OpSec Enhanced

Fixes

• 26.3 no longer fails to connect to every server. Root cause: 26.3 changed ServerboundChatPacket.signature from MessageSignature to Optional<MessageSignature>; the chat-signature-stripping mixin still shadowed the old type, which broke Mixin's transform of GameProtocols/VanillaPacketTypes on the first packet write, poisoning that class for every connection attempt after.
• Jar integrity check now falls back through GitHub Releases (real SHA-256) and CurseForge (filesize only) when Modrinth doesn't have a match, instead of silently skipping.

New privacy features

• Block Cookies (1.20.5+, on by default) - refuses to store any cookie a server sets; cookies persist across reconnects/Transfer hops, a ready-made cross-session tracker.
• Client Information Normalizer (off by default) - reports a fixed, common language/view-distance/chat-mode/skin-layers/main-hand combo instead of your real settings, since that combination is itself a fingerprint.
• Scrub Pack Download Headers (1.20.3+, on by default) - neutralizes X-Minecraft-Username/UUID/Version/Version-ID/Pack-Format and User-Agent on server resource pack downloads.
• Command History Guard (1.20.2+, on by default) - redacts the arguments of /login, /register, /changepassword etc. before they're written to command_history.txt.
• Auto-Purge Pack Cache On Exit (off by default) - wipes the downloaded-pack cache on game close, on top of the existing per-account isolation.
• Lazy Server List Ping (off by default) - stops the multiplayer screen from auto-pinging every saved server on open.

See the GitHub release for full details.