ВЕРСИИ (13)

# Connection Guard 0.6.1 ## Changes - Reduce broad Blackbox blocks: a positive Blackbox answer requires fresh local Intel HOSTING evidence by default; otherwise the normal failover chain continues. Optional signed Intel PROXY data can block locally, without sending player IPs to Intel. - New installations use local Tor/Intel → zowi → confirmed Blackbox → IPQuery. ProxyCheck defaults off and remains an optional late fallback; ip-check.net and IP-API default off. Existing provider choices, order, keys and ENFORCE/OBSERVE mode are retained. zowi remains capped locally at60/minute; quotas/timeouts fall through to the remaining selected services. - Manage partial/empty provider order, sequential/parallel strategy, 1–16 external attempts and IPQuery/IPQualityScore through the existing dashboard after the plugin snapshot. Changes apply without restart, preserve config.yml and reject an invalid update in full. Local sources always precede APIs and IP-API stays last. - Add reviewed migrations from FoxGate, ProxyShield, VPNGuard, KauriVPN and AdvancedAntiVPN. Preview and explicitly stage compatible settings/admin rules for restart; retain CG safeguards and skip competitor verdict caches and foreign commands. - Use a bounded Memory tier before SQLite/coherent Redis, batched SQLite writes and asynchronous optional Velocity cache initialization. Keep fact age, namespace and invalidation fences. Redis without tracking retains remote reads; clean shutdown flushes accepted writes. - Custom TEXT webhooks can choose player name, UUID, VPN status, IP, country/city/location/ISP and UTC time. Privacy controls and unknown values remain; no extra Geo lookup is made. - Add explicit local policy capture/replay, off by default and bounded/private, with no Cloud sync of recorded samples. Add LOCAL_ONLY and shared daily API-budget controls plus read-only profile overlays and visible quota diagnostics. ## Upgrade and privacy Back up config.yml and data, replace the main JAR, and restart. Existing selections are retained; the new recommended provider order is not silently migrated. Review `/cg doctor`, `/cg providers` and `/cg cloud settings`. New installations use ENFORCE: recognized VPN/proxy/Tor evidence can be denied immediately; select OBSERVE explicitly for evaluation. The enabled API services receive the queried player IP. zowi is operated by FoxGate's developer; Blackbox has no written terms; ip-check.net publishes no operator, terms or privacy policy and remains opt-in. IP-API's free service is non-commercial, HTTP-only and opt-in. Consult [provider recipients and controls](https://github.com/gerolndnr/connection-guard/blob/0.6.1/docs/PROVIDERS.md). Cloud remains optional and on by default: `cloud.enabled: false`, `/cg cloud disable` or `CONNECTIONGUARD_CLOUD=false` turns it off. Bounded error reports can be disabled separately with `cloud.error-reports: false`. [Plugin privacy and data controls](https://connectionguard.net/privacy#plugin). ## Verification and limits The full independent competitive benchmark of this exact combined artifact is still pending. No improved detection rate, false-positive rate, latency or market-leadership claim is made. Quota exhaustion can change which sources decide; source replay and older benchmarks do not qualify this new artifact. Exact release-CI, reproducible archives and the named runtime checks are recorded with the release; start/help/reload/stop checks do not imply full qualification of every listed platform/version or real-account flow. The main plugin is0.6.1. Optional LibertyBans/Limbo addons retain their own0.1.0-dev versions and are separate downloads. Download and docs: https://connectionguard.net/download

Connection Guard 0.6.0 adds sequential provider failover, signed local intelligence and operator controls for Paper/Spigot, BungeeCord/Waterfall and Velocity. **Release 0.6.0.** The maintainer approved publication of this exact artifact on all plugin platforms. The full 692-address competitive benchmark of this exact artifact is still pending; no comparative detection, false-positive or burst-coverage result is claimed. - **New installations start in ENFORCE:** flagged VPN/proxy/Tor connections can be denied immediately. Blackbox's positive aggregate listing also includes hosting/cloud addresses. Hosting-only ProxyCheck/zowi facts stay review evidence. Select `operation.mode: OBSERVE` explicitly if you want to inspect before acting. Geo lookups start Disabled. Existing installations retain their chosen mode. - **Sequential VPN failover is the default,** including existing files without a strategy choice. Local Tor, then fresh signed Connection Guard Intel, precede network lookups. The new-install network order is **ProxyCheck → Blackbox → zowi → IPQuery → IP-API**. ip-check.net is disabled by default; explicit opt-in places it between Blackbox and zowi. Each reached service receives the player's IP. A concrete positive or negative ends the chain; failures, exhausted quotas, open circuits and indeterminate answers move to the next available source. Errors can therefore disclose one IP to multiple recipients. The whole-login budget remains 5,000 ms. Set `provider.vpn-failover.enabled: false` to restore parallel voting with your retained providers and threshold. - **Additional player-IP recipients:** Blackbox (`blackbox.ipinfo.app`, Cameron Munroe / ipinfo.app), zowi (`api.zowi.gay`, operated by the developer of competitor FoxGate), IPQuery (`api.ipquery.io`), and ip-check.net only if explicitly enabled. Blackbox has no published written terms and its listing can include hosting/cloud. ip-check.net publishes neither an operator, terms nor a privacy policy. Set `provider.vpn.blackbox.enabled`, `.zowi.enabled`, `.ipquery.enabled` or `.ipcheck.enabled` to `false` to exclude the respective service. Operators must review the services and include selected recipients in their own player privacy information. Existing installations are not silently opted into these services and get a one-time notice. IP-API remains the final option; its free HTTP endpoint has a non-commercial-use restriction. - **Connection Guard Intel** is enabled on new installations; existing installations must opt in and receive a one-time recommendation. Daily background downloads from `intel.connectionguard.net` send **no player IP, name or UUID**. The pinned signing key and SHA-256 verification protect atomic list activation. VPN/Tor entries block, hosting-only enriches review, relay entries follow `provider.local.connectionguard-intel.relay: ALLOW|VPN`. Disable with `.enabled: false`. Missing or stale lists yield UNKNOWN without waiting on a login. - **ProxyCheck uses its supported v2 endpoint with `vpn=1`**, with no hard-coded VPN brand list. VPN and ProxyCheck geo share the same response and local request count. Local Tor remains available during API failures. - **Provider health is visible:** warnings and `/cg doctor`/Cloud status report exhausted budgets and circuits. Allowed UNKNOWN VPN logins have a cumulative reason counter and a periodic five-minute summary. First transport timeouts open the individual circuit; new default HTTP calls are bounded to 1,500 ms and explicit configured timeouts remain unchanged. Multiple previously untested hanging sources can still consume the 5,000 ms ceiling; no universal two-second outage promise is made. - **Redis can start with a bounded Memory fallback** and reconnect in the background. Invalid configuration reloads keep the last active settings. Coalescing continues to share ongoing lookups for one canonical IP. - **Policy tools:** atomic version activation and rollback, synthetic replay and bounded shadow comparison. Shadow/replay do not activate a policy or send new lookups. - **Cloud setup is prominent** in a colored console block and an authorized staff/operator join hint shown once per installation when unlinked. `/cg cloud sync` requests an immediate background settings sync with a shared ten-second cooldown and a result/version reply; regular sync continues. - **Anonymous error reports are enabled with Cloud**, including existing files without the option. Only bounded exception types and Connection Guard stack metadata are included; exception messages, player data and credentials are excluded. Disable with `cloud.error-reports: false` or any Cloud off switch. [Error-report disclosure](https://connectionguard.net/privacy#error-reports). **Upgrade:** back up the plugin data directory, stop the server/proxy, replace the main JAR with `connection-guard-0.6.0-all.jar`, keep only one main JAR and restart. Do not replace an existing configuration with the new-install template. Migration retains existing mode, provider selections/order, keys and explicit lookup/circuit limits; newly available recipients and Intel require opt-in. Missing strategy defaults to failover, and missing `cloud.error-reports` defaults on while Cloud is on. Inspect `/cg doctor` and the one-time notices. To roll back, stop and restore both the backed-up JAR and data directory. **Cloud is optional and on by default.** Disable it with `cloud.enabled: false`, `/cg cloud disable` or `CONNECTIONGUARD_CLOUD=false`. Detection-provider controls are separate. [Plugin privacy disclosure](https://connectionguard.net/privacy#plugin). **Qualification:** 863 regression tests passed in the exact release-commit [Build CI](https://github.com/gerolndnr/connection-guard/actions/runs/37538644878). The main JAR and both optional addons are reproducible and match the previously qualified candidate byte for byte. Controlled actual-JAR core and HTTP/Intel/Cloud-command checks passed. Start/help/reload/shutdown checks passed with this main JAR on Paper 26.3 build 159, Folia 26.2 build 7, Velocity 4.2.0 build 30 and 4.2.1-SNAPSHOT build 39 (Java 25), plus Paper 1.21.11 build 132 and Velocity 3.4.0 build 566 (Java 21). These are named runtime smoke checks, not qualification of every supported Minecraft/Java combination or real-account login. Version metadata was checked through Minecraft 26.3 and Velocity 4.2.1; 4.2.1-SNAPSHOT is a development runtime. **Known limits:** several previously untested hanging providers can take about 4.52 s in controlled component tests, up to the configured 5,000 ms whole-login ceiling. The maintainer accepted this measured boundary; a universal first-outage latency below two seconds is not claimed. The full 692-address, keyed, three-round, all-platform benchmark must be bound to the final source/JAR hash before results or comparative claims are published. [Qualification plan and pre-publication evidence](https://github.com/gerolndnr/connection-guard/blob/180cebe4afd631c44d61844d6f5c6daf6c6fe941/docs/RELEASE_0_6_0.md). **Artifacts:** use `connection-guard-0.6.0-all.jar` as the main plugin. The LibertyBans and Limbo JARs are separate optional addons and retain their own `0.1.0-dev` module version. `SHA256SUMS` covers all three downloads. Main JAR SHA-256: `8ba9534abde294eeb830aed848c5014e03409213aed514719abb6c63d6e9b2c2`. Download and docs: https://connectionguard.net/download

Connection Guard 0.5.1 is a maintenance release for Paper/Spigot, BungeeCord/Waterfall and Velocity. - Fix Velocity bStats initialization with the verified project ID **22913**. The injected factory is bundled in the JAR, the Metrics instance stops on shutdown, and statistics failures leave connection checks active. The global bStats opt-out is respected. - Make clean optional-addon builds independent of the unavailable upstream Maven path by pinning the unchanged, hash-verified MIT LimboAPI 1.1.26 compilation archive. The API is excluded from runtime JARs. - Add canonical website links and update README branding. - Add a reproducible developer benchmark suite with actual-JAR policy, provider-failure and recovery gates in CI. It is a development tool, not a new detection algorithm or a claim of measured performance superiority. - Synchronize asynchronous webhook test fixtures with their worker before assertions; production webhook behavior is unchanged. **Upgrade:** stop the server/proxy, replace the main JAR with `connection-guard-0.5.1-all.jar` and restart. Keep only one main JAR. Existing configuration and the Cloud protocol/defaults are unchanged. **Cloud is optional and on by default.** Disable it with `cloud.enabled: false`, `/cg cloud disable` or `CONNECTIONGUARD_CLOUD=false`. [Plugin privacy disclosure](https://connectionguard.net/privacy#plugin). Qualification: 431 regression tests including loopback Redis, reproducible main/addon archives, packaging/version-history guards and artifact-bound benchmark checks. The final JAR is checked for startup/help/reload/shutdown on Paper 1.21.11-132, Velocity 3.4.0-566, Paper 26.3-151, Folia 26.2-7, Velocity 4.2.0-30 and 4.2.1-SNAPSHOT-36. Current Paper/Folia builds are beta builds; Velocity 4.2.1 is a development snapshot. The actual Velocity bStats factory, service ID and collectors are verified with telemetry disabled; live bStats ingestion is not established. [Exact qualification scope and limits](https://github.com/gerolndnr/connection-guard/blob/0.5.1/docs/RELEASE_0_5_1.md). Compatibility metadata includes stable Minecraft releases through **26.3** and Hangar Velocity entries through **4.2.1**. These selected checks do not prove every intermediate version or authenticated account/login scenario. Download and docs: https://connectionguard.net/download

## 0.5.0 — 2026-10-04 ### Rules, providers and reliability - New scoped allow/deny/exempt rules for IPv4/IPv6, CIDR and trusted UUIDs, with persistent time limits. Explicit DENY retains priority over ALLOW; an expired rule never grants access. - Source-specific country, ASN, ISP/operator, classification, risk and confidence selectors; explain output keeps missing and conflicting evidence separate. - Attributed local address lists and optional Geo/ASN MMDB sources with bounded imports and freshness checks. - Optional native IPQualityScore (off by default), ProxyCheck v2/v3 selection and exact decimal risk in local decisions, caches and API observations. - Whole-login deadlines, bounded transport/cache queues, shared lookups, circuit pauses and local provider request budgets. UNKNOWN is explicit and follows the scoped OPEN/OBSERVE/CLOSED policy. - Optional login admission/cooldown limits; SQLite/Redis namespaced rich-fact storage and Redis TLS selection. - Validated whole-draft reloads preserve active settings on rejection, account for native permissions/current connection identity and run Bukkit/Folia work on the correct platform scheduler. - Versioned provider, observer and read-only admission APIs. Separate optional LibertyBans and native challenge adapters retain their explicit selection, licensing and documented test limits. - German and Spanish messages alongside English; custom files remain intact. Rich decision webhooks use actual completed facts, bounded delivery, mention suppression and private defaults. - Bundle and relocate Gson and the bStats runtime; keep the 0.4.11 hotfix in actual source history. All platform versions derive from the same build value. ### Optional Cloud dashboard - Free dashboard at https://app.connectionguard.net for decisions, provider health, quotas, network rules and supported configuration. - **Cloud is on by default.** Until linked, it sends anonymous installation/platform information, health and aggregate counters; no player IPs or UUIDs. After linking and accepting processing terms, it sends individual decisions with IPs and trusted UUIDs. [Full privacy disclosure](https://connectionguard.net/privacy#plugin) and [plugin controls](https://github.com/gerolndnr/connection-guard/blob/master/docs/CLOUD.md). - Turn it off with `cloud.enabled: false`, `/cg cloud disable` (persistent) or `CONNECTIONGUARD_CLOUD=false`. Logins never wait on Cloud; bounded background sync handles outages. - Remote settings are validated atomically and layered over local config without rewriting `config.yml`. Rejected drafts keep the old configuration. Remote console-command execution is unavailable. - Time-limited dashboard rules report `rule_expiry`, preserve absolute deadlines locally and stop matching offline. Already-expired commands are acknowledged without creating a rule. - Advanced IPQualityScore/rich-webhook settings remain local; protocol v1 uses the legacy integer risk display. Exact local policy risk remains unchanged. ### Upgrade and rollback Back up the plugin directory and stop the server/proxy. Replace the old JAR with `connection-guard-0.5.0-all.jar`; keep only one main JAR. Restart and inspect `/cg doctor` and `/cg cloud status`. **New installs start in OBSERVE with an empty country blocklist.** Existing files without `operation.mode` retain ENFORCE. Existing translations, provider keys and actions are preserved. Compare new options with the bundled template; do not replace your config blindly. Native IPQualityScore, local data and optional integrations are disabled until selected. New rich-fact cache namespaces intentionally do not reuse older Boolean-only entries; expect provider lookups while the new cache warms. Provider budgets are process-local estimates, not account-wide remaining quota. Review provider terms before use. To roll back, stop the server/proxy, restore the backed-up 0.4.11 plugin directory and its JAR, and restart. 0.4.11 does not understand Cloud, managed access rules or the new native integrations; restore its configuration and remove optional 0.5 addons. Disable Cloud before downgrade if desired. ### Qualification Reproducible builds, structured regression reports, package/version-history gates and selected native runtime tests qualify the exact release artifact. [Final release scope](https://github.com/gerolndnr/connection-guard/blob/master/docs/RELEASE_0_5_0.md) records the tests and limits. Synthetic login fixtures do not prove authenticated Java/Bedrock account support, every Minecraft version, provider accuracy or production pilot outcomes. Verified identity-bound challenge grants, complete replay/shadow/rollback and persistent account-wide API budgets are future work; this release does not claim those full differentiation contracts. ### Current compatibility — checked 4 October 2026 Compatibility lists include Minecraft Java releases from 1.8 through **26.3**, including every 1.21 patch and the 26.1/26.2 releases. Velocity metadata starts at the required 3.3 API and extends through **4.2.1** (current development snapshot); latest stable is **4.2.0**. Waterfall has no upstream platform releases beyond 1.21, so its own platform list ends there. Minecraft snapshots are excluded from the release compatibility list. The same release JAR passed selected clean startup, commands, reload and shutdown checks on Paper 26.3 build 151, Folia 26.2 build 7, Velocity 4.2.0 build 30 and Velocity 4.2.1-SNAPSHOT build 36 / Java 25, in addition to the detailed earlier native login/Cloud checks on the named 1.21.11/proxy builds. Paper/Folia current builds are upstream BETA builds; a passing smoke check does not turn them into stable upstream releases or prove every historical patch. Separate optional LibertyBans and Limbo challenge JARs are development previews (0.1.0-dev), with their own licenses and integration requirements; install them only when deliberately selecting the documented integration. Download and docs: https://connectionguard.net/download

# Connection Guard 0.4.11 — urgent bStats hotfix Fixes a missing bStats runtime dependency (`MetricsBase`) that could prevent Connection Guard from enabling on Bukkit/Paper and BungeeCord. bStats Base 3.0.2 is now bundled and relocated inside the plugin; the build checks that the required classes are present. This hotfix is based on published 0.4.10. Existing configuration, translations and connection-check behavior are retained. **Upgrade:** Stop the server/proxy, replace the old JAR with `connection-guard-0.4.11-all.jar`, and restart. Keep only one Connection Guard JAR installed. Validation: 48 regression tests, combined JAR/descriptor/bytecode verification, repeatable-build CI, and a real isolated Paper 1.21.11 build 132 / Java 21 startup, plugin activation, configuration reload, synthetic offline backend join and clean shutdown. These controlled tests add no new platform or real-world detection-accuracy claim.

Maintenance release for Spigot, BungeeCord and Velocity. ### Fixes - Wait for cache initialization before registering connection checks and commands. A failed or stalled cache setup stops plugin initialization with a bounded timeout. - Retry VPN detection after incomplete provider responses instead of caching an unreliable negative verdict. Healthy provider votes still count towards the configured threshold. - Bundle and isolate OkHttp, Okio and Kotlin dependencies so HTTP detection does not depend on libraries supplied by another plugin. - Reuse a bounded HTTP client, close responses, reject unsuccessful HTTP responses and malformed/missing detection fields, and keep provider URLs, API keys and response messages out of failure logs. - Use HTTPS for ProxyCheck and IPHub requests. The free IP-API endpoint remains HTTP. - Cache successful geo lookups and treat failed geo lookups as unavailable so later queries can retry. IP-API error responses no longer require location fields. - Read both custom-provider nested fields using the documented `#` separator, preserve colons in header values and substitute `%IP%` in headers. - Substitute message placeholders literally, including ISP names containing dollar signs or backslashes. - Restore reproducible builds, verify all three plugin descriptors and runtime HTTP dependencies, and run regression tests in CI. - Preserve Velocity's pre-login authentication mode when Connection Guard allows a connection. ### Upgrade Stop the server/proxy, replace the existing Connection Guard JAR with `connection-guard-0.4.10-all.jar`, and restart. Existing configuration and translations are retained. Provider and cache changes require a restart; `/cg reload` reloads configuration and messages. Older versions may have cached negative VPN verdicts during a provider outage. After upgrading, use `/cg clear <IP>` for affected addresses or `/cg clear` to clear the whole cache (permission: `connectionguard.command.clear`). Clearing the cache also clears geo entries and increases provider requests until it fills again. The existing availability policy is unchanged: missing VPN votes do not count as positive votes; if the threshold is not met, the connection proceeds. A missing geo response supplies no geo verdict. This is not a fail-closed mode. ### Validation and compatibility - 48 Java 8 regression tests, including local HTTP fixtures, thresholds, provider recovery, geo caching and cache startup. - Combined JAR packaging and Java bytecode checks: Java 8 for core/Spigot/BungeeCord, Java 17 for Velocity; server software can require a newer Java version. - Real Velocity 3.4.0 build 566 on Java 21: startup, controlled HTTP VPN detection, pre-login rejection, SQLite cache reuse, provider HTTP-503 recovery, negative verdict passing the plugin, command output, reload and shutdown. - Repeated builds compared by SHA-256. GitHub CI checks the archive independently. Spigot and BungeeCord retain their existing APIs. This release does not claim a new Minecraft version range. Full backend joins, all server versions, LuckPerms/Floodgate integration and Redis runtime operation are not covered by this release's proxy fixture. Provider fixtures establish behavior for controlled responses, not real-world detection accuracy. **Full changelog:** https://github.com/gerolndnr/connection-guard/compare/0.4.9...0.4.10

Changelog can be found on [GitHub](https://github.com/gerolndnr/connection-guard/releases/tag/0.3.0).