0.28.0

Lightyear 0.28.0

This release updates Lightyear to the Bevy 0.19 ecosystem and focuses on input hardening, input authorization hooks, and replication simplification.

Highlights

• Updated the dependency stack for Bevy 0.19, including Aeronet 0.21, Bevy Replicon 0.41, Avian 0.7, Bevy Enhanced Input 0.26, Leafwing Input Manager 0.21, and Rust 1.95.
• Simplified bevy enhanced input replication (you just have to spawn the Action entities on the server and replicate them to the client)
• Hardened input handling by bounding future input tick ranges and adding server-side validation/authorization hooks. Thanks to @mmannerm
• Simplified replication internals: resources are replicated like any other component, so there is no need for special-case logic for then.
• Enable handling diff-compressed components. Instead of replicating the full component state, only the delta between two states is replicated. This can be useful for components that store a Vec

What's Changed

• chore(deps): bump actions/checkout from 6 to 7 by @dependabot[bot] in #1518
• fix(inputs): bound InputMessage end_tick lookahead (DoS) by @mmannerm in #1525
• chore: upgrade deps to 0.19 by @cBournhonesque in #1532
• Simplify CatchUpGated catch-up activation by @cBournhonesque in #1527
• Enable diff-compnents by @cBournhonesque in #1517
• fix(inputs): only buffer inputs after timeline sync by @cBournhonesque in #1534
• feat(inputs): server-side input-validation seam (ValidateInputs) by @mmannerm in #1535
• Simplify resource replication by @cBournhonesque in #1536
• feat(inputs): opt-in authorize_controlled_targets helper (spoofed-target defense) by @mmannerm in #1526
• fix(inputs): simplify BEI input replication by @cBournhonesque in #1537

Full Changelog: 0.27.0...0.28.0