S1+56 ≠ S2)",
+    "s2Label": "回應封包填充大小 (S2)",
+    "s2Description": "回應封包填充大小 (0-1188 [1280* - 92 = 1188]，建議: 15-150)",
+    "s3Label": "Cookie 回覆封包填充大小 (S3)",
+    "s3Description": "Cookie 回覆封包填充大小",
+    "s4Label": "傳輸封包填充大小 (S4)",
+    "s4Description": "傳輸封包填充大小",
+    "h1Label": "初始特徵標頭 (H1)",
+    "h1Description": "初始封包標頭值 (5-2147483647，必須與 H2-H4 不同)",
+    "h2Label": "回應特徵標頭 (H2)",
+    "h2Description": "回應封包標頭值 (5-2147483647，必須與 H1、H3、H4 不同)",
+    "h3Label": "Cookie 回覆特徵標頭 (H3)",
+    "h3Description": "Cookie 回覆封包標頭值 (5-2147483647，必須與 H1、H2、H4 不同)",
+    "h4Label": "傳輸特徵標頭 (H4)",
+    "h4Description": "傳輸封包標頭值 (5-2147483647，必須與 H1-H3 不同)",
+    "i1Label": "特殊填充封包 1 (I1)",
+    "i1Description": "協定模仿封包 (16 進位格式): <b 0x...>",
+    "i2Label": "特殊填充封包 2 (I2)",
+    "i2Description": "協定模仿封包 (16 進位格式): <b 0x...>",
+    "i3Label": "特殊填充封包 3 (I3)",
+    "i3Description": "協定模仿封包 (16 進位格式): <b 0x...>",
+    "i4Label": "特殊填充封包 4 (I4)",
+    "i4Description": "協定模仿封包 (16 進位格式): <b 0x...>",
+    "i5Label": "特殊填充封包 5 (I5)",
+    "i5Description": "協定模仿封包 (16 進位格式): <b 0x...>",
+    "mtuNote": "數值取決於 MTU",
+    "obfuscationParameters": "AmneziaWG 混淆參數"
   }
 }

src/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wg-easy",
-  "version": "15.3.0-beta.2",
+  "version": "15.3.0",
   "description": "The easiest way to run WireGuard VPN + Web-based Admin UI.",
   "private": true,
   "type": "module",
@@ -23,56 +23,55 @@
   "dependencies": {
     "@eschricht/nuxt-color-mode": "^1.2.0",
     "@heroicons/vue": "^2.2.0",
-    "@libsql/client": "^0.17.0",
-    "@nuxtjs/i18n": "^10.2.3",
+    "@libsql/client": "^0.17.3",
+    "@nuxtjs/i18n": "^10.3.0",
     "@nuxtjs/tailwindcss": "^6.14.0",
     "@phc/format": "^1.0.0",
     "@pinia/nuxt": "^0.11.3",
     "@tailwindcss/forms": "^0.5.11",
-    "@vueuse/core": "^14.2.1",
-    "@vueuse/nuxt": "^14.2.1",
-    "apexcharts": "^5.10.4",
+    "@vueuse/core": "^14.3.0",
+    "@vueuse/nuxt": "^14.3.0",
+    "apexcharts": "^5.12.0",
     "argon2": "^0.44.0",
-    "cidr-tools": "^11.2.1",
-    "citty": "^0.2.1",
+    "cidr-tools": "^12.0.1",
+    "citty": "^0.2.2",
     "consola": "^3.4.2",
     "crc-32": "^1.2.2",
-    "debug": "^4.4.3",
-    "drizzle-orm": "^0.45.1",
-    "ip-bigint": "^8.2.12",
-    "is-cidr": "^6.0.3",
+    "drizzle-orm": "^0.45.2",
+    "ip-bigint": "^9.0.4",
+    "is-cidr": "^7.0.0",
     "is-ip": "^5.0.1",
     "js-sha256": "^0.11.1",
-    "nuxt": "^3.21.2",
-    "otpauth": "^9.5.0",
+    "nuxt": "^3.21.5",
+    "obug": "^2.1.1",
+    "otpauth": "^9.5.1",
     "pinia": "^3.0.4",
-    "qr": "^0.5.5",
+    "qr": "^0.6.0",
     "radix-vue": "^1.9.17",
-    "semver": "^7.7.4",
+    "semver": "^7.8.0",
     "tailwindcss": "^3.4.19",
     "timeago.js": "^4.0.2",
     "vue": "latest",
     "vue3-apexcharts": "^1.11.1",
-    "zod": "^4.3.6"
+    "zod": "^4.4.3"
   },
   "devDependencies": {
     "@nuxt/eslint": "^1.15.2",
-    "@nuxt/test-utils": "^4.0.0",
-    "@types/debug": "^4.1.12",
+    "@nuxt/test-utils": "^4.0.3",
     "@types/phc__format": "^1.0.1",
     "@types/semver": "^7.7.1",
-    "@vitest/coverage-v8": "^4.1.0",
-    "@vitest/ui": "^4.1.0",
-    "drizzle-kit": "^0.31.9",
-    "esbuild": "^0.27.4",
+    "@vitest/coverage-v8": "^4.1.6",
+    "@vitest/ui": "^4.1.6",
+    "drizzle-kit": "^0.31.10",
+    "esbuild": "^0.28.0",
     "eslint": "^9.39.4",
     "eslint-config-prettier": "^10.1.8",
-    "prettier": "^3.8.1",
-    "prettier-plugin-tailwindcss": "^0.7.2",
-    "tsx": "^4.21.0",
-    "typescript": "^5.9.3",
-    "vitest": "^4.1.0",
-    "vue-tsc": "^3.2.5"
+    "prettier": "^3.8.3",
+    "prettier-plugin-tailwindcss": "^0.8.0",
+    "tsx": "^4.22.1",
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.6",
+    "vue-tsc": "^3.2.9"
   },
-  "packageManager": "pnpm@10.32.1"
+  "packageManager": "pnpm@11.1.2"
 }

src/pnpm-workspace.yaml

@@ -0,0 +1,6 @@
+allowBuilds:
+  '@parcel/watcher': false
+  argon2: false
+  esbuild: false
+  unrs-resolver: false
+  vue-demi: false

src/server/api/client/[clientId]/enable.post.ts

@@ -12,6 +12,19 @@ export default definePermissionEventHandler(
     const client = await Database.clients.get(clientId);
     checkPermissions(client);
 
+    if (
+      client &&
+      client.expiresAt !== null &&
+      new Date() > new Date(client.expiresAt)
+    ) {
+      throw createError({
+        statusCode: 422,
+        statusMessage:
+          'Client is expired. Please update the expiration date first.',
+        message: 'Client is expired. Please update the expiration date first.',
+      });
+    }
+
     await Database.clients.toggle(clientId, true);
     await WireGuard.saveConfig();
     return { success: true };

src/server/database/sqlite.ts

@@ -1,7 +1,7 @@
 import { drizzle } from 'drizzle-orm/libsql';
 import { migrate as drizzleMigrate } from 'drizzle-orm/libsql/migrator';
 import { createClient } from '@libsql/client';
-import debug from 'debug';
+import { createDebug } from 'obug';
 import { eq } from 'drizzle-orm';
 
 import * as schema from './schema';
@@ -13,7 +13,7 @@ import { InterfaceService } from './repositories/interface/service';
 import { HooksService } from './repositories/hooks/service';
 import { OneTimeLinkService } from './repositories/oneTimeLink/service';
 
-const DB_DEBUG = debug('Database');
+const DB_DEBUG = createDebug('Database');
 
 const client = createClient({ url: 'file:/etc/wireguard/wg-easy.db' });
 const db = drizzle({ client, schema });

src/server/routes/metrics/prometheus.get.ts

@@ -62,6 +62,7 @@ async function getPrometheusResponse() {
     '# HELP wireguard_latest_handshake_seconds UNIX timestamp seconds of the last handshake',
     '# TYPE wireguard_latest_handshake_seconds gauge',
     `${wireguardLatestHandshakeSeconds.join('\n')}`,
+    '',
   ];
 
   return returnText.join('\n');

src/server/utils/WireGuard.ts

@@ -1,8 +1,8 @@
 import fs from 'node:fs/promises';
-import debug from 'debug';
+import { createDebug } from 'obug';
 import type { InterfaceType } from '#db/repositories/interface/types';
 
-const WG_DEBUG = debug('WireGuard');
+const WG_DEBUG = createDebug('WireGuard');
 
 const generateRandomHeaderValue = () =>
   Math.floor(Math.random() * 2147483642) + 5;

src/server/utils/cmd.ts

@@ -1,7 +1,7 @@
 import childProcess from 'child_process';
-import debug from 'debug';
+import { createDebug } from 'obug';
 
-const CMD_DEBUG = debug('CMD');
+const CMD_DEBUG = createDebug('CMD');
 
 export function exec(
   cmd: string,

src/server/utils/config.ts

@@ -1,9 +1,9 @@
-import debug from 'debug';
+import { createDebug } from 'obug';
 import packageJson from '@@/package.json';
 
 export const RELEASE = 'v' + packageJson.version;
 
-export const SERVER_DEBUG = debug('Server');
+export const SERVER_DEBUG = createDebug('Server');
 
 export const OLD_ENV = {
   /** @deprecated Only for migration purposes */

src/server/utils/firewall.ts

@@ -1,11 +1,11 @@
-import debug from 'debug';
+import { createDebug } from 'obug';
 import { isIPv6 } from 'is-ip';
 
 import type { ClientType } from '#db/repositories/client/types';
 import type { InterfaceType } from '#db/repositories/interface/types';
 import type { UserConfigType } from '#db/repositories/userConfig/types';
 
-const FW_DEBUG = debug('Firewall');
+const FW_DEBUG = createDebug('Firewall');
 const CHAIN_NAME = 'WG_CLIENTS';
 
 // Mutex to prevent concurrent rule rebuilds