## VeloAuth 1.6.0
**🔒 Security fix.** Premium players connecting during the startup window — after Velocity opens
its port but before VeloAuth finishes initializing — were let through with no premium check, and
got an offline UUID on proxies with `online-mode = false`. The window reopened on every restart
and could be timed deliberately: treat it as a name-sniping vector. Queued logins now go through
the full PreLogin pipeline, and are denied if it isn't ready.
**⏱️ Rate limits for premium lookups.** A join wave could multiply into far more upstream requests
than lookups, cross Mojang's limit, and turn its 429s into a proxy-wide login outage. New ceilings
under `premium.resolver`: `mojang-requests-per-minute` (120), `ashcon-` / `wpme-requests-per-minute`
(60), `rate-limit-max-wait-ms` (1000). Set to `0` to disable.
**Upgrading.**
Full proxy restart required.
Developer information
Projects on Modrinth are automatically available through a Maven repository for use with JVM build tools such as Gradle.
maven { name = "Modrinth"; url = "https://api.modrinth.com/maven" }
