ВЕРСИИ (165)

# AuthSecured 1.2.7 Security follow-ups from the 1.2.6 review, plus Folia support and a new session option from @nicki41. ## What's new - Paper now runs on Folia. - New option `session.extend-while-online` (default `false`): the session timeout counts from when a player leaves instead of from login. Useful on proxy networks sharing one database. ## Security and fixes - Simultaneous registrations can no longer exceed `max-accounts-per-ip`; the limit is enforced atomically, also across servers sharing a PostgreSQL database. - `/authadmin doctor` no longer treats hosts like `127.db.example.com` as loopback. - Audit and login records queued at shutdown are no longer lost. ## Notes - No configuration changes are required. - Folia support has been covered only by the unit-test suite, not tested on a live Folia server. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.7 Security follow-ups from the 1.2.6 review, plus Folia support and a new session option from @nicki41. ## What's new - Paper now runs on Folia. - New option `session.extend-while-online` (default `false`): the session timeout counts from when a player leaves instead of from login. Useful on proxy networks sharing one database. ## Security and fixes - Simultaneous registrations can no longer exceed `max-accounts-per-ip`; the limit is enforced atomically, also across servers sharing a PostgreSQL database. - `/authadmin doctor` no longer treats hosts like `127.db.example.com` as loopback. - Audit and login records queued at shutdown are no longer lost. ## Notes - No configuration changes are required. - Folia support has been covered only by the unit-test suite, not tested on a live Folia server. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.7 Security follow-ups from the 1.2.6 review, plus Folia support and a new session option from @nicki41. ## What's new - Paper now runs on Folia. - New option `session.extend-while-online` (default `false`): the session timeout counts from when a player leaves instead of from login. Useful on proxy networks sharing one database. ## Security and fixes - Simultaneous registrations can no longer exceed `max-accounts-per-ip`; the limit is enforced atomically, also across servers sharing a PostgreSQL database. - `/authadmin doctor` no longer treats hosts like `127.db.example.com` as loopback. - Audit and login records queued at shutdown are no longer lost. ## Notes - No configuration changes are required. - Folia support has been covered only by the unit-test suite, not tested on a live Folia server. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.7 Security follow-ups from the 1.2.6 review, plus Folia support and a new session option from @nicki41. ## What's new - Paper now runs on Folia. - New option `session.extend-while-online` (default `false`): the session timeout counts from when a player leaves instead of from login. Useful on proxy networks sharing one database. ## Security and fixes - Simultaneous registrations can no longer exceed `max-accounts-per-ip`; the limit is enforced atomically, also across servers sharing a PostgreSQL database. - `/authadmin doctor` no longer treats hosts like `127.db.example.com` as loopback. - Audit and login records queued at shutdown are no longer lost. ## Notes - No configuration changes are required. - Folia support has been covered only by the unit-test suite, not tested on a live Folia server. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.7 Security follow-ups from the 1.2.6 review, plus Folia support and a new session option from @nicki41. ## What's new - Paper now runs on Folia. - New option `session.extend-while-online` (default `false`): the session timeout counts from when a player leaves instead of from login. Useful on proxy networks sharing one database. ## Security and fixes - Simultaneous registrations can no longer exceed `max-accounts-per-ip`; the limit is enforced atomically, also across servers sharing a PostgreSQL database. - `/authadmin doctor` no longer treats hosts like `127.db.example.com` as loopback. - Audit and login records queued at shutdown are no longer lost. ## Notes - No configuration changes are required. - Folia support has been covered only by the unit-test suite, not tested on a live Folia server. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.7 Security follow-ups from the 1.2.6 review, plus Folia support and a new session option from @nicki41. ## What's new - Paper now runs on Folia. - New option `session.extend-while-online` (default `false`): the session timeout counts from when a player leaves instead of from login. Useful on proxy networks sharing one database. ## Security and fixes - Simultaneous registrations can no longer exceed `max-accounts-per-ip`; the limit is enforced atomically, also across servers sharing a PostgreSQL database. - `/authadmin doctor` no longer treats hosts like `127.db.example.com` as loopback. - Audit and login records queued at shutdown are no longer lost. ## Notes - No configuration changes are required. - Folia support has been covered only by the unit-test suite, not tested on a live Folia server. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.7 Security follow-ups from the 1.2.6 review, plus Folia support and a new session option from @nicki41. ## What's new - Paper now runs on Folia. - New option `session.extend-while-online` (default `false`): the session timeout counts from when a player leaves instead of from login. Useful on proxy networks sharing one database. ## Security and fixes - Simultaneous registrations can no longer exceed `max-accounts-per-ip`; the limit is enforced atomically, also across servers sharing a PostgreSQL database. - `/authadmin doctor` no longer treats hosts like `127.db.example.com` as loopback. - Audit and login records queued at shutdown are no longer lost. ## Notes - No configuration changes are required. - Folia support has been covered only by the unit-test suite, not tested on a live Folia server. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.7 Security follow-ups from the 1.2.6 review, plus Folia support and a new session option from @nicki41. ## What's new - Paper now runs on Folia. - New option `session.extend-while-online` (default `false`): the session timeout counts from when a player leaves instead of from login. Useful on proxy networks sharing one database. ## Security and fixes - Simultaneous registrations can no longer exceed `max-accounts-per-ip`; the limit is enforced atomically, also across servers sharing a PostgreSQL database. - `/authadmin doctor` no longer treats hosts like `127.db.example.com` as loopback. - Audit and login records queued at shutdown are no longer lost. ## Notes - No configuration changes are required. - Folia support has been covered only by the unit-test suite, not tested on a live Folia server. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.7 Security follow-ups from the 1.2.6 review, plus Folia support and a new session option from @nicki41. ## What's new - Paper now runs on Folia. - New option `session.extend-while-online` (default `false`): the session timeout counts from when a player leaves instead of from login. Useful on proxy networks sharing one database. ## Security and fixes - Simultaneous registrations can no longer exceed `max-accounts-per-ip`; the limit is enforced atomically, also across servers sharing a PostgreSQL database. - `/authadmin doctor` no longer treats hosts like `127.db.example.com` as loopback. - Audit and login records queued at shutdown are no longer lost. ## Notes - No configuration changes are required. - Folia support has been covered only by the unit-test suite, not tested on a live Folia server. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.7 Security follow-ups from the 1.2.6 review, plus Folia support and a new session option from @nicki41. ## What's new - Paper now runs on Folia. - New option `session.extend-while-online` (default `false`): the session timeout counts from when a player leaves instead of from login. Useful on proxy networks sharing one database. ## Security and fixes - Simultaneous registrations can no longer exceed `max-accounts-per-ip`; the limit is enforced atomically, also across servers sharing a PostgreSQL database. - `/authadmin doctor` no longer treats hosts like `127.db.example.com` as loopback. - Audit and login records queued at shutdown are no longer lost. ## Notes - No configuration changes are required. - Folia support has been covered only by the unit-test suite, not tested on a live Folia server. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.7 Security follow-ups from the 1.2.6 review, plus Folia support and a new session option from @nicki41. ## What's new - Paper now runs on Folia. - New option `session.extend-while-online` (default `false`): the session timeout counts from when a player leaves instead of from login. Useful on proxy networks sharing one database. ## Security and fixes - Simultaneous registrations can no longer exceed `max-accounts-per-ip`; the limit is enforced atomically, also across servers sharing a PostgreSQL database. - `/authadmin doctor` no longer treats hosts like `127.db.example.com` as loopback. - Audit and login records queued at shutdown are no longer lost. ## Notes - No configuration changes are required. - Folia support has been covered only by the unit-test suite, not tested on a live Folia server. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.7 Security follow-ups from the 1.2.6 review, plus Folia support and a new session option from @nicki41. ## What's new - Paper now runs on Folia. - New option `session.extend-while-online` (default `false`): the session timeout counts from when a player leaves instead of from login. Useful on proxy networks sharing one database. ## Security and fixes - Simultaneous registrations can no longer exceed `max-accounts-per-ip`; the limit is enforced atomically, also across servers sharing a PostgreSQL database. - `/authadmin doctor` no longer treats hosts like `127.db.example.com` as loopback. - Audit and login records queued at shutdown are no longer lost. ## Notes - No configuration changes are required. - Folia support has been covered only by the unit-test suite, not tested on a live Folia server. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.7 Security follow-ups from the 1.2.6 review, plus Folia support and a new session option from @nicki41. ## What's new - Paper now runs on Folia. - New option `session.extend-while-online` (default `false`): the session timeout counts from when a player leaves instead of from login. Useful on proxy networks sharing one database. ## Security and fixes - Simultaneous registrations can no longer exceed `max-accounts-per-ip`; the limit is enforced atomically, also across servers sharing a PostgreSQL database. - `/authadmin doctor` no longer treats hosts like `127.db.example.com` as loopback. - Audit and login records queued at shutdown are no longer lost. ## Notes - No configuration changes are required. - Folia support has been covered only by the unit-test suite, not tested on a live Folia server. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.7 Security follow-ups from the 1.2.6 review, plus Folia support and a new session option from @nicki41. ## What's new - Paper now runs on Folia. - New option `session.extend-while-online` (default `false`): the session timeout counts from when a player leaves instead of from login. Useful on proxy networks sharing one database. ## Security and fixes - Simultaneous registrations can no longer exceed `max-accounts-per-ip`; the limit is enforced atomically, also across servers sharing a PostgreSQL database. - `/authadmin doctor` no longer treats hosts like `127.db.example.com` as loopback. - Audit and login records queued at shutdown are no longer lost. ## Notes - No configuration changes are required. - Folia support has been covered only by the unit-test suite, not tested on a live Folia server. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.7 Security follow-ups from the 1.2.6 review, plus Folia support and a new session option from @nicki41. ## What's new - Paper now runs on Folia. - New option `session.extend-while-online` (default `false`): the session timeout counts from when a player leaves instead of from login. Useful on proxy networks sharing one database. ## Security and fixes - Simultaneous registrations can no longer exceed `max-accounts-per-ip`; the limit is enforced atomically, also across servers sharing a PostgreSQL database. - `/authadmin doctor` no longer treats hosts like `127.db.example.com` as loopback. - Audit and login records queued at shutdown are no longer lost. ## Notes - No configuration changes are required. - Folia support has been covered only by the unit-test suite, not tested on a live Folia server. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.7 Security follow-ups from the 1.2.6 review, plus Folia support and a new session option from @nicki41. ## What's new - Paper now runs on Folia. - New option `session.extend-while-online` (default `false`): the session timeout counts from when a player leaves instead of from login. Useful on proxy networks sharing one database. ## Security and fixes - Simultaneous registrations can no longer exceed `max-accounts-per-ip`; the limit is enforced atomically, also across servers sharing a PostgreSQL database. - `/authadmin doctor` no longer treats hosts like `127.db.example.com` as loopback. - Audit and login records queued at shutdown are no longer lost. ## Notes - No configuration changes are required. - Folia support has been covered only by the unit-test suite, not tested on a live Folia server. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.7 Security follow-ups from the 1.2.6 review, plus Folia support and a new session option from @nicki41. ## What's new - Paper now runs on Folia. - New option `session.extend-while-online` (default `false`): the session timeout counts from when a player leaves instead of from login. Useful on proxy networks sharing one database. ## Security and fixes - Simultaneous registrations can no longer exceed `max-accounts-per-ip`; the limit is enforced atomically, also across servers sharing a PostgreSQL database. - `/authadmin doctor` no longer treats hosts like `127.db.example.com` as loopback. - Audit and login records queued at shutdown are no longer lost. ## Notes - No configuration changes are required. - Folia support has been covered only by the unit-test suite, not tested on a live Folia server. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.7 Security follow-ups from the 1.2.6 review, plus Folia support and a new session option from @nicki41. ## What's new - Paper now runs on Folia. - New option `session.extend-while-online` (default `false`): the session timeout counts from when a player leaves instead of from login. Useful on proxy networks sharing one database. ## Security and fixes - Simultaneous registrations can no longer exceed `max-accounts-per-ip`; the limit is enforced atomically, also across servers sharing a PostgreSQL database. - `/authadmin doctor` no longer treats hosts like `127.db.example.com` as loopback. - Audit and login records queued at shutdown are no longer lost. ## Notes - No configuration changes are required. - Folia support has been covered only by the unit-test suite, not tested on a live Folia server. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.6 Includes the 1.2.5 Fabric compatibility fix plus seven community contributions from @nicki41. ## What's new - `/authadmin doctor` now also reports IP-unbound sessions on an offline-mode server, Argon2 settings below the OWASP minimum, and unencrypted PostgreSQL connections to a remote host. - Paper: players who have not logged in only see (and can tab-complete) the commands in `restrictions.allowed-commands`, so a player joining under an operator's name can no longer browse that operator's commands before logging in. - The Argon2 and database worker threads have descriptive names, which makes thread dumps and profiler output (spark) readable. ## Contributors A big thank you to [@nicki41](https://github.com/nicki41) for seven pull requests in this release: the new doctor checks (#8), hiding commands before login on Paper (#9), the worker thread names (#10), re-hashing on login (#7), command alias protection (#4), ending authentication on admin reset/unregister (#3) and the GitHub Actions build (#5). - `/authadmin resetpassword` and `/authadmin unregister` now also log out the account owner if they are online (Paper and Fabric), so a compromised account loses access immediately. - Paper: password commands whose aliases are taken by another plugin (for example `/l`) are still redacted from the console log and intercepted before login. - Passwords hashed with older, weaker Argon2 settings are automatically re-hashed with your current settings the next time the player logs in. ## Fabric compatibility - The bundled SQLite driver is 3.49.1.0 (since 1.2.5). It cannot be relocated and takes precedence over other mods' copies; the older 3.53.x made Ledger crash on startup with an `ALTER TABLE players MODIFY COLUMN` error. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.6 Includes the 1.2.5 Fabric compatibility fix plus seven community contributions from @nicki41. ## What's new - `/authadmin doctor` now also reports IP-unbound sessions on an offline-mode server, Argon2 settings below the OWASP minimum, and unencrypted PostgreSQL connections to a remote host. - Paper: players who have not logged in only see (and can tab-complete) the commands in `restrictions.allowed-commands`, so a player joining under an operator's name can no longer browse that operator's commands before logging in. - The Argon2 and database worker threads have descriptive names, which makes thread dumps and profiler output (spark) readable. ## Contributors A big thank you to [@nicki41](https://github.com/nicki41) for seven pull requests in this release: the new doctor checks (#8), hiding commands before login on Paper (#9), the worker thread names (#10), re-hashing on login (#7), command alias protection (#4), ending authentication on admin reset/unregister (#3) and the GitHub Actions build (#5). - `/authadmin resetpassword` and `/authadmin unregister` now also log out the account owner if they are online (Paper and Fabric), so a compromised account loses access immediately. - Paper: password commands whose aliases are taken by another plugin (for example `/l`) are still redacted from the console log and intercepted before login. - Passwords hashed with older, weaker Argon2 settings are automatically re-hashed with your current settings the next time the player logs in. ## Fabric compatibility - The bundled SQLite driver is 3.49.1.0 (since 1.2.5). It cannot be relocated and takes precedence over other mods' copies; the older 3.53.x made Ledger crash on startup with an `ALTER TABLE players MODIFY COLUMN` error. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.6 Includes the 1.2.5 Fabric compatibility fix plus seven community contributions from @nicki41. ## What's new - `/authadmin doctor` now also reports IP-unbound sessions on an offline-mode server, Argon2 settings below the OWASP minimum, and unencrypted PostgreSQL connections to a remote host. - Paper: players who have not logged in only see (and can tab-complete) the commands in `restrictions.allowed-commands`, so a player joining under an operator's name can no longer browse that operator's commands before logging in. - The Argon2 and database worker threads have descriptive names, which makes thread dumps and profiler output (spark) readable. ## Contributors A big thank you to [@nicki41](https://github.com/nicki41) for seven pull requests in this release: the new doctor checks (#8), hiding commands before login on Paper (#9), the worker thread names (#10), re-hashing on login (#7), command alias protection (#4), ending authentication on admin reset/unregister (#3) and the GitHub Actions build (#5). - `/authadmin resetpassword` and `/authadmin unregister` now also log out the account owner if they are online (Paper and Fabric), so a compromised account loses access immediately. - Paper: password commands whose aliases are taken by another plugin (for example `/l`) are still redacted from the console log and intercepted before login. - Passwords hashed with older, weaker Argon2 settings are automatically re-hashed with your current settings the next time the player logs in. ## Fabric compatibility - The bundled SQLite driver is 3.49.1.0 (since 1.2.5). It cannot be relocated and takes precedence over other mods' copies; the older 3.53.x made Ledger crash on startup with an `ALTER TABLE players MODIFY COLUMN` error. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.6 Includes the 1.2.5 Fabric compatibility fix plus seven community contributions from @nicki41. ## What's new - `/authadmin doctor` now also reports IP-unbound sessions on an offline-mode server, Argon2 settings below the OWASP minimum, and unencrypted PostgreSQL connections to a remote host. - Paper: players who have not logged in only see (and can tab-complete) the commands in `restrictions.allowed-commands`, so a player joining under an operator's name can no longer browse that operator's commands before logging in. - The Argon2 and database worker threads have descriptive names, which makes thread dumps and profiler output (spark) readable. ## Contributors A big thank you to [@nicki41](https://github.com/nicki41) for seven pull requests in this release: the new doctor checks (#8), hiding commands before login on Paper (#9), the worker thread names (#10), re-hashing on login (#7), command alias protection (#4), ending authentication on admin reset/unregister (#3) and the GitHub Actions build (#5). - `/authadmin resetpassword` and `/authadmin unregister` now also log out the account owner if they are online (Paper and Fabric), so a compromised account loses access immediately. - Paper: password commands whose aliases are taken by another plugin (for example `/l`) are still redacted from the console log and intercepted before login. - Passwords hashed with older, weaker Argon2 settings are automatically re-hashed with your current settings the next time the player logs in. ## Fabric compatibility - The bundled SQLite driver is 3.49.1.0 (since 1.2.5). It cannot be relocated and takes precedence over other mods' copies; the older 3.53.x made Ledger crash on startup with an `ALTER TABLE players MODIFY COLUMN` error. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.6 Includes the 1.2.5 Fabric compatibility fix plus seven community contributions from @nicki41. ## What's new - `/authadmin doctor` now also reports IP-unbound sessions on an offline-mode server, Argon2 settings below the OWASP minimum, and unencrypted PostgreSQL connections to a remote host. - Paper: players who have not logged in only see (and can tab-complete) the commands in `restrictions.allowed-commands`, so a player joining under an operator's name can no longer browse that operator's commands before logging in. - The Argon2 and database worker threads have descriptive names, which makes thread dumps and profiler output (spark) readable. ## Contributors A big thank you to [@nicki41](https://github.com/nicki41) for seven pull requests in this release: the new doctor checks (#8), hiding commands before login on Paper (#9), the worker thread names (#10), re-hashing on login (#7), command alias protection (#4), ending authentication on admin reset/unregister (#3) and the GitHub Actions build (#5). - `/authadmin resetpassword` and `/authadmin unregister` now also log out the account owner if they are online (Paper and Fabric), so a compromised account loses access immediately. - Paper: password commands whose aliases are taken by another plugin (for example `/l`) are still redacted from the console log and intercepted before login. - Passwords hashed with older, weaker Argon2 settings are automatically re-hashed with your current settings the next time the player logs in. ## Fabric compatibility - The bundled SQLite driver is 3.49.1.0 (since 1.2.5). It cannot be relocated and takes precedence over other mods' copies; the older 3.53.x made Ledger crash on startup with an `ALTER TABLE players MODIFY COLUMN` error. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.6 Includes the 1.2.5 Fabric compatibility fix plus seven community contributions from @nicki41. ## What's new - `/authadmin doctor` now also reports IP-unbound sessions on an offline-mode server, Argon2 settings below the OWASP minimum, and unencrypted PostgreSQL connections to a remote host. - Paper: players who have not logged in only see (and can tab-complete) the commands in `restrictions.allowed-commands`, so a player joining under an operator's name can no longer browse that operator's commands before logging in. - The Argon2 and database worker threads have descriptive names, which makes thread dumps and profiler output (spark) readable. ## Contributors A big thank you to [@nicki41](https://github.com/nicki41) for seven pull requests in this release: the new doctor checks (#8), hiding commands before login on Paper (#9), the worker thread names (#10), re-hashing on login (#7), command alias protection (#4), ending authentication on admin reset/unregister (#3) and the GitHub Actions build (#5). - `/authadmin resetpassword` and `/authadmin unregister` now also log out the account owner if they are online (Paper and Fabric), so a compromised account loses access immediately. - Paper: password commands whose aliases are taken by another plugin (for example `/l`) are still redacted from the console log and intercepted before login. - Passwords hashed with older, weaker Argon2 settings are automatically re-hashed with your current settings the next time the player logs in. ## Fabric compatibility - The bundled SQLite driver is 3.49.1.0 (since 1.2.5). It cannot be relocated and takes precedence over other mods' copies; the older 3.53.x made Ledger crash on startup with an `ALTER TABLE players MODIFY COLUMN` error. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.6 Includes the 1.2.5 Fabric compatibility fix plus seven community contributions from @nicki41. ## What's new - `/authadmin doctor` now also reports IP-unbound sessions on an offline-mode server, Argon2 settings below the OWASP minimum, and unencrypted PostgreSQL connections to a remote host. - Paper: players who have not logged in only see (and can tab-complete) the commands in `restrictions.allowed-commands`, so a player joining under an operator's name can no longer browse that operator's commands before logging in. - The Argon2 and database worker threads have descriptive names, which makes thread dumps and profiler output (spark) readable. ## Contributors A big thank you to [@nicki41](https://github.com/nicki41) for seven pull requests in this release: the new doctor checks (#8), hiding commands before login on Paper (#9), the worker thread names (#10), re-hashing on login (#7), command alias protection (#4), ending authentication on admin reset/unregister (#3) and the GitHub Actions build (#5). - `/authadmin resetpassword` and `/authadmin unregister` now also log out the account owner if they are online (Paper and Fabric), so a compromised account loses access immediately. - Paper: password commands whose aliases are taken by another plugin (for example `/l`) are still redacted from the console log and intercepted before login. - Passwords hashed with older, weaker Argon2 settings are automatically re-hashed with your current settings the next time the player logs in. ## Fabric compatibility - The bundled SQLite driver is 3.49.1.0 (since 1.2.5). It cannot be relocated and takes precedence over other mods' copies; the older 3.53.x made Ledger crash on startup with an `ALTER TABLE players MODIFY COLUMN` error. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.6 Includes the 1.2.5 Fabric compatibility fix plus seven community contributions from @nicki41. ## What's new - `/authadmin doctor` now also reports IP-unbound sessions on an offline-mode server, Argon2 settings below the OWASP minimum, and unencrypted PostgreSQL connections to a remote host. - Paper: players who have not logged in only see (and can tab-complete) the commands in `restrictions.allowed-commands`, so a player joining under an operator's name can no longer browse that operator's commands before logging in. - The Argon2 and database worker threads have descriptive names, which makes thread dumps and profiler output (spark) readable. ## Contributors A big thank you to [@nicki41](https://github.com/nicki41) for seven pull requests in this release: the new doctor checks (#8), hiding commands before login on Paper (#9), the worker thread names (#10), re-hashing on login (#7), command alias protection (#4), ending authentication on admin reset/unregister (#3) and the GitHub Actions build (#5). - `/authadmin resetpassword` and `/authadmin unregister` now also log out the account owner if they are online (Paper and Fabric), so a compromised account loses access immediately. - Paper: password commands whose aliases are taken by another plugin (for example `/l`) are still redacted from the console log and intercepted before login. - Passwords hashed with older, weaker Argon2 settings are automatically re-hashed with your current settings the next time the player logs in. ## Fabric compatibility - The bundled SQLite driver is 3.49.1.0 (since 1.2.5). It cannot be relocated and takes precedence over other mods' copies; the older 3.53.x made Ledger crash on startup with an `ALTER TABLE players MODIFY COLUMN` error. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.6 Includes the 1.2.5 Fabric compatibility fix plus seven community contributions from @nicki41. ## What's new - `/authadmin doctor` now also reports IP-unbound sessions on an offline-mode server, Argon2 settings below the OWASP minimum, and unencrypted PostgreSQL connections to a remote host. - Paper: players who have not logged in only see (and can tab-complete) the commands in `restrictions.allowed-commands`, so a player joining under an operator's name can no longer browse that operator's commands before logging in. - The Argon2 and database worker threads have descriptive names, which makes thread dumps and profiler output (spark) readable. ## Contributors A big thank you to [@nicki41](https://github.com/nicki41) for seven pull requests in this release: the new doctor checks (#8), hiding commands before login on Paper (#9), the worker thread names (#10), re-hashing on login (#7), command alias protection (#4), ending authentication on admin reset/unregister (#3) and the GitHub Actions build (#5). - `/authadmin resetpassword` and `/authadmin unregister` now also log out the account owner if they are online (Paper and Fabric), so a compromised account loses access immediately. - Paper: password commands whose aliases are taken by another plugin (for example `/l`) are still redacted from the console log and intercepted before login. - Passwords hashed with older, weaker Argon2 settings are automatically re-hashed with your current settings the next time the player logs in. ## Fabric compatibility - The bundled SQLite driver is 3.49.1.0 (since 1.2.5). It cannot be relocated and takes precedence over other mods' copies; the older 3.53.x made Ledger crash on startup with an `ALTER TABLE players MODIFY COLUMN` error. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.6 Includes the 1.2.5 Fabric compatibility fix plus seven community contributions from @nicki41. ## What's new - `/authadmin doctor` now also reports IP-unbound sessions on an offline-mode server, Argon2 settings below the OWASP minimum, and unencrypted PostgreSQL connections to a remote host. - Paper: players who have not logged in only see (and can tab-complete) the commands in `restrictions.allowed-commands`, so a player joining under an operator's name can no longer browse that operator's commands before logging in. - The Argon2 and database worker threads have descriptive names, which makes thread dumps and profiler output (spark) readable. ## Contributors A big thank you to [@nicki41](https://github.com/nicki41) for seven pull requests in this release: the new doctor checks (#8), hiding commands before login on Paper (#9), the worker thread names (#10), re-hashing on login (#7), command alias protection (#4), ending authentication on admin reset/unregister (#3) and the GitHub Actions build (#5). - `/authadmin resetpassword` and `/authadmin unregister` now also log out the account owner if they are online (Paper and Fabric), so a compromised account loses access immediately. - Paper: password commands whose aliases are taken by another plugin (for example `/l`) are still redacted from the console log and intercepted before login. - Passwords hashed with older, weaker Argon2 settings are automatically re-hashed with your current settings the next time the player logs in. ## Fabric compatibility - The bundled SQLite driver is 3.49.1.0 (since 1.2.5). It cannot be relocated and takes precedence over other mods' copies; the older 3.53.x made Ledger crash on startup with an `ALTER TABLE players MODIFY COLUMN` error. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.6 Includes the 1.2.5 Fabric compatibility fix plus seven community contributions from @nicki41. ## What's new - `/authadmin doctor` now also reports IP-unbound sessions on an offline-mode server, Argon2 settings below the OWASP minimum, and unencrypted PostgreSQL connections to a remote host. - Paper: players who have not logged in only see (and can tab-complete) the commands in `restrictions.allowed-commands`, so a player joining under an operator's name can no longer browse that operator's commands before logging in. - The Argon2 and database worker threads have descriptive names, which makes thread dumps and profiler output (spark) readable. ## Contributors A big thank you to [@nicki41](https://github.com/nicki41) for seven pull requests in this release: the new doctor checks (#8), hiding commands before login on Paper (#9), the worker thread names (#10), re-hashing on login (#7), command alias protection (#4), ending authentication on admin reset/unregister (#3) and the GitHub Actions build (#5). - `/authadmin resetpassword` and `/authadmin unregister` now also log out the account owner if they are online (Paper and Fabric), so a compromised account loses access immediately. - Paper: password commands whose aliases are taken by another plugin (for example `/l`) are still redacted from the console log and intercepted before login. - Passwords hashed with older, weaker Argon2 settings are automatically re-hashed with your current settings the next time the player logs in. ## Fabric compatibility - The bundled SQLite driver is 3.49.1.0 (since 1.2.5). It cannot be relocated and takes precedence over other mods' copies; the older 3.53.x made Ledger crash on startup with an `ALTER TABLE players MODIFY COLUMN` error. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.6 Includes the 1.2.5 Fabric compatibility fix plus seven community contributions from @nicki41. ## What's new - `/authadmin doctor` now also reports IP-unbound sessions on an offline-mode server, Argon2 settings below the OWASP minimum, and unencrypted PostgreSQL connections to a remote host. - Paper: players who have not logged in only see (and can tab-complete) the commands in `restrictions.allowed-commands`, so a player joining under an operator's name can no longer browse that operator's commands before logging in. - The Argon2 and database worker threads have descriptive names, which makes thread dumps and profiler output (spark) readable. ## Contributors A big thank you to [@nicki41](https://github.com/nicki41) for seven pull requests in this release: the new doctor checks (#8), hiding commands before login on Paper (#9), the worker thread names (#10), re-hashing on login (#7), command alias protection (#4), ending authentication on admin reset/unregister (#3) and the GitHub Actions build (#5). - `/authadmin resetpassword` and `/authadmin unregister` now also log out the account owner if they are online (Paper and Fabric), so a compromised account loses access immediately. - Paper: password commands whose aliases are taken by another plugin (for example `/l`) are still redacted from the console log and intercepted before login. - Passwords hashed with older, weaker Argon2 settings are automatically re-hashed with your current settings the next time the player logs in. ## Fabric compatibility - The bundled SQLite driver is 3.49.1.0 (since 1.2.5). It cannot be relocated and takes precedence over other mods' copies; the older 3.53.x made Ledger crash on startup with an `ALTER TABLE players MODIFY COLUMN` error. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.6 Includes the 1.2.5 Fabric compatibility fix plus seven community contributions from @nicki41. ## What's new - `/authadmin doctor` now also reports IP-unbound sessions on an offline-mode server, Argon2 settings below the OWASP minimum, and unencrypted PostgreSQL connections to a remote host. - Paper: players who have not logged in only see (and can tab-complete) the commands in `restrictions.allowed-commands`, so a player joining under an operator's name can no longer browse that operator's commands before logging in. - The Argon2 and database worker threads have descriptive names, which makes thread dumps and profiler output (spark) readable. ## Contributors A big thank you to [@nicki41](https://github.com/nicki41) for seven pull requests in this release: the new doctor checks (#8), hiding commands before login on Paper (#9), the worker thread names (#10), re-hashing on login (#7), command alias protection (#4), ending authentication on admin reset/unregister (#3) and the GitHub Actions build (#5). - `/authadmin resetpassword` and `/authadmin unregister` now also log out the account owner if they are online (Paper and Fabric), so a compromised account loses access immediately. - Paper: password commands whose aliases are taken by another plugin (for example `/l`) are still redacted from the console log and intercepted before login. - Passwords hashed with older, weaker Argon2 settings are automatically re-hashed with your current settings the next time the player logs in. ## Fabric compatibility - The bundled SQLite driver is 3.49.1.0 (since 1.2.5). It cannot be relocated and takes precedence over other mods' copies; the older 3.53.x made Ledger crash on startup with an `ALTER TABLE players MODIFY COLUMN` error. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.6 Includes the 1.2.5 Fabric compatibility fix plus seven community contributions from @nicki41. ## What's new - `/authadmin doctor` now also reports IP-unbound sessions on an offline-mode server, Argon2 settings below the OWASP minimum, and unencrypted PostgreSQL connections to a remote host. - Paper: players who have not logged in only see (and can tab-complete) the commands in `restrictions.allowed-commands`, so a player joining under an operator's name can no longer browse that operator's commands before logging in. - The Argon2 and database worker threads have descriptive names, which makes thread dumps and profiler output (spark) readable. ## Contributors A big thank you to [@nicki41](https://github.com/nicki41) for seven pull requests in this release: the new doctor checks (#8), hiding commands before login on Paper (#9), the worker thread names (#10), re-hashing on login (#7), command alias protection (#4), ending authentication on admin reset/unregister (#3) and the GitHub Actions build (#5). - `/authadmin resetpassword` and `/authadmin unregister` now also log out the account owner if they are online (Paper and Fabric), so a compromised account loses access immediately. - Paper: password commands whose aliases are taken by another plugin (for example `/l`) are still redacted from the console log and intercepted before login. - Passwords hashed with older, weaker Argon2 settings are automatically re-hashed with your current settings the next time the player logs in. ## Fabric compatibility - The bundled SQLite driver is 3.49.1.0 (since 1.2.5). It cannot be relocated and takes precedence over other mods' copies; the older 3.53.x made Ledger crash on startup with an `ALTER TABLE players MODIFY COLUMN` error. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.6 Includes the 1.2.5 Fabric compatibility fix plus seven community contributions from @nicki41. ## What's new - `/authadmin doctor` now also reports IP-unbound sessions on an offline-mode server, Argon2 settings below the OWASP minimum, and unencrypted PostgreSQL connections to a remote host. - Paper: players who have not logged in only see (and can tab-complete) the commands in `restrictions.allowed-commands`, so a player joining under an operator's name can no longer browse that operator's commands before logging in. - The Argon2 and database worker threads have descriptive names, which makes thread dumps and profiler output (spark) readable. ## Contributors A big thank you to [@nicki41](https://github.com/nicki41) for seven pull requests in this release: the new doctor checks (#8), hiding commands before login on Paper (#9), the worker thread names (#10), re-hashing on login (#7), command alias protection (#4), ending authentication on admin reset/unregister (#3) and the GitHub Actions build (#5). - `/authadmin resetpassword` and `/authadmin unregister` now also log out the account owner if they are online (Paper and Fabric), so a compromised account loses access immediately. - Paper: password commands whose aliases are taken by another plugin (for example `/l`) are still redacted from the console log and intercepted before login. - Passwords hashed with older, weaker Argon2 settings are automatically re-hashed with your current settings the next time the player logs in. ## Fabric compatibility - The bundled SQLite driver is 3.49.1.0 (since 1.2.5). It cannot be relocated and takes precedence over other mods' copies; the older 3.53.x made Ledger crash on startup with an `ALTER TABLE players MODIFY COLUMN` error. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.6 Includes the 1.2.5 Fabric compatibility fix plus seven community contributions from @nicki41. ## What's new - `/authadmin doctor` now also reports IP-unbound sessions on an offline-mode server, Argon2 settings below the OWASP minimum, and unencrypted PostgreSQL connections to a remote host. - Paper: players who have not logged in only see (and can tab-complete) the commands in `restrictions.allowed-commands`, so a player joining under an operator's name can no longer browse that operator's commands before logging in. - The Argon2 and database worker threads have descriptive names, which makes thread dumps and profiler output (spark) readable. ## Contributors A big thank you to [@nicki41](https://github.com/nicki41) for seven pull requests in this release: the new doctor checks (#8), hiding commands before login on Paper (#9), the worker thread names (#10), re-hashing on login (#7), command alias protection (#4), ending authentication on admin reset/unregister (#3) and the GitHub Actions build (#5). - `/authadmin resetpassword` and `/authadmin unregister` now also log out the account owner if they are online (Paper and Fabric), so a compromised account loses access immediately. - Paper: password commands whose aliases are taken by another plugin (for example `/l`) are still redacted from the console log and intercepted before login. - Passwords hashed with older, weaker Argon2 settings are automatically re-hashed with your current settings the next time the player logs in. ## Fabric compatibility - The bundled SQLite driver is 3.49.1.0 (since 1.2.5). It cannot be relocated and takes precedence over other mods' copies; the older 3.53.x made Ledger crash on startup with an `ALTER TABLE players MODIFY COLUMN` error. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.6 Includes the 1.2.5 Fabric compatibility fix plus seven community contributions from @nicki41. ## What's new - `/authadmin doctor` now also reports IP-unbound sessions on an offline-mode server, Argon2 settings below the OWASP minimum, and unencrypted PostgreSQL connections to a remote host. - Paper: players who have not logged in only see (and can tab-complete) the commands in `restrictions.allowed-commands`, so a player joining under an operator's name can no longer browse that operator's commands before logging in. - The Argon2 and database worker threads have descriptive names, which makes thread dumps and profiler output (spark) readable. ## Contributors A big thank you to [@nicki41](https://github.com/nicki41) for seven pull requests in this release: the new doctor checks (#8), hiding commands before login on Paper (#9), the worker thread names (#10), re-hashing on login (#7), command alias protection (#4), ending authentication on admin reset/unregister (#3) and the GitHub Actions build (#5). - `/authadmin resetpassword` and `/authadmin unregister` now also log out the account owner if they are online (Paper and Fabric), so a compromised account loses access immediately. - Paper: password commands whose aliases are taken by another plugin (for example `/l`) are still redacted from the console log and intercepted before login. - Passwords hashed with older, weaker Argon2 settings are automatically re-hashed with your current settings the next time the player logs in. ## Fabric compatibility - The bundled SQLite driver is 3.49.1.0 (since 1.2.5). It cannot be relocated and takes precedence over other mods' copies; the older 3.53.x made Ledger crash on startup with an `ALTER TABLE players MODIFY COLUMN` error. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.6 Includes the 1.2.5 Fabric compatibility fix plus seven community contributions from @nicki41. ## What's new - `/authadmin doctor` now also reports IP-unbound sessions on an offline-mode server, Argon2 settings below the OWASP minimum, and unencrypted PostgreSQL connections to a remote host. - Paper: players who have not logged in only see (and can tab-complete) the commands in `restrictions.allowed-commands`, so a player joining under an operator's name can no longer browse that operator's commands before logging in. - The Argon2 and database worker threads have descriptive names, which makes thread dumps and profiler output (spark) readable. ## Contributors A big thank you to [@nicki41](https://github.com/nicki41) for seven pull requests in this release: the new doctor checks (#8), hiding commands before login on Paper (#9), the worker thread names (#10), re-hashing on login (#7), command alias protection (#4), ending authentication on admin reset/unregister (#3) and the GitHub Actions build (#5). - `/authadmin resetpassword` and `/authadmin unregister` now also log out the account owner if they are online (Paper and Fabric), so a compromised account loses access immediately. - Paper: password commands whose aliases are taken by another plugin (for example `/l`) are still redacted from the console log and intercepted before login. - Passwords hashed with older, weaker Argon2 settings are automatically re-hashed with your current settings the next time the player logs in. ## Fabric compatibility - The bundled SQLite driver is 3.49.1.0 (since 1.2.5). It cannot be relocated and takes precedence over other mods' copies; the older 3.53.x made Ledger crash on startup with an `ALTER TABLE players MODIFY COLUMN` error. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.5 Fabric Compatibility Fix Recommended for Fabric servers that also run Ledger. Paper is unchanged. ## Fixes - Fabric: the bundled SQLite driver is now version 3.49.1.0 (was 3.53.4.0). The driver cannot be relocated and takes precedence over other mods' copies, and the newer one made Ledger crash on startup with an `ALTER TABLE players MODIFY COLUMN` error. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.5 Fabric Compatibility Fix Recommended for Fabric servers that also run Ledger. Paper is unchanged. ## Fixes - Fabric: the bundled SQLite driver is now version 3.49.1.0 (was 3.53.4.0). The driver cannot be relocated and takes precedence over other mods' copies, and the newer one made Ledger crash on startup with an `ALTER TABLE players MODIFY COLUMN` error. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.5 Fabric Compatibility Fix Recommended for Fabric servers that also run Ledger. Paper is unchanged. ## Fixes - Fabric: the bundled SQLite driver is now version 3.49.1.0 (was 3.53.4.0). The driver cannot be relocated and takes precedence over other mods' copies, and the newer one made Ledger crash on startup with an `ALTER TABLE players MODIFY COLUMN` error. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.5 Fabric Compatibility Fix Recommended for Fabric servers that also run Ledger. Paper is unchanged. ## Fixes - Fabric: the bundled SQLite driver is now version 3.49.1.0 (was 3.53.4.0). The driver cannot be relocated and takes precedence over other mods' copies, and the newer one made Ledger crash on startup with an `ALTER TABLE players MODIFY COLUMN` error. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.5 Fabric Compatibility Fix Recommended for Fabric servers that also run Ledger. Paper is unchanged. ## Fixes - Fabric: the bundled SQLite driver is now version 3.49.1.0 (was 3.53.4.0). The driver cannot be relocated and takes precedence over other mods' copies, and the newer one made Ledger crash on startup with an `ALTER TABLE players MODIFY COLUMN` error. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.5 Fabric Compatibility Fix Recommended for Fabric servers that also run Ledger. Paper is unchanged. ## Fixes - Fabric: the bundled SQLite driver is now version 3.49.1.0 (was 3.53.4.0). The driver cannot be relocated and takes precedence over other mods' copies, and the newer one made Ledger crash on startup with an `ALTER TABLE players MODIFY COLUMN` error. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.5 Fabric Compatibility Fix Recommended for Fabric servers that also run Ledger. Paper is unchanged. ## Fixes - Fabric: the bundled SQLite driver is now version 3.49.1.0 (was 3.53.4.0). The driver cannot be relocated and takes precedence over other mods' copies, and the newer one made Ledger crash on startup with an `ALTER TABLE players MODIFY COLUMN` error. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.5 Fabric Compatibility Fix Recommended for Fabric servers that also run Ledger. Paper is unchanged. ## Fixes - Fabric: the bundled SQLite driver is now version 3.49.1.0 (was 3.53.4.0). The driver cannot be relocated and takes precedence over other mods' copies, and the newer one made Ledger crash on startup with an `ALTER TABLE players MODIFY COLUMN` error. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.5 Fabric Compatibility Fix Recommended for Fabric servers that also run Ledger. Paper is unchanged. ## Fixes - Fabric: the bundled SQLite driver is now version 3.49.1.0 (was 3.53.4.0). The driver cannot be relocated and takes precedence over other mods' copies, and the newer one made Ledger crash on startup with an `ALTER TABLE players MODIFY COLUMN` error. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.5 Fabric Compatibility Fix Recommended for Fabric servers that also run Ledger. Paper is unchanged. ## Fixes - Fabric: the bundled SQLite driver is now version 3.49.1.0 (was 3.53.4.0). The driver cannot be relocated and takes precedence over other mods' copies, and the newer one made Ledger crash on startup with an `ALTER TABLE players MODIFY COLUMN` error. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.5 Fabric Compatibility Fix Recommended for Fabric servers that also run Ledger. Paper is unchanged. ## Fixes - Fabric: the bundled SQLite driver is now version 3.49.1.0 (was 3.53.4.0). The driver cannot be relocated and takes precedence over other mods' copies, and the newer one made Ledger crash on startup with an `ALTER TABLE players MODIFY COLUMN` error. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.5 Fabric Compatibility Fix Recommended for Fabric servers that also run Ledger. Paper is unchanged. ## Fixes - Fabric: the bundled SQLite driver is now version 3.49.1.0 (was 3.53.4.0). The driver cannot be relocated and takes precedence over other mods' copies, and the newer one made Ledger crash on startup with an `ALTER TABLE players MODIFY COLUMN` error. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.5 Fabric Compatibility Fix Recommended for Fabric servers that also run Ledger. Paper is unchanged. ## Fixes - Fabric: the bundled SQLite driver is now version 3.49.1.0 (was 3.53.4.0). The driver cannot be relocated and takes precedence over other mods' copies, and the newer one made Ledger crash on startup with an `ALTER TABLE players MODIFY COLUMN` error. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.5 Fabric Compatibility Fix Recommended for Fabric servers that also run Ledger. Paper is unchanged. ## Fixes - Fabric: the bundled SQLite driver is now version 3.49.1.0 (was 3.53.4.0). The driver cannot be relocated and takes precedence over other mods' copies, and the newer one made Ledger crash on startup with an `ALTER TABLE players MODIFY COLUMN` error. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.5 Fabric Compatibility Fix Recommended for Fabric servers that also run Ledger. Paper is unchanged. ## Fixes - Fabric: the bundled SQLite driver is now version 3.49.1.0 (was 3.53.4.0). The driver cannot be relocated and takes precedence over other mods' copies, and the newer one made Ledger crash on startup with an `ALTER TABLE players MODIFY COLUMN` error. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.5 Fabric Compatibility Fix Recommended for Fabric servers that also run Ledger. Paper is unchanged. ## Fixes - Fabric: the bundled SQLite driver is now version 3.49.1.0 (was 3.53.4.0). The driver cannot be relocated and takes precedence over other mods' copies, and the newer one made Ledger crash on startup with an `ALTER TABLE players MODIFY COLUMN` error. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.5 Fabric Compatibility Fix Recommended for Fabric servers that also run Ledger. Paper is unchanged. ## Fixes - Fabric: the bundled SQLite driver is now version 3.49.1.0 (was 3.53.4.0). The driver cannot be relocated and takes precedence over other mods' copies, and the newer one made Ledger crash on startup with an `ALTER TABLE players MODIFY COLUMN` error. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.5 Fabric Compatibility Fix Recommended for Fabric servers that also run Ledger. Paper is unchanged. ## Fixes - Fabric: the bundled SQLite driver is now version 3.49.1.0 (was 3.53.4.0). The driver cannot be relocated and takes precedence over other mods' copies, and the newer one made Ledger crash on startup with an `ALTER TABLE players MODIFY COLUMN` error. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.4 Security & Reliability Update Recommended for every server. This release closes the remaining issues from a follow-up security and quality audit. ## Security fixes - The built-in (non-Redis) rate limiter could be flooded with cheap fake login names to wipe out a real account's failed-attempt count. It now evicts the least-attacked entry first, so an attack can no longer erase a victim's protection. - The per-account-per-IP registration limit is now read from the accounts table directly instead of the audit log, so it keeps working even with audit logging disabled or its retention period passed. - After a lock expires, one more wrong password no longer immediately re-locks the account for another full lockout period. - IPv6 addresses are rounded to their /64 network block before rate limiting and before the per-IP registration cap, closing a bypass through address rotation within one network. - Fabric: if a player disconnects and reconnects (under the same name) while a login, register or password-change request is still being checked, the old request's result can no longer be applied to the new connection. - `/authadmin resetpassword` now refuses to run from the server console or RCON, since those would otherwise write the generated password to the server log. - Discord/Telegram failed-login alerts no longer fire for attempts already blocked by a rate limit, and the alert cooldown tracking can no longer be permanently jammed by an attacker rotating through many fake names. ## Reliability fixes - Password-change, account-unlock and temporary-password operations now update only their own fields in the database instead of the whole account row, removing a rare race where a slow request could overwrite a faster one's lockout state. - Redis's attempt counter and its expiry are now set in one atomic step, so a dropped connection can no longer leave a counter that never expires. - `/authadmin unlock` and issuing a temporary password now also clear the player's rate-limit lock, so the action takes effect right away instead of leaving them rate-limited. - The password-hashing queue is now bounded, so a flood of login attempts is rejected once the server is busy instead of growing memory use without limit. - A failed database migration no longer leaves the connection pool open. - `/logout` now ends every active session for the account, not only the most recent one. - Fabric's `/login`, `/register` and `/changepassword` now accept the same password characters Paper already does, with no need to quote special characters. ## Maintenance - Jackson (pulled in by the database migration library) is now properly relocated inside both the Paper and Fabric jars, preventing a conflict with other plugins/mods that bundle a different version. - Paper's commands now share the exact same authentication code Fabric uses, instead of a separate copy — removing the kind of duplication that caused the pre-login `/changepassword` issue fixed in 1.2.3. - `/authadmin doctor` now warns when the IP-hashing secret is a per-server generated file but the server is using a shared Redis or PostgreSQL backend, since every server sharing that backend then needs the identical secret. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.4 Security & Reliability Update Recommended for every server. This release closes the remaining issues from a follow-up security and quality audit. ## Security fixes - The built-in (non-Redis) rate limiter could be flooded with cheap fake login names to wipe out a real account's failed-attempt count. It now evicts the least-attacked entry first, so an attack can no longer erase a victim's protection. - The per-account-per-IP registration limit is now read from the accounts table directly instead of the audit log, so it keeps working even with audit logging disabled or its retention period passed. - After a lock expires, one more wrong password no longer immediately re-locks the account for another full lockout period. - IPv6 addresses are rounded to their /64 network block before rate limiting and before the per-IP registration cap, closing a bypass through address rotation within one network. - Fabric: if a player disconnects and reconnects (under the same name) while a login, register or password-change request is still being checked, the old request's result can no longer be applied to the new connection. - `/authadmin resetpassword` now refuses to run from the server console or RCON, since those would otherwise write the generated password to the server log. - Discord/Telegram failed-login alerts no longer fire for attempts already blocked by a rate limit, and the alert cooldown tracking can no longer be permanently jammed by an attacker rotating through many fake names. ## Reliability fixes - Password-change, account-unlock and temporary-password operations now update only their own fields in the database instead of the whole account row, removing a rare race where a slow request could overwrite a faster one's lockout state. - Redis's attempt counter and its expiry are now set in one atomic step, so a dropped connection can no longer leave a counter that never expires. - `/authadmin unlock` and issuing a temporary password now also clear the player's rate-limit lock, so the action takes effect right away instead of leaving them rate-limited. - The password-hashing queue is now bounded, so a flood of login attempts is rejected once the server is busy instead of growing memory use without limit. - A failed database migration no longer leaves the connection pool open. - `/logout` now ends every active session for the account, not only the most recent one. - Fabric's `/login`, `/register` and `/changepassword` now accept the same password characters Paper already does, with no need to quote special characters. ## Maintenance - Jackson (pulled in by the database migration library) is now properly relocated inside both the Paper and Fabric jars, preventing a conflict with other plugins/mods that bundle a different version. - Paper's commands now share the exact same authentication code Fabric uses, instead of a separate copy — removing the kind of duplication that caused the pre-login `/changepassword` issue fixed in 1.2.3. - `/authadmin doctor` now warns when the IP-hashing secret is a per-server generated file but the server is using a shared Redis or PostgreSQL backend, since every server sharing that backend then needs the identical secret. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.4 Security & Reliability Update Recommended for every server. This release closes the remaining issues from a follow-up security and quality audit. ## Security fixes - The built-in (non-Redis) rate limiter could be flooded with cheap fake login names to wipe out a real account's failed-attempt count. It now evicts the least-attacked entry first, so an attack can no longer erase a victim's protection. - The per-account-per-IP registration limit is now read from the accounts table directly instead of the audit log, so it keeps working even with audit logging disabled or its retention period passed. - After a lock expires, one more wrong password no longer immediately re-locks the account for another full lockout period. - IPv6 addresses are rounded to their /64 network block before rate limiting and before the per-IP registration cap, closing a bypass through address rotation within one network. - Fabric: if a player disconnects and reconnects (under the same name) while a login, register or password-change request is still being checked, the old request's result can no longer be applied to the new connection. - `/authadmin resetpassword` now refuses to run from the server console or RCON, since those would otherwise write the generated password to the server log. - Discord/Telegram failed-login alerts no longer fire for attempts already blocked by a rate limit, and the alert cooldown tracking can no longer be permanently jammed by an attacker rotating through many fake names. ## Reliability fixes - Password-change, account-unlock and temporary-password operations now update only their own fields in the database instead of the whole account row, removing a rare race where a slow request could overwrite a faster one's lockout state. - Redis's attempt counter and its expiry are now set in one atomic step, so a dropped connection can no longer leave a counter that never expires. - `/authadmin unlock` and issuing a temporary password now also clear the player's rate-limit lock, so the action takes effect right away instead of leaving them rate-limited. - The password-hashing queue is now bounded, so a flood of login attempts is rejected once the server is busy instead of growing memory use without limit. - A failed database migration no longer leaves the connection pool open. - `/logout` now ends every active session for the account, not only the most recent one. - Fabric's `/login`, `/register` and `/changepassword` now accept the same password characters Paper already does, with no need to quote special characters. ## Maintenance - Jackson (pulled in by the database migration library) is now properly relocated inside both the Paper and Fabric jars, preventing a conflict with other plugins/mods that bundle a different version. - Paper's commands now share the exact same authentication code Fabric uses, instead of a separate copy — removing the kind of duplication that caused the pre-login `/changepassword` issue fixed in 1.2.3. - `/authadmin doctor` now warns when the IP-hashing secret is a per-server generated file but the server is using a shared Redis or PostgreSQL backend, since every server sharing that backend then needs the identical secret. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.4 Security & Reliability Update Recommended for every server. This release closes the remaining issues from a follow-up security and quality audit. ## Security fixes - The built-in (non-Redis) rate limiter could be flooded with cheap fake login names to wipe out a real account's failed-attempt count. It now evicts the least-attacked entry first, so an attack can no longer erase a victim's protection. - The per-account-per-IP registration limit is now read from the accounts table directly instead of the audit log, so it keeps working even with audit logging disabled or its retention period passed. - After a lock expires, one more wrong password no longer immediately re-locks the account for another full lockout period. - IPv6 addresses are rounded to their /64 network block before rate limiting and before the per-IP registration cap, closing a bypass through address rotation within one network. - Fabric: if a player disconnects and reconnects (under the same name) while a login, register or password-change request is still being checked, the old request's result can no longer be applied to the new connection. - `/authadmin resetpassword` now refuses to run from the server console or RCON, since those would otherwise write the generated password to the server log. - Discord/Telegram failed-login alerts no longer fire for attempts already blocked by a rate limit, and the alert cooldown tracking can no longer be permanently jammed by an attacker rotating through many fake names. ## Reliability fixes - Password-change, account-unlock and temporary-password operations now update only their own fields in the database instead of the whole account row, removing a rare race where a slow request could overwrite a faster one's lockout state. - Redis's attempt counter and its expiry are now set in one atomic step, so a dropped connection can no longer leave a counter that never expires. - `/authadmin unlock` and issuing a temporary password now also clear the player's rate-limit lock, so the action takes effect right away instead of leaving them rate-limited. - The password-hashing queue is now bounded, so a flood of login attempts is rejected once the server is busy instead of growing memory use without limit. - A failed database migration no longer leaves the connection pool open. - `/logout` now ends every active session for the account, not only the most recent one. - Fabric's `/login`, `/register` and `/changepassword` now accept the same password characters Paper already does, with no need to quote special characters. ## Maintenance - Jackson (pulled in by the database migration library) is now properly relocated inside both the Paper and Fabric jars, preventing a conflict with other plugins/mods that bundle a different version. - Paper's commands now share the exact same authentication code Fabric uses, instead of a separate copy — removing the kind of duplication that caused the pre-login `/changepassword` issue fixed in 1.2.3. - `/authadmin doctor` now warns when the IP-hashing secret is a per-server generated file but the server is using a shared Redis or PostgreSQL backend, since every server sharing that backend then needs the identical secret. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.4 Security & Reliability Update Recommended for every server. This release closes the remaining issues from a follow-up security and quality audit. ## Security fixes - The built-in (non-Redis) rate limiter could be flooded with cheap fake login names to wipe out a real account's failed-attempt count. It now evicts the least-attacked entry first, so an attack can no longer erase a victim's protection. - The per-account-per-IP registration limit is now read from the accounts table directly instead of the audit log, so it keeps working even with audit logging disabled or its retention period passed. - After a lock expires, one more wrong password no longer immediately re-locks the account for another full lockout period. - IPv6 addresses are rounded to their /64 network block before rate limiting and before the per-IP registration cap, closing a bypass through address rotation within one network. - Fabric: if a player disconnects and reconnects (under the same name) while a login, register or password-change request is still being checked, the old request's result can no longer be applied to the new connection. - `/authadmin resetpassword` now refuses to run from the server console or RCON, since those would otherwise write the generated password to the server log. - Discord/Telegram failed-login alerts no longer fire for attempts already blocked by a rate limit, and the alert cooldown tracking can no longer be permanently jammed by an attacker rotating through many fake names. ## Reliability fixes - Password-change, account-unlock and temporary-password operations now update only their own fields in the database instead of the whole account row, removing a rare race where a slow request could overwrite a faster one's lockout state. - Redis's attempt counter and its expiry are now set in one atomic step, so a dropped connection can no longer leave a counter that never expires. - `/authadmin unlock` and issuing a temporary password now also clear the player's rate-limit lock, so the action takes effect right away instead of leaving them rate-limited. - The password-hashing queue is now bounded, so a flood of login attempts is rejected once the server is busy instead of growing memory use without limit. - A failed database migration no longer leaves the connection pool open. - `/logout` now ends every active session for the account, not only the most recent one. - Fabric's `/login`, `/register` and `/changepassword` now accept the same password characters Paper already does, with no need to quote special characters. ## Maintenance - Jackson (pulled in by the database migration library) is now properly relocated inside both the Paper and Fabric jars, preventing a conflict with other plugins/mods that bundle a different version. - Paper's commands now share the exact same authentication code Fabric uses, instead of a separate copy — removing the kind of duplication that caused the pre-login `/changepassword` issue fixed in 1.2.3. - `/authadmin doctor` now warns when the IP-hashing secret is a per-server generated file but the server is using a shared Redis or PostgreSQL backend, since every server sharing that backend then needs the identical secret. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.4 Security & Reliability Update Recommended for every server. This release closes the remaining issues from a follow-up security and quality audit. ## Security fixes - The built-in (non-Redis) rate limiter could be flooded with cheap fake login names to wipe out a real account's failed-attempt count. It now evicts the least-attacked entry first, so an attack can no longer erase a victim's protection. - The per-account-per-IP registration limit is now read from the accounts table directly instead of the audit log, so it keeps working even with audit logging disabled or its retention period passed. - After a lock expires, one more wrong password no longer immediately re-locks the account for another full lockout period. - IPv6 addresses are rounded to their /64 network block before rate limiting and before the per-IP registration cap, closing a bypass through address rotation within one network. - Fabric: if a player disconnects and reconnects (under the same name) while a login, register or password-change request is still being checked, the old request's result can no longer be applied to the new connection. - `/authadmin resetpassword` now refuses to run from the server console or RCON, since those would otherwise write the generated password to the server log. - Discord/Telegram failed-login alerts no longer fire for attempts already blocked by a rate limit, and the alert cooldown tracking can no longer be permanently jammed by an attacker rotating through many fake names. ## Reliability fixes - Password-change, account-unlock and temporary-password operations now update only their own fields in the database instead of the whole account row, removing a rare race where a slow request could overwrite a faster one's lockout state. - Redis's attempt counter and its expiry are now set in one atomic step, so a dropped connection can no longer leave a counter that never expires. - `/authadmin unlock` and issuing a temporary password now also clear the player's rate-limit lock, so the action takes effect right away instead of leaving them rate-limited. - The password-hashing queue is now bounded, so a flood of login attempts is rejected once the server is busy instead of growing memory use without limit. - A failed database migration no longer leaves the connection pool open. - `/logout` now ends every active session for the account, not only the most recent one. - Fabric's `/login`, `/register` and `/changepassword` now accept the same password characters Paper already does, with no need to quote special characters. ## Maintenance - Jackson (pulled in by the database migration library) is now properly relocated inside both the Paper and Fabric jars, preventing a conflict with other plugins/mods that bundle a different version. - Paper's commands now share the exact same authentication code Fabric uses, instead of a separate copy — removing the kind of duplication that caused the pre-login `/changepassword` issue fixed in 1.2.3. - `/authadmin doctor` now warns when the IP-hashing secret is a per-server generated file but the server is using a shared Redis or PostgreSQL backend, since every server sharing that backend then needs the identical secret. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.4 Security & Reliability Update Recommended for every server. This release closes the remaining issues from a follow-up security and quality audit. ## Security fixes - The built-in (non-Redis) rate limiter could be flooded with cheap fake login names to wipe out a real account's failed-attempt count. It now evicts the least-attacked entry first, so an attack can no longer erase a victim's protection. - The per-account-per-IP registration limit is now read from the accounts table directly instead of the audit log, so it keeps working even with audit logging disabled or its retention period passed. - After a lock expires, one more wrong password no longer immediately re-locks the account for another full lockout period. - IPv6 addresses are rounded to their /64 network block before rate limiting and before the per-IP registration cap, closing a bypass through address rotation within one network. - Fabric: if a player disconnects and reconnects (under the same name) while a login, register or password-change request is still being checked, the old request's result can no longer be applied to the new connection. - `/authadmin resetpassword` now refuses to run from the server console or RCON, since those would otherwise write the generated password to the server log. - Discord/Telegram failed-login alerts no longer fire for attempts already blocked by a rate limit, and the alert cooldown tracking can no longer be permanently jammed by an attacker rotating through many fake names. ## Reliability fixes - Password-change, account-unlock and temporary-password operations now update only their own fields in the database instead of the whole account row, removing a rare race where a slow request could overwrite a faster one's lockout state. - Redis's attempt counter and its expiry are now set in one atomic step, so a dropped connection can no longer leave a counter that never expires. - `/authadmin unlock` and issuing a temporary password now also clear the player's rate-limit lock, so the action takes effect right away instead of leaving them rate-limited. - The password-hashing queue is now bounded, so a flood of login attempts is rejected once the server is busy instead of growing memory use without limit. - A failed database migration no longer leaves the connection pool open. - `/logout` now ends every active session for the account, not only the most recent one. - Fabric's `/login`, `/register` and `/changepassword` now accept the same password characters Paper already does, with no need to quote special characters. ## Maintenance - Jackson (pulled in by the database migration library) is now properly relocated inside both the Paper and Fabric jars, preventing a conflict with other plugins/mods that bundle a different version. - Paper's commands now share the exact same authentication code Fabric uses, instead of a separate copy — removing the kind of duplication that caused the pre-login `/changepassword` issue fixed in 1.2.3. - `/authadmin doctor` now warns when the IP-hashing secret is a per-server generated file but the server is using a shared Redis or PostgreSQL backend, since every server sharing that backend then needs the identical secret. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.4 Security & Reliability Update Recommended for every server. This release closes the remaining issues from a follow-up security and quality audit. ## Security fixes - The built-in (non-Redis) rate limiter could be flooded with cheap fake login names to wipe out a real account's failed-attempt count. It now evicts the least-attacked entry first, so an attack can no longer erase a victim's protection. - The per-account-per-IP registration limit is now read from the accounts table directly instead of the audit log, so it keeps working even with audit logging disabled or its retention period passed. - After a lock expires, one more wrong password no longer immediately re-locks the account for another full lockout period. - IPv6 addresses are rounded to their /64 network block before rate limiting and before the per-IP registration cap, closing a bypass through address rotation within one network. - Fabric: if a player disconnects and reconnects (under the same name) while a login, register or password-change request is still being checked, the old request's result can no longer be applied to the new connection. - `/authadmin resetpassword` now refuses to run from the server console or RCON, since those would otherwise write the generated password to the server log. - Discord/Telegram failed-login alerts no longer fire for attempts already blocked by a rate limit, and the alert cooldown tracking can no longer be permanently jammed by an attacker rotating through many fake names. ## Reliability fixes - Password-change, account-unlock and temporary-password operations now update only their own fields in the database instead of the whole account row, removing a rare race where a slow request could overwrite a faster one's lockout state. - Redis's attempt counter and its expiry are now set in one atomic step, so a dropped connection can no longer leave a counter that never expires. - `/authadmin unlock` and issuing a temporary password now also clear the player's rate-limit lock, so the action takes effect right away instead of leaving them rate-limited. - The password-hashing queue is now bounded, so a flood of login attempts is rejected once the server is busy instead of growing memory use without limit. - A failed database migration no longer leaves the connection pool open. - `/logout` now ends every active session for the account, not only the most recent one. - Fabric's `/login`, `/register` and `/changepassword` now accept the same password characters Paper already does, with no need to quote special characters. ## Maintenance - Jackson (pulled in by the database migration library) is now properly relocated inside both the Paper and Fabric jars, preventing a conflict with other plugins/mods that bundle a different version. - Paper's commands now share the exact same authentication code Fabric uses, instead of a separate copy — removing the kind of duplication that caused the pre-login `/changepassword` issue fixed in 1.2.3. - `/authadmin doctor` now warns when the IP-hashing secret is a per-server generated file but the server is using a shared Redis or PostgreSQL backend, since every server sharing that backend then needs the identical secret. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.4 Security & Reliability Update Recommended for every server. This release closes the remaining issues from a follow-up security and quality audit. ## Security fixes - The built-in (non-Redis) rate limiter could be flooded with cheap fake login names to wipe out a real account's failed-attempt count. It now evicts the least-attacked entry first, so an attack can no longer erase a victim's protection. - The per-account-per-IP registration limit is now read from the accounts table directly instead of the audit log, so it keeps working even with audit logging disabled or its retention period passed. - After a lock expires, one more wrong password no longer immediately re-locks the account for another full lockout period. - IPv6 addresses are rounded to their /64 network block before rate limiting and before the per-IP registration cap, closing a bypass through address rotation within one network. - Fabric: if a player disconnects and reconnects (under the same name) while a login, register or password-change request is still being checked, the old request's result can no longer be applied to the new connection. - `/authadmin resetpassword` now refuses to run from the server console or RCON, since those would otherwise write the generated password to the server log. - Discord/Telegram failed-login alerts no longer fire for attempts already blocked by a rate limit, and the alert cooldown tracking can no longer be permanently jammed by an attacker rotating through many fake names. ## Reliability fixes - Password-change, account-unlock and temporary-password operations now update only their own fields in the database instead of the whole account row, removing a rare race where a slow request could overwrite a faster one's lockout state. - Redis's attempt counter and its expiry are now set in one atomic step, so a dropped connection can no longer leave a counter that never expires. - `/authadmin unlock` and issuing a temporary password now also clear the player's rate-limit lock, so the action takes effect right away instead of leaving them rate-limited. - The password-hashing queue is now bounded, so a flood of login attempts is rejected once the server is busy instead of growing memory use without limit. - A failed database migration no longer leaves the connection pool open. - `/logout` now ends every active session for the account, not only the most recent one. - Fabric's `/login`, `/register` and `/changepassword` now accept the same password characters Paper already does, with no need to quote special characters. ## Maintenance - Jackson (pulled in by the database migration library) is now properly relocated inside both the Paper and Fabric jars, preventing a conflict with other plugins/mods that bundle a different version. - Paper's commands now share the exact same authentication code Fabric uses, instead of a separate copy — removing the kind of duplication that caused the pre-login `/changepassword` issue fixed in 1.2.3. - `/authadmin doctor` now warns when the IP-hashing secret is a per-server generated file but the server is using a shared Redis or PostgreSQL backend, since every server sharing that backend then needs the identical secret. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.4 Security & Reliability Update Recommended for every server. This release closes the remaining issues from a follow-up security and quality audit. ## Security fixes - The built-in (non-Redis) rate limiter could be flooded with cheap fake login names to wipe out a real account's failed-attempt count. It now evicts the least-attacked entry first, so an attack can no longer erase a victim's protection. - The per-account-per-IP registration limit is now read from the accounts table directly instead of the audit log, so it keeps working even with audit logging disabled or its retention period passed. - After a lock expires, one more wrong password no longer immediately re-locks the account for another full lockout period. - IPv6 addresses are rounded to their /64 network block before rate limiting and before the per-IP registration cap, closing a bypass through address rotation within one network. - Fabric: if a player disconnects and reconnects (under the same name) while a login, register or password-change request is still being checked, the old request's result can no longer be applied to the new connection. - `/authadmin resetpassword` now refuses to run from the server console or RCON, since those would otherwise write the generated password to the server log. - Discord/Telegram failed-login alerts no longer fire for attempts already blocked by a rate limit, and the alert cooldown tracking can no longer be permanently jammed by an attacker rotating through many fake names. ## Reliability fixes - Password-change, account-unlock and temporary-password operations now update only their own fields in the database instead of the whole account row, removing a rare race where a slow request could overwrite a faster one's lockout state. - Redis's attempt counter and its expiry are now set in one atomic step, so a dropped connection can no longer leave a counter that never expires. - `/authadmin unlock` and issuing a temporary password now also clear the player's rate-limit lock, so the action takes effect right away instead of leaving them rate-limited. - The password-hashing queue is now bounded, so a flood of login attempts is rejected once the server is busy instead of growing memory use without limit. - A failed database migration no longer leaves the connection pool open. - `/logout` now ends every active session for the account, not only the most recent one. - Fabric's `/login`, `/register` and `/changepassword` now accept the same password characters Paper already does, with no need to quote special characters. ## Maintenance - Jackson (pulled in by the database migration library) is now properly relocated inside both the Paper and Fabric jars, preventing a conflict with other plugins/mods that bundle a different version. - Paper's commands now share the exact same authentication code Fabric uses, instead of a separate copy — removing the kind of duplication that caused the pre-login `/changepassword` issue fixed in 1.2.3. - `/authadmin doctor` now warns when the IP-hashing secret is a per-server generated file but the server is using a shared Redis or PostgreSQL backend, since every server sharing that backend then needs the identical secret. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.4 Security & Reliability Update Recommended for every server. This release closes the remaining issues from a follow-up security and quality audit. ## Security fixes - The built-in (non-Redis) rate limiter could be flooded with cheap fake login names to wipe out a real account's failed-attempt count. It now evicts the least-attacked entry first, so an attack can no longer erase a victim's protection. - The per-account-per-IP registration limit is now read from the accounts table directly instead of the audit log, so it keeps working even with audit logging disabled or its retention period passed. - After a lock expires, one more wrong password no longer immediately re-locks the account for another full lockout period. - IPv6 addresses are rounded to their /64 network block before rate limiting and before the per-IP registration cap, closing a bypass through address rotation within one network. - Fabric: if a player disconnects and reconnects (under the same name) while a login, register or password-change request is still being checked, the old request's result can no longer be applied to the new connection. - `/authadmin resetpassword` now refuses to run from the server console or RCON, since those would otherwise write the generated password to the server log. - Discord/Telegram failed-login alerts no longer fire for attempts already blocked by a rate limit, and the alert cooldown tracking can no longer be permanently jammed by an attacker rotating through many fake names. ## Reliability fixes - Password-change, account-unlock and temporary-password operations now update only their own fields in the database instead of the whole account row, removing a rare race where a slow request could overwrite a faster one's lockout state. - Redis's attempt counter and its expiry are now set in one atomic step, so a dropped connection can no longer leave a counter that never expires. - `/authadmin unlock` and issuing a temporary password now also clear the player's rate-limit lock, so the action takes effect right away instead of leaving them rate-limited. - The password-hashing queue is now bounded, so a flood of login attempts is rejected once the server is busy instead of growing memory use without limit. - A failed database migration no longer leaves the connection pool open. - `/logout` now ends every active session for the account, not only the most recent one. - Fabric's `/login`, `/register` and `/changepassword` now accept the same password characters Paper already does, with no need to quote special characters. ## Maintenance - Jackson (pulled in by the database migration library) is now properly relocated inside both the Paper and Fabric jars, preventing a conflict with other plugins/mods that bundle a different version. - Paper's commands now share the exact same authentication code Fabric uses, instead of a separate copy — removing the kind of duplication that caused the pre-login `/changepassword` issue fixed in 1.2.3. - `/authadmin doctor` now warns when the IP-hashing secret is a per-server generated file but the server is using a shared Redis or PostgreSQL backend, since every server sharing that backend then needs the identical secret. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.4 Security & Reliability Update Recommended for every server. This release closes the remaining issues from a follow-up security and quality audit. ## Security fixes - The built-in (non-Redis) rate limiter could be flooded with cheap fake login names to wipe out a real account's failed-attempt count. It now evicts the least-attacked entry first, so an attack can no longer erase a victim's protection. - The per-account-per-IP registration limit is now read from the accounts table directly instead of the audit log, so it keeps working even with audit logging disabled or its retention period passed. - After a lock expires, one more wrong password no longer immediately re-locks the account for another full lockout period. - IPv6 addresses are rounded to their /64 network block before rate limiting and before the per-IP registration cap, closing a bypass through address rotation within one network. - Fabric: if a player disconnects and reconnects (under the same name) while a login, register or password-change request is still being checked, the old request's result can no longer be applied to the new connection. - `/authadmin resetpassword` now refuses to run from the server console or RCON, since those would otherwise write the generated password to the server log. - Discord/Telegram failed-login alerts no longer fire for attempts already blocked by a rate limit, and the alert cooldown tracking can no longer be permanently jammed by an attacker rotating through many fake names. ## Reliability fixes - Password-change, account-unlock and temporary-password operations now update only their own fields in the database instead of the whole account row, removing a rare race where a slow request could overwrite a faster one's lockout state. - Redis's attempt counter and its expiry are now set in one atomic step, so a dropped connection can no longer leave a counter that never expires. - `/authadmin unlock` and issuing a temporary password now also clear the player's rate-limit lock, so the action takes effect right away instead of leaving them rate-limited. - The password-hashing queue is now bounded, so a flood of login attempts is rejected once the server is busy instead of growing memory use without limit. - A failed database migration no longer leaves the connection pool open. - `/logout` now ends every active session for the account, not only the most recent one. - Fabric's `/login`, `/register` and `/changepassword` now accept the same password characters Paper already does, with no need to quote special characters. ## Maintenance - Jackson (pulled in by the database migration library) is now properly relocated inside both the Paper and Fabric jars, preventing a conflict with other plugins/mods that bundle a different version. - Paper's commands now share the exact same authentication code Fabric uses, instead of a separate copy — removing the kind of duplication that caused the pre-login `/changepassword` issue fixed in 1.2.3. - `/authadmin doctor` now warns when the IP-hashing secret is a per-server generated file but the server is using a shared Redis or PostgreSQL backend, since every server sharing that backend then needs the identical secret. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.4 Security & Reliability Update Recommended for every server. This release closes the remaining issues from a follow-up security and quality audit. ## Security fixes - The built-in (non-Redis) rate limiter could be flooded with cheap fake login names to wipe out a real account's failed-attempt count. It now evicts the least-attacked entry first, so an attack can no longer erase a victim's protection. - The per-account-per-IP registration limit is now read from the accounts table directly instead of the audit log, so it keeps working even with audit logging disabled or its retention period passed. - After a lock expires, one more wrong password no longer immediately re-locks the account for another full lockout period. - IPv6 addresses are rounded to their /64 network block before rate limiting and before the per-IP registration cap, closing a bypass through address rotation within one network. - Fabric: if a player disconnects and reconnects (under the same name) while a login, register or password-change request is still being checked, the old request's result can no longer be applied to the new connection. - `/authadmin resetpassword` now refuses to run from the server console or RCON, since those would otherwise write the generated password to the server log. - Discord/Telegram failed-login alerts no longer fire for attempts already blocked by a rate limit, and the alert cooldown tracking can no longer be permanently jammed by an attacker rotating through many fake names. ## Reliability fixes - Password-change, account-unlock and temporary-password operations now update only their own fields in the database instead of the whole account row, removing a rare race where a slow request could overwrite a faster one's lockout state. - Redis's attempt counter and its expiry are now set in one atomic step, so a dropped connection can no longer leave a counter that never expires. - `/authadmin unlock` and issuing a temporary password now also clear the player's rate-limit lock, so the action takes effect right away instead of leaving them rate-limited. - The password-hashing queue is now bounded, so a flood of login attempts is rejected once the server is busy instead of growing memory use without limit. - A failed database migration no longer leaves the connection pool open. - `/logout` now ends every active session for the account, not only the most recent one. - Fabric's `/login`, `/register` and `/changepassword` now accept the same password characters Paper already does, with no need to quote special characters. ## Maintenance - Jackson (pulled in by the database migration library) is now properly relocated inside both the Paper and Fabric jars, preventing a conflict with other plugins/mods that bundle a different version. - Paper's commands now share the exact same authentication code Fabric uses, instead of a separate copy — removing the kind of duplication that caused the pre-login `/changepassword` issue fixed in 1.2.3. - `/authadmin doctor` now warns when the IP-hashing secret is a per-server generated file but the server is using a shared Redis or PostgreSQL backend, since every server sharing that backend then needs the identical secret. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.4 Security & Reliability Update Recommended for every server. This release closes the remaining issues from a follow-up security and quality audit. ## Security fixes - The built-in (non-Redis) rate limiter could be flooded with cheap fake login names to wipe out a real account's failed-attempt count. It now evicts the least-attacked entry first, so an attack can no longer erase a victim's protection. - The per-account-per-IP registration limit is now read from the accounts table directly instead of the audit log, so it keeps working even with audit logging disabled or its retention period passed. - After a lock expires, one more wrong password no longer immediately re-locks the account for another full lockout period. - IPv6 addresses are rounded to their /64 network block before rate limiting and before the per-IP registration cap, closing a bypass through address rotation within one network. - Fabric: if a player disconnects and reconnects (under the same name) while a login, register or password-change request is still being checked, the old request's result can no longer be applied to the new connection. - `/authadmin resetpassword` now refuses to run from the server console or RCON, since those would otherwise write the generated password to the server log. - Discord/Telegram failed-login alerts no longer fire for attempts already blocked by a rate limit, and the alert cooldown tracking can no longer be permanently jammed by an attacker rotating through many fake names. ## Reliability fixes - Password-change, account-unlock and temporary-password operations now update only their own fields in the database instead of the whole account row, removing a rare race where a slow request could overwrite a faster one's lockout state. - Redis's attempt counter and its expiry are now set in one atomic step, so a dropped connection can no longer leave a counter that never expires. - `/authadmin unlock` and issuing a temporary password now also clear the player's rate-limit lock, so the action takes effect right away instead of leaving them rate-limited. - The password-hashing queue is now bounded, so a flood of login attempts is rejected once the server is busy instead of growing memory use without limit. - A failed database migration no longer leaves the connection pool open. - `/logout` now ends every active session for the account, not only the most recent one. - Fabric's `/login`, `/register` and `/changepassword` now accept the same password characters Paper already does, with no need to quote special characters. ## Maintenance - Jackson (pulled in by the database migration library) is now properly relocated inside both the Paper and Fabric jars, preventing a conflict with other plugins/mods that bundle a different version. - Paper's commands now share the exact same authentication code Fabric uses, instead of a separate copy — removing the kind of duplication that caused the pre-login `/changepassword` issue fixed in 1.2.3. - `/authadmin doctor` now warns when the IP-hashing secret is a per-server generated file but the server is using a shared Redis or PostgreSQL backend, since every server sharing that backend then needs the identical secret. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.4 Security & Reliability Update Recommended for every server. This release closes the remaining issues from a follow-up security and quality audit. ## Security fixes - The built-in (non-Redis) rate limiter could be flooded with cheap fake login names to wipe out a real account's failed-attempt count. It now evicts the least-attacked entry first, so an attack can no longer erase a victim's protection. - The per-account-per-IP registration limit is now read from the accounts table directly instead of the audit log, so it keeps working even with audit logging disabled or its retention period passed. - After a lock expires, one more wrong password no longer immediately re-locks the account for another full lockout period. - IPv6 addresses are rounded to their /64 network block before rate limiting and before the per-IP registration cap, closing a bypass through address rotation within one network. - Fabric: if a player disconnects and reconnects (under the same name) while a login, register or password-change request is still being checked, the old request's result can no longer be applied to the new connection. - `/authadmin resetpassword` now refuses to run from the server console or RCON, since those would otherwise write the generated password to the server log. - Discord/Telegram failed-login alerts no longer fire for attempts already blocked by a rate limit, and the alert cooldown tracking can no longer be permanently jammed by an attacker rotating through many fake names. ## Reliability fixes - Password-change, account-unlock and temporary-password operations now update only their own fields in the database instead of the whole account row, removing a rare race where a slow request could overwrite a faster one's lockout state. - Redis's attempt counter and its expiry are now set in one atomic step, so a dropped connection can no longer leave a counter that never expires. - `/authadmin unlock` and issuing a temporary password now also clear the player's rate-limit lock, so the action takes effect right away instead of leaving them rate-limited. - The password-hashing queue is now bounded, so a flood of login attempts is rejected once the server is busy instead of growing memory use without limit. - A failed database migration no longer leaves the connection pool open. - `/logout` now ends every active session for the account, not only the most recent one. - Fabric's `/login`, `/register` and `/changepassword` now accept the same password characters Paper already does, with no need to quote special characters. ## Maintenance - Jackson (pulled in by the database migration library) is now properly relocated inside both the Paper and Fabric jars, preventing a conflict with other plugins/mods that bundle a different version. - Paper's commands now share the exact same authentication code Fabric uses, instead of a separate copy — removing the kind of duplication that caused the pre-login `/changepassword` issue fixed in 1.2.3. - `/authadmin doctor` now warns when the IP-hashing secret is a per-server generated file but the server is using a shared Redis or PostgreSQL backend, since every server sharing that backend then needs the identical secret. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.4 Security & Reliability Update Recommended for every server. This release closes the remaining issues from a follow-up security and quality audit. ## Security fixes - The built-in (non-Redis) rate limiter could be flooded with cheap fake login names to wipe out a real account's failed-attempt count. It now evicts the least-attacked entry first, so an attack can no longer erase a victim's protection. - The per-account-per-IP registration limit is now read from the accounts table directly instead of the audit log, so it keeps working even with audit logging disabled or its retention period passed. - After a lock expires, one more wrong password no longer immediately re-locks the account for another full lockout period. - IPv6 addresses are rounded to their /64 network block before rate limiting and before the per-IP registration cap, closing a bypass through address rotation within one network. - Fabric: if a player disconnects and reconnects (under the same name) while a login, register or password-change request is still being checked, the old request's result can no longer be applied to the new connection. - `/authadmin resetpassword` now refuses to run from the server console or RCON, since those would otherwise write the generated password to the server log. - Discord/Telegram failed-login alerts no longer fire for attempts already blocked by a rate limit, and the alert cooldown tracking can no longer be permanently jammed by an attacker rotating through many fake names. ## Reliability fixes - Password-change, account-unlock and temporary-password operations now update only their own fields in the database instead of the whole account row, removing a rare race where a slow request could overwrite a faster one's lockout state. - Redis's attempt counter and its expiry are now set in one atomic step, so a dropped connection can no longer leave a counter that never expires. - `/authadmin unlock` and issuing a temporary password now also clear the player's rate-limit lock, so the action takes effect right away instead of leaving them rate-limited. - The password-hashing queue is now bounded, so a flood of login attempts is rejected once the server is busy instead of growing memory use without limit. - A failed database migration no longer leaves the connection pool open. - `/logout` now ends every active session for the account, not only the most recent one. - Fabric's `/login`, `/register` and `/changepassword` now accept the same password characters Paper already does, with no need to quote special characters. ## Maintenance - Jackson (pulled in by the database migration library) is now properly relocated inside both the Paper and Fabric jars, preventing a conflict with other plugins/mods that bundle a different version. - Paper's commands now share the exact same authentication code Fabric uses, instead of a separate copy — removing the kind of duplication that caused the pre-login `/changepassword` issue fixed in 1.2.3. - `/authadmin doctor` now warns when the IP-hashing secret is a per-server generated file but the server is using a shared Redis or PostgreSQL backend, since every server sharing that backend then needs the identical secret. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.4 Security & Reliability Update Recommended for every server. This release closes the remaining issues from a follow-up security and quality audit. ## Security fixes - The built-in (non-Redis) rate limiter could be flooded with cheap fake login names to wipe out a real account's failed-attempt count. It now evicts the least-attacked entry first, so an attack can no longer erase a victim's protection. - The per-account-per-IP registration limit is now read from the accounts table directly instead of the audit log, so it keeps working even with audit logging disabled or its retention period passed. - After a lock expires, one more wrong password no longer immediately re-locks the account for another full lockout period. - IPv6 addresses are rounded to their /64 network block before rate limiting and before the per-IP registration cap, closing a bypass through address rotation within one network. - Fabric: if a player disconnects and reconnects (under the same name) while a login, register or password-change request is still being checked, the old request's result can no longer be applied to the new connection. - `/authadmin resetpassword` now refuses to run from the server console or RCON, since those would otherwise write the generated password to the server log. - Discord/Telegram failed-login alerts no longer fire for attempts already blocked by a rate limit, and the alert cooldown tracking can no longer be permanently jammed by an attacker rotating through many fake names. ## Reliability fixes - Password-change, account-unlock and temporary-password operations now update only their own fields in the database instead of the whole account row, removing a rare race where a slow request could overwrite a faster one's lockout state. - Redis's attempt counter and its expiry are now set in one atomic step, so a dropped connection can no longer leave a counter that never expires. - `/authadmin unlock` and issuing a temporary password now also clear the player's rate-limit lock, so the action takes effect right away instead of leaving them rate-limited. - The password-hashing queue is now bounded, so a flood of login attempts is rejected once the server is busy instead of growing memory use without limit. - A failed database migration no longer leaves the connection pool open. - `/logout` now ends every active session for the account, not only the most recent one. - Fabric's `/login`, `/register` and `/changepassword` now accept the same password characters Paper already does, with no need to quote special characters. ## Maintenance - Jackson (pulled in by the database migration library) is now properly relocated inside both the Paper and Fabric jars, preventing a conflict with other plugins/mods that bundle a different version. - Paper's commands now share the exact same authentication code Fabric uses, instead of a separate copy — removing the kind of duplication that caused the pre-login `/changepassword` issue fixed in 1.2.3. - `/authadmin doctor` now warns when the IP-hashing secret is a per-server generated file but the server is using a shared Redis or PostgreSQL backend, since every server sharing that backend then needs the identical secret. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.4 Security & Reliability Update Recommended for every server. This release closes the remaining issues from a follow-up security and quality audit. ## Security fixes - The built-in (non-Redis) rate limiter could be flooded with cheap fake login names to wipe out a real account's failed-attempt count. It now evicts the least-attacked entry first, so an attack can no longer erase a victim's protection. - The per-account-per-IP registration limit is now read from the accounts table directly instead of the audit log, so it keeps working even with audit logging disabled or its retention period passed. - After a lock expires, one more wrong password no longer immediately re-locks the account for another full lockout period. - IPv6 addresses are rounded to their /64 network block before rate limiting and before the per-IP registration cap, closing a bypass through address rotation within one network. - Fabric: if a player disconnects and reconnects (under the same name) while a login, register or password-change request is still being checked, the old request's result can no longer be applied to the new connection. - `/authadmin resetpassword` now refuses to run from the server console or RCON, since those would otherwise write the generated password to the server log. - Discord/Telegram failed-login alerts no longer fire for attempts already blocked by a rate limit, and the alert cooldown tracking can no longer be permanently jammed by an attacker rotating through many fake names. ## Reliability fixes - Password-change, account-unlock and temporary-password operations now update only their own fields in the database instead of the whole account row, removing a rare race where a slow request could overwrite a faster one's lockout state. - Redis's attempt counter and its expiry are now set in one atomic step, so a dropped connection can no longer leave a counter that never expires. - `/authadmin unlock` and issuing a temporary password now also clear the player's rate-limit lock, so the action takes effect right away instead of leaving them rate-limited. - The password-hashing queue is now bounded, so a flood of login attempts is rejected once the server is busy instead of growing memory use without limit. - A failed database migration no longer leaves the connection pool open. - `/logout` now ends every active session for the account, not only the most recent one. - Fabric's `/login`, `/register` and `/changepassword` now accept the same password characters Paper already does, with no need to quote special characters. ## Maintenance - Jackson (pulled in by the database migration library) is now properly relocated inside both the Paper and Fabric jars, preventing a conflict with other plugins/mods that bundle a different version. - Paper's commands now share the exact same authentication code Fabric uses, instead of a separate copy — removing the kind of duplication that caused the pre-login `/changepassword` issue fixed in 1.2.3. - `/authadmin doctor` now warns when the IP-hashing secret is a per-server generated file but the server is using a shared Redis or PostgreSQL backend, since every server sharing that backend then needs the identical secret. ## Notes - No configuration changes are required. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.3 Security Update Recommended for every server. This release closes pre-login bypasses found in a security audit. ## Added - Fabric support for Minecraft 26.3, using Fabric API 0.164.0+26.3. ## Security fixes - `/changepassword` can no longer be used to guess passwords before logging in. It now goes through the same rate limits, failed-attempt counter, account lock and temporary-password expiry checks as `/login`. Before login it only works to finish a temporary-password reset. - Fabric: players who have not logged in can no longer run commands through the signed-command packet (`/msg`, `/me`, or any command sent by a modified client). Every command is checked a second time right before it runs. - A locked account now gives the same answer for right and wrong passwords, so the lock cannot be used to confirm a guessed password. - The built-in (non-Redis) rate limiter can no longer be flooded into locking every player out. - Paper: if the plugin fails to start for any reason, new logins stay blocked instead of the server running without authentication. ## Changes - Players who have not logged in or registered cannot move at all: no walking, jumping, riding, gliding, ender pearls, portals or spectator teleports. Looking around still works. Controlled by `restrictions.freeze-player` (enabled by default). ## Fixes - PostgreSQL: security audit events are stored correctly again. They were rejected before, which also disabled the `max-accounts-per-ip` registration limit. - Spigot: all pre-login restrictions now load, and `/authadmin resetpassword` no longer needs Paper-only APIs. ## Notes - No configuration changes are required. Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.3 Security Update Recommended for every server. This release closes pre-login bypasses found in a security audit. ## Added - Fabric support for Minecraft 26.3, using Fabric API 0.164.0+26.3. ## Security fixes - `/changepassword` can no longer be used to guess passwords before logging in. It now goes through the same rate limits, failed-attempt counter, account lock and temporary-password expiry checks as `/login`. Before login it only works to finish a temporary-password reset. - Fabric: players who have not logged in can no longer run commands through the signed-command packet (`/msg`, `/me`, or any command sent by a modified client). Every command is checked a second time right before it runs. - A locked account now gives the same answer for right and wrong passwords, so the lock cannot be used to confirm a guessed password. - The built-in (non-Redis) rate limiter can no longer be flooded into locking every player out. - Paper: if the plugin fails to start for any reason, new logins stay blocked instead of the server running without authentication. ## Changes - Players who have not logged in or registered cannot move at all: no walking, jumping, riding, gliding, ender pearls, portals or spectator teleports. Looking around still works. Controlled by `restrictions.freeze-player` (enabled by default). ## Fixes - PostgreSQL: security audit events are stored correctly again. They were rejected before, which also disabled the `max-accounts-per-ip` registration limit. - Spigot: all pre-login restrictions now load, and `/authadmin resetpassword` no longer needs Paper-only APIs. ## Notes - No configuration changes are required. Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.3 Security Update Recommended for every server. This release closes pre-login bypasses found in a security audit. ## Added - Fabric support for Minecraft 26.3, using Fabric API 0.164.0+26.3. ## Security fixes - `/changepassword` can no longer be used to guess passwords before logging in. It now goes through the same rate limits, failed-attempt counter, account lock and temporary-password expiry checks as `/login`. Before login it only works to finish a temporary-password reset. - Fabric: players who have not logged in can no longer run commands through the signed-command packet (`/msg`, `/me`, or any command sent by a modified client). Every command is checked a second time right before it runs. - A locked account now gives the same answer for right and wrong passwords, so the lock cannot be used to confirm a guessed password. - The built-in (non-Redis) rate limiter can no longer be flooded into locking every player out. - Paper: if the plugin fails to start for any reason, new logins stay blocked instead of the server running without authentication. ## Changes - Players who have not logged in or registered cannot move at all: no walking, jumping, riding, gliding, ender pearls, portals or spectator teleports. Looking around still works. Controlled by `restrictions.freeze-player` (enabled by default). ## Fixes - PostgreSQL: security audit events are stored correctly again. They were rejected before, which also disabled the `max-accounts-per-ip` registration limit. - Spigot: all pre-login restrictions now load, and `/authadmin resetpassword` no longer needs Paper-only APIs. ## Notes - No configuration changes are required. Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.3 Security Update Recommended for every server. This release closes pre-login bypasses found in a security audit. ## Added - Fabric support for Minecraft 26.3, using Fabric API 0.164.0+26.3. ## Security fixes - `/changepassword` can no longer be used to guess passwords before logging in. It now goes through the same rate limits, failed-attempt counter, account lock and temporary-password expiry checks as `/login`. Before login it only works to finish a temporary-password reset. - Fabric: players who have not logged in can no longer run commands through the signed-command packet (`/msg`, `/me`, or any command sent by a modified client). Every command is checked a second time right before it runs. - A locked account now gives the same answer for right and wrong passwords, so the lock cannot be used to confirm a guessed password. - The built-in (non-Redis) rate limiter can no longer be flooded into locking every player out. - Paper: if the plugin fails to start for any reason, new logins stay blocked instead of the server running without authentication. ## Changes - Players who have not logged in or registered cannot move at all: no walking, jumping, riding, gliding, ender pearls, portals or spectator teleports. Looking around still works. Controlled by `restrictions.freeze-player` (enabled by default). ## Fixes - PostgreSQL: security audit events are stored correctly again. They were rejected before, which also disabled the `max-accounts-per-ip` registration limit. - Spigot: all pre-login restrictions now load, and `/authadmin resetpassword` no longer needs Paper-only APIs. ## Notes - No configuration changes are required. Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.3 Security Update Recommended for every server. This release closes pre-login bypasses found in a security audit. ## Added - Fabric support for Minecraft 26.3, using Fabric API 0.164.0+26.3. ## Security fixes - `/changepassword` can no longer be used to guess passwords before logging in. It now goes through the same rate limits, failed-attempt counter, account lock and temporary-password expiry checks as `/login`. Before login it only works to finish a temporary-password reset. - Fabric: players who have not logged in can no longer run commands through the signed-command packet (`/msg`, `/me`, or any command sent by a modified client). Every command is checked a second time right before it runs. - A locked account now gives the same answer for right and wrong passwords, so the lock cannot be used to confirm a guessed password. - The built-in (non-Redis) rate limiter can no longer be flooded into locking every player out. - Paper: if the plugin fails to start for any reason, new logins stay blocked instead of the server running without authentication. ## Changes - Players who have not logged in or registered cannot move at all: no walking, jumping, riding, gliding, ender pearls, portals or spectator teleports. Looking around still works. Controlled by `restrictions.freeze-player` (enabled by default). ## Fixes - PostgreSQL: security audit events are stored correctly again. They were rejected before, which also disabled the `max-accounts-per-ip` registration limit. - Spigot: all pre-login restrictions now load, and `/authadmin resetpassword` no longer needs Paper-only APIs. ## Notes - No configuration changes are required. Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.3 Security Update Recommended for every server. This release closes pre-login bypasses found in a security audit. ## Added - Fabric support for Minecraft 26.3, using Fabric API 0.164.0+26.3. ## Security fixes - `/changepassword` can no longer be used to guess passwords before logging in. It now goes through the same rate limits, failed-attempt counter, account lock and temporary-password expiry checks as `/login`. Before login it only works to finish a temporary-password reset. - Fabric: players who have not logged in can no longer run commands through the signed-command packet (`/msg`, `/me`, or any command sent by a modified client). Every command is checked a second time right before it runs. - A locked account now gives the same answer for right and wrong passwords, so the lock cannot be used to confirm a guessed password. - The built-in (non-Redis) rate limiter can no longer be flooded into locking every player out. - Paper: if the plugin fails to start for any reason, new logins stay blocked instead of the server running without authentication. ## Changes - Players who have not logged in or registered cannot move at all: no walking, jumping, riding, gliding, ender pearls, portals or spectator teleports. Looking around still works. Controlled by `restrictions.freeze-player` (enabled by default). ## Fixes - PostgreSQL: security audit events are stored correctly again. They were rejected before, which also disabled the `max-accounts-per-ip` registration limit. - Spigot: all pre-login restrictions now load, and `/authadmin resetpassword` no longer needs Paper-only APIs. ## Notes - No configuration changes are required. Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.3 Security Update Recommended for every server. This release closes pre-login bypasses found in a security audit. ## Added - Fabric support for Minecraft 26.3, using Fabric API 0.164.0+26.3. ## Security fixes - `/changepassword` can no longer be used to guess passwords before logging in. It now goes through the same rate limits, failed-attempt counter, account lock and temporary-password expiry checks as `/login`. Before login it only works to finish a temporary-password reset. - Fabric: players who have not logged in can no longer run commands through the signed-command packet (`/msg`, `/me`, or any command sent by a modified client). Every command is checked a second time right before it runs. - A locked account now gives the same answer for right and wrong passwords, so the lock cannot be used to confirm a guessed password. - The built-in (non-Redis) rate limiter can no longer be flooded into locking every player out. - Paper: if the plugin fails to start for any reason, new logins stay blocked instead of the server running without authentication. ## Changes - Players who have not logged in or registered cannot move at all: no walking, jumping, riding, gliding, ender pearls, portals or spectator teleports. Looking around still works. Controlled by `restrictions.freeze-player` (enabled by default). ## Fixes - PostgreSQL: security audit events are stored correctly again. They were rejected before, which also disabled the `max-accounts-per-ip` registration limit. - Spigot: all pre-login restrictions now load, and `/authadmin resetpassword` no longer needs Paper-only APIs. ## Notes - No configuration changes are required. Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.3 Security Update Recommended for every server. This release closes pre-login bypasses found in a security audit. ## Added - Fabric support for Minecraft 26.3, using Fabric API 0.164.0+26.3. ## Security fixes - `/changepassword` can no longer be used to guess passwords before logging in. It now goes through the same rate limits, failed-attempt counter, account lock and temporary-password expiry checks as `/login`. Before login it only works to finish a temporary-password reset. - Fabric: players who have not logged in can no longer run commands through the signed-command packet (`/msg`, `/me`, or any command sent by a modified client). Every command is checked a second time right before it runs. - A locked account now gives the same answer for right and wrong passwords, so the lock cannot be used to confirm a guessed password. - The built-in (non-Redis) rate limiter can no longer be flooded into locking every player out. - Paper: if the plugin fails to start for any reason, new logins stay blocked instead of the server running without authentication. ## Changes - Players who have not logged in or registered cannot move at all: no walking, jumping, riding, gliding, ender pearls, portals or spectator teleports. Looking around still works. Controlled by `restrictions.freeze-player` (enabled by default). ## Fixes - PostgreSQL: security audit events are stored correctly again. They were rejected before, which also disabled the `max-accounts-per-ip` registration limit. - Spigot: all pre-login restrictions now load, and `/authadmin resetpassword` no longer needs Paper-only APIs. ## Notes - No configuration changes are required. Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.3 Security Update Recommended for every server. This release closes pre-login bypasses found in a security audit. ## Added - Fabric support for Minecraft 26.3, using Fabric API 0.164.0+26.3. ## Security fixes - `/changepassword` can no longer be used to guess passwords before logging in. It now goes through the same rate limits, failed-attempt counter, account lock and temporary-password expiry checks as `/login`. Before login it only works to finish a temporary-password reset. - Fabric: players who have not logged in can no longer run commands through the signed-command packet (`/msg`, `/me`, or any command sent by a modified client). Every command is checked a second time right before it runs. - A locked account now gives the same answer for right and wrong passwords, so the lock cannot be used to confirm a guessed password. - The built-in (non-Redis) rate limiter can no longer be flooded into locking every player out. - Paper: if the plugin fails to start for any reason, new logins stay blocked instead of the server running without authentication. ## Changes - Players who have not logged in or registered cannot move at all: no walking, jumping, riding, gliding, ender pearls, portals or spectator teleports. Looking around still works. Controlled by `restrictions.freeze-player` (enabled by default). ## Fixes - PostgreSQL: security audit events are stored correctly again. They were rejected before, which also disabled the `max-accounts-per-ip` registration limit. - Spigot: all pre-login restrictions now load, and `/authadmin resetpassword` no longer needs Paper-only APIs. ## Notes - No configuration changes are required. Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.3 Security Update Recommended for every server. This release closes pre-login bypasses found in a security audit. ## Added - Fabric support for Minecraft 26.3, using Fabric API 0.164.0+26.3. ## Security fixes - `/changepassword` can no longer be used to guess passwords before logging in. It now goes through the same rate limits, failed-attempt counter, account lock and temporary-password expiry checks as `/login`. Before login it only works to finish a temporary-password reset. - Fabric: players who have not logged in can no longer run commands through the signed-command packet (`/msg`, `/me`, or any command sent by a modified client). Every command is checked a second time right before it runs. - A locked account now gives the same answer for right and wrong passwords, so the lock cannot be used to confirm a guessed password. - The built-in (non-Redis) rate limiter can no longer be flooded into locking every player out. - Paper: if the plugin fails to start for any reason, new logins stay blocked instead of the server running without authentication. ## Changes - Players who have not logged in or registered cannot move at all: no walking, jumping, riding, gliding, ender pearls, portals or spectator teleports. Looking around still works. Controlled by `restrictions.freeze-player` (enabled by default). ## Fixes - PostgreSQL: security audit events are stored correctly again. They were rejected before, which also disabled the `max-accounts-per-ip` registration limit. - Spigot: all pre-login restrictions now load, and `/authadmin resetpassword` no longer needs Paper-only APIs. ## Notes - No configuration changes are required. Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.3 Security Update Recommended for every server. This release closes pre-login bypasses found in a security audit. ## Added - Fabric support for Minecraft 26.3, using Fabric API 0.164.0+26.3. ## Security fixes - `/changepassword` can no longer be used to guess passwords before logging in. It now goes through the same rate limits, failed-attempt counter, account lock and temporary-password expiry checks as `/login`. Before login it only works to finish a temporary-password reset. - Fabric: players who have not logged in can no longer run commands through the signed-command packet (`/msg`, `/me`, or any command sent by a modified client). Every command is checked a second time right before it runs. - A locked account now gives the same answer for right and wrong passwords, so the lock cannot be used to confirm a guessed password. - The built-in (non-Redis) rate limiter can no longer be flooded into locking every player out. - Paper: if the plugin fails to start for any reason, new logins stay blocked instead of the server running without authentication. ## Changes - Players who have not logged in or registered cannot move at all: no walking, jumping, riding, gliding, ender pearls, portals or spectator teleports. Looking around still works. Controlled by `restrictions.freeze-player` (enabled by default). ## Fixes - PostgreSQL: security audit events are stored correctly again. They were rejected before, which also disabled the `max-accounts-per-ip` registration limit. - Spigot: all pre-login restrictions now load, and `/authadmin resetpassword` no longer needs Paper-only APIs. ## Notes - No configuration changes are required. Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.3 Security Update Recommended for every server. This release closes pre-login bypasses found in a security audit. ## Added - Fabric support for Minecraft 26.3, using Fabric API 0.164.0+26.3. ## Security fixes - `/changepassword` can no longer be used to guess passwords before logging in. It now goes through the same rate limits, failed-attempt counter, account lock and temporary-password expiry checks as `/login`. Before login it only works to finish a temporary-password reset. - Fabric: players who have not logged in can no longer run commands through the signed-command packet (`/msg`, `/me`, or any command sent by a modified client). Every command is checked a second time right before it runs. - A locked account now gives the same answer for right and wrong passwords, so the lock cannot be used to confirm a guessed password. - The built-in (non-Redis) rate limiter can no longer be flooded into locking every player out. - Paper: if the plugin fails to start for any reason, new logins stay blocked instead of the server running without authentication. ## Changes - Players who have not logged in or registered cannot move at all: no walking, jumping, riding, gliding, ender pearls, portals or spectator teleports. Looking around still works. Controlled by `restrictions.freeze-player` (enabled by default). ## Fixes - PostgreSQL: security audit events are stored correctly again. They were rejected before, which also disabled the `max-accounts-per-ip` registration limit. - Spigot: all pre-login restrictions now load, and `/authadmin resetpassword` no longer needs Paper-only APIs. ## Notes - No configuration changes are required. Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.3 Security Update Recommended for every server. This release closes pre-login bypasses found in a security audit. ## Added - Fabric support for Minecraft 26.3, using Fabric API 0.164.0+26.3. ## Security fixes - `/changepassword` can no longer be used to guess passwords before logging in. It now goes through the same rate limits, failed-attempt counter, account lock and temporary-password expiry checks as `/login`. Before login it only works to finish a temporary-password reset. - Fabric: players who have not logged in can no longer run commands through the signed-command packet (`/msg`, `/me`, or any command sent by a modified client). Every command is checked a second time right before it runs. - A locked account now gives the same answer for right and wrong passwords, so the lock cannot be used to confirm a guessed password. - The built-in (non-Redis) rate limiter can no longer be flooded into locking every player out. - Paper: if the plugin fails to start for any reason, new logins stay blocked instead of the server running without authentication. ## Changes - Players who have not logged in or registered cannot move at all: no walking, jumping, riding, gliding, ender pearls, portals or spectator teleports. Looking around still works. Controlled by `restrictions.freeze-player` (enabled by default). ## Fixes - PostgreSQL: security audit events are stored correctly again. They were rejected before, which also disabled the `max-accounts-per-ip` registration limit. - Spigot: all pre-login restrictions now load, and `/authadmin resetpassword` no longer needs Paper-only APIs. ## Notes - No configuration changes are required. Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.3 Security Update Recommended for every server. This release closes pre-login bypasses found in a security audit. ## Added - Fabric support for Minecraft 26.3, using Fabric API 0.164.0+26.3. ## Security fixes - `/changepassword` can no longer be used to guess passwords before logging in. It now goes through the same rate limits, failed-attempt counter, account lock and temporary-password expiry checks as `/login`. Before login it only works to finish a temporary-password reset. - Fabric: players who have not logged in can no longer run commands through the signed-command packet (`/msg`, `/me`, or any command sent by a modified client). Every command is checked a second time right before it runs. - A locked account now gives the same answer for right and wrong passwords, so the lock cannot be used to confirm a guessed password. - The built-in (non-Redis) rate limiter can no longer be flooded into locking every player out. - Paper: if the plugin fails to start for any reason, new logins stay blocked instead of the server running without authentication. ## Changes - Players who have not logged in or registered cannot move at all: no walking, jumping, riding, gliding, ender pearls, portals or spectator teleports. Looking around still works. Controlled by `restrictions.freeze-player` (enabled by default). ## Fixes - PostgreSQL: security audit events are stored correctly again. They were rejected before, which also disabled the `max-accounts-per-ip` registration limit. - Spigot: all pre-login restrictions now load, and `/authadmin resetpassword` no longer needs Paper-only APIs. ## Notes - No configuration changes are required. Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.3 Security Update Recommended for every server. This release closes pre-login bypasses found in a security audit. ## Added - Fabric support for Minecraft 26.3, using Fabric API 0.164.0+26.3. ## Security fixes - `/changepassword` can no longer be used to guess passwords before logging in. It now goes through the same rate limits, failed-attempt counter, account lock and temporary-password expiry checks as `/login`. Before login it only works to finish a temporary-password reset. - Fabric: players who have not logged in can no longer run commands through the signed-command packet (`/msg`, `/me`, or any command sent by a modified client). Every command is checked a second time right before it runs. - A locked account now gives the same answer for right and wrong passwords, so the lock cannot be used to confirm a guessed password. - The built-in (non-Redis) rate limiter can no longer be flooded into locking every player out. - Paper: if the plugin fails to start for any reason, new logins stay blocked instead of the server running without authentication. ## Changes - Players who have not logged in or registered cannot move at all: no walking, jumping, riding, gliding, ender pearls, portals or spectator teleports. Looking around still works. Controlled by `restrictions.freeze-player` (enabled by default). ## Fixes - PostgreSQL: security audit events are stored correctly again. They were rejected before, which also disabled the `max-accounts-per-ip` registration limit. - Spigot: all pre-login restrictions now load, and `/authadmin resetpassword` no longer needs Paper-only APIs. ## Notes - No configuration changes are required. Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.3 Security Update Recommended for every server. This release closes pre-login bypasses found in a security audit. ## Added - Fabric support for Minecraft 26.3, using Fabric API 0.164.0+26.3. ## Security fixes - `/changepassword` can no longer be used to guess passwords before logging in. It now goes through the same rate limits, failed-attempt counter, account lock and temporary-password expiry checks as `/login`. Before login it only works to finish a temporary-password reset. - Fabric: players who have not logged in can no longer run commands through the signed-command packet (`/msg`, `/me`, or any command sent by a modified client). Every command is checked a second time right before it runs. - A locked account now gives the same answer for right and wrong passwords, so the lock cannot be used to confirm a guessed password. - The built-in (non-Redis) rate limiter can no longer be flooded into locking every player out. - Paper: if the plugin fails to start for any reason, new logins stay blocked instead of the server running without authentication. ## Changes - Players who have not logged in or registered cannot move at all: no walking, jumping, riding, gliding, ender pearls, portals or spectator teleports. Looking around still works. Controlled by `restrictions.freeze-player` (enabled by default). ## Fixes - PostgreSQL: security audit events are stored correctly again. They were rejected before, which also disabled the `max-accounts-per-ip` registration limit. - Spigot: all pre-login restrictions now load, and `/authadmin resetpassword` no longer needs Paper-only APIs. ## Notes - No configuration changes are required. Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.3 Security Update Recommended for every server. This release closes pre-login bypasses found in a security audit. ## Added - Fabric support for Minecraft 26.3, using Fabric API 0.164.0+26.3. ## Security fixes - `/changepassword` can no longer be used to guess passwords before logging in. It now goes through the same rate limits, failed-attempt counter, account lock and temporary-password expiry checks as `/login`. Before login it only works to finish a temporary-password reset. - Fabric: players who have not logged in can no longer run commands through the signed-command packet (`/msg`, `/me`, or any command sent by a modified client). Every command is checked a second time right before it runs. - A locked account now gives the same answer for right and wrong passwords, so the lock cannot be used to confirm a guessed password. - The built-in (non-Redis) rate limiter can no longer be flooded into locking every player out. - Paper: if the plugin fails to start for any reason, new logins stay blocked instead of the server running without authentication. ## Changes - Players who have not logged in or registered cannot move at all: no walking, jumping, riding, gliding, ender pearls, portals or spectator teleports. Looking around still works. Controlled by `restrictions.freeze-player` (enabled by default). ## Fixes - PostgreSQL: security audit events are stored correctly again. They were rejected before, which also disabled the `max-accounts-per-ip` registration limit. - Spigot: all pre-login restrictions now load, and `/authadmin resetpassword` no longer needs Paper-only APIs. ## Notes - No configuration changes are required. Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.3 Security Update Recommended for every server. This release closes pre-login bypasses found in a security audit. ## Added - Fabric support for Minecraft 26.3, using Fabric API 0.164.0+26.3. ## Security fixes - `/changepassword` can no longer be used to guess passwords before logging in. It now goes through the same rate limits, failed-attempt counter, account lock and temporary-password expiry checks as `/login`. Before login it only works to finish a temporary-password reset. - Fabric: players who have not logged in can no longer run commands through the signed-command packet (`/msg`, `/me`, or any command sent by a modified client). Every command is checked a second time right before it runs. - A locked account now gives the same answer for right and wrong passwords, so the lock cannot be used to confirm a guessed password. - The built-in (non-Redis) rate limiter can no longer be flooded into locking every player out. - Paper: if the plugin fails to start for any reason, new logins stay blocked instead of the server running without authentication. ## Changes - Players who have not logged in or registered cannot move at all: no walking, jumping, riding, gliding, ender pearls, portals or spectator teleports. Looking around still works. Controlled by `restrictions.freeze-player` (enabled by default). ## Fixes - PostgreSQL: security audit events are stored correctly again. They were rejected before, which also disabled the `max-accounts-per-ip` registration limit. - Spigot: all pre-login restrictions now load, and `/authadmin resetpassword` no longer needs Paper-only APIs. ## Notes - No configuration changes are required. Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version and requires Fabric API.

# AuthSecured 1.2.2 Security Update ## Security fixes - A private AUTHSECURED_IP_SECRET is now required. Servers without it keep authentication blocked until it is configured. - Unknown player IP addresses no longer share one rate-limit identity or create IP-bound reconnect sessions. - Malformed Argon2id hashes cannot request excessive memory or work factors. - SQLite foreign keys now enforce session deletion when an account is removed. - Optional Redis fallback is visible in /authadmin doctor. Set redis.required: true to stop authentication when shared Redis is unavailable. - Discord alerts accept official HTTPS webhook endpoints only. ## Reliability and maintenance - Expired sessions and old audit entries are cleaned periodically outside the server thread. - Configure logging.audit.retention-days and logging.audit.cleanup-interval-seconds in config.yml. - SQLite now records its schema version and safely upgrades existing databases. - Internal errors produce useful, privacy-safe diagnostics. ## Packaging - Updated dependencies after a vulnerability scan. - Reduced shaded JAR size and isolated bundled JSON libraries. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version. ## Performance - High-frequency events (movement, interactions, commands) now use cached configuration values, significantly reducing string parsing and lookup overhead. ## Bug Fixes & Stability - Intercepted password-bearing commands are now executed directly to prevent double-logging and reliably bypass other command-logging plugins. - Added graceful degradation if the sensitive command log filter fails to install: the server securely blocks new logins and kicks players instead of erroring on startup. - Asynchronous player kicks and messages are now properly scheduled to run on the main server thread. ## Compatibility & Quality of Life - Upgraded internal player messaging and kicks to use the modern Adventure Component API for broader Paper compatibility. - Added explicit folia-supported: false to plugin.yml. - Added a security reminder for administrators to clear their chat history (F3 + D) after generating a temporary password via /authadmin resetpassword.

# AuthSecured 1.2.2 Security Update ## Security fixes - A private AUTHSECURED_IP_SECRET is now required. Servers without it keep authentication blocked until it is configured. - Unknown player IP addresses no longer share one rate-limit identity or create IP-bound reconnect sessions. - Malformed Argon2id hashes cannot request excessive memory or work factors. - SQLite foreign keys now enforce session deletion when an account is removed. - Optional Redis fallback is visible in /authadmin doctor. Set redis.required: true to stop authentication when shared Redis is unavailable. - Discord alerts accept official HTTPS webhook endpoints only. ## Reliability and maintenance - Expired sessions and old audit entries are cleaned periodically outside the server thread. - Configure logging.audit.retention-days and logging.audit.cleanup-interval-seconds in config.yml. - SQLite now records its schema version and safely upgrades existing databases. - Internal errors produce useful, privacy-safe diagnostics. ## Packaging - Updated dependencies after a vulnerability scan. - Reduced shaded JAR size and isolated bundled JSON libraries. - Paper and Fabric remain separate downloads; each Fabric file targets one exact Minecraft version. ## Performance - High-frequency events (movement, interactions, commands) now use cached configuration values, significantly reducing string parsing and lookup overhead. ## Bug Fixes & Stability - Intercepted password-bearing commands are now executed directly to prevent double-logging and reliably bypass other command-logging plugins. - Added graceful degradation if the sensitive command log filter fails to install: the server securely blocks new logins and kicks players instead of erroring on startup. - Asynchronous player kicks and messages are now properly scheduled to run on the main server thread. ## Compatibility & Quality of Life - Upgraded internal player messaging and kicks to use the modern Adventure Component API for broader Paper compatibility. - Added explicit folia-supported: false to plugin.yml. - Added a security reminder for administrators to clear their chat history (F3 + D) after generating a temporary password via /authadmin resetpassword.

# AuthSecured 1.2.1 Security Update ## Security fixes - Argon2 verification now runs before account lock and temporary-password expiry responses for existing accounts. - Failed login attempts use atomic SQLite and PostgreSQL updates. - Concurrent duplicate registration is handled through database constraints. - Changing a password to the same value is rejected with a constant-time check. - Temporary passwords now use safe letters and digits only. - Redis operations run on a dedicated executor and fall back safely on timeout. ## Administration improvements - Administrators can copy temporary passwords with a left click. - Discord and Telegram have configurable channel switches and credentials in config.yml. - Older configuration files receive missing notification settings automatically. - Invalid reloads keep the previous valid configuration active. ## Reliability - Non-persistent mode clears stored sessions at startup. - Paper denies new logins if initialization fails. - Database resources are closed consistently. - New messages are translated into English, Russian, Spanish, Italian, and French.

# AuthSecured 1.2.1 Security Update ## Security fixes - Argon2 verification now runs before account lock and temporary-password expiry responses for existing accounts. - Failed login attempts use atomic SQLite and PostgreSQL updates. - Concurrent duplicate registration is handled through database constraints. - Changing a password to the same value is rejected with a constant-time check. - Temporary passwords now use safe letters and digits only. - Redis operations run on a dedicated executor and fall back safely on timeout. ## Administration improvements - Administrators can copy temporary passwords with a left click. - Discord and Telegram have configurable channel switches and credentials in config.yml. - Older configuration files receive missing notification settings automatically. - Invalid reloads keep the previous valid configuration active. ## Reliability - Non-persistent mode clears stored sessions at startup. - Paper denies new logins if initialization fails. - Database resources are closed consistently. - New messages are translated into English, Russian, Spanish, Italian, and French.

# AuthSecured 1.2.1 Security Update ## Security fixes - Argon2 verification now runs before account lock and temporary-password expiry responses for existing accounts. - Failed login attempts use atomic SQLite and PostgreSQL updates. - Concurrent duplicate registration is handled through database constraints. - Changing a password to the same value is rejected with a constant-time check. - Temporary passwords now use safe letters and digits only. - Redis operations run on a dedicated executor and fall back safely on timeout. ## Administration improvements - Administrators can copy temporary passwords with a left click. - Discord and Telegram have configurable channel switches and credentials in config.yml. - Older configuration files receive missing notification settings automatically. - Invalid reloads keep the previous valid configuration active. ## Reliability - Non-persistent mode clears stored sessions at startup. - Paper denies new logins if initialization fails. - Database resources are closed consistently. - New messages are translated into English, Russian, Spanish, Italian, and French.

# AuthSecured 1.2.1 Security Update ## Security fixes - Argon2 verification now runs before account lock and temporary-password expiry responses for existing accounts. - Failed login attempts use atomic SQLite and PostgreSQL updates. - Concurrent duplicate registration is handled through database constraints. - Changing a password to the same value is rejected with a constant-time check. - Temporary passwords now use safe letters and digits only. - Redis operations run on a dedicated executor and fall back safely on timeout. ## Administration improvements - Administrators can copy temporary passwords with a left click. - Discord and Telegram have configurable channel switches and credentials in config.yml. - Older configuration files receive missing notification settings automatically. - Invalid reloads keep the previous valid configuration active. ## Reliability - Non-persistent mode clears stored sessions at startup. - Paper denies new logins if initialization fails. - Database resources are closed consistently. - New messages are translated into English, Russian, Spanish, Italian, and French.

# AuthSecured 1.2.1 Security Update ## Security fixes - Argon2 verification now runs before account lock and temporary-password expiry responses for existing accounts. - Failed login attempts use atomic SQLite and PostgreSQL updates. - Concurrent duplicate registration is handled through database constraints. - Changing a password to the same value is rejected with a constant-time check. - Temporary passwords now use safe letters and digits only. - Redis operations run on a dedicated executor and fall back safely on timeout. ## Administration improvements - Administrators can copy temporary passwords with a left click. - Discord and Telegram have configurable channel switches and credentials in config.yml. - Older configuration files receive missing notification settings automatically. - Invalid reloads keep the previous valid configuration active. ## Reliability - Non-persistent mode clears stored sessions at startup. - Paper denies new logins if initialization fails. - Database resources are closed consistently. - New messages are translated into English, Russian, Spanish, Italian, and French.

# AuthSecured 1.2.1 Security Update ## Security fixes - Argon2 verification now runs before account lock and temporary-password expiry responses for existing accounts. - Failed login attempts use atomic SQLite and PostgreSQL updates. - Concurrent duplicate registration is handled through database constraints. - Changing a password to the same value is rejected with a constant-time check. - Temporary passwords now use safe letters and digits only. - Redis operations run on a dedicated executor and fall back safely on timeout. ## Administration improvements - Administrators can copy temporary passwords with a left click. - Discord and Telegram have configurable channel switches and credentials in config.yml. - Older configuration files receive missing notification settings automatically. - Invalid reloads keep the previous valid configuration active. ## Reliability - Non-persistent mode clears stored sessions at startup. - Paper denies new logins if initialization fails. - Database resources are closed consistently. - New messages are translated into English, Russian, Spanish, Italian, and French.

# AuthSecured 1.2.1 Security Update ## Security fixes - Argon2 verification now runs before account lock and temporary-password expiry responses for existing accounts. - Failed login attempts use atomic SQLite and PostgreSQL updates. - Concurrent duplicate registration is handled through database constraints. - Changing a password to the same value is rejected with a constant-time check. - Temporary passwords now use safe letters and digits only. - Redis operations run on a dedicated executor and fall back safely on timeout. ## Administration improvements - Administrators can copy temporary passwords with a left click. - Discord and Telegram have configurable channel switches and credentials in config.yml. - Older configuration files receive missing notification settings automatically. - Invalid reloads keep the previous valid configuration active. ## Reliability - Non-persistent mode clears stored sessions at startup. - Paper denies new logins if initialization fails. - Database resources are closed consistently. - New messages are translated into English, Russian, Spanish, Italian, and French.

# AuthSecured 1.2.1 Security Update ## Security fixes - Argon2 verification now runs before account lock and temporary-password expiry responses for existing accounts. - Failed login attempts use atomic SQLite and PostgreSQL updates. - Concurrent duplicate registration is handled through database constraints. - Changing a password to the same value is rejected with a constant-time check. - Temporary passwords now use safe letters and digits only. - Redis operations run on a dedicated executor and fall back safely on timeout. ## Administration improvements - Administrators can copy temporary passwords with a left click. - Discord and Telegram have configurable channel switches and credentials in config.yml. - Older configuration files receive missing notification settings automatically. - Invalid reloads keep the previous valid configuration active. ## Reliability - Non-persistent mode clears stored sessions at startup. - Paper denies new logins if initialization fails. - Database resources are closed consistently. - New messages are translated into English, Russian, Spanish, Italian, and French.

# AuthSecured 1.2.1 Security Update ## Security fixes - Argon2 verification now runs before account lock and temporary-password expiry responses for existing accounts. - Failed login attempts use atomic SQLite and PostgreSQL updates. - Concurrent duplicate registration is handled through database constraints. - Changing a password to the same value is rejected with a constant-time check. - Temporary passwords now use safe letters and digits only. - Redis operations run on a dedicated executor and fall back safely on timeout. ## Administration improvements - Administrators can copy temporary passwords with a left click. - Discord and Telegram have configurable channel switches and credentials in config.yml. - Older configuration files receive missing notification settings automatically. - Invalid reloads keep the previous valid configuration active. ## Reliability - Non-persistent mode clears stored sessions at startup. - Paper denies new logins if initialization fails. - Database resources are closed consistently. - New messages are translated into English, Russian, Spanish, Italian, and French.

## New administration tools - Added /authadmin status and /authadmin doctor. - Added recent audit viewing with an optional player filter. - Added tab completion and separate permissions for every admin operation. - Fixed /authadmin session settimeout. It now changes the live timeout used by newly created sessions. ## Authentication and security - Added a configurable login and registration deadline with automatic kick. - Paper hides raw password-bearing command logs before they reach the console. - Password reset now generates an expiring temporary password and revokes all sessions. - Added optional privacy-safe failed-login alerts for Discord webhooks and Telegram bots. ## Compatibility - Paper-compatible server JAR: Minecraft 1.21 through 26.2. - Fabric: exact JARs for every supported version from 1.21 through 26.2. - Existing SQLite and PostgreSQL databases are upgraded automatically.

## New administration tools - Added /authadmin status and /authadmin doctor. - Added recent audit viewing with an optional player filter. - Added tab completion and separate permissions for every admin operation. - Fixed /authadmin session settimeout. It now changes the live timeout used by newly created sessions. ## Authentication and security - Added a configurable login and registration deadline with automatic kick. - Paper hides raw password-bearing command logs before they reach the console. - Password reset now generates an expiring temporary password and revokes all sessions. - Added optional privacy-safe failed-login alerts for Discord webhooks and Telegram bots. ## Compatibility - Paper-compatible server JAR: Minecraft 1.21 through 26.2. - Fabric: exact JARs for every supported version from 1.21 through 26.2. - Existing SQLite and PostgreSQL databases are upgraded automatically.

## New administration tools - Added /authadmin status and /authadmin doctor. - Added recent audit viewing with an optional player filter. - Added tab completion and separate permissions for every admin operation. - Fixed /authadmin session settimeout. It now changes the live timeout used by newly created sessions. ## Authentication and security - Added a configurable login and registration deadline with automatic kick. - Paper hides raw password-bearing command logs before they reach the console. - Password reset now generates an expiring temporary password and revokes all sessions. - Added optional privacy-safe failed-login alerts for Discord webhooks and Telegram bots. ## Compatibility - Paper-compatible server JAR: Minecraft 1.21 through 26.2. - Fabric: exact JARs for every supported version from 1.21 through 26.2. - Existing SQLite and PostgreSQL databases are upgraded automatically.

## New administration tools - Added /authadmin status and /authadmin doctor. - Added recent audit viewing with an optional player filter. - Added tab completion and separate permissions for every admin operation. - Fixed /authadmin session settimeout. It now changes the live timeout used by newly created sessions. ## Authentication and security - Added a configurable login and registration deadline with automatic kick. - Paper hides raw password-bearing command logs before they reach the console. - Password reset now generates an expiring temporary password and revokes all sessions. - Added optional privacy-safe failed-login alerts for Discord webhooks and Telegram bots. ## Compatibility - Paper-compatible server JAR: Minecraft 1.21 through 26.2. - Fabric: exact JARs for every supported version from 1.21 through 26.2. - Existing SQLite and PostgreSQL databases are upgraded automatically.

## New administration tools - Added /authadmin status and /authadmin doctor. - Added recent audit viewing with an optional player filter. - Added tab completion and separate permissions for every admin operation. - Fixed /authadmin session settimeout. It now changes the live timeout used by newly created sessions. ## Authentication and security - Added a configurable login and registration deadline with automatic kick. - Paper hides raw password-bearing command logs before they reach the console. - Password reset now generates an expiring temporary password and revokes all sessions. - Added optional privacy-safe failed-login alerts for Discord webhooks and Telegram bots. ## Compatibility - Paper-compatible server JAR: Minecraft 1.21 through 26.2. - Fabric: exact JARs for every supported version from 1.21 through 26.2. - Existing SQLite and PostgreSQL databases are upgraded automatically.

## New administration tools - Added /authadmin status and /authadmin doctor. - Added recent audit viewing with an optional player filter. - Added tab completion and separate permissions for every admin operation. - Fixed /authadmin session settimeout. It now changes the live timeout used by newly created sessions. ## Authentication and security - Added a configurable login and registration deadline with automatic kick. - Paper hides raw password-bearing command logs before they reach the console. - Password reset now generates an expiring temporary password and revokes all sessions. - Added optional privacy-safe failed-login alerts for Discord webhooks and Telegram bots. ## Compatibility - Paper-compatible server JAR: Minecraft 1.21 through 26.2. - Fabric: exact JARs for every supported version from 1.21 through 26.2. - Existing SQLite and PostgreSQL databases are upgraded automatically.

## New administration tools - Added /authadmin status and /authadmin doctor. - Added recent audit viewing with an optional player filter. - Added tab completion and separate permissions for every admin operation. - Fixed /authadmin session settimeout. It now changes the live timeout used by newly created sessions. ## Authentication and security - Added a configurable login and registration deadline with automatic kick. - Paper hides raw password-bearing command logs before they reach the console. - Password reset now generates an expiring temporary password and revokes all sessions. - Added optional privacy-safe failed-login alerts for Discord webhooks and Telegram bots. ## Compatibility - Paper-compatible server JAR: Minecraft 1.21 through 26.2. - Fabric: exact JARs for every supported version from 1.21 through 26.2. - Existing SQLite and PostgreSQL databases are upgraded automatically.

## New administration tools - Added /authadmin status and /authadmin doctor. - Added recent audit viewing with an optional player filter. - Added tab completion and separate permissions for every admin operation. - Fixed /authadmin session settimeout. It now changes the live timeout used by newly created sessions. ## Authentication and security - Added a configurable login and registration deadline with automatic kick. - Paper hides raw password-bearing command logs before they reach the console. - Password reset now generates an expiring temporary password and revokes all sessions. - Added optional privacy-safe failed-login alerts for Discord webhooks and Telegram bots. ## Compatibility - Paper-compatible server JAR: Minecraft 1.21 through 26.2. - Fabric: exact JARs for every supported version from 1.21 through 26.2. - Existing SQLite and PostgreSQL databases are upgraded automatically.

## New administration tools - Added /authadmin status and /authadmin doctor. - Added recent audit viewing with an optional player filter. - Added tab completion and separate permissions for every admin operation. - Fixed /authadmin session settimeout. It now changes the live timeout used by newly created sessions. ## Authentication and security - Added a configurable login and registration deadline with automatic kick. - Paper hides raw password-bearing command logs before they reach the console. - Password reset now generates an expiring temporary password and revokes all sessions. - Added optional privacy-safe failed-login alerts for Discord webhooks and Telegram bots. ## Compatibility - Paper-compatible server JAR: Minecraft 1.21 through 26.2. - Fabric: exact JARs for every supported version from 1.21 through 26.2. - Existing SQLite and PostgreSQL databases are upgraded automatically.

## New administration tools - Added /authadmin status and /authadmin doctor. - Added recent audit viewing with an optional player filter. - Added tab completion and separate permissions for every admin operation. - Fixed /authadmin session settimeout. It now changes the live timeout used by newly created sessions. ## Authentication and security - Added a configurable login and registration deadline with automatic kick. - Paper hides raw password-bearing command logs before they reach the console. - Password reset now generates an expiring temporary password and revokes all sessions. - Added optional privacy-safe failed-login alerts for Discord webhooks and Telegram bots. ## Compatibility - Paper-compatible server JAR: Minecraft 1.21 through 26.2. - Fabric: exact JARs for every supported version from 1.21 through 26.2. - Existing SQLite and PostgreSQL databases are upgraded automatically.

## New administration tools - Added /authadmin status and /authadmin doctor. - Added recent audit viewing with an optional player filter. - Added tab completion and separate permissions for every admin operation. - Fixed /authadmin session settimeout. It now changes the live timeout used by newly created sessions. ## Authentication and security - Added a configurable login and registration deadline with automatic kick. - Paper hides raw password-bearing command logs before they reach the console. - Password reset now generates an expiring temporary password and revokes all sessions. - Added optional privacy-safe failed-login alerts for Discord webhooks and Telegram bots. ## Compatibility - Paper-compatible server JAR: Minecraft 1.21 through 26.2. - Fabric: exact JARs for every supported version from 1.21 through 26.2. - Existing SQLite and PostgreSQL databases are upgraded automatically.

## New administration tools - Added /authadmin status and /authadmin doctor. - Added recent audit viewing with an optional player filter. - Added tab completion and separate permissions for every admin operation. - Fixed /authadmin session settimeout. It now changes the live timeout used by newly created sessions. ## Authentication and security - Added a configurable login and registration deadline with automatic kick. - Paper hides raw password-bearing command logs before they reach the console. - Password reset now generates an expiring temporary password and revokes all sessions. - Added optional privacy-safe failed-login alerts for Discord webhooks and Telegram bots. ## Compatibility - Paper-compatible server JAR: Minecraft 1.21 through 26.2. - Fabric: exact JARs for every supported version from 1.21 through 26.2. - Existing SQLite and PostgreSQL databases are upgraded automatically.

## New administration tools - Added /authadmin status and /authadmin doctor. - Added recent audit viewing with an optional player filter. - Added tab completion and separate permissions for every admin operation. - Fixed /authadmin session settimeout. It now changes the live timeout used by newly created sessions. ## Authentication and security - Added a configurable login and registration deadline with automatic kick. - Paper hides raw password-bearing command logs before they reach the console. - Password reset now generates an expiring temporary password and revokes all sessions. - Added optional privacy-safe failed-login alerts for Discord webhooks and Telegram bots. ## Compatibility - Paper-compatible server JAR: Minecraft 1.21 through 26.2. - Fabric: exact JARs for every supported version from 1.21 through 26.2. - Existing SQLite and PostgreSQL databases are upgraded automatically.

## New administration tools - Added /authadmin status and /authadmin doctor. - Added recent audit viewing with an optional player filter. - Added tab completion and separate permissions for every admin operation. - Fixed /authadmin session settimeout. It now changes the live timeout used by newly created sessions. ## Authentication and security - Added a configurable login and registration deadline with automatic kick. - Paper hides raw password-bearing command logs before they reach the console. - Password reset now generates an expiring temporary password and revokes all sessions. - Added optional privacy-safe failed-login alerts for Discord webhooks and Telegram bots. ## Compatibility - Paper-compatible server JAR: Minecraft 1.21 through 26.2. - Fabric: exact JARs for every supported version from 1.21 through 26.2. - Existing SQLite and PostgreSQL databases are upgraded automatically.

## New administration tools - Added /authadmin status and /authadmin doctor. - Added recent audit viewing with an optional player filter. - Added tab completion and separate permissions for every admin operation. - Fixed /authadmin session settimeout. It now changes the live timeout used by newly created sessions. ## Authentication and security - Added a configurable login and registration deadline with automatic kick. - Paper hides raw password-bearing command logs before they reach the console. - Password reset now generates an expiring temporary password and revokes all sessions. - Added optional privacy-safe failed-login alerts for Discord webhooks and Telegram bots. ## Compatibility - Paper-compatible server JAR: Minecraft 1.21 through 26.2. - Fabric: exact JARs for every supported version from 1.21 through 26.2. - Existing SQLite and PostgreSQL databases are upgraded automatically.

## New administration tools - Added /authadmin status and /authadmin doctor. - Added recent audit viewing with an optional player filter. - Added tab completion and separate permissions for every admin operation. - Fixed /authadmin session settimeout. It now changes the live timeout used by newly created sessions. ## Authentication and security - Added a configurable login and registration deadline with automatic kick. - Paper hides raw password-bearing command logs before they reach the console. - Password reset now generates an expiring temporary password and revokes all sessions. - Added optional privacy-safe failed-login alerts for Discord webhooks and Telegram bots. ## Compatibility - Paper-compatible server JAR: Minecraft 1.21 through 26.2. - Fabric: exact JARs for every supported version from 1.21 through 26.2. - Existing SQLite and PostgreSQL databases are upgraded automatically.

## New administration tools - Added /authadmin status and /authadmin doctor. - Added recent audit viewing with an optional player filter. - Added tab completion and separate permissions for every admin operation. - Fixed /authadmin session settimeout. It now changes the live timeout used by newly created sessions. ## Authentication and security - Added a configurable login and registration deadline with automatic kick. - Paper hides raw password-bearing command logs before they reach the console. - Password reset now generates an expiring temporary password and revokes all sessions. - Added optional privacy-safe failed-login alerts for Discord webhooks and Telegram bots. ## Compatibility - Paper-compatible server JAR: Minecraft 1.21 through 26.2. - Fabric: exact JARs for every supported version from 1.21 through 26.2. - Existing SQLite and PostgreSQL databases are upgraded automatically.

## New administration tools - Added /authadmin status and /authadmin doctor. - Added recent audit viewing with an optional player filter. - Added tab completion and separate permissions for every admin operation. - Fixed /authadmin session settimeout. It now changes the live timeout used by newly created sessions. ## Authentication and security - Added a configurable login and registration deadline with automatic kick. - Paper hides raw password-bearing command logs before they reach the console. - Password reset now generates an expiring temporary password and revokes all sessions. - Added optional privacy-safe failed-login alerts for Discord webhooks and Telegram bots. ## Compatibility - Paper-compatible server JAR: Minecraft 1.21 through 26.2. - Fabric: exact JARs for every supported version from 1.21 through 26.2. - Existing SQLite and PostgreSQL databases are upgraded automatically.

### Added - Always-on redaction of password arguments from Fabric command diagnostics, profiler labels, and debug exception logs. - Validation bounds for security, database, Redis, rate-limit, and session numeric settings, plus PostgreSQL `ssl-mode` support. ### Fixed - Fabric now stays fail-closed when core initialization fails, blocks flight according to `restrictions.allow-flight`, and ignores stale asynchronous join callbacks after a disconnect or rapid reconnect. - Invalid YAML reloads retain the last valid configuration snapshot. ### Changed - Configuration lookups now use an immutable flattened snapshot, reducing work in high-frequency movement and packet restriction checks. - `config.yml` now documents every active option, accepted values, units, reload behavior, environment variables, and security-sensitive defaults.

## Added - Shared platform bootstrap so Paper and Fabric use identical password policy, localization, rate limiting, sessions, SQLite/PostgreSQL, and Redis behavior. - Full version-matrix build and compatibility checks. ## Fixed - Session IP verification now rejects reconnects from a different address. - Non-persistent sessions remain in memory and no longer survive restarts. - Logout revokes the active session. - `/register` validates password confirmation. - Paper listeners and commands now share one restriction-state manager. - Database integration tests are included in the standard build. - SQLite now loads correctly from the packaged Fabric and Paper JARs. ## Installation notes - Paper, Purpur, Spigot, or Leaf: use `authsecured-paper-1.1.0.jar` in `plugins/`.

## Added - Fabric support for every Minecraft release from 1.21 through 26.2. - Dedicated Fabric artifacts for each exact Minecraft version. - Fabric implementations of registration, login, password change, logout, authentication status, and administrator commands. - Pre-authentication restrictions for movement, chat, commands, inventory, interactions, block breaking/placing, combat, item pickup/drop, and hunger. - Shared platform bootstrap so Paper and Fabric use identical password policy, localization, rate limiting, sessions, SQLite/PostgreSQL, and Redis behavior. - Full version-matrix build and compatibility checks. ## Fixed - Session IP verification now rejects reconnects from a different address. - Non-persistent sessions remain in memory and no longer survive restarts. - Logout revokes the active session. - `/register` validates password confirmation. - Paper listeners and commands now share one restriction-state manager. - Database integration tests are included in the standard build. - SQLite now loads correctly from the packaged Fabric and Paper JARs. ## Installation notes - Paper, Purpur, Spigot, or Leaf: use `authsecured-paper-1.1.0.jar` in `plugins/`. - Fabric: use the `authsecured-fabric-1.1.0+mc<version>.jar` matching the server version exactly and install the matching Fabric API in `mods/`. - Minecraft 1.21.x requires Java 21; Minecraft 26.x requires Java 25 or newer. - Do not install both platform artifacts on the same server.

### Removed - Complete removal of Fabric module (`platform-fabric`), Fabric Loader dependencies, Fabric API listeners, Brigadier registrations, and Mixin configurations (architectural decision to maintain Fabric as a standalone repository). - ### Changed - Transitioned repository build system to a Paper/Purpur-focused architecture (`:core`, `:database`, `:platform-paper`). - Updated `build_and_test.sh` to compile core/database/paper modules and generate single `authsecured-paper-1.0.3.jar` artifact. - Cleaned up docstrings across core ports [AuthPlatform], [PlatformLogger], [PlayerRestrictionAdapter]

### Added - Specialized Paper, Purpur, Spigot, and Leaf high-performance Minecraft server architecture. - Multi-language localization system with 5 language bundles: English (`messages_en.yml`), Russian (`messages_ru.yml`), Spanish (`messages_es.yml`), Italian (`messages_it.yml`), and French (`messages_fr.yml`). - Chat message color customization (`&0`-`&f`, `&l`, `&o`, etc. -> `§`), customizable command usage labels, and automatic English fallback. - Fully customizable session configuration (`session.timeout-seconds`, `session.enabled`, `session.verify-ip`, `session.persistent`). - Admin session management subcommands (`/authadmin session gettimeout` and `/authadmin session settimeout <seconds>`). - Granular unauthenticated player action restrictions in `config.yml` (`freeze-player`, `allow-flight`, `block-chat`, `block-commands`, `allowed-commands`, `block-inventory`, `block-interactions`, `block-block-break`, `block-block-place`, `block-damage-taken`, `block-damage-dealt`, `block-item-drop`, `block-item-pickup`, `block-hunger`). ### Fixed - Robust exception handling across all asynchronous futures, event listeners, and administrative command handlers. - Safe password character array clearing in memory on both success and error execution paths.

### Added - Fabric Dedicated Server support (`fabric.mod.json` and `AuthSecuredFabricMod` entrypoint) for multi-platform deployment on Fabric, Paper, and Purpur servers. ### Fixed - Fixed SQL column mapping mismatch (`server_id` vs `serverId`) in `DatabaseSessionRepository`. - Fixed `RedisRateLimitStore` initialization in `DependencyContainer` to instantiate `JedisPool` when Redis is enabled, and gracefully close connection pool on shutdown. - Fixed session invalidation in `/logout` command to revoke active database sessions. - Fixed potential `NullPointerException` race condition in `MemoryRateLimitStore` and added expiration key cleanup to prevent memory leaks. - Fixed `countAccountsByIpHash` in SQLite & PostgreSQL repositories to accurately count registered accounts from `security_events` (`REGISTER_SUCCESS`). - Fixed potential `NullPointerException` when calling `player.getAddress()` across commands by adding safe IP fallback (`0.0.0.0`). - Fixed `/authadmin reload` behavior to reload YAML configurations and refresh active settings. ### Changed - Removed duplicate Groovy build files (`build.gradle`, `settings.gradle`) in favor of clean Gradle Kotlin DSL (`build.gradle.kts`, `settings.gradle.kts`). - Updated release version to `1.0.1`.

### Added - Initial release of AuthSecured plugin. - Hexagonal Architecture & Clean Separation. - Argon2id password hashing with BouncyCastle provider. - Dual database support: PostgreSQL & SQLite with Flyway migrations. - Rate limiting for per-account & per-IP abuse prevention. - Pre-auth restriction system for Paper & Purpur. - Integration test suite for SQLite and unit test suite.