Reject oversized split_size before allocating fragment vectors, limit
pending split compounds and ordered-channel queues, and bound unacked
outgoing frames so a never-ACK or split-bomb peer cannot retain unbounded
memory.

Mirror the binary NBT depth budget in the command SNBT parser so deeply
nested compounds/lists from /give and similar paths cannot overflow the
stack.

Return after failed Mojang authentication instead of completing login
with an unverified profile. Kick cleanly when the game profile is missing.
Run ban/whitelist/IP-ban and duplicate UUID/name checks in add_player for
every transport. Validate player names (reject empty/NUL/section sign),
timeout Mojang HTTP, fix prevent-proxy URL, and sanitize Velocity names.

Require a non-empty RCON password and Velocity secret when those features
are enabled. Warn when BungeeCord mode is on. Fix RCON max_connections to
decrement on close, and add read timeouts plus an incoming buffer bound.

Block PickupAll on merchant and anvil result slots, enforce trade uses
limits, consume both anvil inputs, fix drag-slot division-by-zero from u8
cast wrap, and correct Swap action operator precedence for offhand.

Require creative mode for CraftCreative and client inventory descriptors,
consume craft inputs per repetition, require allow_flying for StartFlying,
ignore invalid block actions without panicking, and make heal() tolerant of
overflowed potion amplifiers.

…take

Merchant and anvil result slots are take-only so PickupAll cannot steal
outputs without consumption. Crafting ResultSlot refills after each take
so multi-craft loops stop when ingredients run out.

Reject CreatedOutput without a tracked craft, bound HotBar slot ids,
and stop survival UseItem from writing client item descriptors into
the held stack.

Gate LoginAck on finish_login, clear profiles after failed Mojang auth,
prefer close in get_packet select, accept reconnects by kicking the old
session, and reject section-sign Bedrock names.

…icks

Run play loops in child tasks so connection cleanup always runs, save
only the first worker crash report to disk, and keep the ticker alive
if a single tick panics.

Bound item user/extra data allocations at 256 KiB and reject empty or
whitespace Velocity secrets whenever velocity is enabled.