From 1015874f7cee443c3df3f9b547fa8f159dbec19d Mon Sep 17 00:00:00 2001
From: Alexander Petric <alpetric@users.noreply.github.com>
Date: Fri, 18 Sep 2026 08:35:23 -0400
Subject: [PATCH] install the multiplayer server from its lockfile (#11190)

DockerfileExtra copied multiplayer/package.json alone and ran `npm install`,
so the image shipped whatever npm resolved at build time and the committed
multiplayer/package-lock.json described nothing that ran in production:
Dependabot alerts on it were meaningless either way. Copy the lockfile and
install with `npm ci --omit=dev` so the image is reproducible and the lock is
the source of truth for what ships.

The lock is refreshed with `npm update <dep>` per direct dependency, which
moves each to the newest version inside its existing caret range without
touching package.json. That is exactly what a lockfile-less `npm install`
resolves today (verified: a fresh `npm install --package-lock-only` from the
same package.json produces identical versions), so the image does not regress:

  ws           8.19.0  -> 8.21.3  (covers the open alerts on ws < 8.21.0)
  y-websocket  3.0.0   -> 3.1.0
  yjs          13.6.29 -> 13.6.32
  lib0 0.2.117, y-protocols 1.0.7, isomorphic.js 0.2.5 unchanged

package.json has no devDependencies and the lock has no `dev: true` entries,
so `--omit=dev` changes nothing today and only guards against future ones.

Validation:
- `npm ci` on the pre-update lock and `npm ci --omit=dev` on the updated lock
  both succeed; `node --check server.mjs gateway.mjs` passes.
- Smoke start: server.mjs listens on PORT=3999 and logs "Multiplayer server
  running"; gateway.mjs listens on PORT=3998 and logs its route table.
- The same COPY/RUN lines built on node:22-slim with the repo root as build
  context (the context build-extra-image.yml uses) install the six locked
  packages and pass `node --check`. A full DockerfileExtra build was skipped:
  it is a single stage on an uncached multi-GB base image.

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
---
 docker/DockerfileExtra        |  3 ++-
 multiplayer/package-lock.json | 18 +++++++++---------
 2 files changed, 11 insertions(+), 10 deletions(-)

diff --git a/docker/DockerfileExtra b/docker/DockerfileExtra
index 9eb2a987f2..8aa24206a4 100644
--- a/docker/DockerfileExtra
+++ b/docker/DockerfileExtra
@@ -110,11 +110,12 @@ WORKDIR /multiplayer
 
 # Copy multiplayer server files
 COPY multiplayer/package.json .
+COPY multiplayer/package-lock.json .
 COPY multiplayer/server.mjs .
 COPY multiplayer/gateway.mjs .
 
 # Install dependencies
-RUN npm install
+RUN npm ci --omit=dev
 
 # ============================================================================
 # Entrypoint Setup
diff --git a/multiplayer/package-lock.json b/multiplayer/package-lock.json
index 0d8c1985ce..532dbd226e 100644
--- a/multiplayer/package-lock.json
+++ b/multiplayer/package-lock.json
@@ -47,9 +47,9 @@
       }
     },
     "node_modules/ws": {
-      "version": "8.19.0",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-8.19.0.tgz",
-      "integrity": "sha512-blAT2mjOEIi0ZzruJfIhb3nps74PRWTCz1IjglWEEpQl5XS/UNama6u2/rjFkDDouqr4L67ry+1aGIALViWjDg==",
+      "version": "8.21.3",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.3.tgz",
+      "integrity": "sha512-201TZ/kPWxoPr/OKWjquZR1SWKXcvxdH+e1xrx89b3YbmzLMFCLfnaG1HFIgWzJOEWZ7MvpK++odZufgYR50Rw==",
       "license": "MIT",
       "engines": {
         "node": ">=10.0.0"
@@ -88,9 +88,9 @@
       }
     },
     "node_modules/y-websocket": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/y-websocket/-/y-websocket-3.0.0.tgz",
-      "integrity": "sha512-mUHy7AzkOZ834T/7piqtlA8Yk6AchqKqcrCXjKW8J1w2lPtRDjz8W5/CvXz9higKAHgKRKqpI3T33YkRFLkPtg==",
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/y-websocket/-/y-websocket-3.1.0.tgz",
+      "integrity": "sha512-ZNzwH84Ysxv7zjpFNZHjTJvrBZgcAqMljTe+6zrWciAML9LQ18aVylyPNH9faxCXqEOV8I0JY4TGtrIHFX+Xwg==",
       "license": "MIT",
       "dependencies": {
         "lib0": "^0.2.102",
@@ -109,9 +109,9 @@
       }
     },
     "node_modules/yjs": {
-      "version": "13.6.29",
-      "resolved": "https://registry.npmjs.org/yjs/-/yjs-13.6.29.tgz",
-      "integrity": "sha512-kHqDPdltoXH+X4w1lVmMtddE3Oeqq48nM40FD5ojTd8xYhQpzIDcfE2keMSU5bAgRPJBe225WTUdyUgj1DtbiQ==",
+      "version": "13.6.32",
+      "resolved": "https://registry.npmjs.org/yjs/-/yjs-13.6.32.tgz",
+      "integrity": "sha512-lfiJIIC4Xayt5ItynE407ehlE03pCjeOc4hkR4yxxvvNJ4kuiN25B0g+Qp8XagYz361LLL7DCzR5bvFJ81QKtQ==",
       "license": "MIT",
       "dependencies": {
         "lib0": "^0.2.99"