fix changelog on GitLab Pages
Use CI_JOB_TOKEN (or GITLAB_CHANGELOG_TOKEN) for the commits API, and fall back to git log with git installed in the build image.
fix changelog page showing no commits
Read recent commits from local git instead of the GitLab API, which 404s without a token and left the page empty.
Cut build calculation time by about half
Tighter item search, skip invalid combinations sooner, and cheaper combat scoring. Recommended builds stay the same.
deps(discord): clear 15 advisories in the notification bot
The discord/ sub-project was never covered by the earlier audit pass:
running `pnpm audit` from inside it resolves the parent workspace rather
than the bot, so it silently reported the root project's results. Audited
directly it had 15 advisories (6 high, 7 moderate, 2 low), all reaching
it through discord.js.
- discord.js ^14.21.0 -> ^14.27.0, which moves its own undici floor to
^6.27.0 and clears six of the undici advisories outright.
Three transitive packages remain pinned below their fixed versions by
intermediate parents, so they are handled with overrides declared for
both bun (the notify job runtime) and pnpm:
undici ^6.28.0 (@discordjs/rest allows <6.23.0)
ws ^8.21.1 (@discordjs/ws allows <8.20.1)
lodash ^4.18.1 (@sapphire/shapeshift allows <=4.17.22)
Verified: `bun audit` and `pnpm audit` both clean in discord/; the bot
entry point still bundles cleanly against the new dependency tree.
deps(scraper): consolidate open Dependabot bumps and clear scraper audit
Supersedes the three open Dependabot PRs against /scraper, all of which
were stale against master:
#66 ajv 8.17.1 -> 8.18.0 (landed on 8.20.0)
#64 lodash 4.17.21 -> 4.17.23 (landed on 4.18.1)
#35 undici 6.21.3 -> 7.18.2 (landed on 7.29.0)
The scraper's pnpm-lock.yaml had drifted badly from package.json -- it
still pinned removed packages such as @types/cheerio and resolved undici
to 6.21.3 even though cheerio 1.1.2 requires ^7.12.0. Regenerating both
lockfiles reconciles them and picks up the bumps above.
`bun audit` additionally flagged two transitive packages whose parents
still allow vulnerable versions, neither of which Dependabot had opened
a PR for. Both are pinned via overrides, declared for bun (the scrape
runtime) and pnpm (the lockfile Dependabot tracks):
undici ^7.29.0 (cheerio allows ^7.12.0; <7.18.2 is vulnerable)
fast-uri ^3.1.5 (ajv allows ^3.0.1; <3.1.3 is vulnerable)
Verified: `bun audit` and `pnpm audit` both clean in scraper/; scraper
typecheck output is unchanged from master (the remaining cheerio
`Element` and unknown-catch errors are pre-existing).
security: remove hardcoded GitLab token from changelog page
The /info/changelog build step embedded a GitLab personal access token
directly in source and passed it as a `private_token` URL query
parameter. The value has been committed since a07104d and is readable by
anyone with access to this repository or its mirrors.
- Read the token from a GITLAB_CHANGELOG_TOKEN environment variable,
supplied as a masked GitLab CI/CD variable at build time.
- Send it as a PRIVATE-TOKEN header rather than a query parameter, so it
cannot leak into access logs or proxy caches.
- Degrade gracefully to an empty changelog when the variable is unset,
matching the existing error path, so builds never hard-fail on it.
getStaticProps runs only at build time, so the token was never part of
the client bundle -- the exposure is the repository itself. This change
stops the leak going forward; the existing token still needs to be
revoked and reissued, since it remains in git history.
security: patch 19 dependency advisories
Resolves every advisory reported by `pnpm audit` (12 high, 6 moderate,
1 low) across the app and both sub-projects. Audit is now clean.
- next 16.2.10 -> 16.2.12, clearing nine advisories (middleware/proxy
bypass, Server Action DoS and SSRF, rewrite SSRF, cache confusion,
image-optimization DoS, Server Function endpoint disclosure). The site
is a static export, so most of these are not reachable at runtime, but
the build-time toolchain and any future server target are covered.
Upstream still pins vulnerable transitive versions for the rest, so
those are handled with pnpm overrides in pnpm-workspace.yaml:
- dompurify -> ^3.4.12 (isomorphic-dompurify allows ^3.4.11)
- ws -> ^8.21.1 (jsdom via jest-environment-jsdom)
- brace-expansion -> ^1.1.18 / ^2.1.4 (minimatch pulls both majors)
- postcss -> ^8.5.25 (next dependency-pins 8.4.31)
- sharp -> ^0.35.3 (next optional dep allows vulnerable libvips)
Verified: `pnpm audit` clean in ., scraper/ and discord/; 281 tests
across 26 suites pass; `tsc --noEmit` clean; `next build` compiles.
26.11 & Refactor hard-CC/haste logic;
Add granular hard-CC counting and imperial mandate haste handling: compute finalHasteBonuses per ability, add calculateHardCcInstances helper, and wire imperialMandate ultimate haste and extraUltimateHaste into cooldown math. Replace multiple ad-hoc CC checks (Aftershock, Glacial, Imperial Mandate, shields, etc.) to use the new hard-CC counts and adjust related proc, uptime and damage/armor calculations.
Restore repository state to Fix champion base stat growth
Align master with aa097e4a after revert chain left incorrect stat formulas
and reintroduced the pre-merge attack speed data split.
Revert "Add support for champion extra abilities"
This reverts commit a4b1fb21bdab85d00d321f6244b703920fc98b71.
Revert "Merge branch 'master' of https://gitlab.com/lol-math/item-optimizer"
This reverts commit e6cfc5481e4d90f8f427c80243faa4734c435f22, reversing
changes made to a4b1fb21bdab85d00d321f6244b703920fc98b71.
Reapply "Fix champion base stat growth"
This reverts commit 410805c827e35abae6d7dc1d20796f7916acdff1.
Revert "Fix champion base stat growth"
This reverts commit aa097e4a5764c276e188c387a659f29b2c2e01c4
Add support for champion extra abilities
Add comprehensive support for champion "extra abilities" across UI, state, types, and calculation logic. Key changes:
- UI: Introduce ExtraAbility component and export; render extra abilities in Champion tab and show icons/descriptions in compare damage details. (files: Champion.tsx, ability/ExtraAbility.tsx, ability/index.ts, CompareDamage.tsx)
- State: Add Redux actions to update extra ability fields (damage type, target, booleans, numeric inputs) and include extra ability data in player-champion slice. (player-champion.slice.ts)
- Types: Extend DamageScenario to include extraAbilities. (types/index.ts)
- Damage computation: algorithm worker now includes an extraAbilities entry in scenario outputs; compare-damage utils compute totals and include extra abilities in computed map and overall totals. (algoRequest.worker.ts, compare-damage.utils.ts)
- Battle engine: Ensure dynamic Damage arrays are allocated and zeroed for each extra ability key. (battle-calculation.ts)
- Champion logic: Refactor Udyr calculations to account for extra/empowered activations, split and accumulate extra ability damage into separate keys, and update healing/shield math accordingly. (Udyr.ts)
- Data: Add descriptive ability info for Udyr awakened abilities. (udyr.ability-info.ts)
These changes enable modeling, editing, and displaying custom extra abilities and ensure they are included in damage totals and comparisons.
Fix champion base stat growth
https://wiki.leagueoflegends.com/en-us/Champion_statistic#Growth_by_level
Include Whispering Circlet and generalize tooltip
Add ItemId.whisperingCirclet to the list of tracked Tear items and update the Tooltip copy to reference any Tear item (and a generic "upgrade") instead of specifically naming Manamune/Muramana. This clarifies the guidance and ensures the warning applies to the newly included item.
Update battle calculation and Udyr champion calculations for damage accuracy
- Limited bonus critical chance from Atma's Reckoning to a maximum of 30%.
- Adjusted damage calculations for Udyr's R ability to incorporate magical reduction factor for more accurate damage output.
Refactor TypeScript interfaces and update configurations
- Updated TypeScript interfaces to use `interface` instead of `export interface` for consistency.
- Added `scraper` directory to the TypeScript exclusion list in `tsconfig.json`.
- Enhanced type definitions in `fetch-retry.ts` and `leagueofgraphs.ts` for better type safety.
- Included `@types/node` as a development dependency in `scraper/package.json`.
- Updated `tsconfig.json` in the `scraper` directory to include Node types.
Update Statikk Shiv and Runaan's Hurricane damage calculations for accuracy
- Adjusted Statikk Shiv on-hit application logic to account for chain targets correctly.
- Updated Runaan's Hurricane acquisition rate to reflect the correct number of targets hit.