NovaSync

NovaSync 2.17.161 — accumulated launch-readiness updates since 2.17.146

This release rolls up the entire Fast-channel iteration from 2.17.146 → 2.17.161. Every change in the chain has been live on EU + SA + laptop nodes for hours-to-weeks of soak time before promotion to stable.

Security & hardening (Waves 7-10 + follow-ups)

Cross-vendor trio review (DeepSeek V4-Pro + Gemini 3.1-Pro + Claude java-plugin specialist) drove this sweep.

• Wave 7 (2.17.153) — 4 CRITICALs. Peer-relay factory-reset audit + per-IP rate limit, legacy peer-auth strict-mode primitive, replay/strict-HMAC primitive, role-definition isAdmin smuggle blocked.
• Wave 8 (2.17.154) — 10 HIGH-confirmed fixes. DAO setAutoCommit restoration in all 9 transactional DAOs (no more silent connection-pool corruption on rollback); 5-route peer audit row enforcement; cross-server pay amount cap; dashboard XSS surface sweep; EconomyDao IGNORE for race-safe insert; voice cookie 24h TTL + refresh-on-use (was infinite); installer atomicity + graceful start/stop; PrivateCredentials AES-256-GCM at-rest encryption.
• Wave 9 (2.17.155) — 18 single-vendor HIGH FLAGs. Peer-route size+rate caps on /loot-relay (512 KB → HTTP 413), /item-drop, /voice/broadcast (peer-only auth, dashboard cookie rejected), DAO + SchemaInit mechanical sweep, voice admin-stream rate limit (180/min → 429).
• Wave 10 partial (2.17.156). PrivateCredentials.getCredentialBytes() byte[] accessor + post-crash cleanup in migration path.
• 2.17.157 — CSP 'unsafe-eval' dropped. Audit confirmed zero eval/Function/string-timer usage. Inline-JS extraction tracked as a multi-day follow-up.
• 2.17.158 — BLOCKER fix. Duplicate /dashboard/lib/ HTTP context registration crashed HTTP-API startup on SA promotion. Caught instantly by the newly-shipped Playwright dashboard test suite.
• 2.17.159 — CDN URL normalization + VERSION-FAST.txt staleness hotfix.

Operability

• NovaLink directory test coverage: 2 new @api tests in nova-sync-plugin/dashboard-tests/.
• Installer NOVA_NETWORK_KEY env var to pre-seed network.key for fresh installs joining an existing hub.

UX

• Memory panel split heap vs Java overhead. The "Memory (RAM)" panel was showing total Java process memory under a label saying "Minecraft is using ... you control this with the boxes below" — but the boxes only control the heap (XMX), not the +500-700 MB of Java overhead (thread stacks, metaspace, JIT cache, GC tables, Netty buffers, native libs). New layout breaks process into Heap (you control) + Java overhead (auto) sub-rows. Recommendation row math fixed to reserve room for off-heap overhead.

Verification

• 21-test Playwright suite at nova-sync-plugin/dashboard-tests/ (4 suites: @smoke, @security, @coverage, @api). Live runs on 2.17.161: SA 20 pass / 3 skip / 0 fail; EU 19 pass / 4 skip / 0 fail.
• Cross-vendor trio review confirmed every Wave 7-10 fix.

Tested on Paper 1.21.11 + Java 21 with Geyser-Spigot 2.10.0, Floodgate 2.2.5, LuckPerms 5.5.17, ViaVersion 5.9.2, ViaBackwards 5.9.2, voicechat 2.6.17.