Skip to main content
​

​
Improvements

Challenge token construction versionEvery challenge token now embeds a construction version (v: 1) that pins how the solution is computed. verifySolution rejects tokens with an unknown future version as invalid-token, and the solvers return undefined instead of solving under wrong assumptions. Tokens issued before this release (no v field) are treated as version 1 and still verify, so no action is needed.Argon2id profile tiers clarifiedThe 'mobile' and 'standard' values of argonProfile currently share the same conservative tuning. Pick the tier that matches your audience now; because each token embeds its own parameters and version, future retuning cannot break in-flight tokens.

​
Fixes

  • Argon2id salt entropy. Challenge strings now carry 16 random bytes (128 bits) of entropy, and the Argon2id salt is derived from the full-entropy challenge instead of a shorter zero-padded value. Tokens issued before this fix still verify during their TTL window.
​

​
New

Argon2id memory-hard proof-of-work (opt-in)createChallenge accepts a new algorithm: 'argon2id' option alongside the default sha256. Argon2id is memory-hard, which raises the cost of solving challenges on GPUs and custom hardware. Pick a memory preset with argonProfile ('mobile' or 'standard') instead of raw memory parameters, and Ribaunt enforces hard upper bounds on them. SHA-256 stays the default, so existing setups are unaffected.solveChallengeAsyncA new async solver handles both sha256 and argon2id tokens, detecting the algorithm from each token automatically. The sync solveChallenge remains SHA-256 only and returns undefined for Argon2id tokens.Argon2id calibration helpersNew calibrateArgonNode and calibrateArgonBrowser functions (with a calibrateArgonClient alias) mirror the existing calibrators for device-aware difficulty: "auto" scaling with Argon2id. Use the calibrator that matches your algorithm.

​
Improvements

  • selectWorkload and assess accept algorithm and argonProfile, with per-algorithm difficulty bounds and defaults.
  • verifySolution and the widget detect the algorithm from each token, so no extra configuration is needed on either side.
  • The solver-backend event can now report argon2id in addition to wasm and js.

​
Fixes

  • The widget’s WebAssembly solver now validates the fetched binary before using it. Dev servers with SPA fallbacks (such as Vite) that answer the WASM request with an HTML page no longer break solving; the widget falls back to the JavaScript solver instead.
​

​
New

WebAssembly solver with automatic fallbackThe widget’s solver worker now includes a WebAssembly-backed SHA-256 batch solver for faster proof-of-work solving. It is enabled by default and falls back to the JavaScript solver automatically when WebAssembly is unavailable, so no changes are required. Control it with the new wasm-mode attribute (wasmMode prop in React), which is independent from worker-mode.solver-backend eventThe widget emits a new solver-backend event reporting whether the worker solved with the wasm or js backend. Use it for telemetry or to verify your configuration. The React wrapper’s onEvent catch-all also receives it.
​

​
New

Distinct failure reason for replay-store outagesverifySolution now reports replay-store-unavailable when the replay store cannot be reached, instead of masking outages as invalid-token. You can distinguish infrastructure problems from bad tokens and alert on them separately. See VerifyFailureReason.Machine-readable widget error codesThe widget’s error event now includes a WidgetErrorCode, so you can branch on the failure cause programmatically instead of parsing error messages. See Widget events.Widget types exportedThe widget entry points now export RibauntWidgetElement, WidgetState, and related types, giving you fully typed refs and event handlers in React and Vue.

​
Improvements

Faster, smoother solvingThe solver now yields between batches without the browser’s 4ms timer clamp, so solves finish faster while the page stays responsive. Importing the widget bundle in Node scripts no longer keeps the process alive after your code finishes.Better React prop handlingThe React wrapper live-syncs standard HTML props (such as class and disabled) across re-renders, including prop removal, and binds handlers like onClick and onKeyDown as native listeners. See React integration.Snappier keyboard activationThe widget checkbox responds on key press instead of key release, and warns once if it receives an unrecognized worker-mode value. See Widget configuration.

​
Fixes

  • showProgress={false} on the React component now correctly switches to the bars loader. Omitting the prop restores the default progress ring. See Secondary loader.