tweak config defaults

Implement rate limits by packet read ops
for now this is configured to warn only by default, until we get the parameters for it dialled in
2025-09-13 12:55:06 +00:00 · 2025-03-12 01:06:01 +00:00 · 2025-03-12 01:03:34 +00:00 · 2025-03-11 14:28:44 +00:00 · 2025-03-11 12:41:59 +00:00 · 2025-03-09 02:09:53 +00:00
55 changed files with 467 additions and 515 deletions
--- a/.github/workflows/build-docker-image.yml
+++ b/.github/workflows/build-docker-image.yml
@ -53,7 +53,7 @@ jobs:
        run: echo NAME=$(echo "${GITHUB_REPOSITORY,,}") >> $GITHUB_OUTPUT

      - name: Build image for tag
-        uses: docker/build-push-action@v6.13.0
+        uses: docker/build-push-action@v6.15.0
        with:
          push: true
          context: ./pocketmine-mp
@ -66,7 +66,7 @@ jobs:

      - name: Build image for major tag
        if: steps.channel.outputs.CHANNEL == 'stable'
-        uses: docker/build-push-action@v6.13.0
+        uses: docker/build-push-action@v6.15.0
        with:
          push: true
          context: ./pocketmine-mp
@ -79,7 +79,7 @@ jobs:

      - name: Build image for minor tag
        if: steps.channel.outputs.CHANNEL == 'stable'
-        uses: docker/build-push-action@v6.13.0
+        uses: docker/build-push-action@v6.15.0
        with:
          push: true
          context: ./pocketmine-mp
@ -92,7 +92,7 @@ jobs:

      - name: Build image for latest tag
        if: steps.channel.outputs.CHANNEL == 'stable'
-        uses: docker/build-push-action@v6.13.0
+        uses: docker/build-push-action@v6.15.0
        with:
          push: true
          context: ./pocketmine-mp
--- a/.github/workflows/draft-release.yml
+++ b/.github/workflows/draft-release.yml
@ -165,7 +165,7 @@ jobs:
            ${{ github.workspace }}/core-permissions.rst

      - name: Create draft release
-        uses: ncipollo/release-action@v1.15.0
+        uses: ncipollo/release-action@v1.16.0
        id: create-draft
        with:
          artifacts: ${{ github.workspace }}/PocketMine-MP.phar,${{ github.workspace }}/start.*,${{ github.workspace }}/build_info.json,${{ github.workspace }}/core-permissions.rst
@ -182,6 +182,8 @@ jobs:

            :information_source: Download the recommended PHP binary [here](${{ steps.php-binary-url.outputs.PHP_BINARY_URL }}).

+            :warning: Found a bug? Report it on our [issue tracker](${{ github.server_url }}/${{ github.repository }}/issues). **We can't fix bugs if you don't report them.**
+
      - name: Post draft release URL on PR
        if: github.event_name == 'pull_request_target'
        uses: thollander/actions-comment-pull-request@v3
--- a/README.md
+++ b/README.md
@ -65,6 +65,8 @@ PocketMine-MP accepts community contributions! The following resources will be u
 * [Building and running PocketMine-MP from source](BUILDING.md)
 * [Contributing Guidelines](CONTRIBUTING.md)

+New here? Check out [issues with the "Easy task" label](https://github.com/pmmp/PocketMine-MP/issues?q=is%3Aissue%20state%3Aopen%20label%3A%22Easy%20task%22) for things you could work to familiarise yourself with the codebase.
+
 ## Donate
 PocketMine-MP is free, but it requires a lot of time and effort from unpaid volunteers to develop. Donations enable us to keep delivering support for new versions and adding features your players love.

--- a/build/dump-version-info.php
+++ b/build/dump-version-info.php
@ -36,7 +36,7 @@ require dirname(__DIR__) . '/vendor/autoload.php';
 */
 $options = [
 	"base_version" => VersionInfo::BASE_VERSION,
-	"major_version" => fn() => explode(".", VersionInfo::BASE_VERSION)[0],
+	"major_version" => fn() => explode(".", VersionInfo::BASE_VERSION, limit: 2)[0],
 	"mcpe_version" => ProtocolInfo::MINECRAFT_VERSION_NETWORK,
 	"is_dev" => VersionInfo::IS_DEVELOPMENT_BUILD,
 	"changelog_file_name" => function() : string{
--- a/build/generate-registry-annotations.php
+++ b/build/generate-registry-annotations.php
@ -23,7 +23,6 @@ declare(strict_types=1);

 namespace pocketmine\build\update_registry_annotations;

-use pocketmine\utils\OverloadedRegistryMember;
 use pocketmine\utils\Utils;
 use function basename;
 use function class_exists;
@ -35,7 +34,6 @@ use function fwrite;
 use function implode;
 use function is_dir;
 use function ksort;
-use function lcfirst;
 use function mb_strtoupper;
 use function preg_match;
 use function sprintf;
@ -49,19 +47,11 @@ if(count($argv) !== 2){
 	exit(1);
 }

-/**
- * @phpstan-param \ReflectionClass<*> $class
- */
-function makeTypehint(string $namespaceName, \ReflectionClass $class) : string{
-	return $class->getNamespaceName() === $namespaceName ? $class->getShortName() : '\\' . $class->getName();
-}
-
 /**
 * @param object[] $members
 * @phpstan-param array<string, object> $members
- * @phpstan-param array<string, OverloadedRegistryMember> $overloadedMembers
 */
-function generateMethodAnnotations(string $namespaceName, array $members, array $overloadedMembers) : string{
+function generateMethodAnnotations(string $namespaceName, array $members) : string{
 	$selfName = basename(__FILE__);
 	$lines = ["/**"];
 	$lines[] = " * This doc-block is generated automatically, do not modify it manually.";
@ -79,20 +69,14 @@ function generateMethodAnnotations(string $namespaceName, array $members, array
 		}
 		if($reflect === false){
 			$typehint = "object";
+		}elseif($reflect->getNamespaceName() === $namespaceName){
+			$typehint = $reflect->getShortName();
 		}else{
-			$typehint = makeTypehint($namespaceName, $reflect);
+			$typehint = '\\' . $reflect->getName();
 		}
 		$accessor = mb_strtoupper($name);
 		$memberLines[$accessor] = sprintf($lineTmpl, $accessor, $typehint);
 	}
-	foreach(Utils::stringifyKeys($overloadedMembers) as $baseName => $member){
-		$accessor = mb_strtoupper($baseName);
-		$returnTypehint = makeTypehint($namespaceName, new \ReflectionClass($member->memberClass));
-		$enumReflect = new \ReflectionClass($member->enumClass);
-		$paramTypehint = makeTypehint($namespaceName, $enumReflect);
-
-		$memberLines[] = sprintf(" * @method static %s %s(%s \$%s)", $returnTypehint, $accessor, $paramTypehint, lcfirst($enumReflect->getShortName()));
-	}
 	ksort($memberLines, SORT_STRING);

 	foreach($memberLines as $line){
@ -123,7 +107,7 @@ function processFile(string $file) : void{
 	}
 	echo "Found registry in $file\n";

-	$replacement = generateMethodAnnotations($matches[1], $className::getAll(), $className::getAllOverloaded());
+	$replacement = generateMethodAnnotations($matches[1], $className::getAll());

 	$newContents = str_replace($docComment, $replacement, $contents);
 	if($newContents !== $contents){
--- a/changelogs/5.25.md
+++ b/changelogs/5.25.md
@ -36,3 +36,17 @@ It also allows creating new collapsible groups of items, and modifying or removi
 - `BedrockDataFiles` now includes constants for folders at the top level of `BedrockData` as well as files.
 - The structure of creative data in `BedrockData` was changed to accommodate item category and grouping information. `creativeitems.json` has been replaced by `creative/*.json`, which contain information about item grouping and also segregates item lists per category.
 - New information was added to `required_item_list.json` in `BedrockData`, as the server is now required to send item component NBT data in some cases.
+
+# 5.25.1
+Released 26th February 2025.
+
+## Fixes
+- Fixed confusing exception message when a block-breaking tool has an efficiency value of zero.
+- Fixed incorrect facing of doors since 1.21.60 (resulted in mismatched AABBs between client & server, rendering glitches etc.)
+- Resource pack UUIDs are now validated on load. Previously, invalid UUIDs would be accepted, and potentially cause a server crash on player join.
+
+# 5.25.2
+Released 4th March 2025.
+
+## Fixes
+- Added limits to various `explode()` calls.
--- a/composer.json
+++ b/composer.json
@ -37,14 +37,14 @@
      "pocketmine/bedrock-data": "~4.0.0+bedrock-1.21.60",
      "pocketmine/bedrock-item-upgrade-schema": "~1.14.0+bedrock-1.21.50",
      "pocketmine/bedrock-protocol": "~36.0.0+bedrock-1.21.60",
-      "pocketmine/binaryutils": "^0.2.1",
+      "pocketmine/binaryutils": "dev-experimental/read-ops-accounting as 0.2.6",
      "pocketmine/callback-validator": "^1.0.2",
      "pocketmine/color": "^0.3.0",
      "pocketmine/errorhandler": "^0.7.0",
      "pocketmine/locale-data": "~2.24.0",
      "pocketmine/log": "^0.4.0",
      "pocketmine/math": "~1.0.0",
-      "pocketmine/nbt": "~1.1.0",
+      "pocketmine/nbt": "~1.0.0",
      "pocketmine/raklib": "~1.1.0",
      "pocketmine/raklib-ipc": "~1.0.0",
      "pocketmine/snooze": "^0.5.0",
@ -52,7 +52,7 @@
      "symfony/filesystem": "~6.4.0"
   },
   "require-dev": {
-      "phpstan/phpstan": "2.1.4",
+      "phpstan/phpstan": "2.1.6",
      "phpstan/phpstan-phpunit": "^2.0.0",
      "phpstan/phpstan-strict-rules": "^2.0.0",
      "phpunit/phpunit": "^10.5.24"
--- a/composer.lock
+++ b/composer.lock
@ -4,7 +4,7 @@
        "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
        "This file is @generated automatically"
    ],
-    "content-hash": "663122b8f03ef5ec6718a419923a0851",
+    "content-hash": "415cb668882a32039066467bb308421f",
    "packages": [
        {
            "name": "adhocore/json-comment",
@ -67,16 +67,16 @@
        },
        {
            "name": "brick/math",
-            "version": "0.12.1",
+            "version": "0.12.2",
            "source": {
                "type": "git",
                "url": "https://github.com/brick/math.git",
-                "reference": "f510c0a40911935b77b86859eb5223d58d660df1"
+                "reference": "901eddb1e45a8e0f689302e40af871c181ecbe40"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/brick/math/zipball/f510c0a40911935b77b86859eb5223d58d660df1",
-                "reference": "f510c0a40911935b77b86859eb5223d58d660df1",
+                "url": "https://api.github.com/repos/brick/math/zipball/901eddb1e45a8e0f689302e40af871c181ecbe40",
+                "reference": "901eddb1e45a8e0f689302e40af871c181ecbe40",
                "shasum": ""
            },
            "require": {
@ -85,7 +85,7 @@
            "require-dev": {
                "php-coveralls/php-coveralls": "^2.2",
                "phpunit/phpunit": "^10.1",
-                "vimeo/psalm": "5.16.0"
+                "vimeo/psalm": "6.8.8"
            },
            "type": "library",
            "autoload": {
@ -115,7 +115,7 @@
            ],
            "support": {
                "issues": "https://github.com/brick/math/issues",
-                "source": "https://github.com/brick/math/tree/0.12.1"
+                "source": "https://github.com/brick/math/tree/0.12.2"
            },
            "funding": [
                {
@ -123,7 +123,7 @@
                    "type": "github"
                }
            ],
-            "time": "2023-11-29T23:19:16+00:00"
+            "time": "2025-02-26T10:21:45+00:00"
        },
        {
            "name": "netresearch/jsonmapper",
@ -302,16 +302,16 @@
        },
        {
            "name": "pocketmine/binaryutils",
-            "version": "0.2.6",
+            "version": "dev-experimental/read-ops-accounting",
            "source": {
                "type": "git",
                "url": "https://github.com/pmmp/BinaryUtils.git",
-                "reference": "ccfc1899b859d45814ea3592e20ebec4cb731c84"
+                "reference": "8cfa34c9d5aae11886a4142c172cff05f1e87ee2"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/pmmp/BinaryUtils/zipball/ccfc1899b859d45814ea3592e20ebec4cb731c84",
-                "reference": "ccfc1899b859d45814ea3592e20ebec4cb731c84",
+                "url": "https://api.github.com/repos/pmmp/BinaryUtils/zipball/8cfa34c9d5aae11886a4142c172cff05f1e87ee2",
+                "reference": "8cfa34c9d5aae11886a4142c172cff05f1e87ee2",
                "shasum": ""
            },
            "require": {
@ -320,9 +320,9 @@
            },
            "require-dev": {
                "phpstan/extension-installer": "^1.0",
-                "phpstan/phpstan": "~1.10.3",
-                "phpstan/phpstan-phpunit": "^1.0",
-                "phpstan/phpstan-strict-rules": "^1.0.0",
+                "phpstan/phpstan": "2.1.0",
+                "phpstan/phpstan-phpunit": "^2.0",
+                "phpstan/phpstan-strict-rules": "^2.0.0",
                "phpunit/phpunit": "^9.5 || ^10.0 || ^11.0"
            },
            "type": "library",
@ -338,9 +338,9 @@
            "description": "Classes and methods for conveniently handling binary data",
            "support": {
                "issues": "https://github.com/pmmp/BinaryUtils/issues",
-                "source": "https://github.com/pmmp/BinaryUtils/tree/0.2.6"
+                "source": "https://github.com/pmmp/BinaryUtils/tree/experimental/read-ops-accounting"
            },
-            "time": "2024-03-04T15:04:17+00:00"
+            "time": "2025-03-11T11:50:46+00:00"
        },
        {
            "name": "pocketmine/callback-validator",
@ -576,16 +576,16 @@
        },
        {
            "name": "pocketmine/nbt",
-            "version": "1.1.0",
+            "version": "1.0.1",
            "source": {
                "type": "git",
                "url": "https://github.com/pmmp/NBT.git",
-                "reference": "cfd53a86166b851786967fc560cdb372e66fde96"
+                "reference": "53db37487bc5ddbfbd84247966e1a073bdcfdb7d"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/pmmp/NBT/zipball/cfd53a86166b851786967fc560cdb372e66fde96",
-                "reference": "cfd53a86166b851786967fc560cdb372e66fde96",
+                "url": "https://api.github.com/repos/pmmp/NBT/zipball/53db37487bc5ddbfbd84247966e1a073bdcfdb7d",
+                "reference": "53db37487bc5ddbfbd84247966e1a073bdcfdb7d",
                "shasum": ""
            },
            "require": {
@ -612,9 +612,9 @@
            "description": "PHP library for working with Named Binary Tags",
            "support": {
                "issues": "https://github.com/pmmp/NBT/issues",
-                "source": "https://github.com/pmmp/NBT/tree/1.1.0"
+                "source": "https://github.com/pmmp/NBT/tree/1.0.1"
            },
-            "time": "2025-02-01T21:20:26+00:00"
+            "time": "2025-01-07T22:47:46+00:00"
        },
        {
            "name": "pocketmine/raklib",
@ -1150,16 +1150,16 @@
    "packages-dev": [
        {
            "name": "myclabs/deep-copy",
-            "version": "1.12.1",
+            "version": "1.13.0",
            "source": {
                "type": "git",
                "url": "https://github.com/myclabs/DeepCopy.git",
-                "reference": "123267b2c49fbf30d78a7b2d333f6be754b94845"
+                "reference": "024473a478be9df5fdaca2c793f2232fe788e414"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/myclabs/DeepCopy/zipball/123267b2c49fbf30d78a7b2d333f6be754b94845",
-                "reference": "123267b2c49fbf30d78a7b2d333f6be754b94845",
+                "url": "https://api.github.com/repos/myclabs/DeepCopy/zipball/024473a478be9df5fdaca2c793f2232fe788e414",
+                "reference": "024473a478be9df5fdaca2c793f2232fe788e414",
                "shasum": ""
            },
            "require": {
@ -1198,7 +1198,7 @@
            ],
            "support": {
                "issues": "https://github.com/myclabs/DeepCopy/issues",
-                "source": "https://github.com/myclabs/DeepCopy/tree/1.12.1"
+                "source": "https://github.com/myclabs/DeepCopy/tree/1.13.0"
            },
            "funding": [
                {
@ -1206,7 +1206,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2024-11-08T17:47:46+00:00"
+            "time": "2025-02-12T12:17:51+00:00"
        },
        {
            "name": "nikic/php-parser",
@ -1386,16 +1386,16 @@
        },
        {
            "name": "phpstan/phpstan",
-            "version": "2.1.4",
+            "version": "2.1.6",
            "source": {
                "type": "git",
                "url": "https://github.com/phpstan/phpstan.git",
-                "reference": "8f99e18eb775dbaf6460c95fa0b65312da9c746a"
+                "reference": "6eaec7c6c9e90dcfe46ad1e1ffa5171e2dab641c"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/8f99e18eb775dbaf6460c95fa0b65312da9c746a",
-                "reference": "8f99e18eb775dbaf6460c95fa0b65312da9c746a",
+                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/6eaec7c6c9e90dcfe46ad1e1ffa5171e2dab641c",
+                "reference": "6eaec7c6c9e90dcfe46ad1e1ffa5171e2dab641c",
                "shasum": ""
            },
            "require": {
@ -1440,7 +1440,7 @@
                    "type": "github"
                }
            ],
-            "time": "2025-02-10T08:25:21+00:00"
+            "time": "2025-02-19T15:46:42+00:00"
        },
        {
            "name": "phpstan/phpstan-phpunit",
@ -1864,16 +1864,16 @@
        },
        {
            "name": "phpunit/phpunit",
-            "version": "10.5.44",
+            "version": "10.5.45",
            "source": {
                "type": "git",
                "url": "https://github.com/sebastianbergmann/phpunit.git",
-                "reference": "1381c62769be4bb88fa4c5aec1366c7c66ca4f36"
+                "reference": "bd68a781d8e30348bc297449f5234b3458267ae8"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/sebastianbergmann/phpunit/zipball/1381c62769be4bb88fa4c5aec1366c7c66ca4f36",
-                "reference": "1381c62769be4bb88fa4c5aec1366c7c66ca4f36",
+                "url": "https://api.github.com/repos/sebastianbergmann/phpunit/zipball/bd68a781d8e30348bc297449f5234b3458267ae8",
+                "reference": "bd68a781d8e30348bc297449f5234b3458267ae8",
                "shasum": ""
            },
            "require": {
@ -1945,7 +1945,7 @@
            "support": {
                "issues": "https://github.com/sebastianbergmann/phpunit/issues",
                "security": "https://github.com/sebastianbergmann/phpunit/security/policy",
-                "source": "https://github.com/sebastianbergmann/phpunit/tree/10.5.44"
+                "source": "https://github.com/sebastianbergmann/phpunit/tree/10.5.45"
            },
            "funding": [
                {
@ -1961,7 +1961,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2025-01-31T07:00:38+00:00"
+            "time": "2025-02-06T16:08:12+00:00"
        },
        {
            "name": "sebastian/cli-parser",
@ -2930,9 +2930,18 @@
            "time": "2024-03-03T12:36:25+00:00"
        }
    ],
-    "aliases": [],
+    "aliases": [
+        {
+            "package": "pocketmine/binaryutils",
+            "version": "dev-experimental/read-ops-accounting",
+            "alias": "0.2.6",
+            "alias_normalized": "0.2.6.0"
+        }
+    ],
    "minimum-stability": "stable",
-    "stability-flags": [],
+    "stability-flags": {
+        "pocketmine/binaryutils": 20
+    },
    "prefer-stable": false,
    "prefer-lowest": false,
    "platform": {
--- a/phpstan.neon.dist
+++ b/phpstan.neon.dist
@ -13,6 +13,7 @@ rules:
 	- pocketmine\phpstan\rules\DeprecatedLegacyEnumAccessRule
 	- pocketmine\phpstan\rules\DisallowEnumComparisonRule
 	- pocketmine\phpstan\rules\DisallowForeachByReferenceRule
+	- pocketmine\phpstan\rules\ExplodeLimitRule
 	- pocketmine\phpstan\rules\UnsafeForeachArrayOfStringRule
 #	- pocketmine\phpstan\rules\ThreadedSupportedTypesRule

--- a/resources/pocketmine.yml
+++ b/resources/pocketmine.yml
@ -83,6 +83,29 @@ network:
  #DO NOT DISABLE THIS unless you understand the risks involved.
  enable-encryption: true

+  #EXPERIMENTAL! Limit packet read operations per network session.
+  #This is intended to stop exploitation of packets with arrays in them.
+  #Note that enabling this system may cause players to be unexpectedly kicked, or it may fail to stop attackers.
+  #As of March 2025, the system is still in development and subject to change.
+  packet-read-ops-limit:
+    #What to do when a session's read ops budget is depleted.
+    #Supported actions are "none", "warn" and "kick".
+    deplete-action: warn
+
+    #How many backlog ticks to budget for. 200 allows for a 10-second network lag spike, or a small number of complex
+    #packets.
+    session-budget-ticks: 200
+
+    #How much to top up each session's read operations budget per tick. Recommended to set this to about 2x the
+    #average number of read operations per tick per session.
+    #Exceeding this value won't cause any action to be taken. However, consistently exceeding it will cause the
+    #session's budget to be depleted, resulting in action being taken.
+    session-budget-per-tick: 100
+
+    #Whether to collect stats for debugging. This might impact performance.
+    #See NetworkSession::dumpDecodeCostStats() if you want to visualize the stats yourself.
+    collect-stats: false
+
 debug:
  #If > 1, it will show debug messages in the console
  level: 1
--- a/src/PocketMine.php
+++ b/src/PocketMine.php
@ -264,7 +264,7 @@ JIT_WARNING
 		$composerGitHash = InstalledVersions::getReference('pocketmine/pocketmine-mp');
 		if($composerGitHash !== null){
 			//we can't verify dependency versions if we were installed without using git
-			$currentGitHash = explode("-", VersionInfo::GIT_HASH())[0];
+			$currentGitHash = explode("-", VersionInfo::GIT_HASH(), 2)[0];
 			if($currentGitHash !== $composerGitHash){
 				critical_error("Composer dependencies and/or autoloader are out of sync.");
 				critical_error("- Current revision is $currentGitHash");
--- a/src/Server.php
+++ b/src/Server.php
@ -699,7 +699,7 @@ class Server{

 	public function removeOp(string $name) : void{
 		$lowercaseName = strtolower($name);
-		foreach($this->operators->getAll() as $operatorName => $_){
+		foreach(Utils::promoteKeys($this->operators->getAll()) as $operatorName => $_){
 			$operatorName = (string) $operatorName;
 			if($lowercaseName === strtolower($operatorName)){
 				$this->operators->remove($operatorName);
--- a/src/VersionInfo.php
+++ b/src/VersionInfo.php
@ -31,7 +31,7 @@ use function str_repeat;

 final class VersionInfo{
 	public const NAME = "PocketMine-MP";
-	public const BASE_VERSION = "5.25.1";
+	public const BASE_VERSION = "5.25.3";
 	public const IS_DEVELOPMENT_BUILD = true;
 	public const BUILD_CHANNEL = "stable";

--- a/src/YmlServerProperties.php
+++ b/src/YmlServerProperties.php
@ -90,6 +90,11 @@ final class YmlServerProperties{
 	public const NETWORK_COMPRESSION_LEVEL = 'network.compression-level';
 	public const NETWORK_ENABLE_ENCRYPTION = 'network.enable-encryption';
 	public const NETWORK_MAX_MTU_SIZE = 'network.max-mtu-size';
+	public const NETWORK_PACKET_READ_OPS_LIMIT = 'network.packet-read-ops-limit';
+	public const NETWORK_PACKET_READ_OPS_LIMIT_COLLECT_STATS = 'network.packet-read-ops-limit.collect-stats';
+	public const NETWORK_PACKET_READ_OPS_LIMIT_DEPLETE_ACTION = 'network.packet-read-ops-limit.deplete-action';
+	public const NETWORK_PACKET_READ_OPS_LIMIT_SESSION_BUDGET_PER_TICK = 'network.packet-read-ops-limit.session-budget-per-tick';
+	public const NETWORK_PACKET_READ_OPS_LIMIT_SESSION_BUDGET_TICKS = 'network.packet-read-ops-limit.session-budget-ticks';
 	public const NETWORK_UPNP_FORWARDING = 'network.upnp-forwarding';
 	public const PLAYER = 'player';
 	public const PLAYER_SAVE_PLAYER_DATA = 'player.save-player-data';
--- a/src/block/BlockBreakInfo.php
+++ b/src/block/BlockBreakInfo.php
@ -154,7 +154,7 @@ class BlockBreakInfo{

 		$efficiency = $item->getMiningEfficiency(($this->toolType & $item->getBlockToolType()) !== 0);
 		if($efficiency <= 0){
-			throw new \InvalidArgumentException(get_class($item) . " has invalid mining efficiency: expected >= 0, got $efficiency");
+			throw new \InvalidArgumentException(get_class($item) . " must have a positive mining efficiency, but got $efficiency");
 		}

 		$base /= $efficiency;
--- a/src/block/ChorusPlant.php
+++ b/src/block/ChorusPlant.php
@ -34,16 +34,11 @@ use function mt_rand;
 final class ChorusPlant extends Flowable{
 	use StaticSupportTrait;

-	/**
-	 * @var true[]
-	 * @phpstan-var array<int, true>
-	 */
-	protected array $connections = [];
-
 	protected function recalculateCollisionBoxes() : array{
 		$bb = AxisAlignedBB::one();
-		foreach(Facing::ALL as $facing){
-			if(!isset($this->connections[$facing])){
+		foreach($this->getAllSides() as $facing => $block){
+			$id = $block->getTypeId();
+			if($id !== BlockTypeIds::END_STONE && $id !== BlockTypeIds::CHORUS_FLOWER && !$block->hasSameTypeId($this)){
 				$bb->trim($facing, 2 / 16);
 			}
 		}
@ -51,26 +46,6 @@ final class ChorusPlant extends Flowable{
 		return [$bb];
 	}

-	public function readStateFromWorld() : Block{
-		parent::readStateFromWorld();
-
-		$this->collisionBoxes = null;
-
-		foreach(Facing::ALL as $facing){
-			$block = $this->getSide($facing);
-			if(match($block->getTypeId()){
-				BlockTypeIds::END_STONE, BlockTypeIds::CHORUS_FLOWER, $this->getTypeId() => true,
-				default => false
-			}){
-				$this->connections[$facing] = true;
-			}else{
-				unset($this->connections[$facing]);
-			}
-		}
-
-		return $this;
-	}
-
 	private function canBeSupportedBy(Block $block) : bool{
 		return $block->hasSameTypeId($this) || $block->getTypeId() === BlockTypeIds::END_STONE;
 	}
--- a/src/block/RuntimeBlockStateRegistry.php
+++ b/src/block/RuntimeBlockStateRegistry.php
@ -28,7 +28,6 @@ use pocketmine\block\BlockIdentifier as BID;
 use pocketmine\utils\AssumptionFailedError;
 use pocketmine\utils\SingletonTrait;
 use pocketmine\world\light\LightUpdate;
-use function count;
 use function min;

 /**
@ -41,11 +40,6 @@ use function min;
 class RuntimeBlockStateRegistry{
 	use SingletonTrait;

-	public const COLLISION_CUSTOM = 0;
-	public const COLLISION_CUBE = 1;
-	public const COLLISION_NONE = 2;
-	public const COLLISION_MAY_OVERFLOW = 3;
-
 	/**
 	 * @var Block[]
 	 * @phpstan-var array<int, Block>
@ -80,13 +74,6 @@ class RuntimeBlockStateRegistry{
 	 */
 	public array $blastResistance = [];

-	/**
-	 * Map of state ID -> useful AABB info to avoid unnecessary block allocations
-	 * @var int[]
-	 * @phpstan-var array<int, int>
-	 */
-	public array $collisionInfo = [];
-
 	public function __construct(){
 		foreach(VanillaBlocks::getAll() as $block){
 			$this->register($block);
@ -113,70 +100,6 @@ class RuntimeBlockStateRegistry{
 		}
 	}

-	/**
-	 * Checks if the given class method overrides a method in Block.
-	 * Used to determine if a block might need to disable fast path optimizations.
-	 *
-	 * @phpstan-param anyClosure $closure
-	 */
-	private static function overridesBlockMethod(\Closure $closure) : bool{
-		$declarer = (new \ReflectionFunction($closure))->getClosureScopeClass();
-		return $declarer !== null && $declarer->getName() !== Block::class;
-	}
-
-	/**
-	 * A big ugly hack to set up fast paths for handling collisions on blocks with common shapes.
-	 * The information returned here is stored in RuntimeBlockStateRegistry->collisionInfo, and is used during entity
-	 * collision box calculations to avoid complex logic and unnecessary block object allocations.
-	 * This hack allows significant performance improvements.
-	 *
-	 * TODO: We'll want to redesign block collision box handling and block shapes in the future, but that's a job for a
-	 * major version. For now, this hack nets major performance wins.
-	 */
-	private static function calculateCollisionInfo(Block $block) : int{
-		if(
-			self::overridesBlockMethod($block->getModelPositionOffset(...)) ||
-			self::overridesBlockMethod($block->readStateFromWorld(...))
-		){
-			//getModelPositionOffset() might cause AABBs to shift outside the cell
-			//readStateFromWorld() might cause overflow in ways we can't predict just by looking at known states
-			//TODO: excluding overriders of readStateFromWorld() also excludes blocks with tiles that don't do anything
-			//weird with their AABBs, but for now this is the best we can do.
-			return self::COLLISION_MAY_OVERFLOW;
-		}
-
-		//TODO: this could blow up if any recalculateCollisionBoxes() uses the world
-		//it shouldn't, but that doesn't mean that custom blocks won't...
-		$boxes = $block->getCollisionBoxes();
-		if(count($boxes) === 0){
-			return self::COLLISION_NONE;
-		}
-
-		if(
-			count($boxes) === 1 &&
-			$boxes[0]->minX === 0.0 &&
-			$boxes[0]->minY === 0.0 &&
-			$boxes[0]->minZ === 0.0 &&
-			$boxes[0]->maxX === 1.0 &&
-			$boxes[0]->maxY === 1.0 &&
-			$boxes[0]->maxZ === 1.0
-		){
-			return self::COLLISION_CUBE;
-		}
-
-		foreach($boxes as $box){
-			if(
-				$box->minX < 0 || $box->maxX > 1 ||
-				$box->minY < 0 || $box->maxY > 1 ||
-				$box->minZ < 0 || $box->maxZ > 1
-			){
-				return self::COLLISION_MAY_OVERFLOW;
-			}
-		}
-
-		return self::COLLISION_CUSTOM;
-	}
-
 	private function fillStaticArrays(int $index, Block $block) : void{
 		$fullId = $block->getStateId();
 		if($index !== $fullId){
@ -189,8 +112,6 @@ class RuntimeBlockStateRegistry{
 			if($block->blocksDirectSkyLight()){
 				$this->blocksDirectSkyLight[$index] = true;
 			}
-
-			$this->collisionInfo[$index] = self::calculateCollisionInfo($block);
 		}
 	}

--- a/src/block/VanillaBlocks.php
+++ b/src/block/VanillaBlocks.php
@ -79,10 +79,6 @@ use function strtolower;
 * @see build/generate-registry-annotations.php
 * @generate-registry-docblock
 *
- * @method static Sapling SAPLING(\pocketmine\block\utils\SaplingType $saplingType)
- * @method static Leaves LEAVES(\pocketmine\block\utils\LeavesType $leavesType)
- * @method static FloorSign SIGN(\pocketmine\block\utils\WoodType $woodType)
- * @method static WallSign WALL_SIGN(\pocketmine\block\utils\WoodType $woodType)
 * @method static WoodenButton ACACIA_BUTTON()
 * @method static WoodenDoor ACACIA_DOOR()
 * @method static WoodenFence ACACIA_FENCE()
@ -1235,12 +1231,10 @@ final class VanillaBlocks{
 			$name = $saplingType->getDisplayName();
 			self::register(strtolower($saplingType->name) . "_sapling", fn(BID $id) => new Sapling($id, $name . " Sapling", $saplingTypeInfo, $saplingType));
 		}
-		self::registerOverloaded("sapling", SaplingType::class, Sapling::class);
 		foreach(LeavesType::cases() as $leavesType){
 			$name = $leavesType->getDisplayName();
 			self::register(strtolower($leavesType->name) . "_leaves", fn(BID $id) => new Leaves($id, $name . " Leaves", $leavesBreakInfo, $leavesType));
 		}
-		self::registerOverloaded("leaves", LeavesType::class, Leaves::class);

 		$sandstoneBreakInfo = new Info(BreakInfo::pickaxe(0.8, ToolTier::WOOD));
 		self::register("red_sandstone_stairs", fn(BID $id) => new Stair($id, "Red Sandstone Stairs", $sandstoneBreakInfo));
@ -1376,12 +1370,22 @@ final class VanillaBlocks{
 			self::register($idName("pressure_plate"), fn(BID $id) => new WoodenPressurePlate($id, $name . " Pressure Plate", $woodenPressurePlateBreakInfo, $woodType, 20));
 			self::register($idName("trapdoor"), fn(BID $id) => new WoodenTrapdoor($id, $name . " Trapdoor", $woodenDoorBreakInfo, $woodType));

-			$signAsItem = fn() => VanillaItems::SIGN($woodType);
+			$signAsItem = match($woodType){
+				WoodType::OAK => VanillaItems::OAK_SIGN(...),
+				WoodType::SPRUCE => VanillaItems::SPRUCE_SIGN(...),
+				WoodType::BIRCH => VanillaItems::BIRCH_SIGN(...),
+				WoodType::JUNGLE => VanillaItems::JUNGLE_SIGN(...),
+				WoodType::ACACIA => VanillaItems::ACACIA_SIGN(...),
+				WoodType::DARK_OAK => VanillaItems::DARK_OAK_SIGN(...),
+				WoodType::MANGROVE => VanillaItems::MANGROVE_SIGN(...),
+				WoodType::CRIMSON => VanillaItems::CRIMSON_SIGN(...),
+				WoodType::WARPED => VanillaItems::WARPED_SIGN(...),
+				WoodType::CHERRY => VanillaItems::CHERRY_SIGN(...),
+				WoodType::PALE_OAK => VanillaItems::PALE_OAK_SIGN(...),
+			};
 			self::register($idName("sign"), fn(BID $id) => new FloorSign($id, $name . " Sign", $signBreakInfo, $woodType, $signAsItem), TileSign::class);
 			self::register($idName("wall_sign"), fn(BID $id) => new WallSign($id, $name . " Wall Sign", $signBreakInfo, $woodType, $signAsItem), TileSign::class);
 		}
-		self::registerOverloaded("sign", WoodType::class, FloorSign::class);
-		self::registerOverloaded("wall_sign", WoodType::class, WallSign::class);
 	}

 	private static function registerMushroomBlocks() : void{
--- a/src/block/tile/Sign.php
+++ b/src/block/tile/Sign.php
@ -62,9 +62,10 @@ class Sign extends Spawnable{

 	/**
 	 * @return string[]
+	 * @deprecated
 	 */
 	public static function fixTextBlob(string $blob) : array{
-		return array_slice(array_pad(explode("\n", $blob), 4, ""), 0, 4);
+		return array_slice(array_pad(explode("\n", $blob, limit: 5), 4, ""), 0, 4);
 	}

 	protected SignText $text;
--- a/src/block/utils/SignText.php
+++ b/src/block/utils/SignText.php
@ -79,7 +79,7 @@ class SignText{
 	 * @throws \InvalidArgumentException if the text is not valid UTF-8
 	 */
 	public static function fromBlob(string $blob, ?Color $baseColor = null, bool $glowing = false) : SignText{
-		return new self(array_slice(array_pad(explode("\n", $blob), self::LINE_COUNT, ""), 0, self::LINE_COUNT), $baseColor, $glowing);
+		return new self(array_slice(array_pad(explode("\n", $blob, limit: self::LINE_COUNT + 1), self::LINE_COUNT, ""), 0, self::LINE_COUNT), $baseColor, $glowing);
 	}

 	/**
--- a/src/command/Command.php
+++ b/src/command/Command.php
@ -37,6 +37,7 @@ use function array_values;
 use function explode;
 use function implode;
 use function str_replace;
+use const PHP_INT_MAX;

 abstract class Command{

@ -113,7 +114,7 @@ abstract class Command{
 	}

 	public function setPermission(?string $permission) : void{
-		$this->setPermissions($permission === null ? [] : explode(";", $permission));
+		$this->setPermissions($permission === null ? [] : explode(";", $permission, limit: PHP_INT_MAX));
 	}

 	public function testPermission(CommandSender $target, ?string $permission = null) : bool{
--- a/src/command/defaults/HelpCommand.php
+++ b/src/command/defaults/HelpCommand.php
@ -39,6 +39,7 @@ use function ksort;
 use function min;
 use function sort;
 use function strtolower;
+use const PHP_INT_MAX;
 use const SORT_FLAG_CASE;
 use const SORT_NATURAL;

@ -108,7 +109,7 @@ class HelpCommand extends VanillaCommand{

 					$usage = $cmd->getUsage();
 					$usageString = $usage instanceof Translatable ? $lang->translate($usage) : $usage;
-					$sender->sendMessage(KnownTranslationFactory::pocketmine_command_help_specificCommand_usage(TextFormat::RESET . implode("\n" . TextFormat::RESET, explode("\n", $usageString)))
+					$sender->sendMessage(KnownTranslationFactory::pocketmine_command_help_specificCommand_usage(TextFormat::RESET . implode("\n" . TextFormat::RESET, explode("\n", $usageString, limit: PHP_INT_MAX)))
 						->prefix(TextFormat::GOLD));

 					$aliases = $cmd->getAliases();
--- a/src/command/defaults/ParticleCommand.php
+++ b/src/command/defaults/ParticleCommand.php
@ -219,7 +219,11 @@ class ParticleCommand extends VanillaCommand{
 				break;
 			case "blockdust":
 				if($data !== null){
-					$d = explode("_", $data);
+					//to preserve the old unlimited explode behaviour, allow this to split into at most 5 parts
+					//this allows the 4th argument to be processed normally if given without forcing it to also consume
+					//any unexpected parts
+					//we probably ought to error in this case, but this will do for now
+					$d = explode("_", $data, limit: 5);
 					if(count($d) >= 3){
 						return new DustParticle(new Color(
 							((int) $d[0]) & 0xff,
--- a/src/console/ConsoleCommandSender.php
+++ b/src/console/ConsoleCommandSender.php
@ -62,7 +62,7 @@ class ConsoleCommandSender implements CommandSender{
 			$message = $this->getLanguage()->translate($message);
 		}

-		foreach(explode("\n", trim($message)) as $line){
+		foreach(explode("\n", trim($message), limit: PHP_INT_MAX) as $line){
 			Terminal::writeLine(TextFormat::GREEN . "Command output | " . TextFormat::addBase(TextFormat::WHITE, $line));
 		}
 	}
--- a/src/crafting/ShapedRecipe.php
+++ b/src/crafting/ShapedRecipe.php
@ -97,6 +97,7 @@ class ShapedRecipe implements CraftingRecipe{

 		$this->shape = $shape;

+		Utils::validateArrayValueType($ingredients, function(RecipeIngredient $_) : void{});
 		foreach(Utils::stringifyKeys($ingredients) as $char => $i){
 			if(!str_contains(implode($this->shape), $char)){
 				throw new \InvalidArgumentException("Symbol '$char' does not appear in the recipe shape");
@ -105,6 +106,7 @@ class ShapedRecipe implements CraftingRecipe{
 			$this->ingredientList[$char] = clone $i;
 		}

+		Utils::validateArrayValueType($results, function(Item $_) : void{});
 		$this->results = Utils::cloneObjectArray($results);
 	}

--- a/src/crafting/ShapelessRecipe.php
+++ b/src/crafting/ShapelessRecipe.php
@ -53,7 +53,9 @@ class ShapelessRecipe implements CraftingRecipe{
 		if(count($ingredients) > 9){
 			throw new \InvalidArgumentException("Shapeless recipes cannot have more than 9 ingredients");
 		}
+		Utils::validateArrayValueType($ingredients, function(RecipeIngredient $_) : void{});
 		$this->ingredients = $ingredients;
+		Utils::validateArrayValueType($results, function(Item $_) : void{});
 		$this->results = Utils::cloneObjectArray($results);
 	}

--- a/src/data/bedrock/block/convert/BlockStateDeserializerHelper.php
+++ b/src/data/bedrock/block/convert/BlockStateDeserializerHelper.php
@ -131,7 +131,8 @@ final class BlockStateDeserializerHelper{
 		//TODO: check if these need any special treatment to get the appropriate data to both halves of the door
 		return $block
 			->setTop($in->readBool(BlockStateNames::UPPER_BLOCK_BIT))
-			->setFacing($in->readCardinalHorizontalFacing())
+			//a door facing "east" is actually facing north - thanks mojang
+			->setFacing(Facing::rotateY($in->readCardinalHorizontalFacing(), clockwise: false))
 			->setHingeRight($in->readBool(BlockStateNames::DOOR_HINGE_BIT))
 			->setOpen($in->readBool(BlockStateNames::OPEN_BIT));
 	}
--- a/src/data/bedrock/block/convert/BlockStateSerializerHelper.php
+++ b/src/data/bedrock/block/convert/BlockStateSerializerHelper.php
@ -100,7 +100,8 @@ final class BlockStateSerializerHelper{
 	public static function encodeDoor(Door $block, Writer $out) : Writer{
 		return $out
 			->writeBool(BlockStateNames::UPPER_BLOCK_BIT, $block->isTop())
-			->writeCardinalHorizontalFacing($block->getFacing())
+			//a door facing north is encoded as "east"
+			->writeCardinalHorizontalFacing(Facing::rotateY($block->getFacing(), clockwise: true))
 			->writeBool(BlockStateNames::DOOR_HINGE_BIT, $block->isHingeRight())
 			->writeBool(BlockStateNames::OPEN_BIT, $block->isOpen());
 	}
--- a/src/data/bedrock/block/convert/BlockStateToObjectDeserializer.php
+++ b/src/data/bedrock/block/convert/BlockStateToObjectDeserializer.php
@ -103,18 +103,10 @@ final class BlockStateToObjectDeserializer implements BlockStateDeserializer{

 	/** @phpstan-param \Closure(Reader) : Block $c */
 	public function map(string $id, \Closure $c) : void{
+		if(array_key_exists($id, $this->deserializeFuncs)){
+			throw new \InvalidArgumentException("Deserializer is already assigned for \"$id\"");
+		}
 		$this->deserializeFuncs[$id] = $c;
-		$this->simpleCache = [];
-	}
-
-	/**
-	 * Returns the existing data deserializer for the given ID, or null if none exists.
-	 * This may be useful if you need to override a deserializer, but still want to be able to fall back to the original.
-	 *
-	 * @phpstan-return ?\Closure(Reader) : Block
-	 */
-	public function getDeserializerForId(string $id) : ?\Closure{
-		return $this->deserializeFuncs[$id] ?? null;
 	}

 	/** @phpstan-param \Closure() : Block $getBlock */
--- a/src/data/bedrock/item/ItemDeserializer.php
+++ b/src/data/bedrock/item/ItemDeserializer.php
@ -51,19 +51,12 @@ final class ItemDeserializer{
 	 * @phpstan-param \Closure(Data) : Item $deserializer
 	 */
 	public function map(string $id, \Closure $deserializer) : void{
+		if(isset($this->deserializers[$id])){
+			throw new \InvalidArgumentException("Deserializer is already assigned for \"$id\"");
+		}
 		$this->deserializers[$id] = $deserializer;
 	}

-	/**
-	 * Returns the existing data deserializer for the given ID, or null if none exists.
-	 * This may be useful if you need to override a deserializer, but still want to be able to fall back to the original.
-	 *
-	 * @phpstan-return ?\Closure(Data) : Item
-	 */
-	public function getDeserializerForId(string $id) : ?\Closure{
-		return $this->deserializers[$id] ?? null;
-	}
-
 	/**
 	 * @phpstan-param \Closure(Data) : Block $deserializer
 	 */
--- a/src/entity/Entity.php
+++ b/src/entity/Entity.php
@ -1495,7 +1495,7 @@ abstract class Entity{
 			$this->getId(), //TODO: actor unique ID
 			$this->getId(),
 			static::getNetworkTypeId(),
-			$this->location->asVector3(),
+			$this->getOffsetPosition($this->location->asVector3()),
 			$this->getMotion(),
 			$this->location->pitch,
 			$this->location->yaw,
--- a/src/inventory/transaction/InventoryTransaction.php
+++ b/src/inventory/transaction/InventoryTransaction.php
@ -144,9 +144,8 @@ class InventoryTransaction{
 		$needItems = [];
 		$haveItems = [];
 		foreach($this->actions as $key => $action){
-			$targetItem = $action->getTargetItem();
-			if(!$targetItem->isNull()){
-				$needItems[] = $targetItem;
+			if(!$action->getTargetItem()->isNull()){
+				$needItems[] = $action->getTargetItem();
 			}

 			try{
@ -155,9 +154,8 @@ class InventoryTransaction{
 				throw new TransactionValidationException(get_class($action) . "#" . spl_object_id($action) . ": " . $e->getMessage(), 0, $e);
 			}

-			$sourceItem = $action->getSourceItem();
-			if(!$sourceItem->isNull()){
-				$haveItems[] = $sourceItem;
+			if(!$action->getSourceItem()->isNull()){
+				$haveItems[] = $action->getSourceItem();
 			}
 		}

--- a/src/item/LegacyStringToItemParser.php
+++ b/src/item/LegacyStringToItemParser.php
@ -111,7 +111,8 @@ final class LegacyStringToItemParser{
 	 */
 	public function parse(string $input) : Item{
 		$key = $this->reprocess($input);
-		$b = explode(":", $key);
+		//TODO: this should be limited to 2 parts, but 3 preserves old behaviour when given a string like 351:4:1
+		$b = explode(":", $key, limit: 3);

 		if(!isset($b[1])){
 			$meta = 0;
--- a/src/item/VanillaItems.php
+++ b/src/item/VanillaItems.php
@ -24,7 +24,6 @@ declare(strict_types=1);
 namespace pocketmine\item;

 use pocketmine\block\utils\RecordType;
-use pocketmine\block\utils\WoodType;
 use pocketmine\block\VanillaBlocks as Blocks;
 use pocketmine\entity\Entity;
 use pocketmine\entity\Location;
@ -48,8 +47,6 @@ use function strtolower;
 * @see build/generate-registry-annotations.php
 * @generate-registry-docblock
 *
- * @method static Boat BOAT(BoatType $boatType)
- * @method static ItemBlockWallOrFloor SIGN(\pocketmine\block\utils\WoodType $woodType)
 * @method static Boat ACACIA_BOAT()
 * @method static ItemBlockWallOrFloor ACACIA_SIGN()
 * @method static ItemBlock AIR()
@ -399,6 +396,7 @@ final class VanillaItems{
 		//in the future we'll probably want to dissociate this from the air block and make a proper null item
 		self::_registryRegister("air", Blocks::AIR()->asItem()->setCount(0));

+		self::register("acacia_sign", fn(IID $id) => new ItemBlockWallOrFloor($id, Blocks::ACACIA_SIGN(), Blocks::ACACIA_WALL_SIGN()));
 		self::register("amethyst_shard", fn(IID $id) => new Item($id, "Amethyst Shard"));
 		self::register("apple", fn(IID $id) => new Apple($id, "Apple"));
 		self::register("arrow", fn(IID $id) => new Arrow($id, "Arrow"));
@ -408,6 +406,7 @@ final class VanillaItems{
 		self::register("beetroot", fn(IID $id) => new Beetroot($id, "Beetroot"));
 		self::register("beetroot_seeds", fn(IID $id) => new BeetrootSeeds($id, "Beetroot Seeds"));
 		self::register("beetroot_soup", fn(IID $id) => new BeetrootSoup($id, "Beetroot Soup"));
+		self::register("birch_sign", fn(IID $id) => new ItemBlockWallOrFloor($id, Blocks::BIRCH_SIGN(), Blocks::BIRCH_WALL_SIGN()));
 		self::register("blaze_powder", fn(IID $id) => new Item($id, "Blaze Powder"));
 		self::register("blaze_rod", fn(IID $id) => new BlazeRod($id, "Blaze Rod"));
 		self::register("bleach", fn(IID $id) => new Item($id, "Bleach"));
@ -421,6 +420,7 @@ final class VanillaItems{
 		self::register("bucket", fn(IID $id) => new Bucket($id, "Bucket"));
 		self::register("carrot", fn(IID $id) => new Carrot($id, "Carrot"));
 		self::register("charcoal", fn(IID $id) => new Coal($id, "Charcoal"));
+		self::register("cherry_sign", fn(IID $id) => new ItemBlockWallOrFloor($id, Blocks::CHERRY_SIGN(), Blocks::CHERRY_WALL_SIGN()));
 		self::register("chemical_aluminium_oxide", fn(IID $id) => new Item($id, "Aluminium Oxide"));
 		self::register("chemical_ammonia", fn(IID $id) => new Item($id, "Ammonia"));
 		self::register("chemical_barium_sulphate", fn(IID $id) => new Item($id, "Barium Sulphate"));
@ -475,6 +475,8 @@ final class VanillaItems{
 		self::register("cookie", fn(IID $id) => new Cookie($id, "Cookie"));
 		self::register("copper_ingot", fn(IID $id) => new Item($id, "Copper Ingot"));
 		self::register("coral_fan", fn(IID $id) => new CoralFan($id));
+		self::register("crimson_sign", fn(IID $id) => new ItemBlockWallOrFloor($id, Blocks::CRIMSON_SIGN(), Blocks::CRIMSON_WALL_SIGN()));
+		self::register("dark_oak_sign", fn(IID $id) => new ItemBlockWallOrFloor($id, Blocks::DARK_OAK_SIGN(), Blocks::DARK_OAK_WALL_SIGN()));
 		self::register("diamond", fn(IID $id) => new Item($id, "Diamond"));
 		self::register("disc_fragment_5", fn(IID $id) => new Item($id, "Disc Fragment (5)"));
 		self::register("dragon_breath", fn(IID $id) => new Item($id, "Dragon's Breath"));
@ -514,10 +516,12 @@ final class VanillaItems{
 		self::register("ink_sac", fn(IID $id) => new Item($id, "Ink Sac"));
 		self::register("iron_ingot", fn(IID $id) => new Item($id, "Iron Ingot"));
 		self::register("iron_nugget", fn(IID $id) => new Item($id, "Iron Nugget"));
+		self::register("jungle_sign", fn(IID $id) => new ItemBlockWallOrFloor($id, Blocks::JUNGLE_SIGN(), Blocks::JUNGLE_WALL_SIGN()));
 		self::register("lapis_lazuli", fn(IID $id) => new Item($id, "Lapis Lazuli"));
 		self::register("lava_bucket", fn(IID $id) => new LiquidBucket($id, "Lava Bucket", Blocks::LAVA()));
 		self::register("leather", fn(IID $id) => new Item($id, "Leather"));
 		self::register("magma_cream", fn(IID $id) => new Item($id, "Magma Cream"));
+		self::register("mangrove_sign", fn(IID $id) => new ItemBlockWallOrFloor($id, Blocks::MANGROVE_SIGN(), Blocks::MANGROVE_WALL_SIGN()));
 		self::register("medicine", fn(IID $id) => new Medicine($id, "Medicine"));
 		self::register("melon", fn(IID $id) => new Melon($id, "Melon"));
 		self::register("melon_seeds", fn(IID $id) => new MelonSeeds($id, "Melon Seeds"));
@ -535,7 +539,9 @@ final class VanillaItems{
 		self::register("netherite_scrap", fn(IID $id) => new class($id, "Netherite Scrap") extends Item{
 			public function isFireProof() : bool{ return true; }
 		});
+		self::register("oak_sign", fn(IID $id) => new ItemBlockWallOrFloor($id, Blocks::OAK_SIGN(), Blocks::OAK_WALL_SIGN()));
 		self::register("painting", fn(IID $id) => new PaintingItem($id, "Painting"));
+		self::register("pale_oak_sign", fn(IID $id) => new ItemBlockWallOrFloor($id, Blocks::PALE_OAK_SIGN(), Blocks::PALE_OAK_WALL_SIGN()));
 		self::register("paper", fn(IID $id) => new Item($id, "Paper"));
 		self::register("phantom_membrane", fn(IID $id) => new Item($id, "Phantom Membrane"));
 		self::register("pitcher_pod", fn(IID $id) => new PitcherPod($id, "Pitcher Pod"));
@ -591,6 +597,7 @@ final class VanillaItems{
 		self::register("snowball", fn(IID $id) => new Snowball($id, "Snowball"));
 		self::register("spider_eye", fn(IID $id) => new SpiderEye($id, "Spider Eye"));
 		self::register("splash_potion", fn(IID $id) => new SplashPotion($id, "Splash Potion"));
+		self::register("spruce_sign", fn(IID $id) => new ItemBlockWallOrFloor($id, Blocks::SPRUCE_SIGN(), Blocks::SPRUCE_WALL_SIGN()));
 		self::register("spyglass", fn(IID $id) => new Spyglass($id, "Spyglass"));
 		self::register("steak", fn(IID $id) => new Steak($id, "Steak"));
 		self::register("stick", fn(IID $id) => new Stick($id, "Stick"));
@ -600,6 +607,7 @@ final class VanillaItems{
 		self::register("sweet_berries", fn(IID $id) => new SweetBerries($id, "Sweet Berries"));
 		self::register("torchflower_seeds", fn(IID $id) => new TorchflowerSeeds($id, "Torchflower Seeds"));
 		self::register("totem", fn(IID $id) => new Totem($id, "Totem of Undying"));
+		self::register("warped_sign", fn(IID $id) => new ItemBlockWallOrFloor($id, Blocks::WARPED_SIGN(), Blocks::WARPED_WALL_SIGN()));
 		self::register("water_bucket", fn(IID $id) => new LiquidBucket($id, "Water Bucket", Blocks::WATER()));
 		self::register("wheat", fn(IID $id) => new Item($id, "Wheat"));
 		self::register("wheat_seeds", fn(IID $id) => new WheatSeeds($id, "Wheat Seeds"));
@ -610,12 +618,6 @@ final class VanillaItems{
 			//boat type is static, because different types of wood may have different properties
 			self::register(strtolower($type->name) . "_boat", fn(IID $id) => new Boat($id, $type->getDisplayName() . " Boat", $type));
 		}
-		self::registerOverloaded("boat", BoatType::class, Boat::class);
-
-		foreach(WoodType::cases() as $woodType){
-			self::register("{$woodType->name}_sign", fn(IID $id) => new ItemBlockWallOrFloor($id, Blocks::SIGN($woodType), Blocks::WALL_SIGN($woodType)));
-		}
-		self::registerOverloaded("sign", WoodType::class, ItemBlockWallOrFloor::class);
 	}

 	private static function registerSpawnEggs() : void{
--- a/src/lang/Language.php
+++ b/src/lang/Language.php
@ -71,7 +71,7 @@ class Language{

 				foreach($files as $file){
 					try{
-						$code = explode(".", $file)[0];
+						$code = explode(".", $file, limit: 2)[0];
 						$strings = self::loadLang($path, $code);
 						if(isset($strings[KnownTranslationKeys::LANGUAGE_NAME])){
 							$result[$code] = $strings[KnownTranslationKeys::LANGUAGE_NAME];
--- a/src/network/mcpe/JwtUtils.php
+++ b/src/network/mcpe/JwtUtils.php
@ -72,9 +72,11 @@ final class JwtUtils{
 	 * @throws JwtException
 	 */
 	public static function split(string $jwt) : array{
-		$v = explode(".", $jwt);
+		//limit of 4 allows us to detect too many parts without having to split the string up into a potentially large
+		//number of parts
+		$v = explode(".", $jwt, limit: 4);
 		if(count($v) !== 3){
-			throw new JwtException("Expected exactly 3 JWT parts, got " . count($v));
+			throw new JwtException("Expected exactly 3 JWT parts delimited by a period");
 		}
 		return [$v[0], $v[1], $v[2]]; //workaround phpstan bug
 	}
--- a/src/network/mcpe/NetworkSession.php
+++ b/src/network/mcpe/NetworkSession.php
@ -113,10 +113,11 @@ use pocketmine\utils\BinaryDataException;
 use pocketmine\utils\BinaryStream;
 use pocketmine\utils\ObjectSet;
 use pocketmine\utils\TextFormat;
+use pocketmine\utils\Utils;
 use pocketmine\world\format\io\GlobalItemDataHandlers;
 use pocketmine\world\Position;
 use pocketmine\world\World;
-use pocketmine\YmlServerProperties;
+use pocketmine\YmlServerProperties as Yml;
 use function array_map;
 use function base64_encode;
 use function bin2hex;
@ -126,6 +127,9 @@ use function implode;
 use function in_array;
 use function is_string;
 use function json_encode;
+use function max;
+use function microtime;
+use function min;
 use function ord;
 use function random_bytes;
 use function str_split;
@ -136,6 +140,7 @@ use function substr;
 use function time;
 use function ucfirst;
 use const JSON_THROW_ON_ERROR;
+use const PHP_INT_MAX;

 class NetworkSession{
 	private const INCOMING_PACKET_BATCH_PER_TICK = 2; //usually max 1 per tick, but transactions arrive separately
@ -144,9 +149,17 @@ class NetworkSession{
 	private const INCOMING_GAME_PACKETS_PER_TICK = 2;
 	private const INCOMING_GAME_PACKETS_BUFFER_TICKS = 100;

+	private const READ_OPS_PER_TICK = 100; //subject to change
+	private const READ_OPS_BUFFER_TICKS = 200; //subject to change
+
 	private PacketRateLimiter $packetBatchLimiter;
 	private PacketRateLimiter $gamePacketLimiter;

+	private PacketRateLimiter $readOpsLimiter;
+	private PacketRateLimiterAction $readOpsLimiterAction;
+
+	private bool $readOpsStats;
+
 	private \PrefixedLogger $logger;
 	private ?Player $player = null;
 	private ?PlayerInfo $info = null;
@ -194,6 +207,28 @@ class NetworkSession{
 	 */
 	private ObjectSet $disposeHooks;

+	/**
+	 * @var int[]
+	 * @phpstan-var array<string, int>
+	 */
+	private array $readOpsPerPacketMin = [];
+	/**
+	 * @var int[]
+	 * @phpstan-var array<string, int>
+	 */
+	private array $readOpsPerPacketMax = [];
+	/**
+	 * @var int[]
+	 * @phpstan-var array<string, int>
+	 */
+	private array $readOpsPerPacketTotal = [];
+	/**
+	 * @var int[]
+	 * @phpstan-var array<string, int>
+	 */
+	private array $receivedPacketCounts = [];
+	private int $totalReadOpsUsed = 0;
+
 	public function __construct(
 		private Server $server,
 		private NetworkSessionManager $manager,
@ -216,6 +251,15 @@ class NetworkSession{
 		$this->packetBatchLimiter = new PacketRateLimiter("Packet Batches", self::INCOMING_PACKET_BATCH_PER_TICK, self::INCOMING_PACKET_BATCH_BUFFER_TICKS);
 		$this->gamePacketLimiter = new PacketRateLimiter("Game Packets", self::INCOMING_GAME_PACKETS_PER_TICK, self::INCOMING_GAME_PACKETS_BUFFER_TICKS);

+		$serverConfigGroup = $this->server->getConfigGroup();
+		$this->readOpsLimiter = new PacketRateLimiter(
+			"Packet Read Operations",
+			$serverConfigGroup->getPropertyInt(Yml::NETWORK_PACKET_READ_OPS_LIMIT_SESSION_BUDGET_PER_TICK, self::READ_OPS_PER_TICK),
+			$serverConfigGroup->getPropertyInt(Yml::NETWORK_PACKET_READ_OPS_LIMIT_SESSION_BUDGET_TICKS, self::READ_OPS_BUFFER_TICKS),
+		);
+		$this->readOpsLimiterAction = PacketRateLimiterAction::from($serverConfigGroup->getPropertyString(Yml::NETWORK_PACKET_READ_OPS_LIMIT_DEPLETE_ACTION, PacketRateLimiterAction::WARN->value));
+		$this->readOpsStats = $serverConfigGroup->getPropertyBool(Yml::NETWORK_PACKET_READ_OPS_LIMIT_COLLECT_STATS, false);
+
 		$this->setHandler(new SessionStartPacketHandler(
 			$this,
 			$this->onSessionStartSuccess(...)
@ -450,7 +494,36 @@ class NetworkSession{
 			try{
 				$stream = PacketSerializer::decoder($buffer, 0);
 				try{
-					$packet->decode($stream);
+					if($this->readOpsLimiterAction === PacketRateLimiterAction::NONE){
+						$packet->decode($stream);
+					}else{
+						$this->readOpsLimiter->update();
+						$stream->setReadOpsLimit(
+							$this->readOpsLimiterAction === PacketRateLimiterAction::KICK ?
+								$this->readOpsLimiter->getBudget() :
+								PHP_INT_MAX //don't bail out of decoding if we're only warning
+						);
+
+						$packet->decode($stream);
+						$readOps = $stream->getReadOps();
+						//If we exceeded the budget, a PacketDecodeException has already been thrown if we're in KICK
+						//mode, so we can assume we're in WARN mode here
+						if($this->readOpsLimiter->getBudget() < $readOps){
+							$this->getLogger()->warning("Decoding " . $packet->getName() . " exceeded read ops budget! $readOps > " . $this->readOpsLimiter->getBudget());
+							$this->readOpsLimiter->reset();
+						}else{
+							$this->readOpsLimiter->decrement($readOps);
+						}
+
+						if($this->readOpsStats){
+							$this->totalReadOpsUsed += $readOps;
+							$key = $packet->getName();
+							$this->readOpsPerPacketTotal[$key] = ($this->readOpsPerPacketTotal[$key] ?? 0) + $readOps;
+							$this->readOpsPerPacketMin[$key] = min($this->readOpsPerPacketMin[$key] ?? PHP_INT_MAX, $readOps);
+							$this->readOpsPerPacketMax[$key] = max($this->readOpsPerPacketMax[$key] ?? 0, $readOps);
+							$this->receivedPacketCounts[$key] = ($this->receivedPacketCounts[$key] ?? 0) + 1;
+						}
+					}
 				}catch(PacketDecodeException $e){
 					throw PacketHandlingException::wrap($e);
 				}
@ -483,6 +556,30 @@ class NetworkSession{
 		}
 	}

+	/**
+	 * @return int[]|float[]
+	 * @phpstan-return array<string, int|float|array<string, int|float>>
+	 */
+	public function dumpDecodeCostStats() : array{
+		if(!$this->readOpsStats){
+			throw new \LogicException("Not collecting stats for this session");
+		}
+		$sessionTime = microtime(true) - $this->connectTime;
+		$packetDecodeAverages = [];
+		$packetCostsPerSecondAverages = [];
+		foreach(Utils::stringifyKeys($this->readOpsPerPacketTotal) as $packet => $total){
+			$packetDecodeAverages[$packet] = $total / $this->receivedPacketCounts[$packet];
+			$packetCostsPerSecondAverages[$packet] = $total / $sessionTime;
+		}
+		return [
+			"readOpsAvgPerSecondTotal" => $this->totalReadOpsUsed / $sessionTime,
+			"readOpsAvgPerPacketPerSecond" => $packetCostsPerSecondAverages,
+			"readOpsAvgPerPacket" => $packetDecodeAverages,
+			"readOpsMinPerPacket" => $this->readOpsPerPacketMin,
+			"readOpsMaxPerPacket" => $this->readOpsPerPacketMax
+		];
+	}
+
 	public function handleAckReceipt(int $receiptId) : void{
 		if(!$this->connected){
 			return;
@ -857,7 +954,7 @@ class NetworkSession{
 		}
 		$this->logger->debug("Xbox Live authenticated: " . ($this->authenticated ? "YES" : "NO"));

-		$checkXUID = $this->server->getConfigGroup()->getPropertyBool(YmlServerProperties::PLAYER_VERIFY_XUID, true);
+		$checkXUID = $this->server->getConfigGroup()->getPropertyBool(Yml::PLAYER_VERIFY_XUID, true);
 		$myXUID = $this->info instanceof XboxLivePlayerInfo ? $this->info->getXuid() : "";
 		$kickForXUIDMismatch = function(string $xuid) use ($checkXUID, $myXUID) : bool{
 			if($checkXUID && $myXUID !== $xuid){
--- a/src/network/mcpe/PacketRateLimiter.php
+++ b/src/network/mcpe/PacketRateLimiter.php
@ -62,6 +62,14 @@ final class PacketRateLimiter{
 		$this->budget -= $amount;
 	}

+	public function getBudget() : int{
+		return $this->budget;
+	}
+
+	public function reset() : void{
+		$this->budget = $this->maxBudget;
+	}
+
 	public function update() : void{
 		$nowNs = hrtime(true);
 		$timeSinceLastUpdateNs = $nowNs - $this->lastUpdateTimeNs;
--- a/src/network/mcpe/PacketRateLimiterAction.php
+++ b/src/network/mcpe/PacketRateLimiterAction.php
@ -21,19 +21,10 @@

 declare(strict_types=1);

-namespace pocketmine\utils;
+namespace pocketmine\network\mcpe;

-final class OverloadedRegistryMember{
-
-	/**
-	 * @phpstan-template TMember of object
-	 * @phpstan-param class-string<covariant \UnitEnum> $enumClass
-	 * @phpstan-param class-string<TMember> $memberClass
-	 * @phpstan-param array<string, string> $enumToMemberMap
-	 */
-	public function __construct(
-		public readonly string $enumClass,
-		public readonly string $memberClass,
-		public readonly array $enumToMemberMap
-	){}
+enum PacketRateLimiterAction : string{
+	case NONE = "none";
+	case WARN = "warn";
+	case KICK = "kick";
 }
--- a/src/network/mcpe/cache/ChunkCache.php
+++ b/src/network/mcpe/cache/ChunkCache.php
@ -88,13 +88,9 @@ class ChunkCache implements ChunkListener{
 	private int $hits = 0;
 	private int $misses = 0;

-	/**
-	 * @phpstan-param DimensionIds::* $dimensionId
-	 */
 	private function __construct(
 		private World $world,
-		private Compressor $compressor,
-		private int $dimensionId = DimensionIds::OVERWORLD
+		private Compressor $compressor
 	){}

 	private function prepareChunkAsync(int $chunkX, int $chunkZ, int $chunkHash) : CompressBatchPromise{
@ -113,7 +109,7 @@ class ChunkCache implements ChunkListener{
 				new ChunkRequestTask(
 					$chunkX,
 					$chunkZ,
-					$this->dimensionId,
+					DimensionIds::OVERWORLD, //TODO: not hardcode this
 					$chunk,
 					$promise,
 					$this->compressor
--- a/src/permission/BanEntry.php
+++ b/src/permission/BanEntry.php
@ -148,7 +148,9 @@ class BanEntry{
 			return null;
 		}

-		$parts = explode("|", trim($str));
+		//we expect at most 5 parts, but accept 6 in case of an extra unexpected delimiter
+		//we don't want to include unexpected data into the ban reason
+		$parts = explode("|", trim($str), limit: 6);
 		$entry = new BanEntry(trim(array_shift($parts)));
 		if(count($parts) > 0){
 			$entry->setCreated(self::parseDate(array_shift($parts)));
--- a/src/player/SurvivalBlockBreakHandler.php
+++ b/src/player/SurvivalBlockBreakHandler.php
@ -25,8 +25,6 @@ namespace pocketmine\player;

 use pocketmine\block\Block;
 use pocketmine\entity\animation\ArmSwingAnimation;
-use pocketmine\entity\effect\VanillaEffects;
-use pocketmine\item\enchantment\VanillaEnchantments;
 use pocketmine\math\Facing;
 use pocketmine\math\Vector3;
 use pocketmine\network\mcpe\protocol\LevelEventPacket;
@ -67,29 +65,11 @@ final class SurvivalBlockBreakHandler{
 		if(!$this->block->getBreakInfo()->isBreakable()){
 			return 0.0;
 		}
+		//TODO: improve this to take stuff like swimming, ladders, enchanted tools into account, fix wrong tool break time calculations for bad tools (pmmp/PocketMine-MP#211)
 		$breakTimePerTick = $this->block->getBreakInfo()->getBreakTime($this->player->getInventory()->getItemInHand()) * 20;
-		if(!$this->player->isOnGround() && !$this->player->isFlying()){
-			$breakTimePerTick *= 5;
-		}
-		if($this->player->isUnderwater() && !$this->player->getArmorInventory()->getHelmet()->hasEnchantment(VanillaEnchantments::AQUA_AFFINITY())){
-			$breakTimePerTick *= 5;
-		}
+
 		if($breakTimePerTick > 0){
-			$progressPerTick = 1 / $breakTimePerTick;
-
-			$haste = $this->player->getEffects()->get(VanillaEffects::HASTE());
-			if($haste !== null){
-				$hasteLevel = $haste->getEffectLevel();
-				$progressPerTick *= (1 + 0.2 * $hasteLevel) * (1.2 ** $hasteLevel);
-			}
-
-			$miningFatigue = $this->player->getEffects()->get(VanillaEffects::MINING_FATIGUE());
-			if($miningFatigue !== null){
-				$miningFatigueLevel = $miningFatigue->getEffectLevel();
-				$progressPerTick *= 0.21 ** $miningFatigueLevel;
-			}
-
-			return $progressPerTick;
+			return 1 / $breakTimePerTick;
 		}
 		return 1;
 	}
@ -102,10 +82,7 @@ final class SurvivalBlockBreakHandler{
 		$newBreakSpeed = $this->calculateBreakProgressPerTick();
 		if(abs($newBreakSpeed - $this->breakSpeed) > 0.0001){
 			$this->breakSpeed = $newBreakSpeed;
-			$this->player->getWorld()->broadcastPacketToViewers(
-				$this->blockPos,
-				LevelEventPacket::create(LevelEvent::BLOCK_BREAK_SPEED, (int) (65535 * $this->breakSpeed), $this->blockPos)
-			);
+			//TODO: sync with client
 		}

 		$this->breakProgress += $this->breakSpeed;
--- a/src/resourcepacks/ResourcePackManager.php
+++ b/src/resourcepacks/ResourcePackManager.php
@ -26,6 +26,7 @@ namespace pocketmine\resourcepacks;
 use pocketmine\utils\Config;
 use pocketmine\utils\Filesystem;
 use pocketmine\utils\Utils;
+use Ramsey\Uuid\Uuid;
 use Symfony\Component\Filesystem\Path;
 use function array_keys;
 use function copy;
@ -103,9 +104,14 @@ class ResourcePackManager{
 			try{
 				$newPack = $this->loadPackFromPath(Path::join($this->path, $pack));

-				$this->resourcePacks[] = $newPack;
 				$index = strtolower($newPack->getPackId());
+				if(!Uuid::isValid($index)){
+					//TODO: we should use Uuid in ResourcePack interface directly but that would break BC
+					//for now we need to validate this here to make sure it doesn't cause crashes later on
+					throw new ResourcePackException("Invalid UUID ($index)");
+				}
 				$this->uuidList[$index] = $newPack;
+				$this->resourcePacks[] = $newPack;

 				$keyPath = Path::join($this->path, $pack . ".key");
 				if(file_exists($keyPath)){
@ -190,6 +196,11 @@ class ResourcePackManager{
 		$resourcePacks = [];
 		foreach($resourceStack as $pack){
 			$uuid = strtolower($pack->getPackId());
+			if(!Uuid::isValid($uuid)){
+				//TODO: we should use Uuid in ResourcePack interface directly but that would break BC
+				//for now we need to validate this here to make sure it doesn't cause crashes later on
+				throw new \InvalidArgumentException("Invalid resource pack UUID ($uuid)");
+			}
 			if(isset($uuidList[$uuid])){
 				throw new \InvalidArgumentException("Cannot load two resource pack with the same UUID ($uuid)");
 			}
--- a/src/utils/Config.php
+++ b/src/utils/Config.php
@ -54,6 +54,7 @@ use const CASE_LOWER;
 use const JSON_BIGINT_AS_STRING;
 use const JSON_PRETTY_PRINT;
 use const JSON_THROW_ON_ERROR;
+use const PHP_INT_MAX;
 use const YAML_UTF8_ENCODING;

 /**
@ -339,7 +340,7 @@ class Config{
 	}

 	public function setNested(string $key, mixed $value) : void{
-		$vars = explode(".", $key);
+		$vars = explode(".", $key, limit: PHP_INT_MAX);
 		$base = array_shift($vars);

 		if(!isset($this->config[$base])){
@ -366,7 +367,7 @@ class Config{
 			return $this->nestedCache[$key];
 		}

-		$vars = explode(".", $key);
+		$vars = explode(".", $key, limit: PHP_INT_MAX);
 		$base = array_shift($vars);
 		if(isset($this->config[$base])){
 			$base = $this->config[$base];
@ -390,7 +391,7 @@ class Config{
 		$this->nestedCache = [];
 		$this->changed = true;

-		$vars = explode(".", $key);
+		$vars = explode(".", $key, limit: PHP_INT_MAX);

 		$currentNode = &$this->config;
 		while(count($vars) > 0){
@ -495,7 +496,7 @@ class Config{
 	 */
 	public static function parseList(string $content) : array{
 		$result = [];
-		foreach(explode("\n", trim(str_replace("\r\n", "\n", $content))) as $v){
+		foreach(explode("\n", trim(str_replace("\r\n", "\n", $content)), limit: PHP_INT_MAX) as $v){
 			$v = trim($v);
 			if($v === ""){
 				continue;
--- a/src/utils/Internet.php
+++ b/src/utils/Internet.php
@ -60,6 +60,7 @@ use const CURLOPT_RETURNTRANSFER;
 use const CURLOPT_SSL_VERIFYHOST;
 use const CURLOPT_SSL_VERIFYPEER;
 use const CURLOPT_TIMEOUT_MS;
+use const PHP_INT_MAX;
 use const SOCK_DGRAM;
 use const SOL_UDP;

@ -227,9 +228,10 @@ class Internet{
 			$rawHeaders = substr($raw, 0, $headerSize);
 			$body = substr($raw, $headerSize);
 			$headers = [];
-			foreach(explode("\r\n\r\n", $rawHeaders) as $rawHeaderGroup){
+			//TODO: explore if we can set these limits lower
+			foreach(explode("\r\n\r\n", $rawHeaders, limit: PHP_INT_MAX) as $rawHeaderGroup){
 				$headerGroup = [];
-				foreach(explode("\r\n", $rawHeaderGroup) as $line){
+				foreach(explode("\r\n", $rawHeaderGroup, limit: PHP_INT_MAX) as $line){
 					$nameValue = explode(":", $line, 2);
 					if(isset($nameValue[1])){
 						$headerGroup[trim(strtolower($nameValue[0]))] = trim($nameValue[1]);
--- a/src/utils/RegistryTrait.php
+++ b/src/utils/RegistryTrait.php
@ -24,9 +24,7 @@ declare(strict_types=1);
 namespace pocketmine\utils;

 use function array_map;
-use function assert;
 use function count;
-use function get_class;
 use function mb_strtoupper;
 use function preg_match;

@ -44,12 +42,6 @@ trait RegistryTrait{
 	 */
 	private static $members = null;

-	/**
-	 * @var OverloadedRegistryMember[]
-	 * @phpstan-var array<string, OverloadedRegistryMember>
-	 */
-	private static $overloadedMembers = [];
-
 	private static function verifyName(string $name) : void{
 		if(preg_match('/^(?!\d)[A-Za-z\d_]+$/u', $name) === 0){
 			throw new \InvalidArgumentException("Invalid member name \"$name\", should only contain letters, numbers and underscores, and must not start with a number");
@ -67,37 +59,12 @@ trait RegistryTrait{
 		}
 		self::verifyName($name);
 		$upperName = mb_strtoupper($name);
-		if(isset(self::$members[$upperName]) || isset(self::$overloadedMembers[$upperName])){
+		if(isset(self::$members[$upperName])){
 			throw new \InvalidArgumentException("\"$upperName\" is already reserved");
 		}
 		self::$members[$upperName] = $member;
 	}

-	/**
-	 * @phpstan-template TEnum of \UnitEnum
-	 * @phpstan-param class-string<TEnum> $enumClass
-	 * @phpstan-param class-string        $returnClass
-	 */
-	private static function registerOverloaded(string $baseName, string $enumClass, string $returnClass) : void{
-		self::verifyName($baseName);
-		$upperName = mb_strtoupper($baseName);
-		if(isset(self::$members[$upperName]) || isset(self::$overloadedMembers[$upperName])){
-			throw new \InvalidArgumentException("\"$upperName\" is already reserved");
-		}
-		$enumToMemberMap = [];
-		foreach($enumClass::cases() as $case){
-			$memberName = mb_strtoupper($case->name . "_" . $baseName);
-			if(!isset(self::$members[$memberName])){
-				throw new \LogicException("\"$memberName\" needs to be registered to define overloaded member with enum $enumClass");
-			}
-			if(!self::$members[$memberName] instanceof $returnClass){
-				throw new \LogicException("\"$memberName\" doesn't satisfy the desired type $returnClass");
-			}
-			$enumToMemberMap[$case->name] = $memberName;
-		}
-		self::$overloadedMembers[$upperName] = new OverloadedRegistryMember($enumClass, $returnClass, $enumToMemberMap);
-	}
-
 	/**
 	 * Inserts default entries into the registry.
 	 *
@ -144,36 +111,20 @@ trait RegistryTrait{
 	 * @return object
 	 */
 	public static function __callStatic($name, $arguments){
-		if(count($arguments) === 0){
-			//fast path
-			if(self::$members !== null && isset(self::$members[$name])){
-				return self::preprocessMember(self::$members[$name]);
-			}
+		if(count($arguments) > 0){
+			throw new \ArgumentCountError("Expected exactly 0 arguments, " . count($arguments) . " passed");
+		}

-			//fallback
-			try{
-				return self::_registryFromString($name);
-			}catch(\InvalidArgumentException $e){
-				throw new \Error($e->getMessage(), 0, $e);
-			}
-		}elseif(count($arguments) === 1 && $arguments[0] instanceof \UnitEnum){
-			$enum = $arguments[0];
-			self::checkInit();
+		//fast path
+		if(self::$members !== null && isset(self::$members[$name])){
+			return self::preprocessMember(self::$members[$name]);
+		}

-			$overloadInfo = self::$overloadedMembers[$name] ?? self::$overloadedMembers[mb_strtoupper($name)] ?? null;
-
-			if($overloadInfo !== null){
-				if($enum::class !== $overloadInfo->enumClass){
-					throw new \Error("Wrong enum type for overloaded registry member " . self::class . "::" . mb_strtoupper($name) . "($overloadInfo->enumClass)");
-				}
-				$memberName = $overloadInfo->enumToMemberMap[$enum->name];
-				assert(self::$members !== null);
-				return self::preprocessMember(self::$members[$memberName]);
-			}
-
-			throw new \Error("No such overloaded registry member: " . self::class . "::" . mb_strtoupper($name) . "(" . get_class($enum) . ")");
-		}else{
-			throw new \LogicException("Incorrect arguments passed to overloaded registry member: " . self::class . "::" . mb_strtoupper($name));
+		//fallback
+		try{
+			return self::_registryFromString($name);
+		}catch(\InvalidArgumentException $e){
+			throw new \Error($e->getMessage(), 0, $e);
 		}
 	}

@ -185,12 +136,4 @@ trait RegistryTrait{
 		self::checkInit();
 		return array_map(self::preprocessMember(...), self::$members ?? throw new AssumptionFailedError(self::class . "::checkInit() did not initialize self::\$members correctly"));
 	}
-
-	/**
-	 * @return string[]
-	 * @phpstan-return array<string, OverloadedRegistryMember>
-	 */
-	public static function getAllOverloaded() : array{
-		return self::$overloadedMembers;
-	}
 }
--- a/src/utils/Terminal.php
+++ b/src/utils/Terminal.php
@ -69,7 +69,6 @@ abstract class Terminal{
 	public static string $COLOR_MATERIAL_DIAMOND = "";
 	public static string $COLOR_MATERIAL_LAPIS = "";
 	public static string $COLOR_MATERIAL_AMETHYST = "";
-	public static string $COLOR_MATERIAL_RESIN = "";

 	private static ?bool $formattingCodes = null;

@ -132,7 +131,6 @@ abstract class Terminal{
 		self::$COLOR_MATERIAL_DIAMOND = $color(37);
 		self::$COLOR_MATERIAL_LAPIS = $color(24);
 		self::$COLOR_MATERIAL_AMETHYST = $color(98);
-		self::$COLOR_MATERIAL_RESIN = $color(208);
 	}

 	protected static function getEscapeCodes() : void{
@ -176,12 +174,11 @@ abstract class Terminal{
 			self::$COLOR_MATERIAL_DIAMOND = $colors >= 256 ? $setaf(37) : $setaf(14);
 			self::$COLOR_MATERIAL_LAPIS = $colors >= 256 ? $setaf(24) : $setaf(12);
 			self::$COLOR_MATERIAL_AMETHYST = $colors >= 256 ? $setaf(98) : $setaf(13);
-			self::$COLOR_MATERIAL_RESIN = $colors >= 256 ? $setaf(208) : $setaf(11);
 		}else{
 			self::$COLOR_BLACK = self::$COLOR_DARK_GRAY = self::$COLOR_MATERIAL_NETHERITE = $setaf(0);
 			self::$COLOR_RED = self::$COLOR_DARK_RED = self::$COLOR_MATERIAL_REDSTONE = self::$COLOR_MATERIAL_COPPER = $setaf(1);
 			self::$COLOR_GREEN = self::$COLOR_DARK_GREEN = self::$COLOR_MATERIAL_EMERALD = $setaf(2);
-			self::$COLOR_YELLOW = self::$COLOR_GOLD = self::$COLOR_MINECOIN_GOLD = self::$COLOR_MATERIAL_GOLD = self::$COLOR_MATERIAL_RESIN = $setaf(3);
+			self::$COLOR_YELLOW = self::$COLOR_GOLD = self::$COLOR_MINECOIN_GOLD = self::$COLOR_MATERIAL_GOLD = $setaf(3);
 			self::$COLOR_BLUE = self::$COLOR_DARK_BLUE = self::$COLOR_MATERIAL_LAPIS = $setaf(4);
 			self::$COLOR_LIGHT_PURPLE = self::$COLOR_PURPLE = self::$COLOR_MATERIAL_AMETHYST = $setaf(5);
 			self::$COLOR_AQUA = self::$COLOR_DARK_AQUA = self::$COLOR_MATERIAL_DIAMOND = $setaf(6);
@ -256,7 +253,6 @@ abstract class Terminal{
 				TextFormat::MATERIAL_DIAMOND => Terminal::$COLOR_MATERIAL_DIAMOND,
 				TextFormat::MATERIAL_LAPIS => Terminal::$COLOR_MATERIAL_LAPIS,
 				TextFormat::MATERIAL_AMETHYST => Terminal::$COLOR_MATERIAL_AMETHYST,
-				TextFormat::MATERIAL_RESIN => Terminal::$COLOR_MATERIAL_RESIN,
 				default => $token,
 			};
 		}
--- a/src/utils/TextFormat.php
+++ b/src/utils/TextFormat.php
@ -73,7 +73,6 @@ abstract class TextFormat{
 	public const MATERIAL_DIAMOND = TextFormat::ESCAPE . "s";
 	public const MATERIAL_LAPIS = TextFormat::ESCAPE . "t";
 	public const MATERIAL_AMETHYST = TextFormat::ESCAPE . "u";
-	public const MATERIAL_RESIN = TextFormat::ESCAPE . "v";

 	public const COLORS = [
 		self::BLACK => self::BLACK,
@ -103,7 +102,6 @@ abstract class TextFormat{
 		self::MATERIAL_DIAMOND => self::MATERIAL_DIAMOND,
 		self::MATERIAL_LAPIS => self::MATERIAL_LAPIS,
 		self::MATERIAL_AMETHYST => self::MATERIAL_AMETHYST,
-		self::MATERIAL_RESIN => self::MATERIAL_RESIN,
 	];

 	public const OBFUSCATED = TextFormat::ESCAPE . "k";
@ -152,7 +150,7 @@ abstract class TextFormat{
 	 * @return string[]
 	 */
 	public static function tokenize(string $string) : array{
-		$result = preg_split("/(" . TextFormat::ESCAPE . "[0-9a-v])/u", $string, -1, PREG_SPLIT_NO_EMPTY | PREG_SPLIT_DELIM_CAPTURE);
+		$result = preg_split("/(" . TextFormat::ESCAPE . "[0-9a-u])/u", $string, -1, PREG_SPLIT_NO_EMPTY | PREG_SPLIT_DELIM_CAPTURE);
 		if($result === false) throw self::makePcreError();
 		return $result;
 	}
@ -166,7 +164,7 @@ abstract class TextFormat{
 		$string = mb_scrub($string, 'UTF-8');
 		$string = self::preg_replace("/[\x{E000}-\x{F8FF}]/u", "", $string); //remove unicode private-use-area characters (they might break the console)
 		if($removeFormat){
-			$string = str_replace(TextFormat::ESCAPE, "", self::preg_replace("/" . TextFormat::ESCAPE . "[0-9a-v]/u", "", $string));
+			$string = str_replace(TextFormat::ESCAPE, "", self::preg_replace("/" . TextFormat::ESCAPE . "[0-9a-u]/u", "", $string));
 		}
 		return str_replace("\x1b", "", self::preg_replace("/\x1b[\\(\\][[0-9;\\[\\(]+[Bm]/u", "", $string));
 	}
@ -177,7 +175,7 @@ abstract class TextFormat{
 	 * @param string $placeholder default "&"
 	 */
 	public static function colorize(string $string, string $placeholder = "&") : string{
-		return self::preg_replace('/' . preg_quote($placeholder, "/") . '([0-9a-v])/u', TextFormat::ESCAPE . '$1', $string);
+		return self::preg_replace('/' . preg_quote($placeholder, "/") . '([0-9a-u])/u', TextFormat::ESCAPE . '$1', $string);
 	}

 	/**
@ -254,7 +252,6 @@ abstract class TextFormat{
 				TextFormat::MATERIAL_DIAMOND => "color:#2cb9a8",
 				TextFormat::MATERIAL_LAPIS => "color:#20487a",
 				TextFormat::MATERIAL_AMETHYST => "color:#9a5cc5",
-				TextFormat::MATERIAL_RESIN => "color:#fc7812",
 				TextFormat::BOLD => "font-weight:bold",
 				TextFormat::ITALIC => "font-style:italic",
 				default => null
--- a/src/utils/Utils.php
+++ b/src/utils/Utils.php
@ -369,7 +369,7 @@ final class Utils{
 		debug_zval_dump($value);
 		$contents = ob_get_contents();
 		if($contents === false) throw new AssumptionFailedError("ob_get_contents() should never return false here");
-		$ret = explode("\n", $contents);
+		$ret = explode("\n", $contents, limit: 2);
 		ob_end_clean();

 		if(preg_match('/^.* refcount\\(([0-9]+)\\)\\{$/', trim($ret[0]), $m) > 0){
@ -587,7 +587,7 @@ final class Utils{
 	 * @phpstan-param \Closure(TMemberType) : void $validator
 	 */
 	public static function validateArrayValueType(array $array, \Closure $validator) : void{
-		foreach($array as $k => $v){
+		foreach(Utils::promoteKeys($array) as $k => $v){
 			try{
 				$validator($v);
 			}catch(\TypeError $e){
--- a/src/world/World.php
+++ b/src/world/World.php
@ -375,8 +375,6 @@ class World implements ChunkManager{

 	private \Logger $logger;

-	private RuntimeBlockStateRegistry $blockStateRegistry;
-
 	/**
 	 * @phpstan-return ChunkPosHash
 	 */
@ -490,7 +488,6 @@ class World implements ChunkManager{
 		$this->displayName = $this->provider->getWorldData()->getName();
 		$this->logger = new \PrefixedLogger($server->getLogger(), "World: $this->displayName");

-		$this->blockStateRegistry = RuntimeBlockStateRegistry::getInstance();
 		$this->minY = $this->provider->getWorldMinY();
 		$this->maxY = $this->provider->getWorldMaxY();

@ -562,7 +559,7 @@ class World implements ChunkManager{
 				}catch(BlockStateDeserializeException){
 					continue;
 				}
-				$block = $this->blockStateRegistry->fromStateId(GlobalBlockStateHandlers::getDeserializer()->deserialize($blockStateData));
+				$block = RuntimeBlockStateRegistry::getInstance()->fromStateId(GlobalBlockStateHandlers::getDeserializer()->deserialize($blockStateData));
 			}else{
 				//TODO: we probably ought to log an error here
 				continue;
@ -573,7 +570,7 @@ class World implements ChunkManager{
 			}
 		}

-		foreach($this->blockStateRegistry->getAllKnownStates() as $state){
+		foreach(RuntimeBlockStateRegistry::getInstance()->getAllKnownStates() as $state){
 			$dontTickName = $dontTickBlocks[$state->getTypeId()] ?? null;
 			if($dontTickName === null && $state->ticksRandomly()){
 				$this->randomTickBlocks[$state->getStateId()] = true;
@ -1397,7 +1394,7 @@ class World implements ChunkManager{
 			$entity->onRandomUpdate();
 		}

-		$blockFactory = $this->blockStateRegistry;
+		$blockFactory = RuntimeBlockStateRegistry::getInstance();
 		foreach($chunk->getSubChunks() as $Y => $subChunk){
 			if(!$subChunk->isEmptyFast()){
 				$k = 0;
@ -1531,48 +1528,24 @@ class World implements ChunkManager{

 		$collides = [];

-		$collisionInfo = $this->blockStateRegistry->collisionInfo;
 		if($targetFirst){
 			for($z = $minZ; $z <= $maxZ; ++$z){
-				$zOverflow = $z === $minZ || $z === $maxZ;
 				for($x = $minX; $x <= $maxX; ++$x){
-					$zxOverflow = $zOverflow || $x === $minX || $x === $maxX;
 					for($y = $minY; $y <= $maxY; ++$y){
-						$overflow = $zxOverflow || $y === $minY || $y === $maxY;
-
-						$stateCollisionInfo = $this->getBlockCollisionInfo($x, $y, $z, $collisionInfo);
-						if($overflow ?
-							$stateCollisionInfo === RuntimeBlockStateRegistry::COLLISION_MAY_OVERFLOW && $this->getBlockAt($x, $y, $z)->collidesWithBB($bb) :
-							match ($stateCollisionInfo) {
-								RuntimeBlockStateRegistry::COLLISION_CUBE => true,
-								RuntimeBlockStateRegistry::COLLISION_NONE => false,
-								default => $this->getBlockAt($x, $y, $z)->collidesWithBB($bb)
-							}
-						){
-							return [$this->getBlockAt($x, $y, $z)];
+						$block = $this->getBlockAt($x, $y, $z);
+						if($block->collidesWithBB($bb)){
+							return [$block];
 						}
 					}
 				}
 			}
 		}else{
-			//TODO: duplicated code :( this way is better for performance though
 			for($z = $minZ; $z <= $maxZ; ++$z){
-				$zOverflow = $z === $minZ || $z === $maxZ;
 				for($x = $minX; $x <= $maxX; ++$x){
-					$zxOverflow = $zOverflow || $x === $minX || $x === $maxX;
 					for($y = $minY; $y <= $maxY; ++$y){
-						$overflow = $zxOverflow || $y === $minY || $y === $maxY;
-
-						$stateCollisionInfo = $this->getBlockCollisionInfo($x, $y, $z, $collisionInfo);
-						if($overflow ?
-							$stateCollisionInfo === RuntimeBlockStateRegistry::COLLISION_MAY_OVERFLOW && $this->getBlockAt($x, $y, $z)->collidesWithBB($bb) :
-							match ($stateCollisionInfo) {
-								RuntimeBlockStateRegistry::COLLISION_CUBE => true,
-								RuntimeBlockStateRegistry::COLLISION_NONE => false,
-								default => $this->getBlockAt($x, $y, $z)->collidesWithBB($bb)
-							}
-						){
-							$collides[] = $this->getBlockAt($x, $y, $z);
+						$block = $this->getBlockAt($x, $y, $z);
+						if($block->collidesWithBB($bb)){
+							$collides[] = $block;
 						}
 					}
 				}
@ -1582,64 +1555,24 @@ class World implements ChunkManager{
 		return $collides;
 	}

-	/**
-	 * @param int[] $collisionInfo
-	 * @phpstan-param array<int, int> $collisionInfo
-	 */
-	private function getBlockCollisionInfo(int $x, int $y, int $z, array $collisionInfo) : int{
-		if(!$this->isInWorld($x, $y, $z)){
-			return RuntimeBlockStateRegistry::COLLISION_NONE;
-		}
-		$chunk = $this->getChunk($x >> Chunk::COORD_BIT_SIZE, $z >> Chunk::COORD_BIT_SIZE);
-		if($chunk === null){
-			return RuntimeBlockStateRegistry::COLLISION_NONE;
-		}
-		$stateId = $chunk
-			->getSubChunk($y >> SubChunk::COORD_BIT_SIZE)
-			->getBlockStateId(
-				$x & SubChunk::COORD_MASK,
-				$y & SubChunk::COORD_MASK,
-				$z & SubChunk::COORD_MASK
-			);
-		return $collisionInfo[$stateId];
-	}
-
 	/**
 	 * Returns a list of all block AABBs which overlap the full block area at the given coordinates.
 	 * This checks a padding of 1 block around the coordinates to account for oversized AABBs of blocks like fences.
 	 * Larger AABBs (>= 2 blocks on any axis) are not accounted for.
 	 *
-	 * @param int[] $collisionInfo
-	 * @phpstan-param array<int, int> $collisionInfo
-	 *
 	 * @return AxisAlignedBB[]
 	 * @phpstan-return list<AxisAlignedBB>
 	 */
-	private function getBlockCollisionBoxesForCell(int $x, int $y, int $z, array $collisionInfo) : array{
-		$stateCollisionInfo = $this->getBlockCollisionInfo($x, $y, $z, $collisionInfo);
-		$boxes = match($stateCollisionInfo){
-			RuntimeBlockStateRegistry::COLLISION_NONE => [],
-			RuntimeBlockStateRegistry::COLLISION_CUBE => [AxisAlignedBB::one()->offset($x, $y, $z)],
-			default => $this->getBlockAt($x, $y, $z)->getCollisionBoxes()
-		};
+	private function getBlockCollisionBoxesForCell(int $x, int $y, int $z) : array{
+		$block = $this->getBlockAt($x, $y, $z);
+		$boxes = $block->getCollisionBoxes();

-		//overlapping AABBs can't make any difference if this is a cube, so we can save some CPU cycles in this common case
-		if($stateCollisionInfo !== RuntimeBlockStateRegistry::COLLISION_CUBE){
-			$cellBB = null;
-			foreach(Facing::OFFSET as [$dx, $dy, $dz]){
-				$offsetX = $x + $dx;
-				$offsetY = $y + $dy;
-				$offsetZ = $z + $dz;
-				$stateCollisionInfo = $this->getBlockCollisionInfo($offsetX, $offsetY, $offsetZ, $collisionInfo);
-				if($stateCollisionInfo === RuntimeBlockStateRegistry::COLLISION_MAY_OVERFLOW){
-					//avoid allocating this unless it's needed
-					$cellBB ??= AxisAlignedBB::one()->offset($x, $y, $z);
-					$extraBoxes = $this->getBlockAt($offsetX, $offsetY, $offsetZ)->getCollisionBoxes();
-					foreach($extraBoxes as $extraBox){
-						if($extraBox->intersectsWith($cellBB)){
-							$boxes[] = $extraBox;
-						}
-					}
+		$cellBB = AxisAlignedBB::one()->offset($x, $y, $z);
+		foreach(Facing::OFFSET as [$dx, $dy, $dz]){
+			$extraBoxes = $this->getBlockAt($x + $dx, $y + $dy, $z + $dz)->getCollisionBoxes();
+			foreach($extraBoxes as $extraBox){
+				if($extraBox->intersectsWith($cellBB)){
+					$boxes[] = $extraBox;
 				}
 			}
 		}
@ -1661,15 +1594,13 @@ class World implements ChunkManager{

 		$collides = [];

-		$collisionInfo = $this->blockStateRegistry->collisionInfo;
-
 		for($z = $minZ; $z <= $maxZ; ++$z){
 			for($x = $minX; $x <= $maxX; ++$x){
 				$chunkPosHash = World::chunkHash($x >> Chunk::COORD_BIT_SIZE, $z >> Chunk::COORD_BIT_SIZE);
 				for($y = $minY; $y <= $maxY; ++$y){
 					$relativeBlockHash = World::chunkBlockHash($x, $y, $z);

-					$boxes = $this->blockCollisionBoxCache[$chunkPosHash][$relativeBlockHash] ??= $this->getBlockCollisionBoxesForCell($x, $y, $z, $collisionInfo);
+					$boxes = $this->blockCollisionBoxCache[$chunkPosHash][$relativeBlockHash] ??= $this->getBlockCollisionBoxesForCell($x, $y, $z);

 					foreach($boxes as $blockBB){
 						if($blockBB->intersectsWith($bb)){
@ -1864,7 +1795,7 @@ class World implements ChunkManager{
 			return;
 		}

-		$blockFactory = $this->blockStateRegistry;
+		$blockFactory = RuntimeBlockStateRegistry::getInstance();
 		$this->timings->doBlockSkyLightUpdates->startTiming();
 		if($this->skyLightUpdate === null){
 			$this->skyLightUpdate = new SkyLightUpdate(new SubChunkExplorer($this), $blockFactory->lightFilter, $blockFactory->blocksDirectSkyLight);
@ -1983,7 +1914,7 @@ class World implements ChunkManager{

 			$chunk = $this->chunks[$chunkHash] ?? null;
 			if($chunk !== null){
-				$block = $this->blockStateRegistry->fromStateId($chunk->getBlockStateId($x & Chunk::COORD_MASK, $y, $z & Chunk::COORD_MASK));
+				$block = RuntimeBlockStateRegistry::getInstance()->fromStateId($chunk->getBlockStateId($x & Chunk::COORD_MASK, $y, $z & Chunk::COORD_MASK));
 			}else{
 				$addToCache = false;
 				$block = VanillaBlocks::AIR();
@ -2642,7 +2573,7 @@ class World implements ChunkManager{
 				$localY = $tilePosition->getFloorY();
 				$localZ = $tilePosition->getFloorZ() & Chunk::COORD_MASK;

-				$newBlock = $this->blockStateRegistry->fromStateId($chunk->getBlockStateId($localX, $localY, $localZ));
+				$newBlock = RuntimeBlockStateRegistry::getInstance()->fromStateId($chunk->getBlockStateId($localX, $localY, $localZ));
 				$expectedTileClass = $newBlock->getIdInfo()->getTileClass();
 				if(
 					$expectedTileClass === null || //new block doesn't expect a tile
--- a/src/world/generator/FlatGeneratorOptions.php
+++ b/src/world/generator/FlatGeneratorOptions.php
@ -26,10 +26,12 @@ namespace pocketmine\world\generator;
 use pocketmine\data\bedrock\BiomeIds;
 use pocketmine\item\LegacyStringToItemParser;
 use pocketmine\item\LegacyStringToItemParserException;
+use pocketmine\world\World;
 use function array_map;
 use function explode;
 use function preg_match;
 use function preg_match_all;
+use const PHP_INT_MAX;

 /**
 * @internal
@ -70,7 +72,7 @@ final class FlatGeneratorOptions{
 	 */
 	public static function parseLayers(string $layers) : array{
 		$result = [];
-		$split = array_map('\trim', explode(',', $layers));
+		$split = array_map('\trim', explode(',', $layers, limit: World::Y_MAX - World::Y_MIN));
 		$y = 0;
 		$itemParser = LegacyStringToItemParser::getInstance();
 		foreach($split as $line){
@ -96,7 +98,7 @@ final class FlatGeneratorOptions{
 	 * @throws InvalidGeneratorOptionsException
 	 */
 	public static function parsePreset(string $presetString) : self{
-		$preset = explode(";", $presetString);
+		$preset = explode(";", $presetString, limit: 4);
 		$blocks = $preset[1] ?? "";
 		$biomeId = (int) ($preset[2] ?? BiomeIds::PLAINS);
 		$optionsString = $preset[3] ?? "";
@ -109,9 +111,10 @@ final class FlatGeneratorOptions{
 			$params = true;
 			if($matches[3][$i] !== ""){
 				$params = [];
-				$p = explode(" ", $matches[3][$i]);
+				$p = explode(" ", $matches[3][$i], limit: PHP_INT_MAX);
 				foreach($p as $k){
-					$k = explode("=", $k);
+					//TODO: this should be limited to 2 parts, but 3 preserves old behaviour when given e.g. treecount=20=1
+					$k = explode("=", $k, limit: 3);
 					if(isset($k[1])){
 						$params[$k[0]] = $k[1];
 					}
--- a/tests/phpstan/configs/actual-problems.neon
+++ b/tests/phpstan/configs/actual-problems.neon
@ -48,12 +48,6 @@ parameters:
 			count: 1
 			path: ../../../src/VersionInfo.php

-		-
-			message: '#^Method pocketmine\\VersionInfo\:\:GIT_HASH\(\) should return string but returns mixed\.$#'
-			identifier: return.type
-			count: 1
-			path: ../../../src/VersionInfo.php
-
 		-
 			message: '#^Static property pocketmine\\VersionInfo\:\:\$gitHash \(string\|null\) does not accept mixed\.$#'
 			identifier: assign.propertyType
@ -918,24 +912,6 @@ parameters:
 			count: 1
 			path: ../../../src/plugin/PluginDescription.php

-		-
-			message: '#^Parameter \#1 \$haystack of function stripos expects string, mixed given\.$#'
-			identifier: argument.type
-			count: 1
-			path: ../../../src/plugin/PluginDescription.php
-
-		-
-			message: '#^Parameter \#2 \$subject of function preg_match expects string, mixed given\.$#'
-			identifier: argument.type
-			count: 1
-			path: ../../../src/plugin/PluginDescription.php
-
-		-
-			message: '#^Parameter \#3 \$subject of function str_replace expects array\<string\>\|string, mixed given\.$#'
-			identifier: argument.type
-			count: 1
-			path: ../../../src/plugin/PluginDescription.php
-
 		-
 			message: '#^Property pocketmine\\plugin\\PluginDescription\:\:\$authors \(array\<string\>\) does not accept list\<mixed\>\.$#'
 			identifier: assign.propertyType
@ -966,12 +942,6 @@ parameters:
 			count: 1
 			path: ../../../src/resourcepacks/ZippedResourcePack.php

-		-
-			message: '#^Method pocketmine\\resourcepacks\\ZippedResourcePack\:\:getSha256\(\) should return string but returns string\|false\.$#'
-			identifier: return.type
-			count: 1
-			path: ../../../src/resourcepacks/ZippedResourcePack.php
-
 		-
 			message: '#^Property pocketmine\\resourcepacks\\ZippedResourcePack\:\:\$fileResource \(resource\) does not accept resource\|false\.$#'
 			identifier: assign.propertyType
@ -1009,7 +979,7 @@ parameters:
 			path: ../../../src/utils/Config.php

 		-
-			message: '#^Parameter \#1 \$config of static method pocketmine\\utils\\Config\:\:writeProperties\(\) expects array\<int\|string, bool\|float\|int\|string\>, array\<int\|string, mixed\> given\.$#'
+			message: '#^Parameter \#1 \$config of static method pocketmine\\utils\\Config\:\:writeProperties\(\) expects array\<int\|string, bool\|float\|int\|string\>, array\<mixed\> given\.$#'
 			identifier: argument.type
 			count: 1
 			path: ../../../src/utils/Config.php
--- a/tests/phpstan/configs/phpstan-bugs.neon
+++ b/tests/phpstan/configs/phpstan-bugs.neon
@ -114,12 +114,6 @@ parameters:
 			count: 1
 			path: ../../../src/crash/CrashDump.php

-		-
-			message: '#^Call to function assert\(\) with false and ''unknown hit type'' will always evaluate to false\.$#'
-			identifier: function.impossibleType
-			count: 1
-			path: ../../../src/entity/projectile/Projectile.php
-
 		-
 			message: '#^Property pocketmine\\item\\WritableBookBase\:\:\$pages \(list\<pocketmine\\item\\WritableBookPage\>\) does not accept non\-empty\-array\<int, pocketmine\\item\\WritableBookPage\>\.$#'
 			identifier: assign.propertyType
--- a/tests/phpstan/rules/ExplodeLimitRule.php
+++ b/tests/phpstan/rules/ExplodeLimitRule.php
@ -0,0 +1,92 @@
+<?php
+
+/*
+ *
+ *  ____            _        _   __  __ _                  __  __ ____
+ * |  _ \ ___   ___| | _____| |_|  \/  (_)_ __   ___      |  \/  |  _ \
+ * | |_) / _ \ / __| |/ / _ \ __| |\/| | | '_ \ / _ \_____| |\/| | |_) |
+ * |  __/ (_) | (__|   <  __/ |_| |  | | | | | |  __/_____| |  | |  __/
+ * |_|   \___/ \___|_|\_\___|\__|_|  |_|_|_| |_|\___|     |_|  |_|_|
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * @author PocketMine Team
+ * @link http://www.pocketmine.net/
+ *
+ *
+ */
+
+declare(strict_types=1);
+
+namespace pocketmine\phpstan\rules;
+
+use PhpParser\Node;
+use PhpParser\Node\Expr\FuncCall;
+use PhpParser\Node\Name;
+use PHPStan\Analyser\ArgumentsNormalizer;
+use PHPStan\Analyser\Scope;
+use PHPStan\Reflection\ParametersAcceptorSelector;
+use PHPStan\Reflection\ReflectionProvider;
+use PHPStan\Rules\Rule;
+use PHPStan\Rules\RuleErrorBuilder;
+use function count;
+
+/**
+ * @phpstan-implements Rule<FuncCall>
+ */
+final class ExplodeLimitRule implements Rule{
+	private ReflectionProvider $reflectionProvider;
+
+	public function __construct(
+		ReflectionProvider $reflectionProvider
+	){
+		$this->reflectionProvider = $reflectionProvider;
+	}
+
+	public function getNodeType() : string{
+		return FuncCall::class;
+	}
+
+	public function processNode(Node $node, Scope $scope) : array{
+		if(!$node->name instanceof Name){
+			return [];
+		}
+
+		if(!$this->reflectionProvider->hasFunction($node->name, $scope)){
+			return [];
+		}
+
+		$functionReflection = $this->reflectionProvider->getFunction($node->name, $scope);
+
+		if($functionReflection->getName() !== 'explode'){
+			return [];
+		}
+
+		$parametersAcceptor = ParametersAcceptorSelector::selectFromArgs(
+			$scope,
+			$node->getArgs(),
+			$functionReflection->getVariants(),
+			$functionReflection->getNamedArgumentsVariants(),
+		);
+
+		$normalizedFuncCall = ArgumentsNormalizer::reorderFuncArguments($parametersAcceptor, $node);
+
+		if($normalizedFuncCall === null){
+			return [];
+		}
+
+		$count = count($normalizedFuncCall->getArgs());
+		if($count !== 3){
+			return [
+				RuleErrorBuilder::message('The $limit parameter of explode() must be set to prevent malicious client data wasting resources.')
+					->identifier("pocketmine.explode.limit")
+					->build()
+			];
+		}
+
+		return [];
+	}
+}
--- a/tools/generate-bedrock-data-from-packets.php
+++ b/tools/generate-bedrock-data-from-packets.php
@ -624,7 +624,7 @@ function main(array $argv) : int{
 	}

 	foreach($packets as $lineNum => $line){
-		$parts = explode(':', $line);
+		$parts = explode(':', $line, limit: 3);
 		if(count($parts) !== 2){
 			fwrite(STDERR, 'Wrong packet format at line ' . ($lineNum + 1) . ', expected read:base64 or write:base64');
 			return 1;
Author	SHA1	Message	Date
Dylan K. Taylor	fc072b05d6	tweak config defaults	2025-03-12 01:06:01 +00:00
Dylan K. Taylor	2589fcb31d	Implement rate limits by packet read ops for now this is configured to warn only by default, until we get the parameters for it dialled in	2025-03-12 01:03:34 +00:00
Dylan K. Taylor	8d255a6512	...	2025-03-11 14:28:44 +00:00
Dylan K. Taylor	41789bc67a	Report debug stats for cost accounting every 10 seconds	2025-03-11 12:41:59 +00:00
Lee Siu San	afc4a3c7f1	Fixed entity position offset not being included in AddActorPacket (#6643 ) this was causing TNT and falling blocks to briefly appear half a block lower than their true position, because their positions are measured from the center and not the base.	2025-03-09 02:09:53 +00:00
Dylan K. Taylor	7af5eb3da2	crafting: validate array inputs this makes sure wrong parameters don't show up as core errors, as seen in crash report 12373907 closes #6642	2025-03-09 01:10:12 +00:00
Dylan T.	aad2bce9e4	readme: call out Easy tasks issues	2025-03-09 00:23:59 +00:00
pmmp-admin-bot[bot]	50a1e59aa4	5.25.3 is next Commit created by: https://github.com/pmmp/RestrictedActions/actions/runs/13662905668	2025-03-04 21:05:10 +00:00
Dylan T.	e8824a36b9	Merge pull request #6645 from pmmp/explode-limit 5.25.2	2025-03-04 21:03:52 +00:00
Dylan T.	b1e63e544f	Merge branch 'stable' into explode-limit	2025-03-04 21:00:40 +00:00
Dylan K. Taylor	9e9f8a4870	Prepare 5.25.2 release	2025-03-04 20:57:47 +00:00
Dylan K. Taylor	d0d84d4c51	New rule: explode() limit parameter must be set	2025-03-04 20:44:01 +00:00
dependabot[bot]	e3e0c14275	Bump the github-actions group with 2 updates (#6644 )	2025-03-01 10:04:01 +00:00
Dylan K. Taylor	3a2d0d77d1	Update composer dependencies	2025-02-26 17:30:20 +00:00
Dylan T.	32b98dcbde	draft-release: add a warning about bug reporting too many people just spam on discord and expect that to somehow do something ...	2025-02-26 17:23:27 +00:00
pmmp-admin-bot[bot]	092ea07d51	5.25.2 is next Commit created by: https://github.com/pmmp/RestrictedActions/actions/runs/13549549222	2025-02-26 17:14:49 +00:00
Dylan T.	706f391068	Release 5.25.1 (#6641 )	2025-02-26 17:13:44 +00:00
dependabot[bot]	7c654271a8	Bump phpstan/phpstan in the development-patch-updates group (#6640 )	2025-02-25 13:40:11 +00:00
Dylan K. Taylor	3df2bdb879	Fixed door facing this was broken in 1.21.60 update. should've known better to expect a blockstate upgrade to mean a blockstate fix...	2025-02-24 01:04:52 +00:00
Dylan K. Taylor	1fed9f6cb5	BlockBreakInfo: fixed confusing error message	2025-02-23 20:02:27 +00:00
Dylan K. Taylor	3050af0bc0	ResourcePackManager: validate pack UUIDs fixes CrashArchive ##12248760	2025-02-23 19:45:38 +00:00
Dylan K. Taylor	77be5f8e25	Update PHPStan	2025-02-17 17:51:39 +00:00