TunnelMC

🆕 What's New in 1.3.0

Java 25 & Build Modernization

• Upgraded to Java 25 — compiled with Java 25 bytecode for the latest JVM performance and language features.
• Gradle 9.5.1 — build system upgraded from Gradle 8.x to 9.5.1 for native Java 25 support.
• Virtual thread executor — the dashboard HTTP server now uses newVirtualThreadPerTaskExecutor() for non-blocking I/O scaling on Java 25.
• plugin.yml api-version updated from 1.13 to 1.21 to match the target platform and suppress Paper deprecation warnings.

Security Hardening

• CSRF protection — all mutating API endpoints now require an X-TM-Request header.
• Brute-force login protection — lockout after 5 failed attempts with 500ms delay per failure.
• Timing-safe password comparison — login now uses MessageDigest.isEqual() to prevent timing attacks.
• CSP headers — Content-Security-Policy added to all dashboard responses to mitigate XSS risks.
• Session sweep — expired sessions and stale lockout entries are automatically cleaned up hourly.

Stability

• volatile singleton — static plugin instance is now volatile and nulled on disable to prevent classloader leaks during reloads.
• Config bounds checking — all numeric config getters now clamp to valid ranges via Math.max.
• Default password warning — a prominent console warning at startup if the dashboard password is still "changeme".

Compatibility

• Minecraft 1.21.x – 26.1.x — compiled against Paper 1.21.1 API, which is forward-compatible with all Paper versions through 26.1.x.

Existing configs remain fully compatible — no config changes required.