[1.4.1] - 2026-03-19

Fixed

• : replaced console dispatch with direct delivery so Xaero control strings are sent as chat text without Brigadier JSON parsing errors during GUI clicks

Security

• All plugin GUIs now use (a typed ) as the inventory holder instead of ; click and close dispatch in and all individual feature listeners now identify plugin GUIs by holder type rather than title string, preventing spoofed inventory titles from triggering plugin GUI handlers
• : added handler that cancels any drag action into plugin GUIs (covers -backed inventories and )

Fixed

• VanillaCorePlugin: removed duplicate "vanillacore" entries in the data-folder migration array (was listed three times)
• VanillaCorePlugin: re-added "SMPCore" legacy alias to data-folder migration array so configs from that legacy folder name are migrated correctly
• ConfigManager: corrected default config key features.mace-limiter.mace-crafted → features.mace-limiter.maces-crafted so config migration properly seeds the mace craft counter
• ConfigManager: added explicit migration step to remove the old boolean mace-crafted key and convert its value to the new integer maces-crafted key in existing configs
• ConfigManager: fixed migration log message reporting total defaults instead of actually-added entry count; also removed dead empty features array
• ConfigManager: bumped CURRENT_CONFIG_VERSION to 3 to reflect the new features.stop-item-despawn config section
• DimensionLockFeature.toggle(): CDN-sourced messages are now escaped with MiniMessage.escapeTags() before being passed to MessageManager.parse() to prevent MiniMessage tag injection from remote payloads; also added null checks on CDN message getters
• DimensionLockFeature: made sharedListener and registration flag static so NetherLockFeature and EndLockFeature share one DimensionLockListener instance instead of each registering their own, preventing every PlayerPortalEvent from firing twice
• DimensionLockFeature.toggle(): added remote-disable and maintenance-mode checks (matching BaseFeature.toggleDefault()) before processing the toggle
• FeatureManager.getClasses(): removed // Skip classes that can't be loaded comments from both catch blocks (production code no-comment rule); also added null check for directory.listFiles() return value
• OnePlayerSleepListener: player name and display name are now escaped with MiniMessage.escapeTags() before substitution to prevent tag injection; sleep message is parsed once and reused for all recipients; skip message is also parsed once outside the loop
• OnePlayerSleepListener: sleep and skip messages now parsed through MessageManager.parse() so MiniMessage tags (e.g. <yellow>{player}) render correctly instead of showing literally
• MaceLimiterListener: shift-click mace crafting now validates cursor is empty and inventory has space before consuming ingredients; result is added via addItem() instead of setItemOnCursor() to properly handle shift-click semantics
• MaceLimiterListener: shift-click mace crafting now sets matrix slots to null instead of setAmount(0) when an ingredient stack reaches zero, preventing ghost items in the crafting grid
• ServerRestartFeature: setScheduledRestartsEnabled(false) now cancels the running checker task, preventing it from continuing after scheduled restarts are disabled
• ServerRestartFeature: startScheduledRestartChecker() now stores its task ID; reload() and onDisable() cancel the old checker task before starting a new one, preventing accumulated duplicate restart-checker tasks across reloads
• StopItemDespawnListener: double-death within 60-tick window no longer causes the second death location to be prematurely removed; previous cleanup task is cancelled before scheduling a new one
• StopItemDespawnListener: stale UUID accumulation fixed — onItemDespawn now always removes item UUID from deathDrops even when feature is disabled, preventing unbounded set growth for items destroyed by lava/void/explosions
• StopItemDespawnListener: proximity radius check changed from < 16 to <= 16 so items spawning exactly 4 blocks from the death location are included
• StopItemDespawnListener: onItemMerge now checks isEnabled() to avoid silently transferring tags when feature is toggled off mid-session
• MenuClickListener: ARROW back-button click in Mob Manager World Select GUI now also validates the slot (inventorySize - 3) to prevent any future ARROW item from accidentally triggering navigation
• FeatureManager.getClasses(): added null check for directory.listFiles() return value to prevent NullPointerException when an I/O error occurs in dev/directory mode
• InvisibleKillsFeature: standardised default death-message fallback tag from <obfuscated> to <obf> to match the default in InvisibleKillsListener
• MinimapControlFeature.sendTellraw(): switched from player name to UUID when targeting the tellraw command to be future-proof against edge cases
• NetheriteDisablerListener: event.getView().getPlayer() guarded with instanceof Player pattern-match to prevent a ClassCastException if a non-player human entity ever triggers the smithing event

Added

• Stop Item Despawn feature: items dropped when a player dies will never despawn naturally; they persist indefinitely until picked up; enabled via features.stop-item-despawn.enabled
• Back button (ARROW) to Shield Mechanics settings GUI (slot 22) to navigate back to the main menu
• Back button (ARROW) to Mob Manager World Select GUI (slot size-3) to navigate back to the main menu

Changed

• VanillaCorePlugin: scheduled CooldownManager.cleanup() as an async repeating task (every 5 minutes) to evict expired cooldown entries for offline players and prevent unbounded memory growth

• CDNManager: removed the unused CachedData inner class

• ChatInputListener: migrated from deprecated AsyncPlayerChatEvent (Bukkit) to AsyncChatEvent (Paper) and PlainTextComponentSerializer for message extraction

• Breach Swap: swapping between a Breach-enchanted mace and a sword/axe is now allowed freely; the first attack within 500ms of that swap is blocked instead, removing the attribute-swap PvP advantage without restricting movement

• Breach Swap GUI: the mace icon in the settings menu now displays with an enchantment glint

Changed

• Migrated all player messaging from legacy §-code strings to Adventure API (Component/MiniMessage) across all command and listener classes
• Migrated UpdateNotificationListener from BungeeCord chat API to Adventure API (ClickEvent, HoverEvent, Component builder)
• Fixed InfiniteRestockFeature blacklist GUI: statusText/statusColor now use MiniMessage tags (<red>, <green>) instead of §-codes so they render correctly when passed to MessageManager.parse()
• Item Limiter: findMatchingItemKey no longer scans all configured limits linearly. A Material → key index is built at load time so lookups are O(1) for the common case instead of O(n limits)
• Item Limiter: inventory scan is now distributed across ticks (1 player per tick) instead of checking every online player in a single 20-tick burst
• Item Limiter: getPlayerItemCount no longer re-runs findMatchingItemKey for each inventory slot — the target limit is resolved once and ItemLimit.matches() is used directly
• Item Limiter: potion material detection replaced toString().contains("POTION") with a proper EnumSet<Material> covering POTION, SPLASH_POTION, and LINGERING_POTION
• Completed Adventure API migration: replaced all remaining legacy § color codes in ServerRestartFeature, ShieldMechanicsFeature, MinimapControlFeature, ItemLimiterListener, MaceLimiterListener, InvisibleKillsFeature, and MainMenu with MiniMessage format; GUI title constants in MaceLimiterFeature, ShieldMechanicsFeature, MobManagerFeature, and ServerRestartFeature converted from §-coded strings to Component constants; corresponding listeners updated to use InventoryView.title() (Component API) for title matching
• ServerRestartFeature: migrated from BungeeCord ActionBar API and Bukkit BossBar to Adventure API (player.sendActionBar, player.showTitle, net.kyori.adventure.bossbar.BossBar)
• MainMenu: replaced deprecated getLore() + §-detection with lore() + PlainTextComponentSerializer for lore inspection
• config.yml: migrated all message values from § codes to MiniMessage format
• Added JUnit 5 (junit-jupiter:5.10.0) as a test dependency
• ServerRestartListener: replaced non-thread-safe HashMap with ConcurrentHashMap for awaitingInput; async chat handler now uses atomic remove-and-null-check pattern to eliminate TOCTOU race
• UpdateNotificationListener: CDN-provided title and message text is now escaped with MiniMessage.escapeTags() before parsing to prevent tag injection
• MinimapControlFeature: world name, environment, and minimap mode values are escaped with MiniMessage.escapeTags() before being embedded in MiniMessage strings
• MessageManager.get(String, Object...): now throws IllegalArgumentException immediately when an odd number of replacement arguments is supplied or a key is null, instead of silently ignoring the trailing argument
• ShieldMechanicsFeature: extracted shared stun-lore assembly into buildStunLore(boolean, int) helper to eliminate duplication between buildMaceStunItem and buildAxeStunItem
• ServerRestartFeature.getRestartMessage: consolidated {time} and {player} substitution into a single overloaded method; callers no longer chain .replace("{player}", ...) at the call site
• MobManagerFeature.onRightClick: disabled warning now uses the centralized mob-manager.feature-disabled messages.yml key instead of a hardcoded literal
• InfiniteRestockFeature, ItemLimiterFeature: fillBorder now uses meta.displayName(Component.empty()) instead of the deprecated meta.setDisplayName(" ")
• messages.yml: removed UTF-8 BOM from file header

Fixed

• VanillaCommand reload: each feature's reload() is now wrapped in its own try/catch; a failure in one feature no longer aborts the reload loop for all subsequent features
• MainMenu: removed unreachable duplicate slot-50 handler that could never be reached after the earlier slot-50 Wiki handler returned
• MainMenu: removed duplicate import net.kyori.adventure.text.Component import

Added

• Fixed DimensionLockConfig default lockedMessage values to use MiniMessage (<red>The End/Nether is currently locked!)
• Fixed InvisibleKillsConfig default deathMessage to use MiniMessage ({victim} was killed by <obfuscated>?????????)
• Documentation: updated all §-coded examples in docs/docs/configuration.md to MiniMessage format

Added

• Shield Mechanics feature: configurable shield stun when a player is hit while blocking
  • Mace hitting a blocking player puts their shield on cooldown
  • Axe hitting a blocking player puts their shield on cooldown
  • Stun duration adjustable per weapon type (in ticks) via GUI
  • All settings accessible via /vanilla menu → Shield Mechanics → Right Click

Fixed

• Enchantment Limiter config GUI: clicking an enchantment on page 2+ would apply the action to the enchantment at the same slot on page 1 instead. Caused by firing synchronously, which wiped the stored page number before the new page was written. The page is now recorded after the inventory opens. Rare in practice — only affects servers with enough custom enchantments (from datapacks or other plugins) to fill more than 45 slots

Fixed

• Enchantment Limiter event handlers (enchanting table, anvil, pickup) no longer run when the feature is disabled in config
• Players who disconnect while the Enchantment Limiter config GUI is open no longer leave stale session data server-side
• Removed leftover PrepareAnvilEvent handler that was unused
• Villager discounts from curing zombie villagers and from the Hero of the Village effect now apply correctly. The old code was rebuilding MerchantRecipe objects from scratch on every interaction, which dropped any price multiplier changes Minecraft had set. Recipes are now modified in-place instead

Changed

• Default enchantment limits raised closer to vanilla max levels:
  • Sharpness and Power: 4 → 5
  • Protection, Fire Protection, Blast Protection, Projectile Protection, Feather Falling: 3 → 4
  • Unbreaking: 2 → 3
• Main command class renamed from SmpCommand to VanillaCommand

Added

• GitHub Actions workflow that publishes to Modrinth automatically when a GitHub release is published. It builds from source, pulls the changelog for that version, and uploads via mc-publish
• PR labeler config updated to actions/labeler@v5 syntax