The open-source poker game PokerTH has received version 2.1.6 - shortly after version 2.1.5.

The update adds certificate verification for the lobby server connection to protect against network attackers, a new card deck with four coloured suits, and an important bugfix for check/call that prevents unintended all-ins.

• “new: the lobby connection verifies the server certificate now - the server list carries a pinned public key per entry, so a network attacker can no longer impersonate a lobby server (client & server, issue #515)”
• “new: default4c card deck - four coloured suits (QML)”
• “new: two more table themes with matching card backsides - mile high club, terminus hotel 2 (by BaShFX) (widget)”
• “new: card backsides are a style category of their own now and can be picked in the settings (widget)”
• “new: community suggest and the BBC and WEC invite templates are available in the widget client too, behind a single option (widget)”
• “new: a finished local game reports its winner and offers to start over with the same settings (QML)”
• “improvement: re-connect and re-join after a lost connection fine-tuned, in particular when Android suspends the app (QML)”
• “improvement: connection problems are shown as readable messages instead of raw error codes (QML)”
• “improvement: light mode fine-tuned across pages and components (QML)”
• “improvement: F-key shortcuts fine-tuned on the game, game-wait and local-game pages (QML)”
• “improvement: AFK timeout fine-tuned (QML)”
• “improvement: third party library list on the about page extended (QML & widget)”
• “bugfix: an intended check could turn into a call of the full amount when an opponent raised or went all-in in the very same moment - check/call now never puts in more chips than the button showed (QML)”
• “bugfix: chat text colors in light and dark mode (QML)”
• “bugfix: local game settings were not applied to the started game (QML)”
• “bugfix: wrong and missing entries in the showdown log (QML)”
• “bugfix: pulling the window open at its bottom edge on Windows showed a stale frame, which made the clickable zones appear offset (QML)”
• “server: blacklisted avatars were only reset after the session had been initialised”
• “server: a single WebSocket message could make a connection buffer up to 32 MB - the transport size is capped now”
• “server: chat cleaner connection admission hardened - loopback by default, shared secret required for remote peers, and a timeout for clients that never authenticate”
• “android: the server list download accepted any TLS certificate - it uses the system trust store now, with a root certificate bundle shipped as fallback (issue #516)”
• “android: connection foreground service restored”
• “android: manifest is generated from the build template again, which restores the service and permission entries”
• “android: the Play Store bundle targets SDK 36 (Android 16) now”

Source: GitHub