While Velocity supports BungeeCord-style IP forwarding, it is not secure. Users
have a lot of problems setting up firewalls or setting up plugins like IPWhitelist.
Further, the BungeeCord IP forwarding protocol still retains essentially its original
form, when there is brand new support for custom login plugin messages in 1.13.
Velocity's modern IP forwarding uses an HMAC-SHA256 code to ensure authenticity
of messages, is packed into a binary format that is smaller than BungeeCord's
forwarding, and is integrated into the Minecraft login process by using the 1.13
login plugin message packet.
Upstream has released updates that appears to apply and compile correctly.
This update has not been tested by PaperMC and as with ANY update, please do your own testing
Bukkit Changes:
39ce5d3a SPIGOT-4399: ItemMeta.equals broken with AttributeModifiers
CraftBukkit Changes:
1cf8b5dc SPIGOT-4400: Populators running on existing chunks
116cb9a1 SPIGOT-4399: Add attribute modifier equality test
5ee1c18a SPIGOT-4398: Set ASM7_EXPERIMENTAL flag
