Skip to content

v1.2.135

Choose a tag to compare

View all tags
@LeeAdcock LeeAdcock released this 23 Oct 13:34
· 121 commits to main since this release
v1.2.135
c755478

A ladder-efficiency release: the global ranked ladder now stops replaying pairings that have nothing left to prove, runs at a pace the production box can sustain, and keeps its match history bounded. A round of dependency updates also clears a critical advisory on the server.

No bot-facing or MCP-client contract changed.

Features

  • A ladder pairing is now capped at 10 matches since either app's code last changed (LADDER_PAIR_MATCH_CAP, 0 restores play-forever). With only 66 distinct pairings among eligible apps, each pairing had been replaying roughly 85 times a day. Once every pairing reaches the cap, the ladder idles until someone edits a bot, and an edit opens that app's pairings again.

Fixes

  • The ladder loop is throttled in production: matches now start every 30 seconds instead of back to back, and the per-match timeout is raised to 120 seconds. Previously about one match in five ran out of time on the contended box and finished unrated.
  • Re-saving an app with the name it already has no longer counts as an edit, so it can't reset the ladder's pairing caps.
  • Ranked match history is now bounded. When an app changes, results recorded against its previous version are dropped, so a pairing's stored matches are always its head-to-head record between the two current versions. An hourly sweep clears pairings that stopped playing entirely, after 90 days (LADDER_MATCH_RETENTION_DAYS).

Security

  • express 5.3, which pulls in a fixed proxy-addr and clears a critical IP-spoofing advisory (GHSA-jqcg-44mw-7w3h) in the code that resolves client IPs behind the load balancer for rate limiting.
  • Cleared the remaining high and critical advisories that had turned the dependency gate red on main, including @modelcontextprotocol/sdk, brace-expansion, shell-quote, axios, and undici. One unfixable, dev-only advisory (braces, GHSA-vfj7-8cjw-p6xm, reachable only through nodemon) is now the single documented entry in the audit allowlist.

Build & Tests

  • express-rate-limit 8.7.1, pino 10.4, and pino-pretty 13.2 on the server; @vitejs/plugin-react 6.1.2 in the UI.
Assets 2
Loading