Silent test flaw hid cross-runtime game logic mismatch for months

·2 views

A developer building a browser version of a shipped Android game discovered that the same seed and inputs produced entirely different outcomes across the JVM and TeaVM runtimes — a score of 9 versus 6 with one build dying early. The root cause was that java.util.Random's behavior, while documented as a specific linear congruential generator, is not guaranteed to be replicated identically by foreign runtimes like TeaVM. An existing determinism test had been passing throughout, but it was structurally flawed — it ran the engine twice within the same runtime, making it incapable of detecting disagreements between runtimes. The fix took just ten minutes: replacing java.util.Random with a hand-written LCG so both builds execute identical arithmetic. The developer notes that even a golden-file test pinning one runtime's output would have been equally blind, since only a direct cross-runtime diff can expose this category of bug.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How to Handle Multipart/Form-Data File Uploads with Multer and Cloudinary

Developers working with APIs often encounter multipart/form-data, a content type that supports both file and text uploads but can trigger unexpected errors if handled incorrectly. This tutorial demonstrates how to manage image uploads in a JavaScript and ExpressJS project using two key libraries: Multer for server-side file processing and Cloudinary for cloud-based image storage. Multer is configured via its diskStorage method to define upload destinations and file naming conventions, then exported as middleware to be applied directly on the relevant API endpoints. The upload function must be placed immediately after the endpoint definition; misplacing it prevents Multer from processing incoming files. Developers can use Multer's single method for one file at a time or the array method to allow multiple simultaneous uploads.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Security Tools Shift Focus From Detecting Bugs to Automatically Fixing Them

For years, the cybersecurity industry excelled at identifying vulnerabilities but left the burden of remediation almost entirely to human engineers. Tools like Dependabot, Snyk, and GitHub Advanced Security created detailed, high-resolution views of software flaws, yet the average enterprise still carries 50 to 100 days of open critical vulnerabilities. The core problem is structural: automated scanners can generate thousands of findings in a single run, but fixes require human judgment, context, and architectural knowledge that does not scale at the same pace. A new generation of AI agents is now attempting to close that gap by not just flagging issues but reproducing bugs, writing tests, and proposing targeted patches. Unlike earlier auto-remediation attempts, these agentic systems are designed to understand code intent and codebase context, aiming to reduce false confidence from incomplete or incorrect fixes.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Google Expands Free Personalized Image Generation in Gemini to U.S. Users

Google has broadened access to personalized image generation in its Gemini app, making the feature available at no extra cost to eligible users across the United States. The capability combines Gemini's Nano Banana 2 image-generation technology with an opt-in Personal Intelligence system that draws context from connected Google services such as Photos, Gmail, YouTube, and Search. Users can make image requests using simple prompts — like 'design my dream house' — and Gemini uses their opted-in personal context to produce more relevant, tailored visuals. Google states that it does not train on users' private Google Photos libraries, and the entire personalization workflow remains opt-in, giving users control over what context is shared. The rollout currently prioritizes the Gemini mobile app, with a Gemini for Chrome desktop extension planned to follow.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

npm Blocks 2FA-Bypass Tokens from Account and Package Management Actions

As of July 31, npm has restricted granular access tokens (GATs) configured to bypass two-factor authentication from performing account and package management tasks. These tokens can no longer create or delete other tokens, modify maintainer lists, change package access settings, or manage organisation membership without an interactive 2FA challenge. The change is designed to limit the damage from a leaked bypass token, which previously could be used to take over an account entirely. GitHub, which owns npm, recommends teams migrate automated publishing workflows to OIDC-based trusted publishing to eliminate long-lived credentials altogether. The registry has also signalled that bypass-2FA tokens will lose direct publish rights by January 2027, continuing a broader push away from bearer tokens.

0 comments Read more at DEV Community