🔒 UPDATE 4.0.2 Security Hotfix

CocoVaults Lite - Released February 16th, 2026

---

⚠️ CRITICAL SECURITY UPDATE

This update patches multiple item duplication exploits and data integrity vulnerabilities. All servers should update immediately.

---

🔒 Critical Security Fixes

• Race Condition Dupe Fixed - Fixed race condition where delayed click tasks could overwrite vault saves on close, causing item duplication or loss

• Blacklist Save Failure Exploit Fixed - Blacklisted items are now only returned to players after successful save, preventing duplication on save failures

✨ Data Integrity Improvements

• Thread-Safe Vault Data - VaultData now uses proper synchronization to prevent corruption from concurrent access

• Thread-Safe Active Vaults - Fixed non-thread-safe ArrayList causing potential crashes in ACTIVE_VAULTS registry

• Async Save Performance - Vault close saves are now fully async, eliminating main thread blocking during slow I/O operations

🛠️ Additional Fixes

• Event Priority Corrected - InventoryCloseEvent changed from MONITOR to HIGH priority to properly handle state modifications

• Debounced Save Race Fixed - Fixed race condition where async removal could delete newly scheduled saves

• Click Task Leak Fixed - Pending click/drag delayed tasks are now properly cancelled when vaults close

📋 Update Instructions

1. BACKUP YOUR VAULT DATA - Always backup your plugins/CocoVaults folder before updating
2. Stop your server
3. Replace the old CocoVaults.jar with version 4.0.2
4. Start your server
5. Monitor console for any errors during startup

⚠️ Critical Notes

• UPDATE IMMEDIATELY - Multiple critical duplication exploits have been patched
• No configuration changes required
• Fully compatible with existing vault data (JSON/YAML)
• Improves stability and prevents item loss
• All async operations now properly synchronized

📝 Technical Details

For server admins & developers:

• VaultData fields now use volatile for thread visibility
• Synchronized access methods prevent data races
• CopyOnWriteArrayList used for concurrent vault tracking
• Async saves with proper completion callbacks
• Race condition guards in close/save pipeline
• Defensive copies prevent external modification

---

Questions? Support at fruitforge.com/discord