## What changed
- Upgraded Next.js from 16.1.6 to 16.2.9 across the Next-consuming
packages and lockfile.
- Hardened builder response headers by disabling the powered-by header,
adding CSP directives, setting same-origin CORS for non-API pages, and
applying no-store headers to public entry assets/routes.
- Blocked OPTIONS, TRACE, and TRACK in the builder proxy with a 405
response and an explicit Allow header.
## Why
This addresses TAC scan findings around framework disclosure, cache
behavior, response hardening, and risky HTTP methods on builder routes.
## Validation
- `bunx nx typecheck builder` passed.
- `bunx nx typecheck` currently fails on an unrelated landing-page
telemetry header typing issue at
`apps/landing-page/src/features/telemetry/server/trackPageView.ts:85`
(`"Set-Cookie"` is not in `TypedHeaders<ResponseHeaderMap>`).
- Adds a WhatsApp webhook forwarding URL field directly in the deploy
UI.
- Moves forwarding enablement to an explicit "Forward webhooks" switch
and keeps forwarded events independent from that switch.
- Normalizes legacy URL-only settings through Zod while preserving
explicit disabled configs.
- Restricts forwarding URLs to HTTP(S) and aligns the production update
script with the shared schema.
- Flushes debounced URL inputs on blur and covers legacy, disabled,
empty-event, and invalid-protocol cases in tests.
- Added a new "Is there a status page?" entry to the FAQ pointing to
status.typebot.io.
- Added a "Definitions" section to the analytics doc explaining Views,
Starts, Completions (no input remaining + at least one answer + no
pending client-side action expecting a dedicated reply) and the
per-block drop-off rate.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
## Summary
- Moved site metadata controls (title, description, favicon, preview
image) from Settings into Share page.
- Added a new LinkPreviewMetadataForm component and wired it to update
typebot settings from Share.
- Updated default preview image from PNG to JPEG and replaced the asset
under apps/viewer/public.
- Adjusted share page layout to show links and metadata side-by-side and
improved some responsive width styles.
Verification: commit hooks ran format-and-lint, lint-repo,
check-broken-links, and repository tests automatically during commit.
