Skip to content

v1.10.0 - Go fixes, React docs, browser tests

Choose a tag to compare

View all tags
@cport1 cport1 released this 14 May 03:56
· 184 commits to main since this release
v1.10.0
bfdff67

Highlights

A consolidation release: Go server reaches feature parity on widget delivery, replay-protection stores no longer have a wholesale-wipe failure mode, React integration is documented inline, and the parallel PoW solver shipped in v1.9.0 now has end-to-end browser test coverage.

What's new

  • server-go: serve client/fcaptcha.js from same origin. The route referenced ./static/fcaptcha.js, a path that has never existed in the repo, so the Go server returned 404 for the widget bundle even though Node and Python have served it from /fcaptcha.js since v1.8.0. Now resolves a real client path at startup using FCAPTCHA_CLIENT_PATH or a probe list, and the Docker image COPYs the widget into place.
  • server-go: bound replay-protection stores with LRU + TTL. PoWChallengeStore.usedSolutions previously wiped the entire map once it crossed 10K entries, briefly opening a replay window. TokenStore.usedTokens did O(n) inline cleanup under the write lock on every 100th insert past 1000. Both are now backed by hashicorp/golang-lru/v2 expirable LRUs (cap 100K, TTL 10 min). Per-entry eviction, no more replay window, no more lock-held scans.
  • server-go: closes two pre-existing data races in PoW verification (read/write of usedSolutions and delete of challenges happened without holding the store mutex). The new IsSolutionUsed / MarkSolutionUsed / DeleteChallenge methods take the lock, and MarkSolutionUsed is an atomic test-and-set so concurrent verifications of the same nonce can't both succeed.
  • README: React integration example. Roughly 70 lines covering both invisible mode (useFCaptcha hook + execute()) and checkbox mode (FCaptchaCheckbox component) — no wrapper package required, and the same pattern works for Vue / Svelte / Solid / Angular.
  • test/browser/: Playwright PoW worker tests (new isolated package). Covers what the Node-based test/test-detection.js cannot: end-to-end PoW solve in real Chromium against a live server, multi-thread fan-out (~hardwareConcurrency / 2 workers), single-thread fallback at hardwareConcurrency=1, and post-solve worker termination. Local-runnable via npm test from test/browser/; see test/browser/README.md.

Compatibility

  • No client API changes.
  • No wire-protocol changes.
  • New Go dependency: github.com/hashicorp/golang-lru/v2.
  • The Go Docker image now COPYs client/fcaptcha.js — rebuild your image to pick up the widget route fix.

Tests

  • 83/83 Node detection suite tests pass.
  • New Go unit tests pass (go test ./... in server-go/).
  • 4/4 Playwright browser tests pass against the Node server.
Assets 2
Loading