https://vulnerability.circl.lu/sightings/feed 2026-06-18T15:48:02.201223+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/d2e49c3f-afc1-4531-b2bc-299fec360c8e/export 2026-06-18T15:48:02.581004+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "d2e49c3f-afc1-4531-b2bc-299fec360c8e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-rpr9-rxv7-x643", "type": "seen", "source": "https://gist.github.com/evanpelle/dffeb5f7d26df28bdb72e87289fe0f0c", "content": "# v32 Release Notes\n\n## Renderer & Graphics\n\n- Migrated the entire renderer from canvas2D/Pixi to WebGL and made it the sole renderer - ldlework\n- Added a Graphics Settings modal \u2014 allowing for a dozen+ different graphics options \u2014 Evan\n- Added territory image-based skins \u2014 Evan\n- Added colorblind mode \u2014 noahschmal\n- Moved the theme system from core to a client-side ThemeProvider \u2014 noahschmal\n- Returned factory/defence-post radii and railroad highlighting when placing a city/port on top \u2014 VariableVince\n- Showed the alliance request + duration icon and ally/teammate targets, with optimization \u2014 VariableVince\n- Moved status icons closer above names with emoji on top \u2014 VariableVince\n- Displayed player flags next to names again and restored territory skins \u2014 VariableVince\n- Restored rendering on WebGL context loss \u2014 VariableVince\n- Added a coordinate grid \u2014 FrederikJA\n- Stopped trade-friendly ships from rendering as angry red warships \u2014 Berk\n- Fixed the SAM/factory radius ghost upgrade and added a railroad ghost for factories, syncing factory effective distance and railroad max length \u2014 TKTK123456\n\n## Performance\n\n- Numerous WebGL renderer performance improvements: smoother camera, incremental GPU tile-border/tile-delta updates, staggered territory and name-label rendering, and defense-post rendering scaled to thousands of posts \u2014 Evan\n- Cut worker\u2192main and lobby bandwidth substantially by switching to deltas (per-tick update payload down ~90%), sped up the core sim with no behavior change, and saved ~150 MB by sharing the water pathfinder chain across ships \u2014 Evan\n- Major CPU and memory optimizations in the map generator \u2014 Alex Jurkiewicz\n- Migrated AttackExecution hot loops to `forEachNeighbor` \u2014 Mike Zaugg\n- Fixed AStar overflowing the priority queue on twisted paths \u2014 Arkadiusz Sygulski\n\n## Maps\n\n- Added maps: Taiwan Strait, Indian Subcontinent, Juan de Fuca Strait (3-way team), Southeast Asia, Balkans, Caribbean, Middle East, Venice, \"The Straits\", Mississippi River, Northwest Passage, and Titan (new Cosmic category) \u2014 RickD004\n- Team Maps Expansion (new team spawnzones), a huge terrain re-make of multiple maps, and new/updated map categories \u2014 RickD004\n- Renamed \"The Straits\" \u2192 \"Danish Straits\"; rebalanced the Taiwan Strait map \u2014 RickD004\n- Fixed a river in Balkans not connecting to the sea and the Bosphorus map; QoL for Strait of Malacca \u2014 RickD004\n- Formatted the map lists in Main and MapPlaylist; standardized map names across info/manifest JSONs \u2014 RickD004\n- Added maps: Korea, Hong Kong, Yellow Sea, and Warship Warship (with additional nations + team spawn) \u2014 crunchybbb\n- Added flags to nations on Lemnos/Hormuz/Two Lakes; fixed the disconnected Yalu River and a Warship Warship pathfinding bug \u2014 crunchybbb\n- Added maps: Chopping Block, World Inverted, and May Labyrinth \u2014 Patrick Plays Badly\n- Updated maps: Dyslexdria and LUNA \u2014 Patrick Plays Badly\n- Added the Onion map \u2014 TKTK123456\n- Added a Favourite maps tab \u2014 bijx\n- Added map search \u2014 FloPinguin\n- Improved MapPlaylist \u2014 FloPinguin\n- Fixed map land-tile lookup broken by the asset URL migration \u2014 FloPinguin\n- Removed lakes from the game \u2014 FloPinguin\n- Added the Giant World Map to the multiplayer queue after performance improvements \u2014 Evan\n\n## Nations & Bots\n\n- Allowed mappers to define `additionalNations` and to omit nation coordinates for random spawn \u2014 FloPinguin\n- Better troop management for nations, with follow-up fixes and improvements \u2014 FloPinguin\n- Fixed nations being blocked by PVP immunity and not spawning with random spawn enabled \u2014 FloPinguin\n- Fixed nation city farming, reactive defense posts, and nuked-territory capture \u2014 FloPinguin\n- Fixed nation names with special characters \u2014 Katokoda\n- Fixed nations not spawning in singleplayer when the player picks fast \u2014 Evan\n- Prevented bots from invading/attacking themselves \u2014 Berk\n\n## Alliances\n\n- Added alliance extension handling \u2014 babyboucher\n- Fixed the alliance renewal prompt staying open and the expiration window persisting after expiration \u2014 Katokoda\n- Fixed alliance request event display edge cases and flashed the alliance icon when a renewal prompt is active \u2014 Evan\n\n## Nukes & Combat\n\n- Rendered nukes smoothly per frame and wired trajectory + blast radius into the build-ghost preview \u2014 Evan\n- Improved nuke telegraphs: colored by launcher relation (self/ally/enemy), red range circle when a launch would break an alliance, SAM-interception preview, dimmed untargetable nukes, and a larger intercept marker \u2014 Evan\n- Updated WebGL nuke effects; fixed MIRV skull eyes and fallout embers flickering \u2014 Evan\n- Removed a double `x()` dereference in the MIRV separation point calc \u2014 Berk\n- Destroyed defense posts on tile capture instead of downgrading/transferring ownership \u2014 Berk\n- Fixed warships freezing with no path \u2014 Katokoda\n\n## Store & Account\n\n- Showed full store item names instead of truncating them \u2014 Aotumuri\n\n## Clans\n\n- Added clan game history, a clan stats breakdown, and clantag part 1 \u2014 Ryan\n- Disabled game buttons for clan tag + username; fixed the clans-UI border and a streamer-mode bug \u2014 Ryan\n- Hid clan tags in public FFA games to prevent teaming and hid the clan tab on crazy games \u2014 Evan\n- Added support for direct clan detail links and made the clan-tag warning clickable \u2014 Aotumuri\n- Corrected the clan-tag length error message \u2014 Berk\n\n## Friends & Social\n\n- Added a friends panel with team-grouping hints (extended to the lobby team preview) and put friends on the same team \u2014 Evan\n- Added an FFA collusion warning \u2014 a-happy-goose\n\n## UI, Events & Notifications\n\n- Improved the Notification Panel and showed newest actionable events on top to prevent misclicks \u2014 Evan\n- Fixed events display showing troop donations 10\u00d7 too high and removed unit-capture event messages; only notify on warship/transport destruction \u2014 Evan\n- Added a help notification system to the control panel \u2014 FloPinguin\n- Filtered actionable events to remove dead requestors \u2014 Katokoda\n- Added boat ETA calculation and display in AttacksDisplay \u2014 a-happy-goose\n- Fixed the missing boat sprite icon in the attacks panel \u2014 Cameron Clark\n- Fixed a malformed flag SVG URL in playerRow \u2014 Blake Girardet\n- Fixed mobile logo spacing \u2014 Aotumuri\n- Removed emoji from user settings \u2014 Aotumuri\n- Added a \"go to player on spawn\" setting (default on) \u2014 FrederikJA\n- Added a retaliate keybind \u2014 Sky Elder\n- Fixed rebound keys \u2014 TKTK123456\n- Disabled build hotkeys after death \u2014 Aotumuri\n- Blocked Safari page-level pinch-zoom \u2014 Vansh\n- Added a per-recipient cooldown to QuickChatExecution \u2014 Josh Harris\n\n## Lobby & Matchmaking\n\n- Added a countdown before game start \u2014 tnhnblgl\n- Added a delayed lobby start \u2014 FrederikJA\n- Removed the spawn timer on singleplayer (kept a static one elsewhere) \u2014 Aotumuri / Evan\n- Fixed ranked 1v1 requeue opening matchmaking \u2014 Aotumuri\n\n## Security & Server Stability\n\n- Fixed a critical XSS in NewsModal (GHSA-rpr9-rxv7-x643) \u2014 Mehmet KOZAN\n- Patched a Desync DoS vulnerability with strict majority consensus \u2014 Berk\n- Removed duplicate `express.json()` middleware (SEC-04) \u2014 Berk\n- Guarded all `ws.send()` calls with readyState checks and prevented `sendStartGameMsg` from crashing the server on disconnect \u2014 Berk\n- Fixed a crash when HeadsUpMessage renders before the game is assigned \u2014 Evan\n- Added stale-if-error to the app-shell Cache-Control \u2014 Josh Harris\n\n## Translations\n\n- Translation updates (MLS v5.4, v5.5) \u2014 Aotumuri\n\n## Tooling, CI & Repo\n\n- Fixed the GitHub translation key category and restored the dev-only localStorage pattern override \u2014 Aotumuri\n- Fixed CI test failures from an over-long test \u2014 VariableVince\n- Silenced a noisy LangSelector \"not found\" console warning; fixed a websocket error-log typo \u2014 Berk\n\n## Meta & Misc\n\n- Meta tuning: nuke speed 10 \u2192 12, trade-ship sigmoid midpoint 200 \u2192 400 \u2014 Evan\n- Replaced hardcoded defaults and fixed an off-by-one error \u2014 babyboucher\n- Updated and removed dependencies; removed a leftover optional chain \u2014 VariableVince\n- Dropped the unused disposer return from `installSafariPinchZoomBlocker` \u2014 Vansh", "creation_timestamp": "2026-06-17T01:40:09.000000Z"} 2026-06-17T01:40:09+00:00