[JuliusHenke]

Requested by ju · project thread

Prepares the 4.0.0 release: tests the changes since v3.0.0, fixes the bugs found while doing so and bumps the version in backend/build.gradle.kts and frontend/package.json to 4.0.0.

Bug fixes

• Cached relay locations after family computation (backend): families are computed asynchronously since the coalescing refactor, but the cache of relay locations was refreshed (recent server descriptors) or evicted (archive, daily family job) right away. Requests then cached the previous family IDs again. computeFamilies now returns a future and the cache is updated once it completes, also if a month failed.
• Guard weight (backend): non-Guard relays got Wgm, so exits and middles had a guard weight. Clients only pick Guard flagged relays as guards, and a BadExit doesn't count as exit (Wgd), as in Tor's compute_weighted_bandwidths. Nothing reads guard_weight yet, but rows stored by :edge builds keep the old values for non-Guard relays.
• Unknown relay flags (backend): one flag missing from TorRelayFlag (e.g. MiddleOnly) made the relay lose all flags. Unknown flags are now skipped and the known ones kept.
• Request character encoding (backend): an unknown charset in the request made getReader() throw UnsupportedCharsetException instead of the servlet API's UnsupportedEncodingException.
• Timeline keyboard (frontend): pressing space on an outlier day also scrolled the page.

Tests and coverage

• Backend: adds the jacoco Gradle plugin (./gradlew test jacocoTestReport, vendored org.torproject excluded). Line coverage went from 75% to 97% (129 → 183 tests). New tests cover family computation, descriptor file reading and processed file references, server descriptor processing, collection failures, the daily counts endpoint, admin user creation, CORS origins, the request body limit stream, the reverse DNS address filter and failures, IP lookup ranges, CSV import edge cases and the scheduled jobs.
• Two small refactors for testability, with no change in behavior: the admin user creation in SecurityConfig moved into buildUserDetailsService(...), and isPubliclyRoutable became a top-level internal function.
• Frontend: lines went from 95.8% to 97.3% (326 → 346 tests). New tests cover the date picker (calendar, typing, disabled days, blur reset), date slider keyboard, timeline keyboard/gaps/labels, heat layer (defaults, resize, zoom animation, re-adding) and country usage drawing.

Housekeeping

• Removes committed .DS_Store files (already ignored).

Dependency vetting (JaCoCo 0.8.15, org.jacoco.agent / org.jacoco.ant)

• deps.dev: published 2026-06-04, EPL-2.0, not deprecated, no advisories.
• OpenSourceMalware: no report (malicious: false).
• Snyk (snykTest, snykCode) was not run because the CLI isn't authenticated in this environment. The Snyk PR checks still apply.

Verification

• ./gradlew test jacocoTestReport: 183 tests pass.
• yarn build, yarn lint, yarn test:coverage: pass, 346 tests.

---

Generated by Claude Code

[JuliusHenke]

code/snyk (JuliusHenke) errored with "Code test limit reached". That's the Snyk account's Code test quota, not a finding in this PR's diff, so there's nothing to fix from here. It will need to be re-run once the quota resets, or SAST run locally with an authenticated CLI (./gradlew snykCode, yarn snyk:code). I can't re-run this status myself.

---

Generated by Claude Code

[github-actions]

Visit the preview URL for this PR (updated for commit 3fd0c47):

https://tormap-36f44--pr628-claude-project-threa-k0f85ng3.web.app

_{(expires Thu, 19 Nov 2026 09:58:32 GMT)}

_{🔥 via Firebase Hosting GitHub Action 🌎}

_{Sign: 0c1f71965de18e60b0e686b0d0356977fec090dc}