Auto-updates
A small library, nested in your jar, keeps players on your latest approved registry build. Developers opt in with one Gradle line. Players can switch it to notify-only or off at any time.
For developers
Add the registry Maven and nest the library. Fabric Loader dedupes jar-in-jar copies, so one instance runs per client no matter how many installed mods ship it.
repositories {
maven { url = "https://mods.cosmicprisons.com/maven" }
}
dependencies {
include "com.cosmicprisons:cosmic-updater:1.0.0"
}Only approved builds from the registry pipeline are offered, and only for apps whose download is public. Hidden downloads are never served.
Turn it off per app with the Allow auto-update switch in the developer dashboard. The next check within two minutes returns nothing.
The rule against self-updating code has one exception: an unmodified Cosmic updater nested as a dependency. The build worker hashes the nested copy against the published releases.
The jar's fabric.mod.json version must equal the registry version you submit, or the build fails. The updater compares the two.
A build that nests a copy we did not publish fails with Nested cosmic-updater 1.0.0 (sha256 …) is not a published updater release. Use the version from this page and let Gradle fetch it.
GET https://mods.cosmicprisons.com/api/updates/gang-tools
{
"modId": "gang-tools",
"latest": {
"version": "1.3.0",
"fileName": "gang-tools-1.3.0.jar",
"sizeBytes": 184320,
"sha256": "3f1c…e9a0",
"minecraft": "1.21.11",
"downloadUrl": "https://mods.cosmicprisons.com/download/gang-tools",
"signedAt": "2026-09-05T18:02:11Z",
"signature": "KPLk1vew…SuBw"
}
}modIdstringThe id from your jar's fabric.mod.json. The library asks by this id.
latestobject | nullnull when the app is not approved, the download is hidden, auto-update is off, or nothing is published yet.
latest.versionstringThe published registry version. It must equal the version in the jar.
latest.sha256stringHash of the published jar. The library refuses a download that does not match.
latest.minecraftstring | nullYour jar's depends.minecraft. Clients on another Minecraft version are not offered the build.
latest.downloadUrlstringThe same public download link the registry page shows.
latest.signaturestringEd25519 signature the build worker made at publish time, over modId, version, sha256 and signedAt.
For players
automatic
The default. A new approved build downloads in the background and installs when you close the game. A chat line on join tells you what is coming and lets you skip or pin.
notify
You get the chat line and nothing downloads until you click update or run /cosmicupdater apply <mod>.
off
No checks, no downloads, no network requests. Turn it back on with /cosmicupdater mode automatic.
The command needs Fabric API. Without it, edit config/cosmic-updater.json instead.
/cosmicupdater status — every mod that uses the updater, its version, and what is waiting.
/cosmicupdater mode automatic | notify | off
/cosmicupdater pin <mod> [version] — stay on a version. /cosmicupdater unpin <mod> lifts it.
/cosmicupdater skip <mod> — hide the current offer until a newer version appears.
/cosmicupdater apply <mod> — download now; it still installs at exit.
/cosmicupdater restore <mod> — go back to the previous jar at exit. One backup is kept per mod.
Downloads and the backup of each replaced jar live in .cosmic-updater/ next to your mods folder. On Windows the game cannot replace a jar it has open, so a small helper finishes the swap right after the game closes.
How it is verified
The manifest signature must verify against the public key pinned in the library. Only the registry build worker holds the private key.
The downloaded jar's sha256 must equal the signed hash.
The jar's fabric.mod.json must declare the same mod id and version the manifest names.
The build's Minecraft range must include the running version.
Ed25519 public key (SPKI, base64) MCowBQYDK2VwAyEAN/43jL7fCikp1RRkfcJDwDticNEnmBcEL8538WFWFSw=