Separate dependency-update proposal for Single — 3 November 2026
The original source ZIP below remains unchanged. M2City prepared a separate MPL-2.0 review proposal for the Single executable: MessagePack 3.1.9 and explicit MySqlConnector 2.6.1 references in the two persistence projects. These versions are outside the affected ranges reported by the NuGet feed for the two advisories identified below.

Download the source-only dependency proposal v1 — 85,069 bytes; includes a three-file patch, modified project files, 14 generated lock files, original licence, manifest and instructions.
SHA-256: 1f0d81e61aa20bf3ccca9509783710f371a0c1ed2a4b07edf662abd9387ec3e3

Verified with .NET SDK 10.0.301 on Windows: Single Release build passed with zero warnings/errors; NuGet audit including transitives reported no vulnerable packages for that project at the time of checking; locked restore passed. Patch application to clean originals passed with equivalent resulting text after line-ending normalization. This is not an upstream-approved fix or a runtime-security certification.

Scope matters: AppHost's separate MessagePack 3.1.8 reference is untouched. Other entry points, MySQL authentication/TLS, persistence, cached-data compatibility and gameplay need independent staging tests. No server was launched. Read the included README before applying, preserve your original tree and do not treat this as a repository-wide remediation.

Build verification update — 3 November 2026
M2City restored and built this exact unmodified source snapshot on Windows using .NET SDK 10.0.301. Core.Networking built in Release with zero warnings/errors. Executables/Single built in Release with zero errors and 15 dependency warnings across referenced projects. No game service was started, no database was connected and no client login or gameplay was tested.

Dependency findings: review before deployment
NuGet reported NU1902 (moderate severity) for MessagePack 3.1.8 (advisory) and MySqlConnector 2.4.0 (advisory). These are dependency-audit findings, not proof that either issue was exploited in QCX. They remain unresolved in this mirrored snapshot. Evaluate upstream fixes and compatibility in a separate branch before deployment; do not suppress the warnings and describe the archive as secure.

Repeat the compile-only check
Extract the source ZIP to an isolated workspace and open a terminal in its src directory. Confirm your SDK with dotnet --version. The snapshot targets net10.0; its global.json selects a test runner but does not pin an SDK version. Our result used 10.0.301, so record any different SDK you use.
dotnet restore Core.Networking/Core.Networking.csproj --locked-mode --source https://api.nuget.org/v3/index.json --packages ../audit-packages --disable-parallel
dotnet build Core.Networking/Core.Networking.csproj -c Release --no-restore --disable-build-servers
dotnet restore Executables/Single/Single.csproj --locked-mode --source https://api.nuget.org/v3/index.json --packages ../audit-packages --disable-parallel
dotnet build Executables/Single/Single.csproj -c Release --no-restore --disable-build-servers

Run each build only after its restore succeeds. The successful Single build produced QuantumCore.Single.dll under src/Executables/Single/bin/Release/net10.0. It is a build output, not a claim that this directory is a complete working game installation. The archive's original files and lock files remained byte-identical during our check; generated build outputs and restored packages were separate additions.

For runtime requirements read docs/docs/Getting Started/developer.md and user.md inside this exact snapshot. The developer/AppHost route uses a Docker-compatible runtime and differs from the Single setup. Upstream describes its user setup as testing-only and documents default development credentials; replace defaults before allowing any network access. Client assets are not included in our archive. Compilation does not establish that a legacy C++ server database or client will work with this emulator.

A versioned source download for development and study
Quantum Core X is a community server-emulator project maintained by MeikelLP and contributors. This M2City download is the unmodified source archive for revision 007c7a6cdeeace4c7d09d63f67be21e63a37430f, with the upstream documentation and licence retained.


Original project and current documentation

Licence and attribution
The repository uses Mozilla Public License 2.0. Keep the original notices with the source and consult that licence when redistributing changes. This archive is not relicensed as M2City code. Separate Metin2 clients and proprietary game assets are not included or licensed by this download.

Revision: 007c7a6cdeeace4c7d09d63f67be21e63a37430f
Archive SHA-256:
a5afe5fae75d79d863e9c8e23fe4098fb39497ee130b6df7b79fe08dd21d1eed


How to investigate it usefully
Read the setup documentation inside this snapshot and compare it with upstream's current instructions before choosing dependencies. Record your actual SDK/runtime, database/service requirements and the target client revision. Use a separate development environment and document every local change as a diff.

Choose one narrow experiment, such as building the solution or reproducing a documented login step. A successful compilation and an apparently successful connection are different milestones. Record errors as text and keep configuration secrets out of any shared log.

What M2City checked
The pinned upstream revision, licence presence and archive checksum were checked. The archive inventory contained no executable/DLL or common game-pack/GR2 extensions. This is an archive-content check, not a build test, security audit or production-readiness claim.

Use this thread for version-specific observations, minimal reproduction steps and upstream links. If you test a newer revision, state the new commit rather than assuming the old mirrored snapshot changed. Useful contributions here should help the next builder repeat a result.