Mineger 1.0.2 — Security fixes

Security hardening of the host listener (remote control and webhooks). Updating is recommended for anyone who has enabled the host or a webhook. Servers and settings are kept when upgrading over 1.0.x.

Installation

Download and run Mineger_1.0.2_x64-setup.exe (or the .msi).

What changed

• Request body limits per route. /hook/{id} now accepts at most 64 KB. It has to read the body to find the token, so an unauthenticated caller could previously make the host buffer up to 1 GB per request. API routes are capped at 1 MB and the server icon at 16 MB; the 1 GB limit remains only on mod uploads.
• Constant-time token comparison for the API token and for per-webhook tokens.
• Rate limiting on failed authentication: after 20 failures within a minute from the same address the host answers 429 without evaluating the token.
• API token only in the Authorization: Bearer header. The ?token= query parameter is honoured solely on /api/ws, where browsers cannot set headers. Webhook tokens may still travel in query or body: they are per-hook, carry their own permissions, and GET-only integrations depend on it.
• CORS restricted to the Mineger webview origins instead of permissive(). Bots and the remote app are unaffected.
• Configurable listen address under Settings → Remote control → Listen on: whole network (default) or this PC only, for setups behind a tunnel or VPN on the same machine.
• Webhook statistics no longer rewrite settings.json on every request. Unauthenticated calls stay in memory; authenticated ones are coalesced (written at most every 2 s and on exit). All settings writes go through a single lock.
• Content Security Policy for the webview (was unset).
• New application icon and logo, replacing the default Tauri artwork (installers rebuilt on 2 September 2026 with the same version).

No functional changes. Full changelog: https://github.com/Zed2101/Mineger/blob/main/CHANGELOG.md

Mineger 1.0.1 — English interface

Mineger now speaks English.

Installation

Download and run Mineger_1.0.1_x64-setup.exe (or the .msi). Upgrading over 1.0.0 keeps your servers and settings.

What's new

English interface, American or British. Every string is translated — screens, buttons, error messages, progress text and the console notices the app prints itself.

The language follows your system. On first run en-US gets English (US), other English locales get English (UK), it-IT gets Italian, and anything else falls back to English. Change it any time under Settings → Language: the switch is instant, no restart, and your choice sticks from then on.

Translation completeness at a glance. Each language shows how much of it is translated. Anything a language hasn't covered falls back to English instead of showing blank text.

Settings redesigned. One card per area, a fill bar for disk usage, an active/disabled pill on remote control, Java runtimes listed with version and count, and the ESC shortcut spelled out at the bottom.

Fixed

• The delete confirmation asked for CONFERMA in English while the button only unlocked on CONFIRM — deleting a server was impossible in that language.

Want Mineger in your language?

Adding one takes a JSON file and two lines of registration — no application code:

npm run lang:new -- fr

That writes src/language/fr.json with every key ready to fill in. The full walkthrough is in the README. Automated tests reject a translation with missing keys or broken {placeholders}, so mistakes surface before release rather than in the app.

Notes

• Windows 10/11 64-bit; Java 8/17/21 depending on the Minecraft version.
• CurseForge still needs your own free API key (Settings → CurseForge key); Modrinth and FTB don't.
• The installer isn't signed: SmartScreen may warn on first run (More info → Run anyway).

Full changelog: https://github.com/Zed2101/Mineger/blob/main/CHANGELOG.md

Mineger 1.0.0

First public release of Mineger: create, run and administer your Minecraft servers from a single Windows app, no command line required.

Installation

Download and run Mineger_1.0.0_x64-setup.exe (or the .msi).

Java must be installed: 8/17/21 depending on the Minecraft version. Mineger works out which one to use on its own.

What's inside

Server creation — vanilla, Paper (for Bukkit/Spigot plugins) or modded with NeoForge, Forge or Fabric. Minecraft versions and loader builds come from the official sources, with the recommended build preselected.

Modpacks from a link — paste a CurseForge, Modrinth or FTB link and the server is ready. When an update comes out the app flags it and installs it in one click, backing up the world first and keeping your data.

Mods and plugins from the app — search and install from Modrinth and CurseForge, already filtered by your server's Minecraft version and mod loader. Every file shows where it came from and updates with a button.

Day-to-day management — console with logs, commands, CPU/RAM metrics, server.properties editor, world backups, server icon, drag & drop reordering, port opening via UPnP.

With friends — host mode lets you manage, through an invite link, the servers of whoever keeps their PC always on. Per-server webhooks let Discord bots, Twitch extensions or scripts talk to your server, each with its own permissions.

CurseForge key

Modrinth and FTB work out of the box. CurseForge requires a personal API key, free of charge: its terms of use don't allow shipping a shared key inside the app.

Generate one at console.curseforge.com and paste it under Settings → CurseForge key. Without a key everything else works normally.

Notes

• Italian interface (English arrived in 1.0.1), Windows 10/11 64-bit.
• The installer isn't signed: Windows SmartScreen may warn on first run (More info → Run anyway).
• Documentation: architecture · host API and webhooks