Migrate to lol wiki for mode balance stat overrides, add arena mode stat overrides, expected enemy build are always 6 items, enemy stats don't have runes in non-runes modes.
Replace the Meraki champion scrape with League wiki ChampionData parsing, including a new Lua table parser, Arena schema/output, and updated ARAM/Arena mode overrides. This also normalizes scraped expected builds to six non-Tear items, applies Arena stat modifiers in combat calculations, and clears enemy runes in special modes like Arena and ARAM Mayhem.
Scrape popular builds from op.gg and lolalytics.
League of Graphs answers the CI runner with a Cloudflare challenge. Those two sites return the build page.
Use the CI job token for scheduled scrape pushes.
GL_TOKEN is revoked, so the weekly job authenticated and then failed the push.
Implement more Arena and ARAM Mayhem stat augments
Warlock Juicebox, Purist Caster, Aim for the Head, Don't Blink, and Dashing, plus marking already-coded Slap Around and Tap Dancer as implemented.
Add more Arena and ARAM Mayhem augments
Item upgrades (Death's Dance, Ravenous Hydra, Sundered Sky, Sword of Blossoming Dawn, Zhonya's), Quest: Ultra Hydra with a working item icon, and several missing combat augments. Quest: Ultra Hydra now uses the same name style and tooltip as other quests.
Update Arena and ARAM Mayhem augments
Correct several augment values to match current patch notes, and add Accelerating Sorcery, Mystic Punch, Hand of Baron, Phenomenal Evil, and dragon soul augments to the picker.
Cut GitLab CI minutes: no branch-push pipelines, skip all-champions off master
Drop the install job, skip tests on data-only scrapes, prune merged branches,
and only run the full champion suite when FULL_CHAMP_TESTS=1.
fix changelog on Cloudflare Pages
lolmath.net builds with a shallow clone and no GitLab token, so fall back to a bundled commit list when git/API return too few entries.
fix changelog on GitLab Pages
Use CI_JOB_TOKEN (or GITLAB_CHANGELOG_TOKEN) for the commits API, and fall back to git log with git installed in the build image.
fix changelog page showing no commits
Read recent commits from local git instead of the GitLab API, which 404s without a token and left the page empty.
Cut build calculation time by about half
Tighter item search, skip invalid combinations sooner, and cheaper combat scoring. Recommended builds stay the same.
deps(discord): clear 15 advisories in the notification bot
The discord/ sub-project was never covered by the earlier audit pass:
running `pnpm audit` from inside it resolves the parent workspace rather
than the bot, so it silently reported the root project's results. Audited
directly it had 15 advisories (6 high, 7 moderate, 2 low), all reaching
it through discord.js.
- discord.js ^14.21.0 -> ^14.27.0, which moves its own undici floor to
^6.27.0 and clears six of the undici advisories outright.
Three transitive packages remain pinned below their fixed versions by
intermediate parents, so they are handled with overrides declared for
both bun (the notify job runtime) and pnpm:
undici ^6.28.0 (@discordjs/rest allows <6.23.0)
ws ^8.21.1 (@discordjs/ws allows <8.20.1)
lodash ^4.18.1 (@sapphire/shapeshift allows <=4.17.22)
Verified: `bun audit` and `pnpm audit` both clean in discord/; the bot
entry point still bundles cleanly against the new dependency tree.
deps(scraper): consolidate open Dependabot bumps and clear scraper audit
Supersedes the three open Dependabot PRs against /scraper, all of which
were stale against master:
#66 ajv 8.17.1 -> 8.18.0 (landed on 8.20.0)
#64 lodash 4.17.21 -> 4.17.23 (landed on 4.18.1)
#35 undici 6.21.3 -> 7.18.2 (landed on 7.29.0)
The scraper's pnpm-lock.yaml had drifted badly from package.json -- it
still pinned removed packages such as @types/cheerio and resolved undici
to 6.21.3 even though cheerio 1.1.2 requires ^7.12.0. Regenerating both
lockfiles reconciles them and picks up the bumps above.
`bun audit` additionally flagged two transitive packages whose parents
still allow vulnerable versions, neither of which Dependabot had opened
a PR for. Both are pinned via overrides, declared for bun (the scrape
runtime) and pnpm (the lockfile Dependabot tracks):
undici ^7.29.0 (cheerio allows ^7.12.0; <7.18.2 is vulnerable)
fast-uri ^3.1.5 (ajv allows ^3.0.1; <3.1.3 is vulnerable)
Verified: `bun audit` and `pnpm audit` both clean in scraper/; scraper
typecheck output is unchanged from master (the remaining cheerio
`Element` and unknown-catch errors are pre-existing).