EternalCore

GH-1391 26.2 (#1391)

• dependency: Update actions/upload-artifact action to v7

• Update gradle.yml

• dependency: Update actions/checkout action to v7

• dependency: Update gradle/actions action to v6

• dependency: Update hmarr/auto-approve-action action to v4

• dependency: Update actions/cache action to v6

• harden: verify dependency integrity and add download timeouts

Fixes two findings from the loader audit:

1. Runtime-downloaded dependencies were loaded with no integrity check. DependencyDownloader now verifies every artifact against the strongest checksum the repository publishes (sha512 > sha256 > sha1) before it is written to the local cache and added to the classpath. Fails closed: a mismatch or the absence of any published checksum rejects that repository so resolution falls back to another source (and errors if none can vouch for the artifact). Adds a pure, unit-tested Checksum utility.

2. Jar, checksum, and POM fetches had no connect/read timeouts, so a slow or half-open repository could stall plugin startup. All three now set a 15s connect / 30s read timeout.

Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com Claude-Session: https://claude.ai/code/session_01JrkLFxzmmn7BpB9y6vMTeg

• security: require distinct permission to enchant another player's item

Both /enchant execute overloads were gated only by the class-level @Permission("eternalcore.enchant"), so anyone allowed to enchant their own item could also modify other players' held items.

Follow the FlyCommand convention: drop the class-level permission and gate each overload individually — eternalcore.enchant for the self variant and eternalcore.enchant.other for the "" variant.

Note: servers that previously granted eternalcore.enchant to allow enchanting others must now also grant eternalcore.enchant.other.

Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com Claude-Session: https://claude.ai/code/session_01JrkLFxzmmn7BpB9y6vMTeg

• dependency: Update dependency fr.skytasul:glowingentities to v2

• dependency: Update dependency com.gradleup.shadow:shadow-gradle-plugin to v9.5.1

• 26.2 in runServer

• Revert "harden: verify dependency integrity and add download timeouts"

This reverts commit ebbd343b5832e685908c862fbb4855aa5301c682.

• Add 26.2 in paperVersions property

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 noreply@anthropic.com