v1.4.2 - Security & Performance Hardening

This update is mandatory for all servers using the web dashboard.

Security

• Session tokens for the web dashboard now use cryptographically secure SecureRandom (256-bit entropy) instead of UUID.randomUUID() (122-bit), preventing potential token prediction attacks
• Added explanatory comments to CloudSyncManager for exceptions that are safely ignored

Performance

• Cloud dashboard registration retries no longer block a ForkJoinPool thread for 15 seconds between attempts, replaced Thread.sleep(15_000) with Bukkit's non-blocking runTaskLaterAsynchronously scheduler
• Offline earnings cleanup now uses a single bulk DELETE SQL query instead of N+1 individual queries when a player joins, significantly reducing database load on servers with many offline earnings records

Fixes

• Added proper exception logging to previously empty catch blocks in ShopGUI and CloudSyncManager, making debugging much easier
• Fixed a bug in ShopGUI where target was used instead of clicker for certain player interactions
• BungeeCord/Velocity Sync: Fixed a major bug where player balances could stay "stale" when switching servers due to permanent RAM caching. Player data is now refreshed from MySQL immediately upon joining a new server instance.

Internal

• Bumped version in pom.xml to 1.4.2 to ensure consistent builds across Maven and Gradle.
• Updated README.md to clarify that MySQL is mandatory for cross-server synchronization and that Market Prices remain per-server for regional economy support.

Aurelium - Patch Notes

v1.4.1 - Web Stability Hotfix

Fixes

• Cloud sync now automatically reconnects to the web dashboard if the render server restarts (Fixes 403 Invalid server ID error)

Aurelium - Patch Notes

v1.4.0 - Security, Enchantments & Cleanup

New

• Enchantment books now have individual prices based on rarity and level (Mending = 35k, Sharpness V = 60k, etc.)
• Added 1.21.11 enchantments: Breach, Density, Wind Burst
• Web dashboard balance updates instantly after buying/selling in-game
• /bal now suggests currencies and online players in tab
• Auto database backups when the plugin updates
• Auto schema migrations on startup

Fixes

• /bal was checking the wrong permission — non-op players couldn't use it
• SellGUI sometimes showed a different total than what you actually got paid
• Market GUI prices now update right after a transaction instead of lagging behind
• AH cancellation visual flicker on shift-click
• Collection bin no longer drops items on the ground if your inventory is full
• "All Items" button was showing items outside the configured categories
• NullPointerException when browsing "All Items"
• Cloud sync no longer spams HTML in console when the server is waking up

Security

• Economy, market, and auction transactions are now atomic (no more duping from race conditions)
• Auction bids use price-checked SQL to prevent out-of-order bid corruption
• Web purchases are deduplicated to prevent double-spending
• All GUIs lock down shift-click and drag to prevent inventory exploits
• SellGUI locks the price at review time so it can't change mid-transaction
• CORS is now a configurable whitelist instead of wildcard

Internal

• All money math uses BigDecimal now (no more floating point drift)
• Market item prices stored under market-items in config (moved from market.items)
• Moved Beacon, Respawn Anchor, End Crystal back to Mob Drops & Magic
• Web dashboard scroll performance improved with lazy rendering
• Better error messages for network issues during cloud sync

Aurelium Patch Notes

⚠️ EXPERIMENTAL WEB FEATURES ⚠️

The newly added Web Dashboard features are currently in active development. Please expect potential bugs or instability if you enable web.enabled in your configuration. The core in-game economy, GUI markets, and auction house are stable.

Version 1.3.2 — Web Dashboard Polish & Security (Minecraft 1.21.11)

🌐 Cloud Dashboard Improvements

• Fix: Stock Change % Fix — Resolved a bug where item base prices (like Diamonds) were being overwritten, causing 0% change to show on the web.
• Fix: Auction Display Fix — Fixed a bug where auction prices would show as undefined instead of the correct currency symbol.
• New: Icons — Replaced all legacy emojis with a premium SVG icon system for better clarity and aesthetics.
• Security: Self-Trade Protection — Players can no longer bid on their own auctions or fill their own buy orders via the web.
  • Buy buttons are now explicitly labeled "Your Auction/Order" and disabled for owned items.
  • Added backend validation to reject self-trading attempts.
• New: Added sellerUuid and buyerUuid to sync payloads for improved identity tracking on the frontend.

🎮 In-Game Fixes

• Fix: GUI De-duplication — Removed redundant item entries in the /stocks GUI that appeared if an item was in multiple categories.

Version 1.3.1 — Request Limit Update (Minecraft 1.21.11)

• Updated: Increased the web dashboard API rate limit to 330 requests per minute.
• New: Added an automatic rate-limit bypass for authenticated Minecraft servers.