Half-Life 1: Engine
Servers will default to starting up using VAC2
Added "sv_uploadmax" cvar to limit the max size (in MB) a client can use for a custom resource (i.e spray decals)
Added "-sport" command line option to allow you to specify the VAC2 port the server should use
Don't allow servers to execute "alias" commands on clients (prevents an infinite loop exploit using alias commands from servers)
Fixed S2C_CONNREJECT packet exploit causing the game to quit from any currently connected game server (found by Gavin Cotter)
Fixed crash exploit caused by specially crafted packet triggering a crash in the resource upload code (found by Gavin Cotter)
Fixed infinite loop in richtext/textentry control caused by large sets of spaces between words wrapping around line ends (found by Kristian Hermansen)
Fixed possible lockup when refreshing a login ticket
Disabled old style server queries by default.
Counter-Strike
Fixed menu exploit on join that spawned you into the server but moved you around as you were in spectator mode