StormtrooperX

## What's New ### Changed - **Minecraft 26.2 and 26.3 support.** The supported range is now Minecraft 1.18 through 26.3.x (previously 26.1.x). No plugin code changed to get there. The release was verified four ways: the full test suite compiles and passes against the Spigot 26.2 and 26.3 APIs; every Bukkit and PlaceholderAPI method and field the shipped JAR references resolves against the Spigot 26.2/26.3, Paper 26.3, and Folia 26.3 APIs, including the Folia scheduler methods the plugin binds reflectively; a live Paper 26.3 server nerfed shots from all six supported mobs (Skeleton, Stray, Bogged, Parched, Pillager, Piglin) with projectile speed preserved, before and after `/stormtrooperx reload`; and CI's forward-compatibility job now builds against the 26.3 API on every push. ### Security - **H2 2.5.252 picks up upstream security fixes.** The bundled H2 database (the default `h2` backend) includes fixes for connection-URL setting injection (#4381), a missing deserialization filter for `JAVA_OBJECT` values (#4412), and `SecureFileStore` skipping decryption on partial reads (#4405). None of these are reachable from StormtrooperX: the H2 URL is built from the plugin data folder and fixed settings only, the opt-out table stores only `VARCHAR`/`BOOLEAN`/`TIMESTAMP` columns, and the database is not encrypted. This is a defense-in-depth update. Upstream references advisory GHSA-x6w5-3gpx-27hm, which has not been published yet; no CVE is assigned. ### Dependencies - **MySQL Connector/J 9.7.0 → 26.7.0** (bundled). The version jump is Oracle moving Connector/J onto MySQL Server's calendar versioning; 26.7.0 is the successor to 9.7, not a rewrite. **It requires MySQL Server 8.4 or later** for the `mysql` backend (see Upgrade Notes). The 26.7.0 bug fixes (`LOAD DATA LOCAL INFILE` cleanup, X Protocol connections, `getNString` UTF-8 aliases) don't affect this plugin: `allowLoadLocalInfile` is forced off, the X Protocol classes are stripped from the JAR, and the N-character `ResultSet` methods are unused. No CVEs are addressed. - **H2 2.4.240 → 2.5.252** (bundled, default backend). Besides the security fixes above, this brings MVStore corruption and data-race fixes that apply to the plugin's file-backed opt-out store: "double mark" corruption on reopen after `SHUTDOWN` (#4387), a chunk-rewrite data race (#4374), and stopping on panic to prevent store corruption (#4343). Existing databases need no migration: a file written by 1.10.1's H2 2.4.240 opens, reads, and accepts upserts under 2.5.252. - Build and test tooling: `maven-compiler-plugin` 3.15.0 → 3.16.0, `maven-surefire-plugin` 3.5.6 → 3.6.0, `cyclonedx-maven-plugin` 2.9.2 → 2.9.3, JUnit Jupiter 6.1.2 → 6.1.3, Mockito 5.23.0 → 5.24.0. None of these ship in the JAR. ### Build - **Release pipeline actions updated**, all still pinned to commit SHAs in `release.yml`: `actions/setup-java` 5.2.0 → 6.1.0 (v6 also verifies JDK downloads against vendor checksums), `actions/attest-build-provenance` 4.1.1 → 4.2.2, `softprops/action-gh-release` 3.0.2 → 3.0.3, and `cloudnode-pro/modrinth-publish` 2.5.0 → 2.5.2. - **Forward-compatibility CI job moved to the 26.3 API** ("Ceiling compat (26.3 API)"), still running on Java 25 to match the server runtime that 26.x requires. ## Upgrade Notes **If upgrading from 1.10.x:** Drop-in replacement for most servers. No config schema change (`config-version: 3` continues to apply, no migration runs), and no permission or command changes. - **H2 users (default):** no action needed. Your existing opt-out database is read as-is. - **MySQL users: check your MySQL server version first.** The bundled Connector/J 26.7.0 requires **MySQL Server 8.4 or later**. Because the driver is shaded into the JAR, it can't be swapped for an older one. If your database server runs MySQL 8.0, upgrade the server before updating the plugin, or stay on 1.10.1 until you can. **Server compatibility:** Spigot, Paper, Purpur, and Folia 1.20.4+, on Minecraft 1.18 through 26.3.x, Java 17+. Minecraft 26.x servers themselves require Java 25. **JAR verification:** Built and attested via GitHub Actions with Sigstore. Verify with `gh attestation verify StormtrooperX-1.11.0.jar --repo GooberCraft/StormtrooperX` (requires `gh` 2.43.0+).

## What's New ### Fixed - **Shaded-JAR JDBC driver discovery.** H2 and MySQL Connector/J both ship a `META-INF/services/java.sql.Driver` file. The shade previously kept only H2's, verbatim and unrelocated, so `ServiceLoader`-based driver discovery pointed at a class name that didn't exist in the JAR for H2, and was missing entirely for MySQL. The shade plugin now merges service files via `ServicesResourceTransformer` and relocates their contents; the shipped `java.sql.Driver` entry lists both bundled drivers under their relocated names. - **MySQL connections now use the bundled driver by design.** `DatabaseManager` sets HikariCP's `driverClassName` explicitly, so the pool loads the shaded Connector/J 9.7.0 instead of silently falling back through `DriverManager` to whatever MySQL driver the server platform happens to bundle. MySQL setups now get the pinned, attested driver version regardless of server flavor. ### Changed - **JAR slimmed ~36% (7.7 MB → 4.9 MB).** Excluded `protobuf-java` and Connector/J's X-protocol classes (`com/mysql/cj/x/**`) from the shade, both exist solely for the X DevAPI, which Oracle removed upstream in Connector/J 9.0, so they were dead code (~7.4 MB uncompressed). - **No more unrelocated classes in the JAR.** `org.slf4j` (HikariCP's transitive dependency) is now relocated under `com.goobercraft.stormtrooperx.slf4j` like every other shaded dependency, eliminating a potential classpath conflict with other plugins or the server's own slf4j. Dependency metadata that survives shading uselessly (`module-info.class`, `META-INF/maven/**`, `META-INF/versions/**`, `META-INF/native-image/**`) is stripped. ### Dependencies - Bumped `me.clip:placeholderapi` from `2.12.2` to `2.12.3` (`provided` scope, soft dependency, not shaded into the JAR). - Bumped `org.junit.jupiter:junit-jupiter` from `6.1.0` to `6.1.2` (test scope). ## Upgrade Notes **If upgrading from 1.10.0:** Drop-in replacement. No config schema change (`config-version: 3` continues to apply, no migration runs), no permission changes, no command changes. - **H2 users (default):** no behavior change, just a smaller download. - **MySQL users:** connections now always use the plugin's bundled Connector/J 9.7.0. If your setup was unknowingly relying on the server's own bundled MySQL driver version, this release pins you to the attested one shipped in the JAR. **Server compatibility:** Unchanged - Spigot, Paper, Purpur, and Folia 1.20.4+, on Minecraft 1.18 through 26.1.x, Java 17+. **JAR verification:** Built and attested via GitHub Actions with Sigstore. Verify with `gh attestation verify StormtrooperX-1.10.1.jar --repo GooberCraft/StormtrooperX` (requires `gh` 2.43.0+).

## What's New ### Added - **Permission-aware tab completion** for `/stormtrooperx`. The first argument completes to only the subcommands the sender may actually run; for `optout`/`optin`, the second argument completes to online player names — but only for admins holding `stormtrooperx.optout.others`. Tab-completion pools are pre-sorted and computed once at startup. - **`/stormtrooperx help`** lists only the commands the sender has permission to run, so a regular player no longer sees admin-only subcommands they can't use. - **Idempotent `optout` and new `optin`.** `optout` no longer toggles — it always sets opted-out (reporting "already opted out" instead of silently flipping). `optin` is the symmetric counterpart. `toggle` is retained for the flip behavior. - **Admin opt-out management.** `/stormtrooperx optout|optin <player>` lets admins manage opt-out state for any online player, gated by the new `stormtrooperx.optout.others` permission. The target receives a chat notification of the change. - **`stormtrooperx.admin` permission**, required for `/stormtrooperx reload` and granting `stormtrooperx.optout.others` via permission children. The previous setup had no clean "give one player everything" knob. - **Join-time opt-out reminder.** When an opted-out player's state finishes loading from the database, they get a one-shot chat message confirming the status. - **PlaceholderAPI soft dependency.** When PlaceholderAPI is present, `%stormtrooperx_optout%` resolves to `true`/`false` for the requesting player. The expansion persists across `/papi reload`. PAPI is a soft dependency only — the plugin loads and runs identically without it. ### Changed - **Projectile math extracted.** The speed-preserving direction perturbation now lives in a package-private `ProjectileNerf.perturb(Vector, double, Supplier<Vector>)` with an injectable random source, making the pure-math invariants directly unit-testable without event mocking. Runtime behavior is unchanged. - **`stormtrooperx.use` default flipped from `op` to `true`** so non-op players can actually reach `/stormtrooperx optout` (itself `default: true`). The old default made the public opt-out command unreachable for the audience it was meant for. - **Ignores cancelled `EntityShootBowEvent`.** `onBowShoot` now declares `@EventHandler(ignoreCancelled = true)` — if an upstream plugin cancels the shoot event, we no longer perturb the (cancelled) projectile's velocity. - **HikariCP MySQL pool** sets the Connector/J performance properties from the HikariCP wiki: `useServerPrepStmts`, `useLocalSessionState`, `rewriteBatchedStatements`, `cacheResultSetMetadata`, `cacheServerConfiguration`, `elideSetAutoCommits`, `maintainTimeStats=false`. No config change needed. - **Hot-path micro-optimizations** in `onBowShoot`: `lengthSquared()` for the zero-velocity guard, cached projectile and `isH2` references, pattern-matching `instanceof`. ### Fixed - **Folia regional-thread safety on `/stormtrooperx reload`.** `entityConfigs` and `debug` are now `volatile`, and `loadConfiguration` publishes a freshly-built `EnumMap` in a single reference write instead of mutating the live map. The old code could expose a partially populated map to a regional `EntityShootBowEvent` thread during a reload. ### Security - **CWE-117 log injection — release tags.** Closed log-injection vectors in `UpdateChecker`. GitHub release tags pass a `validateReleaseTag` barrier (`^v?\d+(\.\d+){0,3}([-+][A-Za-z0-9.-]+)?$`) before reaching any logger or version compare; malformed tags are dropped at the source. - **CWE-117 log injection — sink-side allowlist.** A new `sanitizeForLog` helper reduces logged version strings at the sink to `[A-Za-z0-9._+-]` via a negated-character-class `replaceAll` — the form CodeQL recognizes as a sanitizer (a `[\r\n]` denylist does not satisfy `java/log-injection`). - **JDBC parameter smuggling.** `DatabaseManager` now validates the MySQL `properties` map against an explicit allowlist (`SAFE_MYSQL_PROPERTY_KEYS`) and URL-encodes values. Unsupported keys throw `IllegalArgumentException` at `initialize()`. This closes a parameter-smuggling vector that could otherwise enable high-risk Connector/J flags (`allowLoadLocalInfile`, `autoDeserialize`, `queryInterceptors`, …) with RCE / file-read history. - **Defense-in-depth Connector/J defaults.** Even with the allowlist, `dataSourceProperties` forces `allowLoadLocalInfile=false`, `allowUrlInLocalInfile=false`, `autoDeserialize=false`, and `allowPublicKeyRetrieval=false` at the HikariCP layer. - **Chat-injection echo.** Player names echoed by the offline branch of `/stormtrooperx optout|optin <player>` are run through a new `sanitizeNameForEcho` (strips control chars and `§`, caps at 16 chars), closing a low-severity chat-injection vector on offline-mode servers. - **AssertJ pinned to 3.27.7** (test-scope), clear of CVE-2026-24400 (GHSA-rqfh-9r24-8c9r — XXE in the unused `isXmlEqualTo`). ### Build - **CycloneDX SBOM.** Added `cyclonedx-maven-plugin` on the `verify` phase; `release.yml` uploads `bom.xml`/`bom.json` alongside the JAR. - **`release.yml` actions pinned to commit SHAs** (with `# vX.Y.Z` trailers) instead of mutable major tags — the release job holds `id-token` / `attestations: write` scope. Dependabot keeps the pins current. ### Tests - **AssertJ added.** Migrated assertions to fluent `assertThat(...)` style for richer failure messages. Mockito 5.x + JUnit Jupiter 6.x stack is unchanged. - **Branch-coverage gate.** Jacoco now enforces `BRANCH COVEREDRATIO >= 0.50` per package alongside the existing 0.60 line-coverage rule. Current: 72% line / 75% branch. - **CI runs `mvn clean verify`** instead of `package`, so the Jacoco gate (bound to `verify`) is enforced in CI — not just locally. - **Shared test infrastructure.** New `support/` test package: `TestSupport` (reflective field/method access) and `InlinePluginScheduler` (shared inline scheduler), replacing duplicated boilerplate across test classes. - **YAML fixtures** under `src/test/resources/fixtures/` (`config-v2.yml`, `config-v3.yml`); `ConfigMigrationTest` exercises real-load → migrate → assert instead of synthetic YamlConfiguration objects. - **New `ProjectileNerfTest`** for the extracted pure function — speed preservation, zero-velocity guard, mutation semantics, accuracy clamping. Plus expanded `UpdateCheckerTest` covering `validateReleaseTag` accept/reject sets. ### Dependencies - Bumped `me.clip:placeholderapi` from `2.11.6` to `2.12.2` (`provided` scope, soft dependency — not shaded into the JAR). ### Documentation - `OptOutManager#isOptedOut`, `StormtrooperXExpansion`, and the README PlaceholderAPI section all document the **online-only** semantics of `%stormtrooperx_optout%`: offline players resolve to `false` regardless of persisted state. - `DatabaseManager.initializeH2` Javadoc now warns against enabling `AUTO_SERVER=TRUE` / H2 server mode without revisiting the hardcoded `sa`/empty credentials. ## Upgrade Notes **If upgrading from 1.9.x:** - **Behavior change — `/stormtrooperx optout`.** Previously toggled; now it always sets opted-out. Use `/stormtrooperx toggle` for the old flip behavior. If you bind macros or scripts to the command, this is a one-line update. - **Permission default change — `stormtrooperx.use`.** Default flipped from `op` to `true` so the `optout` subcommand (always `default: true`) is reachable for the intended audience. Servers using a permissions plugin that explicitly granted `stormtrooperx.use` to non-ops are unaffected; servers relying on the old default should explicitly deny `stormtrooperx.use` to revert. - **New permissions to wire up (admins):** `stormtrooperx.admin` (grants `reload` and `optout.others` via children) and `stormtrooperx.optout.others` (grants admin opt-out commands for other players). Both default to `op`. - **PlaceholderAPI** is optional. To use `%stormtrooperx_optout%`, install PlaceholderAPI; no config change required. - **Config:** No schema change. `config-version: 3` continues to apply, no migration runs on upgrade. **Server compatibility:** Unchanged — Spigot, Paper, Purpur, and Folia 1.20.4+, on Minecraft 1.18 through 26.1.x, Java 17+. **JAR verification:** Built and attested via GitHub Actions with Sigstore. Verify with `gh attestation verify StormtrooperX-1.10.0.jar --repo GooberCraft/StormtrooperX` (requires `gh` 2.43.0+).

## What's New ### Added - **Folia support** via a runtime-detected `PluginScheduler` abstraction. On Folia 1.20.4+, async work routes through Folia's `AsyncScheduler` / `GlobalRegionScheduler` (via reflection so the Spigot API 1.18 compile dependency is unchanged). On Spigot, Paper, and Purpur the legacy `BukkitScheduler` is used. The scheduler is selected once at plugin enable; `plugin.yml` declares `folia-supported: true`. - **Graceful Folia fallback.** If `RegionizedServer` is detected but Folia's scheduler API cannot be bound (e.g., a future signature change), `PluginScheduler.create` logs a WARNING and falls back to the legacy scheduler instead of failing plugin enable. Async tasks continue working in degraded mode rather than bricking the plugin. ### Changed - **`DatabaseManager` H2 thread safety.** H2 operations (`isOptedOut`, `setOptOut`) are now serialized through an internal lock. JDBC `Connection` instances are not thread-safe, and Folia's regional async pool can dispatch concurrent opt-out reads/writes onto the single shared H2 connection. The MySQL path is unchanged — HikariCP gives each thread its own pooled connection, so no lock is taken there. - **`UpdateChecker` callback contract.** The update-check callback is now invoked on the async worker thread instead of being hopped back to the main thread. Logging only (`java.util.logging` is thread-safe). The previous main-thread hop was unnecessary on Spigot/Paper and forbidden on Folia. Javadoc on `UpdateCallback#onComplete` documents the off-thread contract. - **Constructor signatures.** `OptOutManager` now takes `PluginScheduler` in place of `Plugin`; `UpdateChecker` now takes an additional `PluginScheduler` argument. Internal change — affects no `plugin.yml`/permissions surface, no end-user config. ### Security - **Tightened `UpdateChecker` `githubRepo` validation** to `^[a-zA-Z0-9._-]+/[a-zA-Z0-9._-]+$` (matching GitHub's actual repo-name charset). Defense-in-depth against path traversal, CRLF injection, and arbitrary URL-component characters in the segment that flows into the GitHub API URL. The current call site is hardcoded to `GooberCraft/StormtrooperX`, so this is preventative only. ### Tests - New `PluginSchedulerTest` — 7 tests covering the legacy scheduler delegation (via `MockedStatic<Bukkit>`) and the factory's non-Folia branch - New `UpdateChecker` constructor tests — 5 tests covering semicolon injection, multi-segment paths, path traversal, CRLF injection, and the valid-character allowlist - Total test count: 156 → 170 ## Upgrade Notes **If upgrading from 1.8.x:** No configuration changes required. `plugin.yml` adds `folia-supported: true` automatically; existing `config.yml` files continue to work as-is. **Server compatibility:** Folia 1.20.4+ is now supported in addition to Spigot, Paper, and Purpur. Folia is detected automatically at startup — log message confirms which scheduler is in use (`Folia detected, using regional schedulers` vs `Standard Bukkit scheduler in use`). No Folia or Paper API dependency was added to the build; the plugin still compiles against Spigot API 1.18. **JAR verification:** Built and attested via GitHub Actions with Sigstore. Verify with `gh attestation verify StormtrooperX-1.9.0.jar --repo GooberCraft/StormtrooperX` (requires `gh` 2.43.0+).

## What's New ### Added - **Parched mob support** (Minecraft 1.21.11+, Mounts of Mayhem) — the new desert skeleton variant that fires Arrows of Weakness with a bow. Treated as a standard bow user for accuracy nerfing. Gracefully disabled on servers older than 1.21.11. ### Tests - Added `EntityConfigLoadingTest` — 10 tests covering both `loadEntityConfig` variants, the version-gated `IllegalArgumentException` fallback (the path Parched takes on older servers), and the `displayEntityStatus` Disabled branch - Total test count: 146 → 156 - `StormtrooperX` class line coverage improved from 61% → 72% - Tightened Jacoco package line-coverage minimum from 0.50 → 0.60 ### Dependencies - Bump JUnit Jupiter from 5.14.3 → 6.0.3 (major version; transparent upgrade with no production-code impact) ### Documentation - Backfilled CHANGELOG entries for v1.6.3 (Modrinth publishing + dependabot/CI bumps) and v1.7.0 (Java 11 drop, MC 1.18 baseline, +5 test classes) which previously shipped without release notes ## Upgrade Notes **If upgrading from 1.7.x:** No configuration changes required. The new `parched:` entry is added with sensible defaults (enabled, accuracy 0.7) on first config regeneration; existing configs continue to work as-is. **Server compatibility:** Parched only spawns/exists on Minecraft 1.21.11+. On earlier versions, the plugin logs `Entity 'Parched' is not available in this Minecraft version (1.21.11+ required)` and continues normally — no errors, no startup failures.

## What's New ### Compatibility - **Dropped Java 11 support** — minimum is now Java 17 - **Raised minimum Minecraft version to 1.18** — drops support for 1.13–1.17 - **Added Minecraft 26.1.x support** - **Added Java 25 to CI test matrix** (17, 21, 25) ### Dependencies - Bump `mysql-connector-j` 9.6.0 → 9.7.0 ### CI / GitHub Actions - Bump `codecov/codecov-action` v5 → v6 (Node 20 → 24) - Bump `softprops/action-gh-release` v2 → v3 (Node 20 → 24) ### Tests - Added `BowShootEventTest` — 8 tests covering `onBowShoot()` event handler - Added `CommandHandlerTest` — 11 tests covering all `onCommand()` paths - Added `ConfigMigrationTest` — 4 tests covering `migrateConfigToV3()` - Expanded `OptOutManagerTest` — async DB exception handling coverage - Expanded `PluginResourceTest` — `api-version` assertion ## Upgrade Notes **If upgrading from 1.6.x:** No configuration changes required. Your existing `config.yml` is fully compatible. **Java requirement:** Java 17 or higher is now required. Minecraft 1.18+ already requires Java 17, so this should have no impact on existing servers.

**Dependency Updates** - Updated `mysql-connector-j` from 9.5.0 to 9.6.0 (7 bug fixes including multihost URL and batch statement handling) - Updated `bstats-bukkit` from 3.1.0 to 3.2.1 (improved robustness against exceptions) - Updated `org.jetbrains:annotations` from 26.0.2 to 26.1.0 - Updated Maven build plugins (compiler 3.15.0, surefire 3.5.5, shade 3.6.2)

## What's Changed ### Performance - Use EnumMap for faster entity config lookups (~30% improvement) ### Bug Fixes - Guard against zero-length velocity vectors (prevents NaN in edge cases) - Validate MySQL pool configuration values with clear warnings for invalid settings ### Documentation - Document valid ranges for MySQL pool settings in config.yml ### Dependencies - Update Mockito from 5.15.2 to 5.20.0 **Full Changelog**: https://github.com/GooberCraft/StormtrooperX/compare/v1.6.1...v1.6.2