v1.5.0 — every 1.21 version works, and the model can act

Fixes the bug that stopped players joining when CaYaDev-Check was on. If you are running 1.4.0, take this one.

Every 1.21 version works now

The registry held exactly one version — 1.21.11 — so with the login system switched on, anyone on a different client was refused with "This client version is not supported by the server's protection layer." That is every player who is not on the newest release.

Verified packet tables now ship for 1.21 through 1.21.11 (protocols 767–774), generated the only way this project accepts: each version's own server jar run through Mojang's data generator. They confirm why guessing was never an option — serverbound chat is 0x06 on protocol 767, 0x07 on 768–770 and 0x08 from 771, and clientbound system chat moves four times across the same range.

The generator ships in tools/, so a new Minecraft release is two commands rather than a code change:

python tools/generate-protocol-tables.py work-dir
python tools/apply-protocol-tables.py work-dir

What about other versions, and ViaVersion?

Ordinary players connect on any version, and always could — including anything arriving through ViaVersion or ViaBackwards. The firewall relays a connection it cannot inspect rather than refusing it.

Two things still refuse on an unverified version, and deliberately: a premium-locked name, and a password-registered name arriving from a new address. Skipping either would mean anyone could claim a protected name just by sending an odd version number — which is precisely the attack those features exist to stop. Server-wide registration is a blanket policy with no particular identity at stake, so those connections now go through and the log says what could not be enforced.

The kick message was also misleading: it read as though the whole server were version-locked. It now says other players are unaffected.

The anomaly model can act, not just warn

Choose what a repeated anomaly causes, from the Protection page:

Action	What happens
Report (default)	Written to the log, nothing else.
Score	Counts towards that address's bot score, alongside the behavioural signals.
Require re-authentication	Their next connection must log in again, even from an address they have used before.
Throttle	That address's connection limits are tightened for a while.
Ban	A real firewall ban for the configured duration.

It stays proportionate by construction. Nothing happens on a single odd session — sessions are odd for innocent reasons constantly. Nothing happens at all until the baseline has been settled for an hour, because a freshly trained model is least reliable exactly when it is newest. And every action lands on the address's next connection rather than the one just scored: the model judges a whole session, so by the time it has an opinion the session is over. The worst it can do to somebody mid-game is nothing.

Downloads

File	Use it if
MinecraftFirewall-1.5.0-setup.exe	You want it installed properly. Start here.
MinecraftFirewall-v1.5.0-win-x64.zip	You would rather unzip it somewhere and run it yourself.

Upgrading? The Protection page notices a configuration that predates newer settings and offers to add them, leaving your servers and protected usernames untouched.

503 automated tests pass. Verified against a running service: protocols 767, 771, 774 and an unknown 999 all admitted.