ВЕРСИИ (12)

## [1.5.1] — 2026-06-03 ### Fixed - **[HIGH] Protection-plugin bypass — veinmine queued before WorldGuard/Lands/GriefPrevention could cancel the event** — `onBlockBreak` listened at `EventPriority.NORMAL`. Protection plugins (WorldGuard, Lands, GriefPrevention, Residence) typically cancel `BlockBreakEvent` at `HIGH` priority, *after* NORMAL. When a player tried to break a protected ore, the protection plugin had not yet cancelled the event when BVM ran, so `VeinmineTask` was scheduled with `runTask()`. One tick later, the task fired: the origin block was still intact (its break was cancelled), but all extra vein blocks within the protected region were broken without the player having any permission to do so. Changed to `EventPriority.HIGH` with `ignoreCancelled = true`. Protection plugins that act at `NORMAL` or `LOW` still cancel the event first; protection plugins at `HIGH` that cancel before BVM now prevent the task from being queued entirely. - **[SMALL] BFS visited-cap `break` only exited the inner faces loop, not the BFS while-loop** — When the `visited` set reached the `visitedCap` (`maxBlocks × 4`) sentinel, the `break` statement inside the `for (int[] d : FACES)` loop exited the `for` body but left the outer `while (!queue.isEmpty())` loop running. The queue continued draining, processing each already-enqueued block and attempting to expand further neighbours on every poll (immediately re-hitting the cap check each time). For a world-gen-modded server with a very large ore deposit this was a redundant tight loop running every BFS iteration until the capped queue finally drained. Replaced with a Java labeled-break (`break bfs`) that exits the outer while-loop immediately when the cap is reached. - **[COSMETIC] Stale version comment in `config.yml`** — Header comment still read `Better Veinminer v1.2.0 — Configuration` since the file was not updated during the v1.4.0 or v1.5.0 releases. Updated to `v1.5.1`. ---

## [1.5.0] — 2026-05-22 ### Fixed - **[HIGH] Daily-limit counter not persisted — restart bypass** — `dailyUsageTracker` existed only in RAM. A server restart mid-day cleared the map to zero, allowing players who had already reached their daily cap to veinmine freely after any restart or plugin reload. The map is now saved to `data.yml` via the serialised `BVM-StatsIO` executor on shutdown and on every daily reset. It is restored during `onEnable()` before the reset check, so the data is properly cleared (not silently discarded) when a day boundary is crossed while the server was offline. - **[HIGH] Blocking file I/O from async timer thread** — `saveLastResetDate()` called `YamlConfiguration.save()` directly on the `runTaskTimerAsynchronously` thread, bypassing the `BVM-StatsIO` executor that serialises every other write in the plugin. This could race with `onDisable()` flushing the same file. The method is replaced by `saveDataYmlAsync()`, which snapshots both the reset date and usage counters on the calling thread and submits the actual I/O to the existing `BVM-StatsIO` executor. - **[MEDIUM] Cooldown message with `{remaining}` placeholder never sent** — When a player triggered veinmine while still on cooldown, the listener silently returned without feedback. The config already declared a `cooldown` message key with a `{remaining}` placeholder; it was simply never used. The remaining milliseconds are now calculated and the formatted message is sent to the player's action bar, matching the UX pattern of the success message. - **[MEDIUM] Permission priority non-deterministic — VIP+Premium received random limits** — `getEffectiveCooldown()` and `getEffectiveMaxBlocks()` iterated `HashMap` whose entry order is not defined by Java. A player holding both `betterveinminer.vip` and `betterveinminer.premium` could receive either tier's limits depending on hash collisions that vary between JVM instances and restarts. The `permissionMaxBlocks` and `permissionCooldowns` maps are now `LinkedHashMap` instances whose entries are inserted during `PluginConfig.reload()` sorted by `max-blocks` descending. Iteration therefore always encounters the highest-privilege permission first. - **[MEDIUM] Daily counter incremented before veinmine task confirmed success** — `dailyUsageTracker` was incremented in `onBlockBreak()` before `VeinmineTask` ran. If the `BetterVeinmineEvent` was cancelled by another plugin, or all extra blocks were denied by protection plugins (`extraCount == 0`), the player lost one daily use without breaking anything. The increment is now deferred to inside `VeinmineTask.run()`, executed only after `extraCount > 0` is confirmed. - **[MEDIUM] Cooldown cleanup evicted active entries for long per-ore cooldowns** — The cleanup timer removed `cooldowns` entries older than `config.getCooldownMs()` (default 200 ms). If a per-ore cooldown (e.g. `EMERALD_ORE: 1500`) or a permission cooldown was longer than the base, an entry could be evicted while still within its own active window. The player's next break would find `null` in the map and bypass the cooldown. The timer now calls `config.getMaxConfiguredCooldown()`, which returns the maximum of the base, all per-ore, and all permission cooldown values. - **[SMALL] `breakNaturally(tool)` used stale 1-tick-old tool snapshot** — `VeinmineTask` captured the held `ItemStack` at `BlockBreakEvent` time and used it for every `breakNaturally()` call one tick later. If a player legitimately swapped to a higher-Fortune pickaxe during that tick, all drops were calculated with the old tool's enchantments. The task now reads the item currently in the recorded slot at break time and falls back to the snapshot only if the slot is empty. - **[SMALL] `instance` static field not cleared on disable** — `onDisable()` did not set `instance = null`. If a third-party plugin cached the return value of `BetterVeinminer.getInstance()` and called it after the plugin was disabled (e.g. during `/reload`), it received a fully torn-down instance whose `statsManager` and `config` fields had already been discarded, potentially causing NPEs. `instance` is now set to `null` as the last action in `onDisable()`. - **[SMALL] BFS `visited` set unbounded on abnormally large ore clusters** — The BFS loop stopped adding to `toBreak` at `maxBlocks`, but continued enqueuing and visiting neighbours until the queue drained. On a world-gen-modded server with a massive ore deposit, `visited` could accumulate tens of thousands of entries in a single tick. A hard cap of `maxBlocks × 4` entries is now enforced on the `visited` set; the loop breaks immediately when the cap is reached. ### Changed - `BetterVeinminer.onDisable()` now flushes `data.yml` (daily usage + reset date) via `saveDataYmlAsync()` before calling `statsManager.shutdown()`, ensuring all data is written to the serialised executor queue before the 5-second drain begins. - `StatsManager.getIoExecutor()` added to expose the single-threaded executor to other components within the plugin. - `PluginConfig.getMaxConfiguredCooldown()` added to return the longest cooldown value across all configuration sources. - `BetterVeinminer.getDailyUsageTracker()` added to allow `VeinmineTask` (inner class) to increment the map after confirmed success, without requiring a public field. ---

## [1.4.0] — 2026-05-14 ### Fixed - **[CRITICAL] Async save race condition** — `StatsManager.saveAll()` was scheduled as an async task and read `PlayerStats` fields directly while the main thread was still writing to them. A player could lose stats or receive a corrupted save file depending on thread timing. The auto-save timer now runs on the **main thread** to take a point-in-time snapshot via the new `PlayerStats.copy()`, then hands each snapshot to a single-threaded `ExecutorService` for file I/O. The snapshot is fully consistent; the I/O thread never sees a half-written state. - **[CRITICAL] Concurrent YAML write corruption** — The async auto-save timer and the `onQuit` async save could both be writing the same player's file simultaneously, producing a truncated or structurally invalid YAML file. All disk writes are now submitted to a single-threaded `ExecutorService` (`BVM-StatsIO`). Only one write per file can be in progress at any time. `StatsManager.shutdown()` called from `onDisable()` blocks up to 5 seconds to guarantee all pending writes complete before the plugin unloads. - **[CRITICAL] Daily reset based on server uptime, not real calendar date** — The reset used `24 * 60 * 60 * 20L` ticks (24 hours of server uptime). TPS lag caused the timer to drift, and a server restart before 24 hours elapsed reset the timer entirely, effectively disabling the daily limit. Replaced with a `LocalDate.now()` comparison: the last reset date is persisted to `plugins/BetterVeinminer/data.yml` and checked on startup (to catch any resets missed while the server was offline) and every 2 minutes (to detect midnight without requiring an exact timer). - **[HIGH] Cooldown cleanup removed entries too aggressively** — The cleanup task that evicts stale entries from the `cooldowns` map used a hardcoded 60-second cutoff (`System.currentTimeMillis() - 60_000L`). If the configured cooldown exceeded 60 seconds, player entries were evicted while the cooldown was still active. On the next vein break the lookup returned `null` and the cooldown was silently bypassed. The cutoff now uses `config.getCooldownMs()`. - **[HIGH] Protection plugin bypass** — Extra blocks in the vein were broken with `block.breakNaturally(tool)` without first firing a `BlockBreakEvent`. WorldGuard, GriefPrevention, Lands, and Residence listen to `BlockBreakEvent` to enforce region protection; because no event was fired, blocks in protected regions could be destroyed. A `BlockBreakEvent` is now fired for each extra block before it is broken; if any listener cancels the event, that block is skipped. - **[HIGH] Missing anti-recursion guard** — The protection-plugin fix above fires `BlockBreakEvent` programmatically, which caused the plugin's own `onBlockBreak` listener to trigger again for each block, scheduling a new `VeinmineTask` per block and creating an infinite chain. A `miningPlayers` `Set<UUID>` marks any player whose veinmine session is currently active; `onBlockBreak` returns immediately if the player's UUID is already present. The set is always cleared in a `finally` block to ensure a player can never be permanently locked out. - **[MEDIUM] 26-direction BFS linked separate nearby veins** — The BFS scanned all 26 neighbours (3×3×3 cube), allowing diagonal connections to bridge two distinct ore veins that happened to be close together. Vanilla Minecraft generates ores using face-adjacent placement only, so diagonal connections are always false positives. Changed to **6-direction** (face-adjacent) BFS. This also reduces the maximum queue size by up to 4×, improving TPS on large veins. - **[MEDIUM] Unbreaking durability formula was deterministic, not vanilla-accurate** — The old `calcDamage()` computed `Math.round(hits × multiplier × 1/(unbreaking+1))` and clamped to a minimum of 1. Vanilla Minecraft independently rolls each hit: each has a `1/(unbreaking+1)` chance to actually apply damage. The clamped average could never produce 0 damage even with high Unbreaking levels and few hits. `calcDamage()` now performs a per-hit Bernoulli trial using `Math.random()`, matching vanilla behaviour including the possibility of 0 damage. - **[MEDIUM] `PlayerStats` exposed public mutable fields** — All four fields (`blocksMined`, `totalOresCollected`, `currentTier`, `veinminesUsed`) were `public`, allowing any code to set them to negative or overflowed values without validation. All fields are now `private`. Setters clamp values to valid ranges (e.g. tier ≥ 1, counts ≥ 0). The new `copy()` method supports safe async snapshotting. - **[MEDIUM] Config accepted invalid numeric values** — Values such as `max-blocks: -1` or `damage-multiplier: -100` were loaded without validation, producing undefined behaviour (negative BFS limit, inverted durability, server lag). All numeric fields are now clamped on load: `max-blocks` → `[1, 1000]`, `cooldown-ms` → `[0, 300000]`, `damage-multiplier` → `[0.1, 10.0]`, `limit-per-day` → `[1, 100000]`, `base-exp` → `[0, 10000]`. ### Clarified (not a bug) - **Tool swap exploit (audit report #7)** — The report described a tool-swap exploit where a player could switch items during the 1-tick task delay to bypass restrictions. This was already fixed in **v1.2.1**: `VeinmineTask` records the inventory slot and tool snapshot at event time, then re-validates with `isSimilar()` before applying durability. No change needed. ### Changed - Auto-save timer switched from `runTaskTimerAsynchronously` to `runTaskTimer` (main thread) so snapshot collection is always synchronised with game state. The actual file I/O is still off the main thread via the `BVM-StatsIO` executor. - `onDisable()` now calls `statsManager.shutdown()` (blocking flush with 5 s timeout) instead of `saveAll()` directly, guaranteeing all pending I/O completes before the plugin unloads. ---

## [1.3.0] — 2026-04-25 ### Added - **`BetterVeinmineEvent`** — Custom cancellable Bukkit event fired just before extra blocks are broken. Other plugins can now: - Cancel the entire veinmine via `event.setCancelled(true)` - Inspect the block list via `event.getBlocks()` (unmodifiable) - Override the EXP reward via `event.setExpReward(int)` - Read the ore type via `event.getOreType()` - **`StatsManager`** — Full YAML persistence for `PlayerStats`. Stats are now saved to `plugins/BetterVeinminer/stats/<uuid>.yml` and survive server restarts. - Stats load synchronously on `PlayerJoinEvent` (file is tiny, no noticeable delay) - Stats save asynchronously on `PlayerQuitEvent` - Auto-save every 5 minutes (async) while the server is running - Final synchronous flush in `onDisable()` to guarantee no data loss on shutdown ### Fixed - **NullPointerException on missing config sections** — `PluginConfig.reload()` called `.getKeys(false)` directly on the return value of `getConfigurationSection(...)`, which returns `null` when the section is absent from `config.yml`. This caused an NPE crash on any server where `ore-multipliers.multipliers`, `per-ore-cooldowns.cooldowns`, or `permission-levels` were omitted or empty. All three sites now null-check the section before iterating. - **Player-offline NPE in `VeinmineTask`** — The task is scheduled 1 tick after the `BlockBreakEvent`. If the player disconnects in that window (network drop, kick, crash), every subsequent field access on the `Player` object threw a `NullPointerException`. Added an early `if (!player.isOnline()) return;` guard at the top of `run()`. - **`{uses}` placeholder never replaced in `/bvm stats`** — `showStats()` built the message with `{blocks}` and `{tier}` substitutions but forgot `{uses}`, so the literal string `{uses}` was printed to the player. - **`{blocks}` placeholder never replaced in tier-up message** — The tier-up message template `"You reached Tier {tier}! New max blocks: {blocks}"` only had `{tier}` replaced; `{blocks}` was left as-is in the output. - **`sendActionBar(String)` deprecated in Paper 1.21** — Replaced with the Adventure API: `player.sendActionBar(LegacyComponentSerializer.legacySection().deserialize(msg))`. This eliminates the deprecation warning in server logs and future-proofs the call. - **Scheduler tasks not cancelled on disable** — `onDisable()` cleared data maps but never called `Bukkit.getScheduler().cancelTasks(this)`. The cooldown-cleanup and daily-reset runnables could fire after the plugin was disabled (e.g. during `/reload`), accessing a partially torn-down plugin instance. `cancelTasks(this)` is now the first action in `onDisable()`, before any data is flushed or cleared. ### Changed - `onDisable()` now cancels all plugin tasks **before** flushing data, then calls `statsManager.saveAll()` as a final synchronous write to guarantee persistence. - `VeinmineTask` now collects extra blocks into a `List<Block>` (instead of iterating `Set<Block>` with an origin equality check) to pass cleanly to `BetterVeinmineEvent`. - EXP calculation is now performed **before** the event is fired so listeners can read and override the reward via `event.setExpReward(int)`. ---

fix bug

## [1.2.1] — 2026-03-16 ### Fixed - **Critical Item Swap Bug** — Fixed a bug where switching items during a veinmine task (0.05s delay) could overwrite a new item in the player's hand with the old tool, potentially causing item loss. The task now tracks the specific inventory slot and verifies the tool's identity before applying durability changes. - **UX Improvement** — Success messages are now sent to the **Action Bar** instead of the chat to prevent spamming the chat history for active miners.

## [1.2.0] — 2026-03-14 ### Added - **Tier System** — Players automatically progress through 4 tiers as they mine more blocks: - Tier 1: 32 max blocks (0 blocks mined) - Tier 2: 64 max blocks (100k blocks mined) - Tier 3: 128 max blocks (500k blocks mined) - Tier 4: 256 max blocks (1M blocks mined) - **Player Statistics** — Track blocks mined, veinmines used, and current tier - **New Commands**: `/bvm stats` and `/bvm tier` for player progression tracking - **Ore Multipliers** — Configure different drop multipliers for different ore types (e.g., diamonds worth 1.5x) - **Per-Ore Cooldowns** — Optional: Set different cooldown times per ore type - **Permission-based Limits** — VIP (`betterveinminer.vip`) and Premium (`betterveinminer.premium`) tiers - **Daily Limits** — Optional: Prevent abuse by limiting veinmines per player per day - **Advanced Effect Settings** — Customizable particle types, colors, speeds, and sounds - **Custom Messages** — Fully customizable player notifications with placeholders - **EXP Rewards** — Optional custom experience points for veinmining - **PlayerStats.java** — New data class for tracking individual player progress ### Changed - **Version** bumped to 1.2.0 with major feature expansion - **pom.xml** — Fixed XML syntax errors (typo: `<n>` → `<n>`) - **PluginConfig.java** — Expanded from ~90 lines to ~300+ lines with comprehensive settings - **BetterVeinminer.java** — Refactored to support tier system, stats, permissions, and daily limits - **config.yml** — Completely rewritten with organized sections for each feature - **plugin.yml** — Added 3 new commands and 2 new permission levels ### Improved - Much better tier progression system that rewards dedicated miners - More granular permission-based control for VIP/Premium players - Enhanced logging and player feedback with customizable messages - Better code organization with dedicated helper methods ---

fixed

## [1.1.1] — 2025-03-10 ### Fixed - **Plugin was completely non-functional.** The BFS task read `block.getType()` one tick after the block-break event fired — at that point the block is already `AIR`, so the search found nothing and no extra ores were mined. The block `Material` is now captured inside the event handler (while the block still exists) and passed to the task. - Tool durability changes were silently discarded because the modified `ItemStack` was never written back to the player's hand. Added `setItemInMainHand(tool)` after updating the item meta. - `Enchantment.UNBREAKING` resolved via `Enchantment.getByKey(NamespacedKey)` with a `try-catch` fallback, fixing compatibility across all Paper 1.21.x patch builds. - Removed unused `outer:` loop label left over from a refactor. - Event priority reverted to `NORMAL` (was incorrectly `HIGH`) so protection-plugin cancellations at `NORMAL` priority are still respected. ---

# Changelog — Better Veinminer All notable changes to this project will be documented in this file. --- ## [1.1.0] — 2025-03-10 ### Added - **Per-player toggle** (`/bvm toggle`) — each player can enable/disable veinminer independently - **Tab completion** for `/bvm` already existed for `reload`; extended to include `toggle` - **README.md** with full installation guide, permissions table, and usage notes - **CHANGELOG.md** (this file) ### Fixed - BFS `visited` set and `toBreak` set now pre-sized to `maxBlocks * 2` / `maxBlocks * 4` to reduce HashMap rehashing on large veins - Switched inner `Queue` from `LinkedList` to `ArrayDeque` for better BFS performance - `disabledPlayers` set cleared in `onDisable()` to release player references on shutdown ### Changed - **Fortune & Silk Touch** explicitly documented in config comments and README — both work automatically via `breakNaturally(tool)`, no extra code needed - **Deepslate behaviour** explicitly documented — `IRON_ORE` vs `DEEPSLATE_IRON_ORE` are intentionally separate; both listed in `ore-types` - Version bump: `1.0.0` → `1.1.0` --- ## [1.0.0] — (initial release) - BFS veinminer with 26-direction scanning - Strict same-type matching - Configurable max-blocks, cooldown, tool whitelist - Unbreaking enchantment support - Particle and sound effects - World whitelist/blacklist - `/bvm reload` command with tab completion

# First Version