v1.0.0-alpha.6 reworks how damage lands, folds every break-and-death drop onto one system, and puts real armor around the parts of the game that read untrusted data — your saves, network traffic, and mods. Existing worlds, saves, and mods carry over as-is. The one thing to know if you write content: the block-only item-drops: config field is now deprecated in favor of the shared drop-table: schema. Your existing item-drops still loads (with a warning), so nothing breaks today.

Combat that respects the swing

Until now, anything overlapping a damage source — a weapon swing, an area-of-effect zone, plain contact — took damage every single server tick. That made combat impossible to balance: a fast weapon and a heavy weapon hit at the same runaway rate, and standing in an AoE zone chewed through health frame by frame.

Damage is now rate-limited per attacker. Each hit opens a short invulnerability window (300 ms by default) during which that same attacker can’t damage you again, so hits land at a sane cadence no matter how fast they’re delivered. On top of that:

• Per-weapon hit cooldowns. Weapons can set their own hit-cooldown-ms in weapon-info, so a light dagger can tag a target more often than a slow greatsword.
• Post-hit invulnerability. Health configs can grant a classic “you took a hit, now you get a moment” window with global-iframe-ms — after any hit, all incoming attacker damage is briefly ignored. It’s meant for the player’s default-player-health.
• The end-of-swing double hit is gone. Weapon swings used to sneak a second hit in at the tail of the animation. Each swing now hits a target exactly once.
• Damage can’t heal you anymore. Negative damage used to silently heal a target past its cap, and health could go below zero. Both are fixed.

One drop table for everything

Break/death drops used to run on two separate systems: blocks had their own, while mobs, static objects, trees, interactables, mounts, and vehicles shared another. This release unifies all of them onto a single drop-table system with one config vocabulary.

The shared drop-table: schema now has two parts: drops: (each entry rolls independently on its own chance) and a new groups: mode (a weighted “pick one from this bundle” roll — what blocks always did). The big win is that groups: is now available to everything, not just blocks — mobs, trees, and the rest can all do weighted pick-one drops now.

If you write content: the old block-only item-drops: field still works but is deprecated and logs a warning. Move it to drop-table: with a groups: list — there’s a migration note in the block configuration docs, and the base mod has already been migrated as a worked example.

Mob targeting scales better

The server used to rebuild its entire entity spatial index from scratch every tick, just to answer “where’s the nearest player?” — allocating a fresh list over every entity in the world each time. The index is now per-type and incremental: entities that didn’t move do zero work, and newly spawned or removed entities (mobs, summons, projectiles, item drops) show up in proximity queries immediately instead of lagging a tick behind. Mob targeting now scales with how many entities are actually moving, not how many exist.

A wide security pass

A big chunk of this release is hardening the game against untrusted data — malicious servers, crafted packets, downloaded saves, and third-party mods. If you host a server or install mods from the community, these matter:

• Mods are now sandboxed. Mod Lua scripts no longer have access to the os and io standard libraries or the dofile/loadfile file loaders. A downloaded world or modpack can no longer run operating-system commands or read and write arbitrary files on your machine. Mods keep string, table, math, utf8, coroutine, and require for loading their own modules.
• Runaway mods can’t freeze the server. A mod with an infinite loop in one of its scripts used to hang the whole server. Mod callbacks are now cut off after a few seconds of runaway execution and the game keeps running.
• Hardened against malicious servers. Crafted network packets can no longer crash your client or force it into a giant memory allocation — inbound data is size-bounded and malformed packets are rejected cleanly instead of panicking.
• Safer saves. Loading a downloaded or shared save can no longer create or overwrite files outside your saves folder. Save and world names are validated, and the save’s location is always derived from its own folder.
• Operator commands locked down on offline servers. On servers using offline authentication — where a player’s identity can’t be verified and could be impersonated — operator commands are now disabled by default. Use Steam auth on public servers, or set allow-offline-operators: true to re-enable them on a trusted private/LAN server.
• More untrusted-data hardening. Corrupt or malicious saves, packets, and mod textures can no longer exhaust memory; player names are stripped of control characters before being shown or logged; and Steam-auth servers now reject logins when Steam is unavailable rather than letting players in unverified. Servers also apply a small default chat throttle (500 ms) to curb flooding — set slowdown-ms: 0 to disable it.

Fixes you’ll feel while playing

• Fluid sim no longer stalls on chunk load. Every time a chunk loaded, fluid simulation used to briefly pause. Fixed.
• Co-op looting no longer freezes the server. Two players moving items in each other’s (or nearby) inventories at the same instant could permanently lock up the server for everyone. This was a full outage triggerable by ordinary co-op looting — now fixed.
• No more sky-island spawns. Starting a new default world could occasionally drop you on top of a floating sky island instead of on the ground. You now spawn on the surface.
• Weather no longer goes missing. A rare world-generation race where two chunks loading at once could lose their weather assignment — leaving part of the world with no weather — is fixed.
• Headless startup. The game no longer crashes on startup when there’s no working audio device (headless machines, missing or broken drivers). It launches with sound disabled and logs a warning instead.
• HUD fix. The health and oxygen icons no longer render partly off the right edge of the screen.

What’s next

alpha.6 is a combat, systems, and security release — damage that lands fairly, one drop system instead of two, a leaner targeting index, and a lot more armor around the untrusted data the game reads. Thanks as always to everyone playtesting with us; the melee-timing tuning came straight out of in-game testing. Keep the reports coming.