Project Zomboid hotfixes patch security flaw, break some mods

The Indie Stone has released hotfixes across all three Project Zomboid branches: 42.20.4 Stable, 42.19.2 Unstable, and 41.78.21 Legacy. The update addresses security vulnerabilities and, as part of that fix, removes the Lua loadstring and loadstream methods.

The studio says the update should not break existing saves, but asks players to verify bugs on a fresh save with no mods installed before reporting them to the bug reports forum.

The removal of loadstring and loadstream directly affects mods that relied on these methods. Mod authors must update their work accordingly. If a mod used these methods to execute code sent from a server, the recommended approach is to create the necessary methods and call them by sending the appropriate commands.

Modders who cannot replace these methods should explain their usage in the #mod_portal channel of The Official Project Zomboid Discord server.

Discussion of this update is pinned in the Project Zomboid Steam Discussions.