Third Party Dependencies

CityRP runs on code this repo does not build. This page records where each piece comes from, which version is deployed, and what it would take to replace or rebuild it, so that a GMod update or a host move is not the first time anyone goes looking.

Covered so far: the binary and Lua modules held in cityrp2-cfg, git submodules, addons vendored in addons/, copies of Garry's Mod's own files, and the Workshop content clients download.

The CI tooling, Python requirements and submodules are kept current by Renovate; what it covers and what it leaves alone is in Dependency Updates.

Binary modules

Storage: limelight-development/cityrp2-cfg, under lua/bin/ on main. That repo is private. Its own deploy workflow rsyncs lua/bin/*_linux.dll onto Beta 1, Beta 2, Beta 3, Build, Live and Event, and cityrp2's deploy filter excludes lua/bin so the two do not collide.

Every module there is a 32-bit Linux build (gmsv_*_linux.dll), so every server has to stay on GMod's 32-bit public branch. The table's 64-bit column says whether a replacement exists for the x86-64 branch.

The cfg repo's history starts on 2026-09-07 (7538dc2, "add lua module syncing"), when the files were copied in from the hosts. Where each binary came from before that is not recorded, so the versions below were worked out on 2026-09-17 by hashing each file against upstream release assets and, where nothing matched, reading the strings compiled into it.

Module	Loaded by	Deployed version	Source	Built by	64-bit
tmysql4	db.lua, on every boot	Tag R1.02, self-built	bkacjios/gm_tmysql4	Unknown	SuperiorServers/gm_tmysql4 4.4+, API-incompatible
environ	env.lua, on every boot	v0.5.0 release	JoshPiper/gm_environ	Upstream CI	Yes, same release
sysinfo	inter_benchmark, optionally	v3.1.0 release	JoshPiper/gm_sysinfo	Upstream CI	Yes, same release
reqwest	Nothing in this repo	v4.0.0 release	WilliamVenner/gmsv_reqwest	Upstream CI	Yes, same release
luaerror	Nothing in this repo	1.5.9-rc2 release	danielga/gm_luaerror	Upstream CI	No release asset
mysqloo	damagelog, only with Use_MySQL on (it is off)	Pre-9 MySQLOO, self-built	Andy Vincent's MySQLOO, not located	Unknown	FredyH/MySQLOO 9.x
gatekeeper	Nothing; cannot load on GMod 13	GMod 12 module	Not identified	Unknown	Not applicable

"Upstream CI" means the deployed file is byte-identical to the release asset the project's own pipeline published, so replacing it is a download, not a build.

Checksums

SHA-256 of each file on cityrp2-cfg main at 1398dee. A mismatch means the file has changed since this page was written, and the row above needs checking again.

File	SHA-256
gmsv_environ_linux.dll	6fdcb7596ec572d47af9c9e2cdfebf295039f7e96907d2109797adea5b509001
gmsv_gatekeeper_linux.dll	c370e17c58699a56e4f57f02bce9740561f5a96de2cd7f97bcfad6789342c434
gmsv_luaerror_linux.dll	431c3008ddc087d78c6548bd5b197b94b30f9f0328109840a443bcebabe233d0
gmsv_mysqloo_linux.dll	4be8f45e38c9e1512af52fe0b7ca52e2cd18236ddaa4186ac22f610d4dae9195
gmsv_reqwest_linux.dll	e83e582b75cb67b626708024a7a91b8f33ba05ac4dd84a71945ec7e0e9b60d74
gmsv_sysinfo_linux.dll	c531c3f5848dacaabc45e9d2669935f8aff046c80632ec969663ff09ec93d2e4
gmsv_tmysql4_linux.dll	4e0b13a9c908ce3b8ba1c2f50bb450dda50910d9aa85d0cc6a22a006ade0478a

tmysql4

The gamemode's only database driver. Nothing starts without it.

The source is bkacjios/gm_tmysql4, the original repo, at its final commit and tag R1.02 (cf49078, 2017-01-01). That repo has had no commits since. SuperiorServers/gm_tmysql4 was created on 2017-04-17 carrying the same history (it is a copy, not a GitHub fork) and is where development continued, so it is the upstream for any upgrade, not the origin of this build.

The file does not match the R1.02 release asset, or any build committed to either repo. The release asset was built in /home/jake/gm_tmysql4. The deployed file was built by hand in /root/gm_tmysql4 with Debian 8's GCC 4.9.2 (-m32 -march=i586 -std=c++11), by someone not on record. The code it contains still pins the source to R1.02:

• It calls ErrorNoHalt, which 275cd84 (2016-12-30, the last source change before R1.02) introduced in place of LUA->ThrowError.
• It still exports tmysql.initialize, embeds MySQL Connector/C 6.1.6 and links Boost. The SuperiorServers copy replaced the connector on 2017-11-04, started removing Boost the next day, and removed initialize in f2fbb66 (2017-12-12).

Rebuilding it means reproducing a 2017 32-bit toolchain with Boost 1.59, which nobody is known to have done since. The official R1.02 release asset is the nearest drop-in, but it is a different build and has not been tested.

Updating: take new versions from SuperiorServers/gm_tmysql4 (releases), not the bkacjios repo. It is maintained (4.6, September 2026) and publishes x64 builds, but 4.1 renamed initialize and stopped self-polling, so moving to it needs changes to db.lua first. The internal technical risk register covers that upgrade under TR-007, and the module's pinned behaviour is in lua/tests/cityrp2_integration/tmysql4.lua.

environ

Reads the container's environment variables, which is where every secret and most server configuration come from. Nothing starts without it.

Owned by Josh. Each tagged release is built and published by the repo's GitHub Actions, with a SHA256SUMS file and a CycloneDX SBOM (gm_environ-v0.5.0.cdx.json) alongside the binaries. To update, download gmsv_environ_linux.dll from the release, check it against SHA256SUMS, and commit it to cityrp2-cfg.

sysinfo

Host CPU, memory and OS details. Only inter_benchmark uses it, and it checks util.IsBinaryModuleInstalled first, so a missing module just drops those lines from the report.

Owned by Josh, released the same way as environ.

reqwest

An HTTP client module that replaces GMod's HTTP. Nothing in this repo requires it. It may be loaded by something outside the repo on the servers, which has not been checked.

Third party, MIT licensed. Deployed file is the upstream v4.0.0 release asset, the latest release (2024-08-02).

luaerror

Exposes Lua errors to a hook so they can be reported. Only the server build is deployed. Nothing in this repo requires it, with the same caveat as reqwest.

Third party. Deployed file is the upstream 1.5.9-rc2 release asset (2023-05-28), which is the latest release and has no 64-bit build.

mysqloo

Only damagelog requires it, and only when Damagelog.Use_MySQL is true. It is false, so the module is never loaded.

This is not the maintained FredyH/MySQLOO (no 9.x release asset matches). The binary was built from Andy Vincent's original MySQLOO source, for the GMod 13 beta headers, by a user named drake with Ubuntu's GCC 4.5.2, which puts it around the GMod 13 beta in 2012. It links libmysql.so.16 dynamically rather than bundling a client library, so it would load only on a host that provides that file, which has not been checked.

If damagelog ever needs MySQL, replace it with FredyH's 9.x build rather than reviving this one.

gatekeeper

Dead. The file exports gmod_open, the GMod 12 module entry point, and not gmod13_open, so GMod 13 cannot load it. It was built against the Source SDK's tier1 with GCC 4.2.2. The gamemode replaced it with a Lua shim of the same name, sv_gatekeeper.lua, and nothing requires the binary. It can be deleted from cityrp2-cfg.

Lua modules

Storage: limelight-development/cityrp2-cfg, under lua/includes/modules/ on main, deployed by the same workflow as the binary modules. cityrp2's deploy filter excludes lua/includes for the same reason.

A file in lua/includes/modules/ only runs when something calls require with its name. None of these three has a maintained upstream: each is a copy of someone else's file from 2007 to 2014, worked out on 2026-09-17 by diffing it against the history of its likely source.

Module	Loaded by	Origin	Changed from origin
json.lua (Json)	sv_logs.lua, on every boot	Shaun Brown's JSON Encoder and Parser for Lua 5.1, 2007	Not known; the original download is gone
net.lua	Nothing	Garry's Mod's own includes/modules/net.lua at f93acbf, 2014-08-17	No
ltimer.lua (ltimer)	Nothing	Garry's Mod's own includes/modules/timer.lua at 329e797, 2013-01-10	Renamed, and one error made non-fatal

Checksums

SHA-256 of each file on cityrp2-cfg main at 1398dee.

File	SHA-256
json.lua	a80b124e065bfa8e57cddb157b994d37dcd67ae565e8839c68202b609965a27f
ltimer.lua	3f34b2070f9dcd3790d1f68d5d443d1890005ae6d94232f4970fa349b5f1af35
net.lua	a71609075d4d3cfe76aecfe51e75302ea0583697d6fee9279544d3c9b3ae9e26

json

Defines the global Json table (Json.Encode, Json.Decode, Json.Null). sv_logs.lua requires it and uses Json.Encode to write each log row to data/logs/<server>/<date>.txt. The caw plugin also calls Json.Encode, without a require of its own, so it depends on sv_logs.lua having loaded first.

The header credits Shaun Brown, 2007, at chipmunkav.com, under an MIT-style licence. That site no longer serves the file, so the copy here cannot be checked against the original. A copy on Pastebin differs from it in two code lines, and it is not known which of the two is the unmodified one. It still carries a leftover local Chipmunk = Chipmunk from the program it was written for. The file is Latin-1, not UTF-8 (the © in the header is byte 0xA9).

Nobody maintains it. It is plain Lua, so there is nothing to build, and GMod's built-in util.TableToJSON covers the same need if it is ever replaced. The output of the two differs (key order, number formatting, escaping), so anything that parses the log files would need checking.

net

A line-for-line copy (ignoring line endings and trailing whitespace) of Garry's Mod's own net.lua as it stood on 2014-08-17, the last version before Garry's Mod moved the file to includes/extensions/net.lua on 2014-08-30. GMod has loaded it from the new path ever since, so this copy is never loaded. Nothing requires it.

It is not harmless if something ever did: require("net") would replace net.Receive, net.Incoming, net.WriteEntity, net.ReadTable and the rest with their 2014 versions over the top of the current ones, which differ in wire format (entities are now written in MAX_EDICT_BITS bits, not 16). It can be deleted from cityrp2-cfg.

ltimer

Garry's Mod's Lua timer module as it stood in its first commit to the public repo (2013-01-10), before GMod replaced it with a C++ implementation in 2014. The copy was changed in three places: the module is named ltimer instead of timer, it calls AddCSLuaFile() on itself, and a bad Simple call raises ErrorNoHalt rather than error. Nothing requires it. If something did, it would add a Think hook named CheckTimers. It can be deleted from cityrp2-cfg.

Git submodules

Two submodules, worked out on 2026-09-17 with git ls-tree HEAD and git ls-remote against each upstream. Renovate bumps both to the head of the branch .gitmodules names (Dependency Updates). advdupe2, listed below them, was a third and is now plain files.

Path	Upstream	Pinned at	Deployed	Licence
addons/photon	photonle/Photon	e0d5ee75 (2026-08-30)	Yes, every server	Creative Commons Non-Commercial (README), used with the maintainers' permission
tools/docs/vendor/glua-api-snippets	luttje/glua-api-snippets, branch lua-language-server-addon	972e9527, tag v0032 (2026-08-01)	No; docs tooling only	MIT
addons/advdupe2	wiremod/advdupe2	Not a submodule any more	Yes, as plain files	Apache-2.0

photon

Emergency vehicle lighting, and the base addons/vehicles_emvu builds its vehicle configs on.

The pin is a Limelight commit that only exists upstream as the head of PR #286, whose branch claude/vehicle-blackout-delay-07ccf8 no longer exists on photonle/Photon. The commit is not on the default branch development either: the PR landed there rebased, and development is now three commits further on. A fresh checkout still works because GitHub keeps refs/pull/286/head. .gitmodules now names development, so Renovate's first Photon PR moves the gitlink onto it.

Every deploy workflow checks out with submodules: true, so Photon ships to every server. The compile check and test jobs check out without submodules, so Photon's Lua is never checked before it deploys.

Updating: Renovate opens the PR, on a dev/renovate/ branch so it can be tried on a development server first. While testing a Photon feature that is ahead of development, point branch = at the feature branch and set it back once the feature merges upstream.

glua-api-snippets

GMod API annotations for LuaLS, used by tools/docs/generate.py to build the docs site. It is one release behind its branch (v0033, 2026-09-01). The deploy filter does not include tools/, so it never reaches a server, though deploy checkouts still clone it.

advdupe2

Converted from a submodule to plain files in 928fb91d4 (2025-01-28). Its leftover .gitmodules entry was removed when Renovate was added.

The copy is based on upstream 620d3ba (2025-01-08), which master is now 41 commits past. Eight Lua files carry Limelight fixes from August and September 2026 (undo crash, submaterial validation, keypad and entity saving, the AD1 legacy decoder), so updating means merging upstream into the local copy, not replacing it. The upstream Apache-2.0 LICENSE was deleted from the copy; the licence asks that redistributed copies keep it.

Vendored addons

Storage: addons/ in this repo. The deploy filter ships every folder there except _* and a few host-only folders (sprops_workshop_edition_173482196, gcompute-master, glib-master, gooey-master, vfs-master), so every addon below is deployed. addons/advdupe2 and addons/photon are covered under Git submodules.

Worked out on 2026-09-17. "Matches" means the vendored copy was diffed against that upstream version, ignoring whitespace and line endings. Where an upstream is only on the Workshop, the item was resolved through the Steam API, and diffed where a copy was in the local Workshop cache. Workshop items carry no licence unless the author states one.

Upstream kinds: WS is a Steam Workshop item; GitHub repos are linked.

Addon	What it is	Origin and upstream	Vendored version and local changes
3dsign	3D sign entity and editor	RocketMania; upstream not found	Heavily edited since 2015 (resolution, cityrp.imageHosts)
advanced_material_reborn_3118788923	Advanced Material tool	WS 3118788923	Large local additions (material browser, 2026); not diffed
advanced_resizer_217376234	Prop resizer tool	WS 217376234, now titled "Collision Resizer (ENHANCED)"	Heavily edited (build-server gating, limits); not diffed
advduplicator	Advanced Duplicator 1	wiremod/advduplicator, closest f2385d5 (2013)	Local fork. Copying disabled 2026-09-16; kept only to convert old dupes to AdvDupe2. Its LICENSE is GPLv3, upstream is Apache-2.0
binoculars	RPW binoculars SWEPs	WS 764395035	Imported identical to the 2016 Workshop build; lightly edited
christmas2019	Christmas 2019 models, Santa and tuxedo playermodels	Packed by Limelight from third-party models (Santa credited to Voikanaa, tuxedo from Mafia II); sources not found	Unchanged since 2019
cityrp_measuring	Measuring tool	Probably first party (2015)	Nothing references it; g-rule does the same job
content_firefighters	Firefighter playermodels	Third-party models; client copy is WS 1919778255	Unchanged since 2019
cw20	Customizable Weaponry 2.0 base, attachments and weapons	WS 349050451 and 358608166 (Spy), plus attachments from other CW 2.0 packs not identified	Base closest to the 2016 "Rev75" build; 29 base files edited, 78 files from other packs
damagelog	Damage log and RDM manager	Tommy228/TTTDamagelogs, based on 3.1.0 (2aa8d96, 2017). GPL-3.0	Effectively a first-party fork: 114 local commits, 5 local-only files. Upstream inactive since 2019. Admin clients fetch upstream's version.md on join
dougscrashdixes-master	Clamps SetPos calls to +/-100000	Douglas Huck, 2013; upstream not found	Unchanged. The clamp is beyond the map limit, so it likely does nothing but wrap every SetPos
easy_bodygroup_tool	Bodygroup tool	Robotboy655, WS 104604943, robotboy655/gmod-addons	2017 import, predates the GitHub history; access gating added
easy_bonemerge_tool_170917418	Bonemerge tool	Robotboy655, WS 170917418	Matches e132361 (2024) plus a developer-only CanTool hook
easy_elevator_tool	Elevator tool and entity	WS 3683954525 (2026)	Heavily edited at import (limits, dupe support).
easy_entity_inspector	Entity inspector tool	Robotboy655, WS 195065185	2017 Workshop build with small edits
elevator tool	Older elevator tool	WS 733454527 (2016, abandoned)	Nothing references it; easy_elevator_tool does the same job
events	Event models and materials	First party; also served as WS 1357124301	Content only
ext_spawnmenu	Extended Spawnmenu	Robotboy655, WS 104603291	2018 import, unchanged
fading door tool	Fading door tool	Upstream not found	Unchanged since 2015; uses SendLua
favorites_2901526545	Spawnmenu favourites tab	WS 2901526545, ret-0/gmod_favorites. GPL-3.0	Matches 4d9728e (2026) except the tab's sort order
foodnhouseholdsitems	Food and household prop models	WS 108024198 (by model path)	Content only
fprofiler	In-game Lua profiler	FPtje/FProfiler. LGPL-2.1	Matches 6342602 (2016) plus an on/off switch; bundles a 2015 CAMI draft
g-rule	Measuring tool	WS 3335380314, MartyX5555/G-Rule. MIT	Matches 6028993 (2024) plus PHX units
gmod_legs_3_112806637	First-person legs	WS 112806637, v3.10.2. The author asks that it not be reuploaded to the Workshop	Imported 2026; not diffed
hr_cm	Meth lab system	EnnX49, sold on ScriptFodder (paid); listing not found	Effectively a first-party fork (+6,702/-3,224 lines, active in 2026). lua/darkrp_modules/ is DarkRP-only and unused
inter_benchmark	GLua benchmark suite	Josh's JoshPiper/InterBenchmark. MIT	v3.2.1 minimal release (build 8098d36), unchanged
it_emitter	Entity that runs /it text by radius	Contributed by Jompe, 2017	Keyed variant added 2018
keypad 1.6	Keypad tool and entity	A bug-fixed repost of the original Keypad; upstream not found	Edited (team bypasses, dupe support 2026). Overlaps the unisec-keypads plugin
ladder_tool	Ladder tool	WS 708225419 (2016, abandoned)	Unchanged; nothing references it
material_url_2559426779	Web image materials tool	WS 2559426779, v0.9.1 (upstream abandoned 2021)	Heavily edited (41 commits since 2025)
melee_weapons	HL2 melee SWEPs	WS 675824914 (by title and author)	Rebalanced (19 commits)
navmesh	Nav mesh for rp_evocity_v4b1	First party (generated 2019)	Binary file
nopickup	Tool to stop props being picked up	First party (Temar, 2016)	Unchanged
npcifier	Staff tool to make NPCs from models	Probably "kk"; upstream not found	Blocked in cityrp.BlockedTools
pcasino	Casino games	Owain's pCasino, paid on GmodStore. Content is WS 2228228831	Heavily edited (59 commits since 2025, odds retuned); exact version unknown
playablepiano	GMod Tower piano	MacDGuy, WS 104548572	Lightly edited. Opens a sheet-music page from gmtower.org over HTTP in the player's game
polecam	SWAT pole camera SWEP	CustomHQ, probably sold on ScriptFodder; content is WS 461261004	Unchanged since 2018
pollux_itbutton	Button that runs /it	Contributed by Pollux, 2019	Nothing references it
pollux_sensor	PIR sensor entity and tool	Contributed by Pollux, 2018	Lightly edited
precision	Precision tool (Easy Precision 0.96)	WS 104482086 (by description)	Edited (middle-mouse move, 2026); not diffed
prop_placer_stool_2980170883	Prop placement tool	WS 2980170883	Prop limit fix (2025); upstream updated since
redo_button_796294821	Redo for undone props	WS 796294821 (abandoned 2016)	Rewritten at import (2026)
rradio_3318060741	Boombox and car radio	WS 3318060741, charles-mills/rRadio. MIT	Closest c6f111c (2025-09-22), 16 files edited. Upstream has since restructured, so updating means porting the edits
rt_camera	GMod 12 RT camera tool	Garry's Mod 12's tool; WS 106944414 is a candidate reupload	Nothing references it
sit_anywhere	Sit anywhere	Xerasin, WS 108176967, Xerasin/Sit-Anywhere	Server files match 4f3ef7e (2018); client edited. Upstream has restructured since
skinswitcher	Skin selector tool	Mihara, 2008 (pre-Workshop)	Blocked in cityrp.BlockedTools
smartsnap 13	Snap-to-grid building aid	Syranide, GMod 13 fix by Raklatif (2012)	Unchanged since 2016
smartwelder	Smart Welder V4	WS 131586620 lineage	Local fork (weld modes 2025, ownership fix 2026)
sound_emitter	Sound emitter tool	MajorVictory; original Workshop item removed, reupload WS 2995660241	Cleaned up 2025
stacker stool	Improved Stacker	Mista Tea, Mista-Tea/improved-stacker, WS 264467687	Matches af0cff7 (2015) with one local change; upstream updated 2023
stool_precisionalign	Precision Alignment	Wenli, unofficial v9 by TweaK, WS 457478322. GPL-3.0	Matches that release plus two fixes
stove	Cooking stove and skill	Luvbunny for Limelight, 2021	First party; models by "markus"
sub_material_tool	Per-submaterial tool	WS 405793043 (by name; abandoned 2015)	Hardened 2026; not diffed
summercards_reward_bmw_i8	BMW i8 reward vehicle script	CrushingSkirmish over VCMod-era content, WS 890978176	Unchanged since 2018
tile_build_2858777893	Tile building tool	WS 2858777893	Heavily edited (2025 to 2026)
tool_organizer_2950719460	Spawnmenu tool organiser	WS 2950719460	Performance and lint edits (2026); upstream updated since
uk_police_line_rope	Police tape rope materials	Viten, WS 384656069	Materials deleted from the repo in 2017 and the item is not in downloads.lua, so the tape may render untextured
vape_swep_673698301	Vape SWEPs	Swamp Onions, WS 673698301	Lightly edited
vehicles_emvu	Photon emergency vehicle configs	Many community authors (LoneWolfie, Schmal and others) plus Limelight's own	152 commits; no per-file provenance. Needs addons/photon
warp	Staff warp areas (WASYS)	"[GrGr] Merdeus"; upstream not found	warpdesttool is blocked in cityrp.BlockedTools
waterizer_stool_1_1_140687545	Makes props act like water	WS 140687545	Undo fix (2026)
wheel-clamp	Vehicle clamp SWEP and entity	First party (Spai, 2017)	Lightly edited

Duplicates and likely dead addons

• Doing the same job twice: elevator tool and easy_elevator_tool; cityrp_measuring and g-rule; keypad 1.6 and the unisec-keypads plugin.
• Nothing references them: cityrp_measuring, elevator tool, ladder_tool, rt_camera, pollux_itbutton. Tools still register with the toolgun whether or not code references them, so check with staff before removing.
• Blocked tools: skinswitcher, npcifier and warp's warpdesttool are in cityrp.BlockedTools.
• Likely no-ops: dougscrashdixes-master, and hr_cm/lua/darkrp_modules/.
• Empty: addons/addons.txt is a tracked, empty file.

Paid addons

pcasino (GmodStore) and hr_cm (ScriptFodder) are commercial, and polecam probably is. Running them on our own servers is what the licences are for, and cityrp2-contrib's addons/ is empty, so none of them is mirrored to contributors. What matters for maintenance is that none has a public source to update from: the vendored copy is the only copy, and for pcasino and hr_cm it has been edited well past the version that was bought.

Copies of Garry's Mod's own files

The repo no longer carries a sandbox gamemode, but it still carries part of one.

A full copy of gamemodes/sandbox was committed in 69990d930 (2017-06-30), refreshed by hand until b8d8e3ee4 (2019-07-03, "Update from current dedi files after gmod update"), and deleted in 0bed2cc3a (2019-11-13). The deploy filter now excludes gamemodes/sandbox and gamemodes/base, so servers run the sandbox their GMod install ships.

The same 2019 snapshot's copy of GMod's garrysmod/lua/autorun/ was left behind, and it is deployed. The deploy rsyncs the repo onto each server's garrysmod/ with --delete --inplace and + lua/***, so these files are written straight over the stock files of the same name, and clients receive the server's copies. Staleness below is measured against Facepunch/garrysmod history as of 2026-09-14.

Files in lua/autorun/	State
properties.lua, properties/collisions.lua, keep_upright.lua, npc_scale.lua, remove.lua	Identical to current stock
base_npcs.lua (32 commits behind), game_hl2.lua (16), utilities_menu.lua (15), developer_functions.lua (12), base_vehicles.lua (8), client/gm_demo.lua (5), menubar.lua (4), server/admin_functions.lua (3), client/demo_recording.lua (3), the other ten properties/*.lua (1 to 6 each)	Unedited copies of the July 2019 stock files
server/sensorbones/*.lua (10 files)	2013 stock; upstream has only restyled them since
game_css.lua, game_dod.lua, game_ep2.lua	Deleted from stock in 2013 and 2014; still register CS:S, DoD:S and Episode 2 models and NPCs when those games are mounted
menubar/ai_options.lua, menubar/display_options.lua	Deleted from stock in 2014; fully commented out and loaded by nothing

What this costs:

• Missing upstream fixes. Since 2019, stock has gained fixes and rate limiting in several context-menu properties, the fix stopping two players driving one entity, edict-limit handling in bone manipulation, and the lua_find access changes in developer_functions.lua. None of it reaches the servers while these copies are deployed.
• Stale spawnmenu. base_npcs.lua, base_vehicles.lua and game_hl2.lua miss six years of NPC and vehicle entries and their localisation.
• --delete owns the folder. Every current stock autorun file also exists in the repo, so nothing is deleted today. A file Facepunch adds to lua/autorun/ in future is deleted from the servers by the next deploy.
• Updates can flip versions. If a server updates GMod on start (not checked; that is Pelican configuration), a GMod update restores stock copies until the next deploy overwrites them again.

Recommended, in this order. Deleting the files alone would make things worse: with --delete, removing them from the repo removes them from the servers, stock copies included.

1. Add the stock lua/autorun/ paths to the deploy filter's exclusions, so rsync neither writes nor deletes them.
2. Delete the 29 stale copies, the five that match stock and the five stock no longer ships from the repo. The files CityRP wrote itself in lua/autorun/ stay.
3. Restore stock on each server, for example with a GMod update that validates files, since the deploys have already overwritten them on disk. Remove the three game_*.lua and two menubar/ files stock no longer ships by hand.

Inside the gamemode

entities/weapons/gmod_tool/stools/rope.lua overrides sandbox's rope tool. It is Facepunch's 2016-08-04 version (1acd2a105) plus two cityrp.logs.add calls added in 2018. It lacks everything upstream added since, including the sbox_maxrope/sbox_maxconstraints limits (2024) and the 2023 validity checks for sandbox tools. gamemode/init.lua, cl_init.lua, cl_hints.lua and cl_scoreboard.lua share names with sandbox files but are CityRP's own code.

darkrp.txt in the gamemode folder is a second gamemode descriptor ("category" "rp"), added in 2021 so the same folder can be deployed as gamemodes/darkrp and list under the server browser's RP category. GMod only reads the descriptor matching the folder name, so it does nothing today, and the deploy filter excludes gamemodes/darkrp.

Other third-party files in lua/

File	Origin
lua/csl/*, lua/autorun/csl_load.lua	SProps' 2016 custom spawnlist loader, by shadowscion (ACF-Team/sprops, Workshop 173482196. Current SProps no longer ships these files.
lua/autorun/client/cw_cl_init.lua	Customizable Weaponry 2.0 client bootstrap for addons/cw20.
lua/autorun/client/cl_cinematic_camera_menu.lua	Cinematic Camera SWEP menu, by Patrick Hunt/Wood. The SWEP is in the gamemode.
lua/autorun/materials.lua	Material replacement library, origin not found. Nothing calls it, and addons/advduplicator/lua/autorun/materials.lua has the same Lua path, so only one of the two runs.
lua/autorun/holdfix.lua, lua/autorun/client/gmc.lua, lua/autorun/flmaterial.lua	Origin not found. Imported in 2015 ("Version from fearless", "lua update from ftp"). holdfix.lua is a pre-GMod 13 hold type workaround using umsg.

Everything else in lua/autorun/ (thirdperson.lua, modelreg.lua, rpprops.lua, downloads.lua, the map fixes and so on) is CityRP's own.

Workshop content

What clients download is set by resource.AddWorkshop calls, almost all in lua/autorun/server/downloads.lua. That file says it is generated (last on 2026-08-31), but the generator is in neither this repo nor cityrp2-cfg, and it has been hand-edited since. It lists 60 items for every server, a game.GetMap() chain for 12 maps, and five items for the beta server only.

What the servers mount themselves is not recorded in either repo. No host_workshop_collection, workshop.vdf or map setting exists, so it is in the Pelican startup parameters.

All 99 unique IDs were resolved against Steam on 2026-09-17. Every available item is public and none is banned. Notable:

ID	Item	Note
230319541	SW Racecar Maps	Removed from the Workshop. Served only on gm_swrc_track_bresse, where clients cannot download it.
3465709662	rRadio development build	Removed. Only used when rRadio.DEV is on.
3778805854	Limelight v4b1 Content	A collection. resource.AddWorkshop sends nothing for a collection, and its five children are already listed next to it.
1323211588, 1334105250, 1338276210, 1338277336	Limelight Content Blobs 1 to 4	About 5.5 GiB between them, of about 9.3 GiB served to every client. All four were updated on 2026-09-15, so every client re-downloads them after a content push.
2072136134, 3726467234, 3389728250	CH Bitminers content, Glide Ford/Ferrari, Glide vehicle base	Beta only, 1.4 GB. No Lua for them is in the repo, and the beta deploy's --delete removes non-repo addons unless their folder starts with _.
1129792694, 719497720, 2228228831	Damagelogs, Unisec, pCasino content	The calls in those addons are disabled or commented out. pCasino content is still served by downloads.lua.

Addons vendored in addons/ whose Workshop item is also served: rRadio, Favorites, Vape SWEP and Waterizer (folders named with the ID), plus the content packs for easy_elevator_tool, playablepiano, binoculars, pcasino, polecam and cw20. SProps (173482196) is served, and its addon folder lives only on the hosts: the deploy filter excludes it.

Changing a dependency

When a dependency on this page is added, updated or removed, update its row, checksum or section here in the same change, so this page stays the record of what is deployed.