1.0.15

• Update re2js, which the Firestore SDK uses, to 2.9.1 to address GHSA-gg6h-894w-4m9c (#54).
• Update qs, which the development server uses, to 6.17.1 to address GHSA-6pq8-jhm2-2vcw (#53).
• Validate with a frozen install, lint, format check, the production build and all 110 tests in Node 24. Both Dependabot alerts are closed.
• Confirm the production JavaScript matches its integrity hash. The game screen was not opened in production, because that connects to the real Firebase.

1.0.14

• Update firebase to 13.1.0, eslint to 10.13.0, sass to 1.106.1, webpack to 5.112.0 and webpack-dev-server to 6.1.0 (#52).
• Test through what the screen and Firestore show instead of internal functions (#51).
• Validate with a frozen install, lint, format check, the production build and all 110 tests in Node 24.
• Confirm the production JavaScript and CSS match their integrity hashes and the deployed bundle reports Firebase 13.1.0. The game screen was not opened in production, because that connects to the real Firebase.

1.0.13

• Judge bat hits by the rotated bat's box: at any swing angle, the ball hits when its center is within 20px of the 20×120px bat box, and contact between the 30ms checks also counts, so the bat no longer passes through the ball between checks (#47). The old rule, which allowed hits from 20px above to 70px below the top edge of the bat's bounding box, is removed.
• Measure vector length from both components, and take random ranges in (min, max) order, so the pitch speed is 10–30px and the horizontal speed after a hit is -30 to 30px (#47).
• Document the bat hit rules with figures in the README (#47).
• Correct comments and documents, and remove unused Vue data, dependencies (babel-plugin-transform-runtime and core-js) and settings (#46).
• Clear lint and format warnings, add yarn lint and yarn format:check, and build before running tests (#45).
• Install the nginx image packages without prompting, so docker compose up -d no longer stops while building web/Dockerfile (#48). The production nginx is unchanged.
• Update prettier to 3.9.10, eslint-plugin-prettier to 5.5.7, launch-editor to 2.14.2, fast-uri to 3.1.9 and serialize-javascript to 7.1.4 (#43, #44, #49, #50).
• Validate with a frozen install, the production build and all 110 tests in Node 24.
• Confirm the production JavaScript and CSS match their integrity hashes.

1.0.12

• Update the npm dependencies, including Firebase 13.0.0, Babel 8, ESLint 10, Prettier 3, webpack 5.111.1, webpack-cli 7 and dotenv-webpack 9 (#42). The Firebase major release only changes the AI module, which the game does not use.
• Remove sprintf-js from the dependency tree to address GHSA-hp3w-g68c-fv3c (#42).
• Migrate linting to the ESLint flat config and pass the original error as cause when rethrowing Firebase errors (#42).
• Babel now targets its default browser set (browserslist defaults) instead of ES5 output.
• Add Dependabot version updates for npm and the Docker image (#41).
• Validate with a frozen install, the production build and all 91 tests in Node 24.
• Confirm the production JavaScript and CSS match their integrity hashes.

1.0.11

• Update the transitive build dependencies shell-quote to 1.12.0, proxy-addr to 2.0.8, compression to 1.8.2 and source-map-js to 1.2.2 to address GHSA-pqg4-j6r4-53mv and three other advisories (#40). package.json and gameplay are unchanged.
• Include development guide refinements since 1.0.10 (#39).
• Validate with a frozen install, the production build and all 91 tests in Node 24.
• Confirm the production JavaScript and CSS match their integrity hashes.

1.0.10

• Replace runtime inline styles with existing Bootstrap utilities (top-50 for the pitch message, lh-1 for board labels) and drop an unsupported Bootstrap 4 class, with no visual or gameplay change.
• Validate all 91 tests and lint; 10 before/after screenshots of the offline browser build at desktop and mobile widths are pixel-identical, and a full guest game runs to the result screen.
• Confirm the production HTML, JavaScript and CSS match the validated build and their integrity hashes.

1.0.9

• Patch brace-expansion, fast-uri, serialize-javascript and gRPC dependencies.
• Validate all 91 tests and offline browser game flows at desktop and mobile widths.
• Confirm the production HTML, JavaScript and CSS match the validated build.

1.0.8

• Reuse existing Bootstrap utilities for game layout and remove redundant custom positioning styles while preserving gameplay and desktop/mobile appearance. (#36)
• Serve the existing baseball favicon as PNG with the correct MIME type and use the shared image path in production and browser-test builds. (#36)
• Clarify code comments and streamline repository guidance without changing runtime behavior. (#33, #34, #35)

Validation:

• Build and all 91 tests passed in the pinned Node 24 deployment container; Firebase was disconnected during these checks. ESLint and Prettier passed for the same source, and merged main CodeQL succeeded.
• All 11 public assets match the validated production build byte-for-byte. JavaScript/CSS cache identifiers and the PNG favicon MIME type are correct.
• Production verification covered 1440px, 390px and 320px widths, sequential guest allocation, weekly/all-time rankings, Google-authenticated gameplay, guest gameplay, batting and upward ball reflection, three-out completion, finishing without saving, retry with the same guest number and reset score/counts, and one guest score save with ranking reflection.
• No horizontal page overflow or browser console errors/warnings were observed.

Live Firestore checks were explicitly authorized and limited to one page load: three ranking-fetch batches (12 query invocations), one guest allocation transaction, and one guest score save. There was no polling or repeated page reload. These counts describe application operations; billed document reads and SDK transport requests were not instrumented.

One normal guest-play record (guest 741, 0 points) was saved for verification. Authenticated score overwrite and deletion were not exercised in production; their contracts passed Firebase-mocked tests.

Release commit: ec06963903ce1f0927db746e85faceab5d3c3307.
Deployed site: https://baseballgames.jp.net/

1.0.7

Changes

• Restore sequential guest numbers with a Firestore transaction counter. Bootstrap from the highest existing guest ID and fetch only that one record; preserve the random suffix used for stored IDs. (#30)

• Display the guest number or signed-in player name above the score panel, truncating long names without changing the panel width. (#31)

• Retain the original yellow/orange trapezoid targets and 150×40px dimensions, with restrained bold text and rounded corners. (#31)

• Add a browser verification build that replaces Firebase with an in-memory mock and excludes Firebase SDK modules and production credentials. Document the Spark-only policy and prohibition on routine live Firebase tests. (#31)

• Allocate and display the guest number on the initial unsigned-in menu, share pending allocation with the start button, and reuse the number during the page session. Display loading and retry guidance without blocking rankings. Opening the menu now consumes one guest number. (#32)

Verification

• Node 24 production build and lint passed; all 91 automated tests passed. Integrated main CI succeeded.
• All 12 public assets match the validated production build by SHA-256.
• After the daily quota reset, a targeted transaction read succeeded. Initial sequential allocation produced guest 701; the deployed browser then started guest 702.
• Production mobile verification covered ranking retrieval, player-name and target display, batting, three-out game completion, and retry preserving the guest number while resetting score and counts. No console errors were observed in these guest-play checks.

Limitations

• Guest allocation requires an available Firestore quota and network connection; Spark daily limits still apply. No paid plan was enabled.
• Live Google authentication and the previously reported Cross-Origin-Opener-Policy warning were not verified or changed by this release.
• Production score saving was not performed. Live Firebase checks were limited to the previously authorized quota recovery and guest-play checks; the latest start-screen change was verified with mocks and static asset integrity checks.

Target commit: 9845a01
Deployed site: https://baseballgames.jp.net/

1.0.6

Fixes

• Allow guest play to start without Firestore reads or writes, including when the database read quota is exhausted. Guest identifiers are generated locally with cryptographically secure randomness; records are created only when a score is saved. (#28)
• Detect hits along the ball's path between frames so fast balls cannot pass through scoring targets and be counted as outs. When multiple targets intersect the path, apply the first contact only. (#29)
• Wait for each pitch to finish before scheduling the next one, preserving the normal four-second cadence and at least 1.5 seconds for result messages. Prevent duplicate game starts. (#29)

Verification

• Node 24 production build and lint passed; all 72 automated tests passed.
• Tests cover 410 speed/position combinations, target edges and gaps, adjacent targets, scoring and out counts, fouls, overlapping pitches, game completion, and retry.
• Browser checks covered desktop and mobile layouts. Production mobile checks confirmed a three-run hit, game completion with three points, and retry resetting the score and counts to zero, with no console errors observed during these guest-play checks.
• All 12 public files match the validated production build by SHA-256. No test scores were saved to the production rankings.

Known limitation

• The reported Google sign-in Cross-Origin-Opener-Policy console warning is not addressed by this release. Live Google authentication and production score saving were not re-tested for this release.

Target commit: 183d51e
Deployed site: https://baseballgames.jp.net/