Roadmap · Scripting & SDK
Lua scripting
Ready for Closed Alpha
Resources with events, threads, exports, commands, convars and permissions run on game servers and in the game.
In preview: Works today in the closed test and can still change.
Each resource runs in its own sandbox, so one broken resource cannot take down the others, and the server can measure what each one costs. The API uses familiar names, so existing roleplay resources need fewer changes.
Shipped so far 18 changes
New In the game, functions now work across resources: exports can return objects with methods, events can pass callbacks, and exports may wait. Common roleplay frameworks rely on this. Engine New The bundled oxmysql and mysql-async resources provide their exports in the game, so `exports.oxmysql:query(...)` and `exports['mysql-async']:mysql_fetch_all(...)` work. Engine New Functions now work across resources: exports can return objects with methods, and events can pass callbacks. The received function is a normal Lua function that runs in the resource it came from. SDK & scripting New Exports may now call `Wait`. A caller in a thread or event handler gets the result once the export finishes. SDK & scripting New All oxmysql exports work, including `query_async` and `executeSync`, and the mysql-async exports `mysql_execute`, `mysql_fetch_all` and friends. SDK & scripting Improved `resmon` shows how many of a resource's functions other resources hold. SDK & scripting New Game servers run Lua resources with `server.cfg`, console commands, ACE permissions and network events between server scripts and players. Engine New Players only spawn after the server has checked their launcher join ticket, and get their GAMPEON display name in game. Engine New `gampeon-server` runs server resources without the game, with a console, database, HTTP and fake players for testing scripts. SDK & scripting New `server.cfg` and console commands (`ensure`, `exec`, `set`/`setr`/`sets`, `add_ace`, `add_principal`, `status`, `resmon` …) with ACE permissions. SDK & scripting New Player functions for scripts: `GetPlayers`, `GetPlayerName`, `GetPlayerIdentifiers`, `GetPlayerIdentifierByType`, `GetPlayerPing`, `DropPlayer` and more, with `gampeon:` and `license:` identifiers. SDK & scripting New `playerJoining` and `playerDropped` events. SDK & scripting Improved Network events from players are size- and rate-limited before scripts see them. SDK & scripting New Lua scripts can register console and chat commands with permissions (RegisterCommand, ExecuteCommand, IsPlayerAceAllowed). SDK & scripting New Server scripts can read and set convars from server.cfg and send web requests with PerformHttpRequest; private network addresses are blocked. SDK & scripting New vector2, vector3 and vector4 values, promises and `Citizen.Await` for scripts. SDK & scripting New LoadResourceFile, SaveResourceFile, GetResourceMetadata and GetInvokingResource for scripts. SDK & scripting New Lua 5.4 scripting runtime with a sandbox and a resource system driven by manifest files. SDK & scripting
Full changelog
Read about it in the developer docs
Last updated 6 November 2026 . Plans can change. Ideas and questions are welcome on Discord .
More in Scripting & SDK Back to the roadmap
