ВЕРСИИ (4)

## PlayerVaultZ 1.3.0 **Security update. Everyone on 1.1.0 or older should update.** This release rolls up everything since 1.1.0 (1.2.0 was never published separately). ### Security - **Quick Pick duplication fixed.** In `/pv selector` with quick pick on, taking a stack (right-click) or all of an item (shift-click) gave the player the items while the vault kept them too. Items are now removed from the vault before they are handed over, anything that doesn't fit goes back into the vault, and only the exact item clicked is taken (named or plugin items that share a material are no longer swept up together). - **Navigation bar duplication fixed.** Buttons and filler panes could be pulled out of the vault GUI with a double-click (or an inventory-sorting mod) and kept as real items. GUI items are now tagged and can never be stored or saved. - **Free spyglass from vault search fixed.** Every way of leaving the search anvil on Paper 26.x handed the player the placeholder spyglass. ### New - **Language files.** Every chat message and GUI label is now configurable. Set `language: en` or `language: fr` in `config.yml`; the jar ships complete English and French files, and you can add your own in `lang/`. MiniMessage and `&` color codes both work. - **Per-vault permissions.** `playervaultz.vault.<n>` grants a single vault number (for example vault 7 only) alongside the existing `playervaultz.vaults.<n>` count permission. - **MySQL storage and network support.** `storage.type: mysql` lets several servers behind a proxy share vaults, with locking so two servers never open the same vault at once. `/pvadmin migrate sqlite-to-mysql` moves existing data. - **Custom navigation buttons.** Add your own buttons to the vault GUI in `gui.yml` that run player or console commands. ### Fixed - Failed database writes were silently reported as saved, which could lose items. Saves now retry and only count as saved once they actually commit. - Backup and restore menus no longer break when their titles are translated. - `playervaultz.vaults.4` now shows up in permission plugin tab completion. ### Upgrading Drop in the new jar and restart. Existing configs keep working: new message and GUI keys are added to your files automatically. The old `messages.yml` is no longer used; its text now lives in `lang/en.yml`. Requires Paper (or a fork) 1.21.5 or newer, including 26.x.

## [1.1.0] - 2026-05-27 ### Fixed - **Search crash** — Replaced the WesJD AnvilGUI library with Paper's native `MenuType.ANVIL` API. The old library used versioned NMS packages (`org.bukkit.craftbukkit.v1_21_R5`) that do not exist in Paper 26.1.x, causing a `NoClassDefFoundError` whenever a player opened the search GUI. - **Search field pre-filled with "Spyglass"** — The anvil rename field now starts blank instead of showing the item's material name. - **Security config not loading** — YAML key paths in `SecurityConfig` were mismatched (e.g. `security.input-validation.*` vs the actual `item-validation.*`), causing all security settings to silently fall back to defaults. - **`logAllTransactions` field rename** — `AuditLogger` referenced a field that had been renamed to `logTransactions`, which would have caused a compile error on a clean build. - **Plugin uptime showing Unix epoch** — `getUptime()` was returning `System.currentTimeMillis()` directly instead of subtracting the start time, showing billions of hours of uptime. - **`ItemFlag.HIDE_ITEM_SPECIFICS`** — Replaced with `HIDE_ADDITIONAL_TOOLTIP` in `IconSelectorGUI` and `VaultSelectorGUI` to match the renamed enum in Paper 1.21.x. ### Changed - **Security system** — Stripped unimplemented Phase 3–5 dead code (duplication detection, anomaly detection, honeypot vaults). The three active layers (item validation, rate limiting, audit logging) are unchanged. - **`checkVaultAccess`** — Switched from `CompletableFuture.supplyAsync()` to `completedFuture()` so the security check is synchronous and cannot arrive after the inventory event has already been processed. - **`SecurityViolationType`** — Removed unused enum values: `DUPLICATION_DETECTED`, `ANOMALOUS_BEHAVIOR`, `HONEYPOT_ACCESS`, `SUSPICIOUS_TIMING`. ### Removed - **AnvilGUI dependency** — `net.wesjd:anvilgui` removed from `pom.xml`. The CodeMC Maven repositories that existed solely for this dependency are also removed. ### Config - **`security.yml`** — Removed three sections that were never read by the plugin: `performance`, `bypasses`, and unused audit sub-keys (`log-suspicious-patterns`, `file-prefix`, `max-file-size-mb`, `max-files`, `include-metadata`). - **`config.yml`** — Removed `security.audit-logging` (dead key; audit is controlled by `security.yml → audit.enabled`).

Extra security checks

Was using incorrect API methods for Nexo. Tested and verified Nexo items work in GUI!