ВЕРСИИ (3)

**BackyardBan 1.1.1** Security fix: replaced BungeeCord's unsafe YAML config loader (vulnerable to RCE via SnakeYAML, CVE-2022-1471) with a safe SnakeYAML-based implementation. No user-facing changes.

**Velocity support**\ BackyardBan now runs natively on both BungeeCord and Velocity.\ Same jar, same commands, same config.\ ### 🐛 Fixed - `/backyardban unban` (and `/backyardban pardon`) no longer suggests `ban` in tab-completion — it now correctly suggests `unban`. - Self-ban and self-unban protections (`/ban`, `/banip`, `/unban`) now actually trigger. They previously compared UUIDs and IP addresses by reference (`==`) instead of by value, so the check silently never fired. - Malformed or excessively large ban durations (e.g. a typo'd unit, or `t:100y` overflowing) are now rejected with a usage message instead of silently becoming a **permanent** ban. - **Banned players could still connect to the network.** The login handler was disconnecting the incoming connection without cancelling the proxy's own login event, so the proxy carried on connecting them to a backend server anyway. Login is now correctly denied, and the check runs at the highest listener priority so no other plugin (e.g. an auth plugin) can flip the decision afterward. - Online players are now reliably kicked the instant they're banned — a fragile null-check in the kick path could previously skip it silently. - `/ban` and `/banip` now consistently match players by username rather than display name, avoiding mismatches for nicknamed players. ### 🔧 Internal - Extracted a platform-agnostic core (config/locale loading and migration, ban-duration parsing, message formatting, ban-record storage) shared verbatim between the BungeeCord and Velocity implementations, so a fix on one platform can't quietly go missing on the other.