Bump three from 0.167.1 to 0.185.1 in /client - #2
Open
dependabot[bot] wants to merge 17 commits into
Open
Conversation
Prepare the game server to run behind a reverse proxy on a plain VM instead
of Railway's managed runtime.
- Bind to HOST (default 0.0.0.0 so local dev is unchanged); systemd pins
127.0.0.1 in production so the app is only reachable via TLS through Caddy.
- GET /health -> 200 {"status":"ok"} and GET /metrics (tick + event-loop
percentiles via perf_hooks histograms — no new dependency).
- Graceful SIGTERM/SIGINT: stop the tick, close sockets, exit 0. systemd sends
SIGTERM on every restart, so without this players got a hard RST.
- Pin perMessageDeflate:false explicitly. It is already the ws server default,
but gameplay frames are small and frequent — compression would only add CPU
and latency.
- Record tick duration. setInterval is kept deliberately: Node reschedules only
after the callback returns, so a slow tick delays the next rather than
queueing a backlog.
deploy/ holds the systemd unit, Caddyfile, and an idempotent VM bootstrap.
server/loadtest.js drives 8 real clients through the actual protocol and
reports the numbers the migration is graded on.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
A CR in setup.sh's shebang fails as 'bad interpreter: /usr/bin/env bash^M'. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Two-stage: run without DOMAIN to stand up the server + systemd; re-run with DOMAIN set to add Caddy/TLS once the record resolves. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- setup.sh: SUB var for the subdomain label; two-stage DOMAIN handling
- Caddyfile: parameterized hostname ({$FQDN})
- deploy/ROLLBACK.md: full migration + rollback record
- README: Oracle deploy docs, drop Railway
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Server hardening (server/index.js + security.test.js): - Origin allowlist enforced at the WebSocket upgrade in production - Connection caps (global + per-IP), payload size limit, per-connection message-rate limit, join timeout, heartbeat - Anti-cheat: clamped move dt (no teleport-by-pausing), full arena position bounds inc. vertical, line-of-sight checks on hitscan, RPM fire-rate limit - Env-validated PORT/limits; /metrics kept loopback-only - security.test.js covers the above; `npm test` wired up Deploy hardening: - Caddyfile: security headers, /metrics -> 404, non-GET/HEAD -> 405 - fragzone.service: systemd sandboxing + memory ceilings, runtime env file - setup.sh: derives ALLOWED_ORIGINS from SITE_ORIGINS; input validation Public-release cleanup: - exploits.md: security-analysis writeup of the attacks above and their fixes - Remove raw bugs.md / todo.md (content distilled into exploits.md) - PRODUCT.md, SECURITY.md, .github/dependabot.yml - gitignore .impeccable/ tool scratch - README: verification + security sections, exploits.md link Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Bumps [three](https://github.com/mrdoob/three.js) from 0.167.1 to 0.185.1. - [Release notes](https://github.com/mrdoob/three.js/releases) - [Commits](https://github.com/mrdoob/three.js/commits) --- updated-dependencies: - dependency-name: three dependency-version: 0.185.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps three from 0.167.1 to 0.185.1.
Commits
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)