netcode 1.4.0 — security release

netcode 1.4.0 — security release

Security fix

• AEAD nonce reuse across server restart (found while porting netcode to Rust).
  The server's global packet sequence number (used for connection-challenge and
  connection-denied packets) was seeded only in netcode_server_create and reset
  to zero by netcode_server_stop. A server that was stopped and restarted would
  re-encrypt global packets at sequence 0, 1, 2 … under the same server-to-client
  key it uses for per-client packets, the same key and nonce over different
  plaintexts, which breaks the AEAD security guarantees. The global sequence is
  now re-seeded on netcode_server_start, not just on create.
  (#159)

If you run a long-lived or restartable netcode server, upgrade to 1.4.0. The
wire protocol is unchanged and fully interoperable with previous releases and the
other language ports. Full honest accounting of the 2026 hardening work:
https://github.com/mas-bandwidth/patreon/blob/main/BUGS.md

Also in this release

• Crediting is now the expected standard: if you ship a product using netcode,
  credit "netcode — Glenn Fiedler" under "Más Bandwidth LLC" in your product
  credits. The license is unchanged (BSD 3-Clause); this is an official request.
• The license file is renamed LICENCE to LICENSE (American spelling; content
  unchanged).