Skip to content

chore!: integrate upstream login hardening and registry context fixes - #27

Merged
oglassdev merged 24 commits into
masterfrom
chore/integrate-upstream-2026-10
Oct 12, 2026
Merged

oglassdev merged 24 commits into
masterfrom
chore/integrate-upstream-2026-10

Conversation

@oglassdev

@oglassdev oglassdev commented Oct 8, 2026 •

Copy link
Copy Markdown

We were 22 commits behind upstream, including a security fix: a client could finish configuration before the server did and break spawning. This brings all of it in.

Integrates Minestom/Minestom@5485bbd50f.

How it fits the fork

Upstream's main theme was letting callers pick a Registries per instance/inventory to replace MinecraftServer.getRegistries(). Those overloads are adopted with the owning ServerProcess prepended, so the API stays in step with upstream:

  • Instance and InstanceContainer gain (ServerProcess, Registries, ...) constructors; InstanceManager.createInstanceContainer gains Registries overloads.
  • EnchantmentTableInventory can take the Registry<Enchantment> that assigns displayed IDs.
  • Copies, shared instances and chunk tag handlers follow their instance's registries.

The one difference from upstream: the constructors without a Registries argument are not deprecated. Upstream deprecates them because they fall back to the global registries; here they default to the process's registries, which is the right default.

The bug fixes riding along are kept:

  • Early config finish is kicked; a spawn failure kicks only that player.
  • Copied/shared instances keep their dimension name.
  • Enchantment table stores keys and rejects unknown enchantments.
  • Hover item components encode with the buffer's registries (via MinestomDataComponentValue).
  • World border transitions are sent in ticks.
  • Invalid item components in commands become syntax errors.

Breaking

  • RegistryKey/TagKey unsafeOf → of.
  • NetworkBuffer.IOView and upstream's other deprecated-for-removal API removed; fork's deprecated Tool (Registry, Block) overloads removed to match.
  • DamageEventPacket carries a RegistryKey<DamageType>.

Tests

Upstream tests built on the global pool/registries are dropped; their assertions are ported to process-based InstanceContainerTest and EnchantmentTableInventoryTest, which also cover explicit registries (including a dimension and an enchantment registered only in the explicit context). :test, :testing:test, and :javadoc passed locally on the integration commit; the registry-context follow-up was checked with those two test classes.

🤖 Generated with Claude Code

kermandev and others added 23 commits October 3, 2026 18:57
…3382)

Debug hive and POI values write their counts as VarInts, and debug game events write their position as doubles. DebugChunkValuePacket takes chunk x and z and packs x into the low bits of the chunk position.

DeleteChatPacket holds a packed signature, so it can delete by cache index as well as by full signature.

Minecart lerp steps pack their rotations into LP_FLOAT, and item templates write the component patch instead of every default component.

World border lerp and initialize packets carry the transition time in ticks. WorldBorder.createLerpSizePacket and createInitializePacket take ticks. (Breaking)

On the serverbound side, the change difficulty packet has no locked flag, the structure block seed is a VarLong, and beacon effects are mob effects.
Deleted by just making our own NBT reader/writer, which is likely better.

Already deprecated for removal.
* refactor: NetworkBuffer#resizableBuffer should take long

Instead of int, breaking change though I think it's fine to have a ABI incompatible one compared to a source incompatible one where it tries to pick the bridge.

* fix: update usage in jmh
Lets callers serialize components without an initialized server process.
Raw values decoded with different registry contexts compare equal.
Each enchantment table uses the registry it was created with. This likely needs to be refactored to be deferred lookup only when the property needs to be sent, so it's not a requirement to pass this, it's not like it matters so much for scratch though.
…tPacket (Minestom#3395)

The damage type ID is resolved when the packet is written.
…3396)

Pooled buffers hold no registries until a write sets them.
Bumps the non-breaking group with 3 updates: [gradle-wrapper](https://github.com/gradle/gradle), [ch.qos.logback:logback-core](https://github.com/qos-ch/logback) and [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback).


Updates `gradle-wrapper` from 9.7.1 to 9.8.0
- [Release notes](https://github.com/gradle/gradle/releases)
- [Commits](gradle/gradle@v9.7.1...v9.8.0)

Updates `ch.qos.logback:logback-core` from 1.6.3 to 1.6.5
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.6.3...v_1.6.5)

Updates `ch.qos.logback:logback-classic` from 1.6.3 to 1.6.5
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.6.3...v_1.6.5)

Updates `ch.qos.logback:logback-classic` from 1.6.3 to 1.6.5
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.6.3...v_1.6.5)

---
updated-dependencies:
- dependency-name: gradle-wrapper
  dependency-version: 9.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: non-breaking
- dependency-name: ch.qos.logback:logback-core
  dependency-version: 1.6.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: non-breaking
- dependency-name: ch.qos.logback:logback-classic
  dependency-version: 1.6.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: non-breaking
- dependency-name: ch.qos.logback:logback-classic
  dependency-version: 1.6.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: non-breaking
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
RegistryKey.of and TagKey.of replace unsafeOf. A key will become just a typed key, it was never really a proof of registration as you could simply register and unregister a entry in a dynamic registry regardless.

Drops unsafeOf as they are internal (Though I know they are used so I will include migration notes and mark this as breaking)
)

Instance and InstanceContainer constructors without a registry context are deprecated.
Integrates Minestom/Minestom@5485bbd50f.

Registries remain owned by the ServerProcess, so upstream's per-instance
Registries constructors and global-registry fallbacks are not adopted.

BREAKING CHANGE: RegistryKey/TagKey unsafeOf is renamed to of, NetworkBuffer.IOView
and other upstream APIs deprecated for removal are gone, Tool's Block overloads are
removed, and DamageEventPacket carries a damage type key.
@github-actions

github-actions Bot commented Oct 8, 2026

Copy link
Copy Markdown

Binary Compatibility

This Pull Request has introduced binary incompatible changes compared to the master branch.

What is Binary Compatibility?
Binary compatibility ensures that libraries compiled against Minestom can upgrade between versions without needing recompilation.

What should you do?

  • If unintentional, please restore the compatibility. Feel free to ask for help if you are unsure how to proceed.
  • If intentional, a maintainer will review them and label your PR as breaking, which will bypass this check. Please refer to CONTRIBUTING.md for requirements regarding breaking changes.
View offending signatures
Public/protected method removed or signature changed: net/minestom/server/entity/EntityType#registry()Ljava/lang/Object;
Public/protected method removed or signature changed: net/minestom/server/entity/VillagerProfession#registry()Ljava/lang/Object;
Public/protected method removed or signature changed: net/minestom/server/entity/VillagerProfessionImpl#registry()Ljava/lang/Object;
Public/protected method removed or signature changed: net/minestom/server/entity/attribute/Attribute#isSynced()Z
Public/protected method removed or signature changed: net/minestom/server/entity/attribute/Attribute#registry()Ljava/lang/Object;
Public/protected method removed or signature changed: net/minestom/server/game/GameEvent#registry()Ljava/lang/Object;
Public/protected method removed or signature changed: net/minestom/server/instance/block/Block#isAir()Z
Public/protected method removed or signature changed: net/minestom/server/instance/block/Block#isSolid()Z
Public/protected method removed or signature changed: net/minestom/server/instance/block/Block#isLiquid()Z
Public/protected method removed or signature changed: net/minestom/server/instance/block/Block#isFluid()Z
Public/protected method removed or signature changed: net/minestom/server/instance/block/Block#registry()Ljava/lang/Object;
Public/protected method removed or signature changed: net/minestom/server/instance/block/BlockSoundType#registry()Ljava/lang/Object;
Public/protected method removed or signature changed: net/minestom/server/instance/fluid/Fluid#registry()Ljava/lang/Object;
Public/protected method removed or signature changed: net/minestom/server/instance/gamerule/GameRule#registry()Ljava/lang/Object;
Public/protected method removed or signature changed: net/minestom/server/item/Material#isBlock()Z
Public/protected method removed or signature changed: net/minestom/server/item/Material#isArmor()Z
Public/protected method removed or signature changed: net/minestom/server/item/Material#registry()Ljava/lang/Object;
Public/protected method removed or signature changed: net/minestom/server/item/component/Tool#isCorrectForDrops(Lnet/minestom/server/registry/Registry;Lnet/minestom/server/instance/block/Block;)Z
Public/protected method removed or signature changed: net/minestom/server/item/component/Tool#getSpeed(Lnet/minestom/server/registry/Registry;Lnet/minestom/server/instance/block/Block;)F
Public/protected method removed or signature changed: net/minestom/server/network/NetworkBuffer#resizableBuffer(I)Lnet/minestom/server/network/NetworkBuffer;
Public/protected method removed or signature changed: net/minestom/server/network/packet/client/play/ClientChangeDifficultyPacket#<init>(Lnet/minestom/server/world/Difficulty;Z)V
Public/protected method removed or signature changed: net/minestom/server/network/packet/client/play/ClientChangeDifficultyPacket#locked()Z
Public/protected method removed or signature changed: net/minestom/server/network/packet/client/play/ClientSetBeaconEffectPacket#<init>(Lnet/minestom/server/potion/PotionType;Lnet/minestom/server/potion/PotionType;)V
Public/protected method removed or signature changed: net/minestom/server/network/packet/client/play/ClientSetBeaconEffectPacket#primaryEffect()Lnet/minestom/server/potion/PotionType;
Public/protected method removed or signature changed: net/minestom/server/network/packet/client/play/ClientSetBeaconEffectPacket#secondaryEffect()Lnet/minestom/server/potion/PotionType;
Public/protected method removed or signature changed: net/minestom/server/network/packet/server/play/DamageEventPacket#<init>(IIIILnet/minestom/server/coordinate/Point;)V
Public/protected method removed or signature changed: net/minestom/server/network/packet/server/play/DamageEventPacket#damageTypeId()I
Public/protected method removed or signature changed: net/minestom/server/network/packet/server/play/DamageEventPacket#sourceEntityId()I
Public/protected method removed or signature changed: net/minestom/server/network/packet/server/play/DamageEventPacket#sourceDirectId()I
Public/protected method removed or signature changed: net/minestom/server/network/packet/server/play/DebugChunkValuePacket#<init>(JLnet/minestom/server/network/debug/DebugSubscription$Update;)V
Public/protected method removed or signature changed: net/minestom/server/network/packet/server/play/DebugChunkValuePacket#chunkPos()J
Public/protected method removed or signature changed: net/minestom/server/network/packet/server/play/DeleteChatPacket#signature()Lnet/minestom/server/crypto/MessageSignature;
Public/protected method removed or signature changed: net/minestom/server/potion/PotionEffect#registry()Ljava/lang/Object;
Public/protected method removed or signature changed: net/minestom/server/registry/StaticProtocolObject#registry()Ljava/lang/Object;
Public/protected method removed or signature changed: net/minestom/server/registry/TagKey#hashCodec(Lnet/minestom/server/registry/Registries$Selector;)Lnet/minestom/server/codec/Codec;

Adopts upstream's Registries overloads on Instance, InstanceContainer,
InstanceManager and EnchantmentTableInventory, with the owning ServerProcess
prepended. The process-only constructors stay undeprecated and default to
the process's registries.

Copies, shared instances and chunk tag handlers follow the instance's
registries.
@oglassdev
oglassdev merged commit eb8f2a8 into master Oct 12, 2026
3 of 4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants