## Changes ## ⚠️ Upgrade Notes - The OIDC issuer and the `iss` claim of every token are now built from `server.baseUrl`. `jwt.issuer` is deprecated and ignored. Tokens issued before the upgrade are rejected, so users have to log in again once. - To accept tokens issued by other MineAuth servers that share the signing key, list their `baseUrl` values in `jwt.trustedIssuers`. - Redirect URIs move to the new `oauth_client_redirect_uris` table, and `oauth_clients.redirect_uri` is dropped at startup. If several servers share one database, upgrade all of them at the same time. ## 💥 Breaking Changes - ✨ Support multiple redirect URIs per OAuth client @Nlkomaru (#463) - 🐛 Derive OIDC issuer from baseUrl and accept trusted issuers @Nlkomaru (#461) ## 🚀 Features - ✨ Support multiple redirect URIs per OAuth client @Nlkomaru (#463) ## 🐛 Bug Fixes - 🐛 Derive OIDC issuer from baseUrl and accept trusted issuers @Nlkomaru (#461) ## 📝 Documentation - ✨ Support multiple redirect URIs per OAuth client @Nlkomaru (#463) - 🐛 Derive OIDC issuer from baseUrl and accept trusted issuers @Nlkomaru (#461) ## ⬆️ Dependencies <details> <summary>8 changes</summary> - Bump exposed from 1.5.0 to 1.5.1 @[dependabot[bot]](https://github.com/apps/dependabot) (#457) - Bump org.jetbrains.kotlin.plugin.serialization from 2.4.20 to 2.4.21 @[dependabot[bot]](https://github.com/apps/dependabot) (#453) - Bump io.papermc.paper:paper-api from 26.2.build.132-stable to 26.3.build.194-stable @[dependabot[bot]](https://github.com/apps/dependabot) (#458) - Bump org.jetbrains.kotlin.jvm from 2.4.20 to 2.4.21 @[dependabot[bot]](https://github.com/apps/dependabot) (#455) - Bump opentelemetry from 1.66.0 to 1.67.0 @[dependabot[bot]](https://github.com/apps/dependabot) (#456) - Bump io.papermc.paper:paper-api from 26.2.build.129-stable to 26.2.build.132-stable @[dependabot[bot]](https://github.com/apps/dependabot) (#454) - Bump gradle-wrapper from 9.8.0 to 9.8.1 @[dependabot[bot]](https://github.com/apps/dependabot) (#452) - Bump ch.qos.logback:logback-classic from 1.6.4 to 1.6.5 @[dependabot[bot]](https://github.com/apps/dependabot) (#451) </details>

## Changes ## 🐛 Bug Fixes - 🐛 Advertise the plugin scope in OIDC Discovery @Nlkomaru (#449) ## 📝 Documentation - 🐛 Advertise the plugin scope in OIDC Discovery @Nlkomaru (#449)

## Changes ## 🚀 Features - ✨ Allow overriding the authorization page from the plugin directory @Nlkomaru (#447) ## 📝 Documentation - ✨ Allow overriding the authorization page from the plugin directory @Nlkomaru (#447)

## Changes ## 🚀 Features - ✨ Redesign authorization page and drop legacy pepper support @Nlkomaru (#445)

## Changes ## 🐛 Bug Fixes - 🐛 Fix player login by moving password hashing settings to config.json @Nlkomaru (#444) ## 🧰 Maintenance - ⚡️ Speed up CI by fixing Gradle build cache and limiting Dokka to root @Nlkomaru (#443)

## Changes - ⚡️ Load all Maven Central dependencies via plugin.yml libraries (core JAR 33MB → 9.5MB) @Nlkomaru (#434) - 🔧 Prefer Modrinth over GitHub in mpm repository definitions @Nlkomaru (#435) - 👷 Show JAR sizes in preview PR comment @Nlkomaru (#433) ## ⬆️ Dependencies <details> <summary>10 changes</summary> - Bump mccoroutine from 2.22.0 to 2.23.0 @[dependabot[bot]](https://github.com/apps/dependabot) (#439) - Bump xyz.jpenilla.resource-factory from 1.3.0 to 1.4.0 @[dependabot[bot]](https://github.com/apps/dependabot) (#438) - Bump io.papermc.paper:paper-api from 26.2.build.119-stable to 26.2.build.129-stable @[dependabot[bot]](https://github.com/apps/dependabot) (#440) - Bump gradle-wrapper from 9.7.1 to 9.8.0 @[dependabot[bot]](https://github.com/apps/dependabot) (#436) - Bump ch.qos.logback:logback-classic from 1.6.3 to 1.6.4 @[dependabot[bot]](https://github.com/apps/dependabot) (#437) - Bump org.jetbrains.kotlin.jvm from 2.4.10 to 2.4.20 @[dependabot[bot]](https://github.com/apps/dependabot) (#426) - Bump opentelemetry from 1.65.0 to 1.66.0 @[dependabot[bot]](https://github.com/apps/dependabot) (#428) - Bump com.mysql:mysql-connector-j from 9.7.0 to 26.7.0 @[dependabot[bot]](https://github.com/apps/dependabot) (#430) - Bump com.nimbusds:nimbus-jose-jwt from 10.9.1 to 10.10 @[dependabot[bot]](https://github.com/apps/dependabot) (#427) - Bump bouncycastle from 1.85 to 1.86 @[dependabot[bot]](https://github.com/apps/dependabot) (#429) </details> ## 🚀 Features - ✨ Rebuild authorization page with React and Chlorophyll @Nlkomaru (#442)

## Changes - 🐛 Fix plugin enable failure on Paper 26.3 by bumping cloud-paper to 2.0.1 @Nlkomaru (#432) - ♻️ Publish the mpm index in the repository-index format and include MineAuth core @Nlkomaru (#431) - 👷 Bump setup-node to Node 26 in GitHub Actions workflows @Nlkomaru (#424) ## ⬆️ Dependencies <details> <summary>6 changes</summary> - Bump ktor from 3.5.2 to 3.6.0 @[dependabot[bot]](https://github.com/apps/dependabot) (#425) - Bump com.ghostchu:quickshop-api from 6.2.0.11 to 6.3.0.0 @[dependabot[bot]](https://github.com/apps/dependabot) (#407) - Bump org.jetbrains.kotlin.plugin.serialization from 2.4.10 to 2.4.20 @[dependabot[bot]](https://github.com/apps/dependabot) (#419) - Bump dev.detekt from 2.0.0-alpha.5 to 2.0.0-alpha.6 @[dependabot[bot]](https://github.com/apps/dependabot) (#420) - Bump io.opentelemetry.semconv:opentelemetry-semconv from 1.43.0 to 1.44.0 @[dependabot[bot]](https://github.com/apps/dependabot) (#422) - Bump io.qameta.allure:allure-junit5 from 2.35.4 to 2.35.5 @[dependabot[bot]](https://github.com/apps/dependabot) (#421) </details>

## Changes ## ⬆️ Dependencies - Bump io.micrometer:micrometer-registry-prometheus from 1.17.0 to 1.17.1 @[dependabot[bot]](https://github.com/apps/dependabot) (#418) ## 🐛 Bug Fixes - 🐛 Fix IllegalAccessException when resolving PureTickets services from Guice Injector @Nlkomaru (#423)

## Changes - 🐛 Align pure-tickets mpm index with the Tickets plugin name (PureTickets v5.3.0+) @Nlkomaru (#417) - ✨ Publish an mpm delegated repository index for the addons @Nlkomaru (#415)

## Changes - ✨ Add PureTickets list-all endpoint and expose registered endpoints in availableIntegrations @Nlkomaru (#412) ## 🚀 Features - ✨ Add player activity endpoint to core and nearby claims search to GriefPrevention addon @Nlkomaru (#413)