The counter stored one entry per addTime call, so a client sending tiny
(even empty) packets could grow it without limit while staying under the
bytes-per-second limit, eventually OOMing the proxy. Merge data points
within 1ms of the newest one so the entry count is bounded by the window
size (~7000 for the default 7s window) rather than by packet rate.
* Fix config reload not removing deleted servers
When reloading velocity.toml, unregister servers that were removed from
the config and evacuate any connected players to fallback servers.
* Requested PR fixes
* Make Expected ConnectedPlayer exceptions more detailed
Checkstyle fixed a bunch of false-negatives; linting errors in the source that should've been caught according to our settings. Rather than updating `checkstyle.xml` to work around these, this commit also properly fixes these checkstyle errors.
* Added 'ALLBUTVERSION' option for ping passthrough.
* Added more configuration options for ping passthrough.
* Updated default velocity.toml
* Add support for the legacy ping passthrough.
* Removed legacy ping passthrough & added config migration
- Bumped config-version to 2.8
- Updated comments and grammar
- Removed legacy ping passthrough in the config
* Cleaned up code to match code style
* Update to latest
* Move ping passthrough into its own section
* Reorder migrations so they occur in the right order.
* Clean up ping passthrough related code.
* Update file dates and cleanup/consolidate ping-passthrough code.
* Update proxy/src/main/java/com/velocitypowered/proxy/config/PingPassthroughMode.java
* Update proxy/src/main/java/com/velocitypowered/proxy/config/PingPassthroughMode.java
* Remaining nits
- Read a string instead of LegacyPingPassthroughMode
- Update `announce-forge`'s comment in `PingPassthroughMigration`
- Consume `Config` instead of `CommentedConfig` in `PingPassthroughMode#fromConfig`
---------
Co-authored-by: TheMiningTeamYT <loanisamazing@outlook.com>
Co-authored-by: ButterDebugger <34288129+ButterDebugger@users.noreply.github.com>
Co-authored-by: Wouter Gritter <wouter@gritter.nl>
FFM is the canonical choice for Java 22+, but it has some issues (mainly crashing the JVM on window resize), see jline/jline3#2139 and jline/jline3#2141
Downgrading to 4.0.x isn't an option as it re-introduces CVE-2026-77420..77423
Once the referenced PR gets merged and released, jline should be bumped to jline-terminal-ffm's latest version again
During configuration, a ServerboundCustomClickActionPacket arriving
when connectionInFlight is null falls through to handleGeneric, which
writes it to the connected backend without retaining. The encoder
releases the packet, then MinecraftConnection.channelRead's finally
block releases again - double-free.
Two fixes:
- handle() now uses getConnectionInFlightOrConnectedServer() so the
packet is properly retained before being written
- handleGeneric() retains any ByteBufHolder packet before write, not
just PluginMessagePacket
Closes#1841
YoyoNow
yoyosource