Repository navigation
1.35.0
Security
- Every API route now checks the request: the Host must be localhost or an IP address (DNS rebinding is refused) and any non-GET request must come from the app itself, so a web page cannot post to the tracker. Command-line tools, the desktop shell and OBS overlay reads keep working.
- Database export is only served on the loopback address.
- The osu! login carries a random state that the callback verifies.
Sync and checks
- A new score queues both the country and the global check once, whatever the score's age. A best fetched by the backfill weeks later used to never get its global check.
- An empty leaderboard answer on a held country #1 or held global rank is retried at most five times in a row, then the check is parked with the held state kept until the regular re-check. No more endless request loop on a delisted map and no false "lost" notification.
- The startup country requeue and two dead requeue paths were removed.
Data
- A map's best is the passed score with the highest standardised total score. It used to be picked by classic score, which is not monotone under Strict Tracking. Affected maps are re-pointed once at startup.
- The mod multiplier stored on scores now rounds exactly like the live calculation and is recomputed once at startup. A new test keeps the two in step.
- A recorded country #1 or global tier change refreshes the timeline and the time machine immediately instead of waiting for the next score.
- Metric filters and breakdown buckets on star rating and max combo use the convert's own values outside osu!standard, as the dashboard already did.
Discord
- A milestone crossed during the 30-minute cooldown is posted at the next poll instead of being lost.
- Deleting a metric also removes its milestone state.
- The preview avatar pointed at a missing image.
Desktop
- On quit the app asks the server to checkpoint and close the database before exiting, so no journal files are left behind.
UI
- The manual set import message shows the real number of new difficulties (it always said 0).
- The stat strip no longer re-renders on every time machine tick.
- A stale value saved in the browser can no longer blank a view.
Housekeeping
- Unused react-table dependency removed, rosu-pp-js pinned exactly.
- Project notes and README brought back in line with the code.