• Added configurable vanilla-style panorama shading to the account manager
• CurseForge builds omit automatic account migration
• Added Android compatibility for SQLite storage and clear handling of unsupported skin/cape file selection

• Removed ability to configure Implementation Name
• Route all profile texture lookups through WawelAuth
• Moved LOTR map player face patch to FentLib
• Moved Better Questing skin patch to FentLib
• Provider-aware ban/pardon commands
• Provider-aware ServerUtilities player command targets
• Centralized provider-aware command name resolution
• Provider-aware ServerUtilities team player persistence
• UUID-backed ServerUtilities team GUI player actions
• Provider-aware Better Questing party skin sync, invites, commands
• Provider-aware ServerUtilities tab player head skin lookup
• Offloaded HTTP route handlers from Netty event loops to a bounded worker pool. Limits DOS attacks, hammering expensive routes no longer impacts the game.
• Fixed in-game account manager keybind not being registered on the correct bus. Fixed in-game manager npe. Fixed in-game drag and drop not re-opening the manager screen.
• Avoid HTTP self-calls for local auth and avatars
• Other session tokens get invalidated on local account password change
• Admin panel settings saves no longer leak runtime state (auto-added skin domain, fallback server list with discovered keys) into server.json
• Run dummy PBKDF2 for non-existent users to prevent username brute-forcing
• Prompt server admin via fml confirm/cancel for cert regeneration if publicBaseUrl changes
• Launcher session import prompt
• All local auth providers can be toggled on and off in the main manager
• Ingame manager shows local auth (if advertised by current server) as first entry
• Added button next to select account entries to jump to corresponding provider in the manager
• Added client-side authlib-injector compat: skins load properly, and account import works (as long as the provider exists)
• Moved config/wawelauth.cfg to config/wawelauth/wawelauth.cfg. Migration is automatic
• Fixed left leg/arm texture face swap on 64x64 skins
• Sodium-GUIfied interface + many ergdeonomic upgrades
• Moved editable built-in provider JSON definitions to the shared client config by default

• Fixed escape key not working in some mui2 guis

• Fixed @Redirect mixin clash with TabFaces
• Added nodep jars to each release. They do not bundle sqlite or Bouncy Castle, and require FalsePatternLib to download them

• Hardened fallback texture proxy redirects so they can't reach localhost or private network targets
• Fixed trusted nginx client IP handling for join/hasJoined without trusting spoofed forwarded headers from public clients
• Added app-level rate limiting for admin login and Yggdrasil auth endpoints
• Removed admin session cookie auth and tightened HTTPS detection behind local proxies
• Bounded public fallback profile and texture proxy caches so high-cardinality requests can't grow memory forever
• Hardened animated GIF cape validation without breaking optimized GIF subframes
• Added same-port HTTPS for admin login when you do not have a separate reverse proxy port
• Exposed same-port HTTPS settings in the admin panel with bounded TLS handshake timeout
• Hardened texture resolving and caching to avoid stale skin/cape state and race-condition bugs
• Reused FentLib's shared player face renderer for client account heads
• Replaced automatic orphaned local provider cleanup with an opt-in prompt on server delete to avoid wiping providers shared across Minecraft instances
• Improved local Wawel Auth credential detection and added configurable credential hiding for unsupported providers
• Improved the public site and admin panel
• Added 67minecraft publishing and filled in Modrinth/CurseForge metadata
• Moved server.dat backups to config/wawelauth/backups
• Force player skull rendering to go through Wawel Auth instead of Et Futurum, when installed

Initial Release.