5.8 build 3638

This update brings some improvements and bugfixes. Next update 5.9 will require Java 17 or newer so this is released before that to get those unable to update as many fixes as possible. bStats is showing Java versions <17 at 0.6% or 35/5300 so consider updating your Java version if you're able.

Special thanks to Zoriot and Minecraft0122 for contributions to this update.

Change log

Database

• Possibly fixed deadlock related to RemoveDuplicateUserInfoTransaction

Webserver

• Fixed minor vulnerability where path traversal bypass allowed anyone to read .json files on the system with a tab \t or newline \n character in the file path. This is minor because filesystems often block using those characters in filenames, they are not common with .json files, and attacker would need to know the relative path to the file.

Extensions

• Extension metadata is now cached in memory to avoid redundant database updates. Thanks to Minecraft0122 for work on this.
• Fixed LuckPerms related exception after Plan was reloaded

Other

• Zoriot added fabric-permissions-api as an optional dependency to fabric publish