Updated Upstream (BungeeCord), drop macOS natives, default native cipher off

[electronicboy]

Updates the BungeeCord submodule by 16 commits, and takes the opportunity to clean up
two things the update surfaced: the jline pin, and the native cipher.

Upstream changes

Mostly dependabot bumps, plus three substantive commits:

• f56d37f4 Revert back to Cloudflare zlib not zlib_ng
• dc538cb2 #3998: Use pending connection online mode state for login packet
• 0b2812d2 Fix Minecraft 26.2 scoreboard team packet

Patches dropped

Two of our temporary patches are gone — upstream took both verbatim, with only our
explanatory comments differing:

• Use proxy online mode state → upstream #3998
• Temp fixup: 26.2 team packet → upstream 0b2812d2

macOS natives removed

OSX native zlib and crypto is dropped rather than updated.

Upstream's zlib-ng revert left the prebuilt osx-native-compress-arm.so we vendored
linked against an implementation upstream no longer uses. Rather than rebuild it, the
whole patch goes: isSupportedPlatformAndArch() returns to upstream's Linux-only check,
so macOS uses pure Java for both cipher and compression. That also removes ~98Ki of
vendored binaries and the macOS branches in compile-native-arm.sh.

For the cipher this costs nothing — see below, the native cipher was a pessimisation on
macOS by a factor of ~16. For compression, macOS loses a genuine 1.2–1.4x, which is the
actual trade being made here.

Native cipher now opt-in

The mbedtls native cipher is slower than the JDK's own implementation on every platform
and every supported JDK. Measured 2026-08-31, AES-128-CFB8, 16 MiB, median of 3, across
JDK 17/21/25:

Platform	mbedtls native	JDK JavaCipher	native vs JDK
macOS arm64	4.2 MiB/s	69.5	0.06x
Linux aarch64	7.2 MiB/s	~63	0.11x
Linux x86_64	29.4 MiB/s	~41	0.71x

AESCE/AESNI are compiled in and dispatching; the cost is that mbedtls's CFB8 driver calls
mbedtls_aes_crypt_ecb once per byte. The native cipher dates to 2013 (BungeeCord
c70006a3) when it beat Java 7 — the JDK baseline moved on and the comparison was never
re-run.

Those figures are single-call throughput on a large buffer, so they say nothing on their
own about packet-sized work. Re-measured across realistic sizes on Linux x86_64 (JDK 21,
median of 5 after 3 warmup rounds, 128 MiB per round, direct pooled buffers as in the
real pipeline) the ratio is flat:

buffer	mbedtls MiB/s	JDK MiB/s	native/JDK
256 B	31.3	40.8	0.77x
1 KiB	30.9	41.4	0.75x
16 KiB	30.9	41.8	0.74x
1 MiB	31.5	41.2	0.76x
16 MiB	31.4	41.4	0.76x

Per-call overhead never gets a look in: at ~31 MiB/s a 256-byte packet takes roughly 8 µs,
against a JNI transition of tens of nanoseconds. NativeCipher is zero-copy via
memoryAddress() and JavaCipher copies through heap arrays, and even so the difference
is under 1% of the work at the smallest realistic packet. The per-byte mbedtls_aes_crypt_ecb
call dominates at every size.

Only the default changes. -Dnet.md_5.bungee.jni.native-cipher.enable=true restores it.
NativeCode gains a defaultEnabled parameter used as the System.getProperty fallback;
its existing constructors still default to enabled, so EncryptionUtil is the only site
opting out.

Native compression is untouched and still enabled — it remains genuinely ahead of
java.util.zip.

jline 4.4.0

The Temp backbump jline to 4.0.9 patch existed because the FFM terminal provider crashes
on 4.1.x–4.3.1. 4.4.0 contains the fix, so the backbump is replaced by setting
jline-terminal-ffm / jline-terminal-jni to 4.4.0 where we introduce them, in the
TerminalConsoleAppender console patch.

Upstream's own org.jline:jline dep lives in the log module, which that same patch
comments out of the reactor — so it needs no patch at all, and we now carry no divergence
from upstream's jline version.

Testing

mvn clean package on JDK 21: BUILD SUCCESS, all tests pass, including NativeCipherTest
(which builds its own NativeCode and still sees the native cipher load, confirming the
default only moved at the EncryptionUtil call site) and the native zlib tests covering
upstream's zlib revert.

Cipher defaults verified against the built jar rather than just the unit tests:

property	cipher impl	compress impl
unset	JavaCipher	NativeZlib
native-cipher.enable=true	NativeCipher	NativeZlib
native-cipher.enable=false	JavaCipher	NativeZlib

Note that JDK 25 cannot build this — its javac rejects maven.compiler.release=17.