Skip to content

MC Startup Script v2.3.2

Choose a tag to compare

View all tags
@GarnServo GarnServo released this 29 Aug 11:04
· 4 commits to main since this release
v2.3.2
9040416
This commit was signed with the committer’s verified signature.
GarnServo Garn Servo
SSH Key Fingerprint: /pwSsZuBwOlmpAvmZNWkich/xQNy7v5YEmd0549bI2w
Verified
Learn about vigilant mode.

What's New

  • Added SHA256 checksum verification for self-updates, checked when a release publishes .sha256 files alongside START.bat/core.ps1, before anything is installed.
  • Added explicit TLS 1.2 pinning for all network calls instead of relying on the host's default protocol negotiation.
  • Added format validation for the release version tag before it's used anywhere a shell or generated script could reinterpret it.
  • Added control-character stripping to release notes before they're displayed, so a crafted release description can't manipulate terminal output.
  • Added a warning at setup time that a configured Discord webhook URL is a credential, not just a setting, since anyone who reads it can post to that channel.
  • Rewrote the self-updater to pass every URL as a bound script parameter instead of interpolating it into a generated command string, removing an entire class of quoting/injection risk.
  • Switched START.bat's first-run download from re-encoded text to a raw byte-for-byte fetch, which checksum verification depends on to actually match.
  • Added a JVM flags step to setup: calculated tuning, your own pasted flags, or no extra flags at all.
  • Added automatic GC selection between G1GC and generational ZGC, based on detected Java version, allocated RAM, CPU core count, and total system memory headroom.
  • Added a modded-workload flag variant (larger young generation and region size) applied automatically for Forge/NeoForge/Fabric servers.
  • Added correct handling of Java 24+, where generational ZGC is the only mode and the older opt-in flag is no longer used.
  • Added the active garbage collector to the server status dashboard.
  • Added the JVM flags choice to the setup review summary.

Improvements

  • Corrected the first-run bootstrap URL, which pointed at a repository path that was never populated and caused fresh installs to fail outright.
  • Clearer failure messaging when an update can't be verified or installed.
  • Config schema updated to reflect that no-extra-flags is now an explicit choice rather than a silently-applied default.

Upgrade Notes

Configuration format changed. Existing installs are walked through setup again on next launch so JVM tuning becomes an explicit choice rather than changing silently. Server data, worlds, and jars are untouched. If you maintain your own fork or release pipeline, publishing START.bat.sha256 and core.ps1.sha256 alongside each release is optional but enables the new checksum-verification step.

NOTE: You only need to download START.bat - the PowerShell core will automatically download itself.

Assets 4
Loading