ВЕРСИИ (48)

### Fixed - Skin update events now bypass the short-lived selected-skin cache, so changed skins are fetched immediately instead of waiting for the cache to expire. - Force-refresh events received during an active fetch are coalesced into a follow-up fetch; late responses can no longer restore stale cached selections.

### Fixed - Skin update events now bypass the short-lived selected-skin cache, so changed skins are fetched immediately instead of waiting for the cache to expire. - Force-refresh events received during an active fetch are coalesced into a follow-up fetch; late responses can no longer restore stale cached selections.

### Fixed - Skin update events now bypass the short-lived selected-skin cache, so changed skins are fetched immediately instead of waiting for the cache to expire. - Force-refresh events received during an active fetch are coalesced into a follow-up fetch; late responses can no longer restore stale cached selections.

### Fixed - Skin update events now bypass the short-lived selected-skin cache, so changed skins are fetched immediately instead of waiting for the cache to expire. - Force-refresh events received during an active fetch are coalesced into a follow-up fetch; late responses can no longer restore stale cached selections.

### Fixed - Fixed the Myopia settings category so it can be expanded and its controls respond to clicks. - Fixed the Request Signing Key row label and reset button, and hide its input when General is collapsed.

### Fixed - Fixed the Myopia settings category so it can be expanded and its controls respond to clicks. - Fixed the Request Signing Key row label and reset button, and hide its input when General is collapsed.

### Added - **WebSocket client** using native `java.net.http.WebSocket` (Java 11+) for high-performance real-time skin sync. - **Automatic protocol negotiation** — client sends `x-catskinc-protocol: 3` header on WebSocket handshake. - **Resilient connection management**: - Exponential backoff reconnection (1.5s → 60s max). - Shared circuit breaker across REST, SSE, and WebSocket (unified failure tracking). - Automatic fallback to SSE when WebSocket fails or protocol is unsupported. - **Session-token authentication** on WebSocket with auto-subscription to local player UUID. - **Protocol version verification** in welcome message — closes connection on mismatch. - **In-game toast notifications** for WebSocket-originated events (skin updates, server messages). - **Myopia skin LOD** for CatSkinC-managed remote skins. When enabled, distant players use lazily cached, pixel-perfect half, quarter, or eighth-resolution copies while GUI, inventory, and tab-list skins retain full resolution. - A Myopia settings screen with an enabled toggle, a 4–128 block base-distance control, Normal and Panicked modes, and links to Minecraft's keybinding menu. - Default keybindings for increasing and decreasing the Myopia range with the Up and Down arrow keys. All settings are persisted in `catskinc.json`. ### Changed - **Join flow** now attempts WebSocket first, falls back to SSE on failure. - **Shared circuit breaker state** between `ServerApiClient` and `WebSocketClient` — REST/SSE/WS failures all contribute to the same breaker. - **Heartbeat handling** — application-level JSON ping/pong (30s) replaces binary WebSocket ping frames for consistency. ### Fixed - **Broadcast framing** — WebSocket clients now receive raw JSON (SSE `data: ` prefix stripped server-side). - **Handshake protocol header** — added `X-CatSkinC-Protocol` to WebSocket upgrade request. - **Auth race** — session token acquired synchronously before WebSocket connection attempt. - **Protocol defense** — client verifies `protocol_version` in welcome message, closes on mismatch. - **Fallback trigger** — SSE fallback now activates on abnormal post-connect disconnections, not just initial connect failure. - **Toast handler** — implemented proper `Toasts.info()` with translatable titles. - **Select-Fetch race eliminated**: `selectSkin()` now chains `thenRun(refresh)` so the POST completes before the GET, eliminating the 4-8s skin delay after upload. - **Pending selections cache**: `PENDING_SELECTIONS` returns the uploaded skin URL immediately after select, avoiding old-skin flashing. - **LAST_CHECK on success only**: failed fetches no longer reset the 5s poll timer, preventing a 15s blackout window. - **Fast-retry after null skin**: retries fetch in 2s when the server has no cached skin yet, reducing initial sync from 15s to 2s. - **Poll interval reduced**: 15s → 5s for faster periodic sync. - **SSE clear-skin handling**: clears `BASE_CACHE`/`TALKING_CACHE` on null URL, so players properly revert to the default skin. - **SSE reconnect delay**: added 1.5s–60s exponential backoff on stream close (was instant reconnect), preventing server flooding. - **Circuit breaker in SSE**: SSE checks `circuitOpenUntilMs` before connecting, eliminating useless retries during outage. - **AtomicInteger**: `consecutiveFailures` switched to `AtomicInteger` for correct failure counting. - **Always destroy old textures**: removed identity check gate on texture release to prevent GPU memory leaks. - **Fixed HTTP 401 on skin downloads**: Added `signDownloadUrl()` method that appends `?exp=&sig=` HMAC-signed query parameters to download URLs using the client's `requestSigningKey`. This matches the server's `verify_download_signature()` check when `ENFORCE_SIGNED_DOWNLOADS=true`. - **Replaced per-player TextureManager registrations with a single shared dynamic texture**: CatSkinC no longer registers per-player textures with the vanilla `TextureManager`. Downloaded `NativeImage` objects are cached and pixel-copied into one shared `catskinc:dynamic/active` texture on each render frame. This prevents F3+S debug dumps from saving every player's skin to disk. - **Security**: **Request signing** (HMAC-SHA256) applied to WebSocket upgrade request. - **Hardened transitive dependencies against Dependabot advisories.** Added `resolutionStrategy { force ... }` constraints in `build.gradle` to pin patched versions of vulnerable transitive libraries on both the project and buildscript classpaths: - Netty → `4.1.136.Final` (fixes GHSA-558v-64gr-wgg4 Bzip2Decoder infinite loop and related netty advisories). - Log4j → `2.25.4` (fixes Log4j TLS hostname verification, XML escaping, and related advisories). - Guava → `32.0.0-jre` (fixes temp-dir and information-disclosure advisories). - Commons IO → `2.16.1`, Commons Compress → `1.26.0`, Commons Lang3 → `3.18.0`. - Buildscript classpath: Commons Text → `1.12.0`, Commons Beanutils → `1.11.0`, Plexus Utils → `3.6.1`. - These libraries are Minecraft-provided runtime/build-tooling dependencies and are **not bundled** into the shipped mod JAR, so the end-user artifact is unaffected; the constraints keep the dev runtime and CI dependency graph clean.

### Added - **WebSocket client** using native `java.net.http.WebSocket` (Java 11+) for high-performance real-time skin sync. - **Automatic protocol negotiation** — client sends `x-catskinc-protocol: 3` header on WebSocket handshake. - **Resilient connection management**: - Exponential backoff reconnection (1.5s → 60s max). - Shared circuit breaker across REST, SSE, and WebSocket (unified failure tracking). - Automatic fallback to SSE when WebSocket fails or protocol is unsupported. - **Session-token authentication** on WebSocket with auto-subscription to local player UUID. - **Protocol version verification** in welcome message — closes connection on mismatch. - **In-game toast notifications** for WebSocket-originated events (skin updates, server messages). - **Myopia skin LOD** for CatSkinC-managed remote skins. When enabled, distant players use lazily cached, pixel-perfect half, quarter, or eighth-resolution copies while GUI, inventory, and tab-list skins retain full resolution. - A Myopia settings screen with an enabled toggle, a 4–128 block base-distance control, Normal and Panicked modes, and links to Minecraft's keybinding menu. - Default keybindings for increasing and decreasing the Myopia range with the Up and Down arrow keys. All settings are persisted in `catskinc.json`. ### Changed - **Join flow** now attempts WebSocket first, falls back to SSE on failure. - **Shared circuit breaker state** between `ServerApiClient` and `WebSocketClient` — REST/SSE/WS failures all contribute to the same breaker. - **Heartbeat handling** — application-level JSON ping/pong (30s) replaces binary WebSocket ping frames for consistency. ### Fixed - **Broadcast framing** — WebSocket clients now receive raw JSON (SSE `data: ` prefix stripped server-side). - **Handshake protocol header** — added `X-CatSkinC-Protocol` to WebSocket upgrade request. - **Auth race** — session token acquired synchronously before WebSocket connection attempt. - **Protocol defense** — client verifies `protocol_version` in welcome message, closes on mismatch. - **Fallback trigger** — SSE fallback now activates on abnormal post-connect disconnections, not just initial connect failure. - **Toast handler** — implemented proper `Toasts.info()` with translatable titles. - **Select-Fetch race eliminated**: `selectSkin()` now chains `thenRun(refresh)` so the POST completes before the GET, eliminating the 4-8s skin delay after upload. - **Pending selections cache**: `PENDING_SELECTIONS` returns the uploaded skin URL immediately after select, avoiding old-skin flashing. - **LAST_CHECK on success only**: failed fetches no longer reset the 5s poll timer, preventing a 15s blackout window. - **Fast-retry after null skin**: retries fetch in 2s when the server has no cached skin yet, reducing initial sync from 15s to 2s. - **Poll interval reduced**: 15s → 5s for faster periodic sync. - **SSE clear-skin handling**: clears `BASE_CACHE`/`TALKING_CACHE` on null URL, so players properly revert to the default skin. - **SSE reconnect delay**: added 1.5s–60s exponential backoff on stream close (was instant reconnect), preventing server flooding. - **Circuit breaker in SSE**: SSE checks `circuitOpenUntilMs` before connecting, eliminating useless retries during outage. - **AtomicInteger**: `consecutiveFailures` switched to `AtomicInteger` for correct failure counting. - **Always destroy old textures**: removed identity check gate on texture release to prevent GPU memory leaks. - **Fixed HTTP 401 on skin downloads**: Added `signDownloadUrl()` method that appends `?exp=&sig=` HMAC-signed query parameters to download URLs using the client's `requestSigningKey`. This matches the server's `verify_download_signature()` check when `ENFORCE_SIGNED_DOWNLOADS=true`. - **Replaced per-player TextureManager registrations with a single shared dynamic texture**: CatSkinC no longer registers per-player textures with the vanilla `TextureManager`. Downloaded `NativeImage` objects are cached and pixel-copied into one shared `catskinc:dynamic/active` texture on each render frame. This prevents F3+S debug dumps from saving every player's skin to disk. - **Security**: **Request signing** (HMAC-SHA256) applied to WebSocket upgrade request. - **Hardened transitive dependencies against Dependabot advisories.** Added `resolutionStrategy { force ... }` constraints in `build.gradle` to pin patched versions of vulnerable transitive libraries on both the project and buildscript classpaths: - Netty → `4.1.136.Final` (fixes GHSA-558v-64gr-wgg4 Bzip2Decoder infinite loop and related netty advisories). - Log4j → `2.25.4` (fixes Log4j TLS hostname verification, XML escaping, and related advisories). - Guava → `32.0.0-jre` (fixes temp-dir and information-disclosure advisories). - Commons IO → `2.16.1`, Commons Compress → `1.26.0`, Commons Lang3 → `3.18.0`. - Buildscript classpath: Commons Text → `1.12.0`, Commons Beanutils → `1.11.0`, Plexus Utils → `3.6.1`. - These libraries are Minecraft-provided runtime/build-tooling dependencies and are **not bundled** into the shipped mod JAR, so the end-user artifact is unaffected; the constraints keep the dev runtime and CI dependency graph clean.

### Added - **Myopia skin LOD** for CatSkinC-managed remote skins. When enabled, distant players use lazily cached, pixel-perfect half, quarter, or eighth-resolution copies while GUI, inventory, and tab-list skins retain full resolution. - A Myopia settings screen with an enabled toggle, a 4–128 block base-distance control, Normal and Panicked modes, and links to Minecraft's keybinding menu. - Default keybindings for increasing and decreasing the Myopia range with the Up and Down arrow keys. All settings are persisted in `catskinc.json`. - **WebSocket client** using native `java.net.http.WebSocket` (Java 11+) for high-performance real-time skin sync. - **Automatic protocol negotiation** — client sends `x-catskinc-protocol: 3` header on WebSocket handshake. - **Resilient connection management**: - Exponential backoff reconnection (1.5s → 60s max). - Shared circuit breaker across REST, SSE, and WebSocket (unified failure tracking). - Automatic fallback to SSE when WebSocket fails or protocol is unsupported. - **Session-token authentication** on WebSocket with auto-subscription to local player UUID. - **Protocol version verification** in welcome message — closes connection on mismatch. - **In-game toast notifications** for WebSocket-originated events (skin updates, server messages). ### Changed - **Join flow** now attempts WebSocket first, falls back to SSE on failure. - **Shared circuit breaker state** between `ServerApiClient` and `WebSocketClient` — REST/SSE/WS failures all contribute to the same breaker. - **Heartbeat handling** — application-level JSON ping/pong (30s) replaces binary WebSocket ping frames for consistency. - **Managed-skin texture cleanup** now also releases all associated Myopia GPU textures and resets per-player LOD state. ### Fixed - **Broadcast framing** — WebSocket clients now receive raw JSON (SSE `data: ` prefix stripped server-side). - **Handshake protocol header** — added `X-CatSkinC-Protocol` to WebSocket upgrade request. - **Auth race** — session token acquired synchronously before WebSocket connection attempt. - **Protocol defense** — client verifies `protocol_version` in welcome message, closes on mismatch. - **Fallback trigger** — SSE fallback now activates on abnormal post-connect disconnections, not just initial connect failure. - **Toast handler** — implemented proper `Toasts.info()` with translatable titles. - **Select-Fetch race eliminated**: `selectSkin()` now chains `thenRun(refresh)` so the POST completes before the GET, eliminating the 4-8s skin delay after upload. - **Pending selections cache**: `PENDING_SELECTIONS` returns the uploaded skin URL immediately after select, avoiding old-skin flashing. - **LAST_CHECK on success only**: failed fetches no longer reset the 5s poll timer, preventing a 15s blackout window. - **Fast-retry after null skin**: retries fetch in 2s when the server has no cached skin yet, reducing initial sync from 15s to 2s. - **Poll interval reduced**: 15s → 5s for faster periodic sync. - **SSE clear-skin handling**: clears `BASE_CACHE`/`TALKING_CACHE` on null URL, so players properly revert to the default skin. - **SSE reconnect delay**: added 1.5s–60s exponential backoff on stream close (was instant reconnect), preventing server flooding. - **Circuit breaker in SSE**: SSE checks `circuitOpenUntilMs` before connecting, eliminating useless retries during outage. - **AtomicInteger**: `consecutiveFailures` switched to `AtomicInteger` for correct failure counting. - **Always destroy old textures**: removed identity check gate on texture release to prevent GPU memory leaks. - **Fixed HTTP 401 on skin downloads**: Added `signDownloadUrl()` method that appends `?exp=&sig=` HMAC-signed query parameters to download URLs using the client's `requestSigningKey`. This matches the server's `verify_download_signature()` check when `ENFORCE_SIGNED_DOWNLOADS=true`. - **Replaced per-player TextureManager registrations with a single shared dynamic texture**: CatSkinC no longer registers per-player textures (`catskinc:remote/<uuid>`) with the vanilla `TextureManager`. Instead, downloaded `NativeImage` objects are cached in `SKIN_IMAGES` and pixel-copied into one shared `catskinc:dynamic/active` texture on each render frame. This prevents F3+S debug dumps from saving every player's skin to disk. - **Broadcast framing** — WebSocket clients now receive raw JSON (SSE `data: ` prefix stripped server-side). - **Handshake protocol header** — added `X-CatSkinC-Protocol` to WebSocket upgrade request. - **Auth race** — session token acquired synchronously before WebSocket connection attempt. - **Protocol defense** — client verifies `protocol_version` in welcome message, closes on mismatch. - **Fallback trigger** — SSE fallback now activates on abnormal post-connect disconnections, not just initial connect failure. - **Toast handler** — implemented proper `Toasts.info()` with translatable titles. - **Select-Fetch race eliminated**: `selectSkin()` now chains `thenRun(refresh)` so the POST completes before the GET, eliminating the 4-8s skin delay after upload. - **Pending selections cache**: `PENDING_SELECTIONS` returns the uploaded skin URL immediately after select, avoiding old-skin flashing. - **LAST_CHECK on success only**: failed fetches no longer reset the 5s poll timer, preventing a 15s blackout window. - **Fast-retry after null skin**: retries fetch in 2s when the server has no cached skin yet, reducing initial sync from 15s to 2s. - **Poll interval reduced**: 15s → 5s for faster periodic sync. - **SSE clear-skin handling**: clears `BASE_CACHE`/`TALKING_CACHE` on null URL, so players properly revert to the default skin. - **SSE reconnect delay**: added 1.5s–60s exponential backoff on stream close (was instant reconnect), preventing server flooding. - **Circuit breaker in SSE**: SSE checks `circuitOpenUntilMs` before connecting, eliminating useless retries during outage. - **AtomicInteger**: `consecutiveFailures` switched to `AtomicInteger` for correct failure counting. - **Always destroy old textures**: removed identity check gate on texture release to prevent GPU memory leaks. - **Fixed HTTP 401 on skin downloads**: Added `signDownloadUrl()` method that appends `?exp=&sig=` HMAC-signed query parameters to download URLs using the client's `requestSigningKey`. This matches the server's `verify_download_signature()` check when `ENFORCE_SIGNED_DOWNLOADS=true`. - **Replaced per-player TextureManager registrations with a single shared dynamic texture**: CatSkinC no longer registers per-player textures (`catskinc:remote/<uuid>`) with the vanilla `TextureManager`. Instead, downloaded `NativeImage` objects are cached in `SKIN_IMAGES` and pixel-copied into one shared `catskinc:dynamic/active` texture on each render frame. This prevents F3+S debug dumps from saving every player's skin to disk. - **Security**: **Request signing** (HMAC-SHA256) applied to WebSocket upgrade request. - **Hardened transitive dependencies against Dependabot advisories.** Added `resolutionStrategy { force ... }` constraints in `build.gradle` to pin patched versions of vulnerable transitive libraries on both the project and buildscript classpaths: - Netty → `4.1.136.Final` (fixes GHSA-558v-64gr-wgg4 Bzip2Decoder infinite loop and related netty advisories). - Log4j → `2.25.4` (fixes Log4j TLS hostname verification, XML escaping, and related advisories). - Guava → `32.0.0-jre` (fixes temp-dir and information-disclosure advisories). - Commons IO → `2.16.1`, Commons Compress → `1.26.0`, Commons Lang3 → `3.18.0`. - Buildscript classpath: Commons Text → `1.12.0`, Commons Beanutils → `1.11.0`, Plexus Utils → `3.6.1`. - These libraries are Minecraft-provided runtime/build-tooling dependencies and are **not bundled** into the shipped mod JAR, so the end-user artifact is unaffected; the constraints keep the dev runtime and CI dependency graph clean.

### Added - **Myopia skin LOD** for CatSkinC-managed remote skins. When enabled, distant players use lazily cached, pixel-perfect half, quarter, or eighth-resolution copies while GUI, inventory, and tab-list skins retain full resolution. - A Myopia settings screen with an enabled toggle, a 4–128 block base-distance control, Normal and Panicked modes, and links to Minecraft's keybinding menu. - Default keybindings for increasing and decreasing the Myopia range with the Up and Down arrow keys. All settings are persisted in `catskinc.json`. - **WebSocket client** using native `java.net.http.WebSocket` (Java 11+) for high-performance real-time skin sync. - **Automatic protocol negotiation** — client sends `x-catskinc-protocol: 3` header on WebSocket handshake. - **Resilient connection management**: - Exponential backoff reconnection (1.5s → 60s max). - Shared circuit breaker across REST, SSE, and WebSocket (unified failure tracking). - Automatic fallback to SSE when WebSocket fails or protocol is unsupported. - **Session-token authentication** on WebSocket with auto-subscription to local player UUID. - **Protocol version verification** in welcome message — closes connection on mismatch. - **In-game toast notifications** for WebSocket-originated events (skin updates, server messages). ### Changed - **Join flow** now attempts WebSocket first, falls back to SSE on failure. - **Shared circuit breaker state** between `ServerApiClient` and `WebSocketClient` — REST/SSE/WS failures all contribute to the same breaker. - **Heartbeat handling** — application-level JSON ping/pong (30s) replaces binary WebSocket ping frames for consistency. - **Managed-skin texture cleanup** now also releases all associated Myopia GPU textures and resets per-player LOD state. ### Fixed - **Broadcast framing** — WebSocket clients now receive raw JSON (SSE `data: ` prefix stripped server-side). - **Handshake protocol header** — added `X-CatSkinC-Protocol` to WebSocket upgrade request. - **Auth race** — session token acquired synchronously before WebSocket connection attempt. - **Protocol defense** — client verifies `protocol_version` in welcome message, closes on mismatch. - **Fallback trigger** — SSE fallback now activates on abnormal post-connect disconnections, not just initial connect failure. - **Toast handler** — implemented proper `Toasts.info()` with translatable titles. - **Select-Fetch race eliminated**: `selectSkin()` now chains `thenRun(refresh)` so the POST completes before the GET, eliminating the 4-8s skin delay after upload. - **Pending selections cache**: `PENDING_SELECTIONS` returns the uploaded skin URL immediately after select, avoiding old-skin flashing. - **LAST_CHECK on success only**: failed fetches no longer reset the 5s poll timer, preventing a 15s blackout window. - **Fast-retry after null skin**: retries fetch in 2s when the server has no cached skin yet, reducing initial sync from 15s to 2s. - **Poll interval reduced**: 15s → 5s for faster periodic sync. - **SSE clear-skin handling**: clears `BASE_CACHE`/`TALKING_CACHE` on null URL, so players properly revert to the default skin. - **SSE reconnect delay**: added 1.5s–60s exponential backoff on stream close (was instant reconnect), preventing server flooding. - **Circuit breaker in SSE**: SSE checks `circuitOpenUntilMs` before connecting, eliminating useless retries during outage. - **AtomicInteger**: `consecutiveFailures` switched to `AtomicInteger` for correct failure counting. - **Always destroy old textures**: removed identity check gate on texture release to prevent GPU memory leaks. - **Fixed HTTP 401 on skin downloads**: Added `signDownloadUrl()` method that appends `?exp=&sig=` HMAC-signed query parameters to download URLs using the client's `requestSigningKey`. This matches the server's `verify_download_signature()` check when `ENFORCE_SIGNED_DOWNLOADS=true`. - **Replaced per-player TextureManager registrations with a single shared dynamic texture**: CatSkinC no longer registers per-player textures (`catskinc:remote/<uuid>`) with the vanilla `TextureManager`. Instead, downloaded `NativeImage` objects are cached in `SKIN_IMAGES` and pixel-copied into one shared `catskinc:dynamic/active` texture on each render frame. This prevents F3+S debug dumps from saving every player's skin to disk. - **Broadcast framing** — WebSocket clients now receive raw JSON (SSE `data: ` prefix stripped server-side). - **Handshake protocol header** — added `X-CatSkinC-Protocol` to WebSocket upgrade request. - **Auth race** — session token acquired synchronously before WebSocket connection attempt. - **Protocol defense** — client verifies `protocol_version` in welcome message, closes on mismatch. - **Fallback trigger** — SSE fallback now activates on abnormal post-connect disconnections, not just initial connect failure. - **Toast handler** — implemented proper `Toasts.info()` with translatable titles. - **Select-Fetch race eliminated**: `selectSkin()` now chains `thenRun(refresh)` so the POST completes before the GET, eliminating the 4-8s skin delay after upload. - **Pending selections cache**: `PENDING_SELECTIONS` returns the uploaded skin URL immediately after select, avoiding old-skin flashing. - **LAST_CHECK on success only**: failed fetches no longer reset the 5s poll timer, preventing a 15s blackout window. - **Fast-retry after null skin**: retries fetch in 2s when the server has no cached skin yet, reducing initial sync from 15s to 2s. - **Poll interval reduced**: 15s → 5s for faster periodic sync. - **SSE clear-skin handling**: clears `BASE_CACHE`/`TALKING_CACHE` on null URL, so players properly revert to the default skin. - **SSE reconnect delay**: added 1.5s–60s exponential backoff on stream close (was instant reconnect), preventing server flooding. - **Circuit breaker in SSE**: SSE checks `circuitOpenUntilMs` before connecting, eliminating useless retries during outage. - **AtomicInteger**: `consecutiveFailures` switched to `AtomicInteger` for correct failure counting. - **Always destroy old textures**: removed identity check gate on texture release to prevent GPU memory leaks. - **Fixed HTTP 401 on skin downloads**: Added `signDownloadUrl()` method that appends `?exp=&sig=` HMAC-signed query parameters to download URLs using the client's `requestSigningKey`. This matches the server's `verify_download_signature()` check when `ENFORCE_SIGNED_DOWNLOADS=true`. - **Replaced per-player TextureManager registrations with a single shared dynamic texture**: CatSkinC no longer registers per-player textures (`catskinc:remote/<uuid>`) with the vanilla `TextureManager`. Instead, downloaded `NativeImage` objects are cached in `SKIN_IMAGES` and pixel-copied into one shared `catskinc:dynamic/active` texture on each render frame. This prevents F3+S debug dumps from saving every player's skin to disk. - **Security**: **Request signing** (HMAC-SHA256) applied to WebSocket upgrade request. - **Hardened transitive dependencies against Dependabot advisories.** Added `resolutionStrategy { force ... }` constraints in `build.gradle` to pin patched versions of vulnerable transitive libraries on both the project and buildscript classpaths: - Netty → `4.1.136.Final` (fixes GHSA-558v-64gr-wgg4 Bzip2Decoder infinite loop and related netty advisories). - Log4j → `2.25.4` (fixes Log4j TLS hostname verification, XML escaping, and related advisories). - Guava → `32.0.0-jre` (fixes temp-dir and information-disclosure advisories). - Commons IO → `2.16.1`, Commons Compress → `1.26.0`, Commons Lang3 → `3.18.0`. - Buildscript classpath: Commons Text → `1.12.0`, Commons Beanutils → `1.11.0`, Plexus Utils → `3.6.1`. - These libraries are Minecraft-provided runtime/build-tooling dependencies and are **not bundled** into the shipped mod JAR, so the end-user artifact is unaffected; the constraints keep the dev runtime and CI dependency graph clean.

## [3.1.0] - 2026-06-12 (26.1.2) ### Added - Added editable `catskinCloudIp` setting to specify custom server addresses. The server URL is automatically normalized and prepended with a protocol (`http://` or `https://`) if missing. - Added toggle settings to selectively enable or disable various toast notifications (`showConnectionToast`, `showUploadToast`, `showInfoToast`, and `showErrorToast`). - Added the original button click sound to the Slim Model toggle switch. ### Changed - Redesigned the client Settings screen: replaced the dropdown menu with search-filterable and collapsible accordion categories. - Replaced the library slot thumbnail rendering with a 2D player face (matching the Tab Server List appearance) utilizing `PlayerFaceExtractor` to integrate with Minecraft's deferred PiP rendering pipeline. - Shortened Toast messages in English and Thai language files to prevent text overflowing the toast boxes. ### Fixed - Decoupled connection checks from skin downloads: increased client concurrent connection limit to 50 and executed pings on a separate thread pool to ensure player skins load instantly without queueing. - Fixed the "Clear Skin" action: attached the Mojang verification session token to clear selection requests to prevent HTTP 401 Unauthorized errors on session-enforced servers. - Fixed skin texture registration issues by utilizing a 2-argument `ResourceTexture` constructor to prevent path modification.

## [3.1.0] - 2026-06-12 (26.1.2) ### Added - Added editable `catskinCloudIp` setting to specify custom server addresses. The server URL is automatically normalized and prepended with a protocol (`http://` or `https://`) if missing. - Added toggle settings to selectively enable or disable various toast notifications (`showConnectionToast`, `showUploadToast`, `showInfoToast`, and `showErrorToast`). - Added the original button click sound to the Slim Model toggle switch. ### Changed - Redesigned the client Settings screen: replaced the dropdown menu with search-filterable and collapsible accordion categories. - Replaced the library slot thumbnail rendering with a 2D player face (matching the Tab Server List appearance) utilizing `PlayerFaceExtractor` to integrate with Minecraft's deferred PiP rendering pipeline. - Shortened Toast messages in English and Thai language files to prevent text overflowing the toast boxes. ### Fixed - Decoupled connection checks from skin downloads: increased client concurrent connection limit to 50 and executed pings on a separate thread pool to ensure player skins load instantly without queueing. - Fixed the "Clear Skin" action: attached the Mojang verification session token to clear selection requests to prevent HTTP 401 Unauthorized errors on session-enforced servers. - Fixed skin texture registration issues by utilizing a 2-argument `ResourceTexture` constructor to prevent path modification.

## [3.1.0] - 2026-06-12 ### Added - Added editable `catskinCloudIp` setting to specify custom server addresses. The server URL is automatically normalized and prepended with a protocol (`http://` or `https://`) if missing. - Added toggle settings to selectively enable or disable various toast notifications (`showConnectionToast`, `showUploadToast`, `showInfoToast`, and `showErrorToast`). - Added the original button click sound to the Slim Model toggle switch. ### Changed - Redesigned the client Settings screen: replaced the dropdown menu with search-filterable and collapsible accordion categories. ### Fixed - Decoupled connection checks from skin downloads: increased client concurrent connection limit to 50 and executed pings on a separate thread pool to ensure player skins load instantly without queueing. - Fixed the "Clear Skin" action: attached the Mojang verification session token to clear selection requests to prevent HTTP 401 Unauthorized errors on session-enforced servers.

## [3.1.0] - 2026-06-12 ### Added - Added editable `catskinCloudIp` setting to specify custom server addresses. The server URL is automatically normalized and prepended with a protocol (`http://` or `https://`) if missing. - Added toggle settings to selectively enable or disable various toast notifications (`showConnectionToast`, `showUploadToast`, `showInfoToast`, and `showErrorToast`). - Added the original button click sound to the Slim Model toggle switch. ### Changed - Redesigned the client Settings screen: replaced the dropdown menu with search-filterable and collapsible accordion categories. ### Fixed - Decoupled connection checks from skin downloads: increased client concurrent connection limit to 50 and executed pings on a separate thread pool to ensure player skins load instantly without queueing. - Fixed the "Clear Skin" action: attached the Mojang verification session token to clear selection requests to prevent HTTP 401 Unauthorized errors on session-enforced servers.

## [3.1.0] - 2026-06-12 ### Added - Added editable `catskinCloudIp` setting to specify custom server addresses. The server URL is automatically normalized and prepended with a protocol (`http://` or `https://`) if missing. - Added toggle settings to selectively enable or disable various toast notifications (`showConnectionToast`, `showUploadToast`, `showInfoToast`, and `showErrorToast`). - Added the original button click sound to the Slim Model toggle switch. ### Changed - Redesigned the client Settings screen: replaced the dropdown menu with search-filterable and collapsible accordion categories. ### Fixed - Decoupled connection checks from skin downloads: increased client concurrent connection limit to 50 and executed pings on a separate thread pool to ensure player skins load instantly without queueing. - Fixed the "Clear Skin" action: attached the Mojang verification session token to clear selection requests to prevent HTTP 401 Unauthorized errors on session-enforced servers.

## [3.1.0] - 2026-06-12 ### Added - Added editable `catskinCloudIp` setting to specify custom server addresses. The server URL is automatically normalized and prepended with a protocol (`http://` or `https://`) if missing. - Added toggle settings to selectively enable or disable various toast notifications (`showConnectionToast`, `showUploadToast`, `showInfoToast`, and `showErrorToast`). - Added the original button click sound to the Slim Model toggle switch. ### Changed - Redesigned the client Settings screen: replaced the dropdown menu with search-filterable and collapsible accordion categories. ### Fixed - Decoupled connection checks from skin downloads: increased client concurrent connection limit to 50 and executed pings on a separate thread pool to ensure player skins load instantly without queueing. - Fixed the "Clear Skin" action: attached the Mojang verification session token to clear selection requests to prevent HTTP 401 Unauthorized errors on session-enforced servers.

## [3.0.3-HF] - 2026-06-03 ### Fixed - Fixed a crash on launch on Fabric (`NoClassDefFoundError: net.minecraft.server.level.ServerPlayer` during mod init). The 3.0.3 Fabric jar was packaged without the Minecraft name → intermediary remap, so every Minecraft reference used development (Mojmap) names that do not exist at runtime and the mod failed to initialize. 3.0.3-HF is rebuilt with the remap correctly applied. This is a packaging fix only — there are no gameplay or code changes versus 3.0.3, and the Figura compatibility fix from 3.0.3 is included. (NeoForge runs with Mojang-mapped names at runtime and was not affected.) - Figura compatibility: CatSkinC now yields to an active Figura avatar. When a player has a loaded Figura avatar, CatSkinC performs no skin/model override for that player so the two mods no longer compete over the same skin lookups. Detection is reflective and Figura remains an optional dependency. (1.20.1 already overrides texture and model through separate methods and did not show the 1.21.1 `getSkin()` conflict; this keeps behaviour consistent and future-proof.)

## [3.0.3] - 2026-06-03 ### Fixed - Figura compatibility: CatSkinC now yields to an active Figura avatar. When a player has a loaded Figura avatar, CatSkinC performs no skin/model override for that player so the two mods no longer compete over the same skin lookups. Detection is reflective and Figura remains an optional dependency. (1.20.1 already overrides texture and model through separate methods and did not show the 1.21.1 `getSkin()` conflict; this keeps behaviour consistent and future-proof.)

## [3.0.3] - 2026-06-03 ### Fixed - Figura compatibility: CatSkinC now yields to an active Figura avatar. When a player has a loaded Figura avatar, CatSkinC performs no skin/model override for that player so the two mods no longer compete over the same skin lookups. Detection is reflective and Figura remains an optional dependency. (1.20.1 already overrides texture and model through separate methods and did not show the 1.21.1 `getSkin()` conflict; this keeps behaviour consistent and future-proof.)

## [3.0.3] - 2026-06-03 ### Fixed - Figura compatibility: CatSkinC now yields to an active Figura avatar. When a player has a loaded Figura avatar, CatSkinC performs no skin/model override for that player so the two mods no longer compete over the same skin lookups. Detection is reflective and Figura remains an optional dependency. (1.20.1 already overrides texture and model through separate methods and did not show the 1.21.1 `getSkin()` conflict; this keeps behaviour consistent and future-proof.)

## [3.0.0] - 2026-05-30 ### Added - Auto-update now resolves the exact download for your platform: when a newer version is detected, it queries Modrinth for that version filtered by your loader and Minecraft version and surfaces the matching file (falling back to the project page when no direct file matches). ### Changed - Upload errors caused by session/identity checks now show clear, actionable messages (verify Minecraft session, premium-account-only) instead of raw server text. ### Fixed - Mouth PNGs that do not match the base skin size are now rejected up front with a clear message, instead of failing later during upload. - Fixed a native-image leak and double-free on the skin texture apply error path.

## [3.0.0] - 2026-05-30 ### Added - Auto-update now resolves the exact download for your platform: when a newer version is detected, it queries Modrinth for that version filtered by your loader and Minecraft version and surfaces the matching file (falling back to the project page when no direct file matches). ### Changed - Upload errors caused by session/identity checks now show clear, actionable messages (verify Minecraft session, premium-account-only) instead of raw server text. ### Fixed - Mouth PNGs that do not match the base skin size are now rejected up front with a clear message, instead of failing later during upload. - Fixed a native-image leak and double-free on the skin texture apply error path.

## [3.0.0] - 2026-05-30 ### Added - Auto-update now resolves the exact download for your platform: when a newer version is detected, it queries Modrinth for that version filtered by your loader and Minecraft version and surfaces the matching file (falling back to the project page when no direct file matches). ### Changed - Upload errors caused by session/identity checks now show clear, actionable messages (verify Minecraft session, premium-account-only) instead of raw server text. ### Fixed - Mouth PNGs that do not match the base skin size are now rejected up front with a clear message, instead of failing later during upload. - Fixed a native-image leak and double-free on the skin texture apply error path.

## [3.0.0] - 2026-05-30 ### Added - Auto-update now resolves the exact download for your platform: when a newer version is detected, it queries Modrinth for that version filtered by your loader and Minecraft version and surfaces the matching file (falling back to the project page when no direct file matches). ### Changed - Upload errors caused by session/identity checks now show clear, actionable messages (verify Minecraft session, premium-account-only) instead of raw server text. ### Fixed - Mouth PNGs that do not match the base skin size are now rejected up front with a clear message, instead of failing later during upload. - Fixed a native-image leak and double-free on the skin texture apply error path.

More GUI-based mods that rely on Minecraft's standard skin lookup should now display CatSkin overrides correctly.

More GUI-based mods that rely on Minecraft's standard skin lookup should now display CatSkin overrides correctly

CatSkinC 2.0.2 improves compatibility with mods that render player heads/faces in custom GUI screens

CatSkinC 2.0.2 improves compatibility with mods that render player heads/faces in custom GUI screens

- Add 3D display head

- Add 3D display head

- Add 3D Head Library display - Fix display issues

- Add 3D Head Library display - Fix display issues

## [2.0.0] - 2026-03-08 ### Added - New in-game upload workspace with three main panels: `Library`, `Live Preview`, and `Controls`. - Live 3D player preview with support for model rotation from mouse movement and a dedicated `Slim Model` toggle. - Support for separate `mouth_open` and `mouth_close` PNG overlays during preview and upload. - Drag-and-drop support for PNG files, including bulk import into the local Library/history panel. - Automatic update notification using the Modrinth API for the `catskinc` project. ### Changed - Skin uploads now keep a reusable local Library/history with thumbnails, quick reselect, and delete actions. - Join flow now reports cloud connection status in-game and refreshes player skin state more reliably. - CatSkinC `2.0.0` is now aligned across Minecraft `1.20.1` and `1.21.1` release lines. ### Fixed - Fixed release-jar runtime issues caused by remapped identifiers and resource-location creation. - Fixed voice-state network channel initialization for production builds. - Fixed 3D preview rendering in packaged builds. - Fixed preview nameplate rendering so the 3D preview no longer shows a floating name or empty label space. - Fixed multi-file drag-and-drop so Library imports can handle multiple PNGs instead of only using the first few files. - Improved general runtime stability around preview texture registration, preview player creation, and upload UI behavior.

## [2.0.0] - 2026-03-08 ### Added - New in-game upload workspace with three main panels: `Library`, `Live Preview`, and `Controls`. - Live 3D player preview with support for model rotation from mouse movement and a dedicated `Slim Model` toggle. - Support for separate `mouth_open` and `mouth_close` PNG overlays during preview and upload. - Drag-and-drop support for PNG files, including bulk import into the local Library/history panel. - Automatic update notification using the Modrinth API for the `catskinc` project. ### Changed - Skin uploads now keep a reusable local Library/history with thumbnails, quick reselect, and delete actions. - Join flow now reports cloud connection status in-game and refreshes player skin state more reliably. - CatSkinC `2.0.0` is now aligned across Minecraft `1.20.1` and `1.21.1` release lines. ### Fixed - Fixed release-jar runtime issues caused by remapped identifiers and resource-location creation. - Fixed voice-state network channel initialization for production builds. - Fixed 3D preview rendering in packaged builds. - Fixed preview nameplate rendering so the 3D preview no longer shows a floating name or empty label space. - Fixed multi-file drag-and-drop so Library imports can handle multiple PNGs instead of only using the first few files. - Improved general runtime stability around preview texture registration, preview player creation, and upload UI behavior.

## [2.0.0] - 2026-03-08 ### Added - New in-game upload workspace with three main panels: `Library`, `Live Preview`, and `Controls`. - Live 3D player preview with support for model rotation from mouse movement and a dedicated `Slim Model` toggle. - Support for separate `mouth_open` and `mouth_close` PNG overlays during preview and upload. - Drag-and-drop support for PNG files, including bulk import into the local Library/history panel. - Automatic update notification using the Modrinth API for the `catskinc` project. ### Changed - Skin uploads now keep a reusable local Library/history with thumbnails, quick reselect, and delete actions. - Join flow now reports cloud connection status in-game and refreshes player skin state more reliably. - CatSkinC `2.0.0` is now aligned across Minecraft `1.20.1` and `1.21.1` release lines. ### Fixed - Fixed release-jar runtime issues caused by remapped identifiers and resource-location creation. - Fixed voice-state network channel initialization for production builds. - Fixed 3D preview rendering in packaged builds. - Fixed preview nameplate rendering so the 3D preview no longer shows a floating name or empty label space. - Fixed multi-file drag-and-drop so Library imports can handle multiple PNGs instead of only using the first few files. - Improved general runtime stability around preview texture registration, preview player creation, and upload UI behavior.

## [2.0.0] - 2026-03-08 ### Added - New in-game upload workspace with three main panels: `Library`, `Live Preview`, and `Controls`. - Live 3D player preview with support for model rotation from mouse movement and a dedicated `Slim Model` toggle. - Support for separate `mouth_open` and `mouth_close` PNG overlays during preview and upload. - Drag-and-drop support for PNG files, including bulk import into the local Library/history panel. - Automatic update notification using the Modrinth API for the `catskinc` project. ### Changed - Skin uploads now keep a reusable local Library/history with thumbnails, quick reselect, and delete actions. - Join flow now reports cloud connection status in-game and refreshes player skin state more reliably. - CatSkinC `2.0.0` is now aligned across Minecraft `1.20.1` and `1.21.1` release lines. ### Fixed - Fixed release-jar runtime issues caused by remapped identifiers and resource-location creation. - Fixed voice-state network channel initialization for production builds. - Fixed 3D preview rendering in packaged builds. - Fixed preview nameplate rendering so the 3D preview no longer shows a floating name or empty label space. - Fixed multi-file drag-and-drop so Library imports can handle multiple PNGs instead of only using the first few files. - Improved general runtime stability around preview texture registration, preview player creation, and upload UI behavior.

This installment is in version 1.21.1

Minor changes and optimizations.

Minor changes and optimizations.

- Revamped UI with a new layout - Added local Skin history saving - Switched from 2D preview to full 3D rendering

**Temporary bug fixes** Real-time skin updates Correct arm model (Alex/Steve) before remote skin loads

**Temporary bug fixes** Real-time skin updates Correct arm model (Alex/Steve) before remote skin loads