3.1.0

What's Changed

A full internal code audit — one new admin setting, plus reliability, ethics, and type-safety fixes under the hood.

New

• Disable On3 headshots. A new admin toggle (Enable On3 player headshots) lets you stop all outbound traffic to On3 entirely — recruits then show star-tier initials avatars. The setting's help text documents exactly what the scrape does, and the admin panel now shows when headshots were last successfully refreshed.

Fixed

• No more request stampede on a cold cache. The first request for a recruiting class used to make two blocking outbound calls (~22 s) with no lock, so a burst of visitors each launched their own pair of fetches. A single-flight lock now guarantees at most one cold fetch; everyone else serves the warmed cache or retries automatically.
• Honest scraping. Removed the spoofed Chrome browser User-Agent used to bypass On3's bot detection (a ToS/identity-spoofing risk that could get the forum's IP blocked). The fetch now identifies itself truthfully.
• Layout-change detection. If On3 returns a page but almost no players parse out, the extension now logs a warning instead of silently dropping all headshots.

Internal

• The outbound HTTP client is now container-managed and injected, so operators can layer forum-wide middleware (logging, retry, proxy).
• The /recruiting page is fully TypeScript-type-checked (the prior @ts-nocheck escape hatch is gone), and the API URL is derived correctly for subdirectory installs.