site: move to studio 0.18.2 and correct every page against the release

docs/DECISIONS.md

@@ -317,29 +317,42 @@ the prototype's raw `rgba()`, which is the same composite through the token.
 
 ## Engine marks
 
-All sixteen logos are **self-hosted** in `public/engines/` (the prototype
-hot-linked jsDelivr and `cdn.simpleicons.org`). `scripts/fetch-engine-logos.sh`
-re-downloads them with devicon pinned to `v2.17.0`; `@latest` is a moving target
-that can restructure a path and break a production build.
-
-Two ids deliberately differ from their upstream slug — `libsql` is served as
-`turso`, `druid` as `apachedruid`. Renaming them to match breaks the fetch.
-
-**Open question for design.** Four marks are near-invisible on the white hexagon
-plate the design specifies:
+Every mark is **self-hosted** in `public/engines/` (the prototype hot-linked
+jsDelivr and `cdn.simpleicons.org`). `scripts/fetch-engine-logos.sh` re-downloads
+the nineteen that come from a CDN, with devicon pinned to `v2.17.0`; `@latest` is
+a moving target that can restructure a path and break a production build.
+
+Three ids deliberately differ from their upstream slug — `libsql` is served as
+`turso`, `druid` as `apachedruid`, `kafka` as `apachekafka`. Renaming them to
+match breaks the fetch.
+
+Nine marks are not fetched. `libredb.svg` is our own. Seven — Db2, Neo4j,
+Milvus, Qdrant, both InfluxDB types and Oxia — are the
+generic marks the product draws for itself
+(`libredb-studio/src/components/icons/db-icons.tsx`), stroked in `#334155`.
+The product chose not to use those vendors' logos (Neo4j's provider doc lists it
+as a known limitation), and the site does not show a vendor mark the product
+itself refuses; Db2 has no CDN mark in any case. Databend's is
+its official icon, used at the Databend team's request
+(databendlabs/databend-docs#3512), paths and colours unchanged. The fetch
+script's header names each.
+
+**Open question for design.** Five marks are faint on the white hexagon plate the
+design specifies, the first four near-invisible:
 
 ```
 1.19:1  duckdb      #FFF000
 1.34:1  libsql      #4FF8D2
 1.39:1  druid       #29F1FB
 1.51:1  clickhouse  #FFCC01
+2.95:1  etcd        #419EDA
 ```
 
 They are shipped **in brand colour anyway**. These are third-party trademarks and
 vendor brand guidelines forbid recolouring; the engine name is rendered as text
 directly beneath each mark, so the logo is decorative (`alt=""`) and carries no
 WCAG requirement. Recolouring them was tried and reverted. If this matters
-visually the fix belongs in the design — a darker plate for those four, or
+visually the fix belongs in the design — a darker plate for those five, or
 licensed alternate marks. `node scripts/logo-contrast-report.mjs` prints the
 current numbers.
 
@@ -401,6 +414,17 @@ Each of these was a live failure here, not a hypothetical. Each has a test.
    `.optional()` accepts only `undefined` (`PITFALLS A2`). The schema uses
    tolerant combinators; `tests/content.test.ts` feeds it all three.
 
+## The compose file is upstream's, with listed comment fixes
+
+`src/data/docker-compose.example.yml` was a verbatim copy of libredb-studio's
+file. At 0.18.2 four of its comments were false (the image's Node version, what
+happens without ADMIN_PASSWORD, which providers read LLM_API_URL, and the claim
+that every supported variable is listed). The studio repository is not edited
+from this site, so the site copy corrects those comments and lists each one in
+`upstreamCompose` (`src/data/compose.ts`). `tests/compose.test.ts` reverts the
+listed lines and checks the result against the upstream file's SHA-256, so any
+other difference still fails the gate. Functional lines stay byte-identical.
+
 ## Known limits
 
 - `app.libredb.org` and the two Netlify demo iframes are third-party embeds; if

docs/IMPLEMENTATION.md

@@ -177,7 +177,7 @@ drifts out of step.
 ## Regenerating assets
 
 ```sh
-./scripts/fetch-engine-logos.sh          # the sixteen engine marks
+./scripts/fetch-engine-logos.sh          # the nineteen fetched engine marks
 node scripts/logo-contrast-report.mjs    # how each reads on the white plate
 bun run build && bun run scripts/og/build-og.mjs   # public/og/default.png
 node scripts/contrast.mjs "#7f87a7" "#141829"   # one contrast pair

package.json

@@ -1,6 +1,6 @@
 {
   "name": "libredb-website",
-  "version": "1.3.7",
+  "version": "1.4.0",
   "private": true,
   "type": "module",
   "description": "libredb.org — marketing website for LibreDB Studio (Astro static + Outstatic CMS)",

public/.well-known/security.txt

@@ -1,3 +1,4 @@
+Contact: mailto:info@sekoya.tech
 Contact: https://github.com/libredb/libredb-studio/security/advisories
 Expires: 2027-03-11T00:00:00.000Z
 Preferred-Languages: en, tr

public/humans.txt

@@ -15,7 +15,7 @@ Site: https://sekoya.tech
 Contact: info@sekoya.tech
 
 /* SITE */
-Last update: 2026/08/01
+Last update: 2026/10/11
 Language: English
 Standards: HTML5, CSS3, ES2024
 Framework: Astro 7

scripts/fetch-engine-logos.sh

@@ -1,13 +1,26 @@
 #!/usr/bin/env bash
-# Re-download the sixteen engine marks into public/engines/.
+# Re-download the nineteen fetched engine marks into public/engines/.
+#
+# Ten more marks in public/engines/ are NOT fetched and this script never touches
+# them: libredb.svg is our own, and eight come from the product's own icon set,
+# libredb-studio/src/components/icons/db-icons.tsx, copied as static SVG:
+#   - db2, neo4j, milvus, qdrant, influxdb, influxdb3, oxia: marks drawn for
+#     Studio, deliberately not the vendor's logo. The product decided that per
+#     engine (Neo4j's provider doc lists "never Neo4j's logo" as a known
+#     limitation; InfluxDB, Milvus, Qdrant and Oxia say the same in their icon
+#     comments), so the site does not use a vendor mark the product refuses.
+#     Db2 has no mark on either CDN anyway. Stroke #334155.
+#   - databend: Databend's official icon (databend.com/brand, "Icon · Light"),
+#     used at the Databend team's request (databendlabs/databend-docs#3512);
+#     paths and colours unchanged.
 #
 # The prototype hot-linked jsDelivr and cdn.simpleicons.org. Production self-hosts
 # them: @latest is a moving target, and a CDN outage must not take the page with
 # it. devicon is pinned; simpleicons has no version in the URL, so the downloaded
 # files are committed and this script is only for a deliberate refresh.
 #
-# Note two ids do not match their upstream slug: libsql is served as `turso`, and
-# druid as `apachedruid`. Renaming them to match breaks the fetch.
+# Note three ids do not match their upstream slug: libsql is served as `turso`,
+# druid as `apachedruid` and kafka as `apachekafka`. Renaming them to match breaks the fetch.
 #
 # Marks are third-party trademarks — never recoloured. Run
 # `node scripts/logo-contrast-report.mjs` afterwards to see how each reads on the
@@ -44,6 +57,9 @@ fetch clickhouse    "$SI/clickhouse"
 fetch druid         "$SI/apachedruid"
 fetch trino         "$SI/trino"
 fetch opensearch    "$SI/opensearch"
+fetch prometheus    "$SI/prometheus"
+fetch kafka         "$SI/apachekafka"
+fetch etcd          "$SI/etcd"
 
 echo
-echo "16 marks in $OUT"
+echo "19 marks in $OUT"

site.config.json

@@ -4,8 +4,8 @@
   "url": "https://libredb.org",
   "domain": "libredb.org",
   "tagline": "The database editor that deploys next to your data.",
-  "description": "LibreDB Studio is the open-source database IDE that deploys next to your data instead of onto your laptop — one browser tab for PostgreSQL, MySQL, MongoDB, Redis and fifteen more engines, with SSO and audit built in.",
-  "version": "0.17.0",
+  "description": "LibreDB Studio is the open-source database IDE that deploys next to your data instead of onto your laptop — one browser tab for PostgreSQL, MySQL, MongoDB, Redis and twenty-three more engines, with SSO and audit built in.",
+  "version": "0.18.2",
   "license": "MIT",
   "company": "Sekoya Grup Bilişim ve Teknoloji Ltd. Şti., İstanbul",
   "copyrightYear": 2026,