AutoModpack

Security patch

• The server's TLS certificate is now checked against Mozilla's OneCRL revocation list. Certificates issued by revoked or compromised certificate authorities, such as the recently compromised eMudhra intermediates, are no longer trusted. The list ships with the mod, so the check also works offline, and it refreshes in the background.
• Certificates issued by a public CA are now checked against that CA's revocation list before they're trusted automatically.
• The server's TLS private key is now saved readable only by its owner. Existing keys stay as they are and log a warning.
• The server no longer replaces its TLS key and certificate when one of them is missing. If cert.crt exists without key.pem, hosting won't start until you restore the key or remove both files.
• Downloads now stop as soon as they run past the size listed in the modpack, so a malicious server or mirror can no longer fill memory or disk.

Clients on 4.0.7 can join servers running 4.0.5, 4.0.6 and 4.0.7.

Full Changelog: https://github.com/Skidamek/AutoModpack/compare/v4.0.6...v4.0.7