yojimbo 1.7.0 — security release (vendored dependency update)
Security
- Vendored netcode updated to 1.4.0, which fixes AEAD nonce reuse across
server restart. netcode's server global packet sequence (connection-challenge
and connection-denied packets) was seeded only on create and reset to zero on
stop, so a stopped-and-restarted server re-encrypted global packets at sequence
0, 1, 2 … under the same server-to-client key used for per-client packets — the
same key and nonce over different plaintexts, breaking the AEAD guarantees. The
global sequence is now re-seeded on server start.
(netcode #159)
If you run a restartable yojimbo dedicated server, upgrade to 1.7.0. The
wire protocol is unchanged and fully interoperable with previous releases. Full
honest accounting of the 2026 hardening work:
https://github.com/mas-bandwidth/patreon/blob/main/BUGS.md
Also in this release
- Vendored reliable updated to 1.3.5, serialize updated to 1.4.4.
- All 22 test suites pass; built and tested against the re-vendored tree before
release. - Crediting is now the expected standard: a product using yojimbo should credit
yojimbo, netcode, reliable and serialize (it ships all four) under
"Más Bandwidth LLC". The license is unchanged (BSD 3-Clause).