X-Commands

🚀 X-Commands v2.7 - Changelog

🛡️ Security Fixes

• Added null byte (\0) and control character removal in command sanitization (ConsoleAction, PlayerAction) to prevent potential injection exploits.
• Fixed PermissionCondition allowing server operators to bypass LuckPerms negation nodes — OP players are now properly checked against negative permissions.

🐛 Bug Fixes

• Fixed CommandManager still referencing old template names (ejemplo.yml and aviso.yml) instead of the renamed example.yml and announce.yml, causing command creation to fail.
• Fixed HealAction crashing on servers running pre-1.20.6 due to direct use of org.bukkit.Registry.ATTRIBUTE. Added fallback compatibility using Attribute.valueOf().
• Fixed UpdateChecker throwing NumberFormatException when parsing version strings like v1.0.0-beta, which caused the update checker to crash silently.
• Fixed ActionsMenu not finding commands case-insensitively, causing commands with uppercase letters to not appear in the menu.
• Fixed SchedulerUtils thread safety issues — task references are now volatile to prevent race conditions.
• Fixed CompatibilityUtils.isPaper not being volatile, causing unreliable Paper detection from async threads.
• Fixed ConfigUpdater crashing with NullPointerException when a resource template was missing from the JAR.
• Fixed VelocityAction sending messages through the BungeeCord channel, which Velocity doesn't listen to. Added console warning and corrected channel usage.
• Fixed KickAction applying double color translation, which could corrupt formatted kick messages.
• Fixed BaseMenu sharing a single mutable ItemStack reference across all empty glass pane slots — modifying one would corrupt all others.
• Fixed LocateCommand showing a misleading "language changed" message when only displaying the current language.
• Fixed SendToAction using tag "SENT_TO" instead of the expected "SEND_TO", causing proxy forwarding to fail.
• Fixed EffectAction unnecessarily initializing a variable to null.
• Fixed MenuHolder.getInventory() potentially returning null on plugin disable.
• Fixed InventoryListener showing hardcoded Spanish text ("Anterior" / "Siguiente") as fallback for pagination buttons instead of using translated keys.
• Fixed LoggerUtils eagerly initializing Bukkit.getConsoleSender() at class load time, which could fail during early startup.
• Fixed 9 silently swallowed exceptions in CompatibilityUtils — all compatibility checks now log debug messages on failure for easier troubleshooting.

🔧 Code Quality

• Added volatile modifier to all fields accessed from async threads (UpdateChecker, SchedulerUtils, CompatibilityUtils) to ensure proper memory visibility.
• Improved error handling and logging across the entire codebase for better diagnostics.
• Reduced code duplication in proxy-related actions (BungeeAction, VelocityAction, SendToAction).
• Cleaned up unnecessary initializations and dead code.
• Standardized error messages to use language keys instead of hardcoded strings.