🔒 UPDATE 4.0.2 Security Hotfix

CocoVaults Lite - Released February 16th, 2026

---

⚠️ CRITICAL SECURITY UPDATE

This update patches multiple item duplication exploits and data integrity vulnerabilities. All servers should update immediately.

---

🔒 Critical Security Fixes

• Race Condition Dupe Fixed - Fixed race condition where delayed click tasks could overwrite vault saves on close, causing item duplication or loss

• Blacklist Save Failure Exploit Fixed - Blacklisted items are now only returned to players after successful save, preventing duplication on save failures

✨ Data Integrity Improvements

• Thread-Safe Vault Data - VaultData now uses proper synchronization to prevent corruption from concurrent access

• Thread-Safe Active Vaults - Fixed non-thread-safe ArrayList causing potential crashes in ACTIVE_VAULTS registry

• Async Save Performance - Vault close saves are now fully async, eliminating main thread blocking during slow I/O operations

🛠️ Additional Fixes

• Event Priority Corrected - InventoryCloseEvent changed from MONITOR to HIGH priority to properly handle state modifications

• Debounced Save Race Fixed - Fixed race condition where async removal could delete newly scheduled saves

• Click Task Leak Fixed - Pending click/drag delayed tasks are now properly cancelled when vaults close

📋 Update Instructions

1. BACKUP YOUR VAULT DATA - Always backup your plugins/CocoVaults folder before updating
2. Stop your server
3. Replace the old CocoVaults.jar with version 4.0.2
4. Start your server
5. Monitor console for any errors during startup

⚠️ Critical Notes

• UPDATE IMMEDIATELY - Multiple critical duplication exploits have been patched
• No configuration changes required
• Fully compatible with existing vault data (JSON/YAML)
• Improves stability and prevents item loss
• All async operations now properly synchronized

📝 Technical Details

For server admins & developers:

• VaultData fields now use volatile for thread visibility
• Synchronized access methods prevent data races
• CopyOnWriteArrayList used for concurrent vault tracking
• Async saves with proper completion callbacks
• Race condition guards in close/save pipeline
• Defensive copies prevent external modification

---

Questions? Support at fruitforge.com/discord

CocoVaults Lite — Update (Aligned with Official Version 4.0.1)

Released: January 8th, 2026

---

✨ What's New

• Full Version Alignment — Lite version updated to match the official plugin version.

🐞 Bug Fixes

• Vault Saving Fixes — Important corrections applied to vault saving.
• Known Issues Resolved — All known errors have been fixed.
• Dependencies Updated — All dependencies have been refreshed.

⚠️ Important Changes

• Incompatible with Previous Files — Older version files (items and configuration) are not compatible; a clean reinstall is recommended.
• This compatibility reset will not change again moving forward.

Update Instructions

1. Stop your server.
2. Remove previous Lite plugin files.
3. Place the new Lite .jar and fresh configuration.
4. Start your server.

⚠️ Important Notes:

• Perform a clean reinstall due to incompatibility with prior versions.
• Back up any data you wish to preserve before replacing files.

---

✅ What's New

• Hotfix for plugin.yml dependencies - Fixed an inconsistency affecting dependencies
• MiniMessage Dependency Updated - Updated to the latest version
• Unused Dependencies Removed - Freed up storage by removing unused dependencies

📥 Update Instructions

1. Stop your server
2. Replace the old .jar file with the new one
3. Start your server

⚠️ Important Notes:

• This update requires a server restart
• The update improves plugin stability and reduces storage usage

---

---

✅ What's New

• PlayerVaultsX Importer Fixed - Importer now works as expected
• Cache Responsibilities Improved - Separated and optimized for better performance
• Storage Methods Refactored - Partial refactor (except YAML) with up to 60% performance boost
• Fixed /cv 0 Bug - Command no longer allows usage with zero as vault number

📥 Update Instructions

1. Stop your server
2. Replace the old .jar file with the new one
3. Start your server

⚠️ Important Notes:

• This update requires a server restart
• Configuration files are compatible with previous versions

---

---

✅ What's New

• Minecraft 1.21.8 BETA Support - Be aware of update notes and report bugs on Discord
• CocoVaults Premium Permission - Added permission to unlock specific vaults
• Individualized GUI Permission - Main GUI opening permission now editable in Settings.yml

📋 Development Status

When will we leave ALPHA versions?

When the deprecations in the plugin's storage methods are resolved and support for Minecraft 1.21.8 is totally stable. (An update from NBT-API (@tr7zw/Item-NBT-API) is expected)

📥 Update Instructions

1. Stop your server
2. Replace the old .jar file with the new one
3. Start your server

⚠️ Important Notes:

• This update requires a server restart
• Configuration files are compatible with previous versions
• BETA support for MC 1.21.8 - Please report any issues

---