Should we remove 0.4 servers? Older 5.x servers/clients?

Nobody has claimed this yet.

## 0.4.x is not secure

In the last 8 years, we've made a massive effort to find and fix security vulnerabilities and harden our code. Our most recent release fixed multiple serious security vulnerabilities. We are aware of multiple critical security vulnerabilities affecting 0.4.x. More worryingly, as 0.4.x is unsupported it likely has many unknown security vulnerabilities.

Since 0.4.x, we have reworked and modernized our dependencies, reducing risk. Irrlicht was effectively unmaintained and riddled with bugs. We merged it into our code base, stripped it down, and replaced many of its functions with well-maintained libraries like SDL and modern C++ code. As an example, we recently discovered serious vulnerabilities in Irrlicht's mesh and image loading code. These vulnerabilities put players at risk and the fixes will never make it to the 0.4.x series.

0.4.x binaries also ship with dependencies from 8 years ago. Our dependencies have released many security fixes in this time, including in zlib, libpng, libjpeg, and curl - all of which have a remote attack surface.

## Removing 0.4.x servers reduces risk

By removing 0.4.x from the serverlist, we reduce the risk of 0.4 clients being exploited remotely in the wild. Players can still connect to servers they trust by using favorites or entering the address and port.

This action would remove 13 servers from the serverlist and impact an average of 20 concurrent online players. For comparison, there are 427 5.x servers with 450 online players.

## Should we block older 5.x clients and servers too?

Older 5.x versions also contain vulnerabilities. What should our minimum version be?

The following graph shows how many unique clients have a Luanti version of the given column or newer. This graph shows only clients that identify as Luanti or Minetest.

Data is from 6th November 2025.

## See also

https://github.com/luanti-org/luanti/security/advisories?state=published

No files, tests, or entry points are named in the issue. Start by reviewing the serverlist implementation and the linked security advisories; done means an explicit decision on whether to remove 0.4.x and which 5.x minimum to enforce, followed by a separately scoped implementation.

Written by the indexing model from the issue text.