From c72212e6b3eeb31442eb7f060b0d75222901b39f Mon Sep 17 00:00:00 2001 From: "prosoponator[bot]" Date: Fri, 23 Oct 2026 15:07:58 +0000 Subject: [PATCH 1/2] RELEASING: Releasing 4 package(s) Releases: @prosopo/provider@5.21.1 @prosopo/provider-mock@2.8.207 @prosopo/scripts@3.1.211 @prosopo/cli@3.9.2 [skip ci] --- .changeset/decoy-count-follows-piece-size.md | 13 ------------- .changeset/log-assigned-detector-bundle.md | 5 ----- .changeset/provider-caddy-least-conn.md | 8 -------- demos/provider-mock/CHANGELOG.md | 7 +++++++ demos/provider-mock/package.json | 2 +- dev/scripts/CHANGELOG.md | 8 ++++++++ dev/scripts/package.json | 2 +- packages/cli/CHANGELOG.md | 7 +++++++ packages/cli/package.json | 2 +- packages/provider/CHANGELOG.md | 14 ++++++++++++++ packages/provider/package.json | 2 +- 11 files changed, 40 insertions(+), 30 deletions(-) delete mode 100644 .changeset/decoy-count-follows-piece-size.md delete mode 100644 .changeset/log-assigned-detector-bundle.md delete mode 100644 .changeset/provider-caddy-least-conn.md diff --git a/.changeset/decoy-count-follows-piece-size.md b/.changeset/decoy-count-follows-piece-size.md deleted file mode 100644 index 9e549381ff..0000000000 --- a/.changeset/decoy-count-follows-piece-size.md +++ /dev/null @@ -1,13 +0,0 @@ ---- -"@prosopo/provider": patch ---- - -Stop the puzzle burying the background under decoys, especially on phones. - -The difficulty ladder draws `decoyCount` and `pieceScale` from a band independently — one in `samplePuzzleDifficulty`, the other in the renderer's own piece-size draw — so nothing tied how many decoys there were to how big they were. Ten decoys against a 126px piece is a different puzzle from ten against a 42px one, and a level was not monotonic in what the user actually saw: at the current bands a level-0 render could be crowded roughly seven times harder than a level-3 one. - -Touch was worse rather than better. `easePieceScaleForTouch` raises the piece-scale floor so a finger cannot hide the piece, but it left the decoy count alone — bigger decoys in the same number is strictly more crowding. At level 4 the *minimum* coverage on a touch device was 1.56x the background area, so every render was a pile of overlapping pieces no one could read. - -The decoy count is now trimmed against the piece size actually drawn, so the decoys cannot cover more of the background than a ceiling allows. Touch takes a lower ceiling than desktop, which is what makes easing for touch help instead of hurt. The cap only ever reduces the count, so no render becomes harder than the ladder intended, and a count already inside the ceiling is untouched — a render drawn near the middle of any level is unaffected and only the crowded corner is trimmed. - -The trimmed count is what gets rendered *and* what is written to `render.settings.decoyCount` on the challenge record, so a replay reproduces the puzzle the user saw. The browser renderer takes the count as an input rather than deriving it, so the node and JS paths stay in step without a change to `@prosopo/puzzle-assets`. diff --git a/.changeset/log-assigned-detector-bundle.md b/.changeset/log-assigned-detector-bundle.md deleted file mode 100644 index 7c5212f754..0000000000 --- a/.changeset/log-assigned-detector-bundle.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@prosopo/provider": patch ---- - -The provider now logs `Detector bundle assigned` with the `bundleId`, its `release` and the `detectorSessionId` every time `detector/assign` hands out a bundle. Before this nothing recorded which bundle went out, so after a harvest we could only estimate how much of the pool had leaked. diff --git a/.changeset/provider-caddy-least-conn.md b/.changeset/provider-caddy-least-conn.md deleted file mode 100644 index 2c11031dd3..0000000000 --- a/.changeset/provider-caddy-least-conn.md +++ /dev/null @@ -1,8 +0,0 @@ ---- ---- - -The provider's Caddy now spreads requests across both provider containers (`lb_policy least_conn`) instead of sending everything to provider1 and only using provider2 when provider1 fails. Under a traffic spike, provider1's single Node event loop maxed out and verify calls queued past the 10s timeout, while provider2 and most of the host's CPU sat idle. - -Admin paths (`/v1/prosopo/provider/admin/*`) can name a container with an `X-Prosopo-Upstream: provider1|provider2` header. The detector-pool push only updates the container that receives it, and both containers now need the same pool, so the push script uses this to update each one in turn. Client paths ignore the header. - -The upstream transport and `header_up` settings move into a `(provider_upstream)` snippet shared by all three `reverse_proxy` blocks. The headers sent to the provider are unchanged. diff --git a/demos/provider-mock/CHANGELOG.md b/demos/provider-mock/CHANGELOG.md index 6d053a4c04..a462c850fc 100644 --- a/demos/provider-mock/CHANGELOG.md +++ b/demos/provider-mock/CHANGELOG.md @@ -1,5 +1,12 @@ # @prosopo/provider-mock +## 2.8.207 +### Patch Changes + +- Updated dependencies [5c9792b] +- Updated dependencies [4201cf0] + - @prosopo/provider@5.21.1 + ## 2.8.206 ### Patch Changes diff --git a/demos/provider-mock/package.json b/demos/provider-mock/package.json index ea920cb332..1238bdafb3 100644 --- a/demos/provider-mock/package.json +++ b/demos/provider-mock/package.json @@ -1,6 +1,6 @@ { "name": "@prosopo/provider-mock", - "version": "2.8.206", + "version": "2.8.207", "author": "PROSOPO LIMITED ", "license": "Apache-2.0", "type": "module", diff --git a/dev/scripts/CHANGELOG.md b/dev/scripts/CHANGELOG.md index 5568a9cb93..5e4309c827 100644 --- a/dev/scripts/CHANGELOG.md +++ b/dev/scripts/CHANGELOG.md @@ -1,5 +1,13 @@ # @prosopo/scripts +## 3.1.211 +### Patch Changes + +- Updated dependencies [5c9792b] +- Updated dependencies [4201cf0] + - @prosopo/provider@5.21.1 + - @prosopo/cli@3.9.2 + ## 3.1.210 ### Patch Changes diff --git a/dev/scripts/package.json b/dev/scripts/package.json index b274b53900..9d6af5baa8 100644 --- a/dev/scripts/package.json +++ b/dev/scripts/package.json @@ -1,6 +1,6 @@ { "name": "@prosopo/scripts", - "version": "3.1.210", + "version": "3.1.211", "description": "Dev scripts for working with prosopo packages", "main": "dist/index.js", "types": "dist/index.d.ts", diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md index b9dacbad40..af15174fd9 100644 --- a/packages/cli/CHANGELOG.md +++ b/packages/cli/CHANGELOG.md @@ -1,5 +1,12 @@ # @prosopo/cli +## 3.9.2 +### Patch Changes + +- Updated dependencies [5c9792b] +- Updated dependencies [4201cf0] + - @prosopo/provider@5.21.1 + ## 3.9.1 ### Patch Changes diff --git a/packages/cli/package.json b/packages/cli/package.json index 345e3e6720..57be340922 100644 --- a/packages/cli/package.json +++ b/packages/cli/package.json @@ -1,6 +1,6 @@ { "name": "@prosopo/cli", - "version": "3.9.1", + "version": "3.9.2", "description": "CLI for Prosopo Provider", "main": "dist/index.js", "types": "dist/index.d.ts", diff --git a/packages/provider/CHANGELOG.md b/packages/provider/CHANGELOG.md index 1099b1c2e3..b6df054d8b 100644 --- a/packages/provider/CHANGELOG.md +++ b/packages/provider/CHANGELOG.md @@ -1,5 +1,19 @@ # @prosopo/provider +## 5.21.1 +### Patch Changes + +- 5c9792b: Stop the puzzle burying the background under decoys, especially on phones. + + The difficulty ladder draws `decoyCount` and `pieceScale` from a band independently — one in `samplePuzzleDifficulty`, the other in the renderer's own piece-size draw — so nothing tied how many decoys there were to how big they were. Ten decoys against a 126px piece is a different puzzle from ten against a 42px one, and a level was not monotonic in what the user actually saw: at the current bands a level-0 render could be crowded roughly seven times harder than a level-3 one. + + Touch was worse rather than better. `easePieceScaleForTouch` raises the piece-scale floor so a finger cannot hide the piece, but it left the decoy count alone — bigger decoys in the same number is strictly more crowding. At level 4 the *minimum* coverage on a touch device was 1.56x the background area, so every render was a pile of overlapping pieces no one could read. + + The decoy count is now trimmed against the piece size actually drawn, so the decoys cannot cover more of the background than a ceiling allows. Touch takes a lower ceiling than desktop, which is what makes easing for touch help instead of hurt. The cap only ever reduces the count, so no render becomes harder than the ladder intended, and a count already inside the ceiling is untouched — a render drawn near the middle of any level is unaffected and only the crowded corner is trimmed. + + The trimmed count is what gets rendered *and* what is written to `render.settings.decoyCount` on the challenge record, so a replay reproduces the puzzle the user saw. The browser renderer takes the count as an input rather than deriving it, so the node and JS paths stay in step without a change to `@prosopo/puzzle-assets`. +- 4201cf0: The provider now logs `Detector bundle assigned` with the `bundleId`, its `release` and the `detectorSessionId` every time `detector/assign` hands out a bundle. Before this nothing recorded which bundle went out, so after a harvest we could only estimate how much of the pool had leaked. + ## 5.21.0 ### Minor Changes diff --git a/packages/provider/package.json b/packages/provider/package.json index 05ae017af1..f94c90372f 100644 --- a/packages/provider/package.json +++ b/packages/provider/package.json @@ -1,6 +1,6 @@ { "name": "@prosopo/provider", - "version": "5.21.0", + "version": "5.21.1", "author": "PROSOPO LIMITED ", "license": "Apache-2.0", "type": "module", From 3785e4fed6ff16cc84ec5d28c822001f51bd78d3 Mon Sep 17 00:00:00 2001 From: "prosoponator[bot]" Date: Fri, 23 Oct 2026 15:09:18 +0000 Subject: [PATCH 2/2] chore: version bump v3.9.2 --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index f0a9acb983..63df1ba5d0 100644 --- a/package.json +++ b/package.json @@ -1,7 +1,7 @@ { "name": "@prosopo/captcha", "packageManager": "pnpm@11.27.1", - "version": "3.9.1", + "version": "3.9.2", "author": "Prosopo", "type": "module", "repository": {