Commit graph

4 commits

Author SHA1 Message Date
11e6b27806 Fix 11 npm audit vulnerabilities via in-range dependency bumps
Resolves all Dependabot alerts (5 high, 6 moderate) through transitive
patch/minor updates — no package.json range changes, no breaking upgrades:

- socket.io-parser: unbounded binary attachments (high)
- minimatch: matchOne() ReDoS (high)
- path-to-regexp: route-param ReDoS (high)
- picomatch: POSIX class method injection + extglob ReDoS (high)
- ws: uninitialized memory disclosure (moderate)
- qs: arrayLimit bypass DoS + stringify crash (moderate/low)
- brace-expansion: zero-step sequence hang (moderate)

npm audit now reports 0 vulnerabilities.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-05-28 23:50:02 +00:00
a0481ed867 Route gameCommand traffic through WebRTC unreliable DataChannel
Socket.IO (TCP) holds back later packets while it retransmits a lost
one, which stalls worldUpdate delivery on lossy long-distance links —
exactly the pattern game state suffers worst from. WebRTC DataChannels
in unreliable mode (ordered:false, maxRetransmits:0) drop late packets
instead of queueing them, which is what we want for high-frequency
state sync.

Adds a per-user WebRTCTransport on top of the existing Socket.IO
connection. Socket.IO stays in charge of bootstrap, signaling
(SDP/ICE exchange), and control messages — only gameCommand payloads
get routed onto the unreliable channel once it's open. If WebRTC
fails to negotiate, gameCommand transparently falls back to
Socket.IO, so the game keeps working unchanged.

A new StatsLogger writes per-session JSONL events (session_start,
webrtc_ready with negotiation time, per-second stats with transport,
RTT samples, recv/send rates, seq gaps) so we can compare real-world
runs (e.g. Germany server <-> Korea client) instead of guessing.
URL flag ?webrtc=0 forces fallback for A/B testing.

scripts/webrtc-browser-test.js spins up a headless Chromium against
a freshly-started server and asserts the unreliable channel opens
and gameCommand traffic actually rides it.
2026-05-11 00:38:18 +00:00
Karl Pannek
e6089687ed 2025 update! 2025-07-15 20:05:12 +02:00
1df7258b56 Upgrade socket.io to 2.x 2017-11-06 22:17:33 +01:00