Connection Guard

Maintenance release for Spigot, BungeeCord and Velocity.

Fixes

- Wait for cache initialization before registering connection checks and commands. A failed or stalled cache setup stops plugin initialization with a bounded timeout. - Retry VPN detection after incomplete provider responses instead of caching an unreliable negative verdict. Healthy provider votes still count towards the configured threshold. - Bundle and isolate OkHttp, Okio and Kotlin dependencies so HTTP detection does not depend on libraries supplied by another plugin. - Reuse a bounded HTTP client, close responses, reject unsuccessful HTTP responses and malformed/missing detection fields, and keep provider URLs, API keys and response messages out of failure logs. - Use HTTPS for ProxyCheck and IPHub requests. The free IP-API endpoint remains HTTP. - Cache successful geo lookups and treat failed geo lookups as unavailable so later queries can retry. IP-API error responses no longer require location fields. - Read both custom-provider nested fields using the documented # separator, preserve colons in header values and substitute %IP% in headers. - Substitute message placeholders literally, including ISP names containing dollar signs or backslashes. - Restore reproducible builds, verify all three plugin descriptors and runtime HTTP dependencies, and run regression tests in CI. - Preserve Velocity's pre-login authentication mode when Connection Guard allows a connection.

Upgrade

Stop the server/proxy, replace the existing Connection Guard JAR with connection-guard-0.4.10-all.jar, and restart. Existing configuration and translations are retained. Provider and cache changes require a restart; /cg reload reloads configuration and messages. Older versions may have cached negative VPN verdicts during a provider outage. After upgrading, use /cg clear <IP> for affected addresses or /cg clear to clear the whole cache (permission: connectionguard.command.clear). Clearing the cache also clears geo entries and increases provider requests until it fills again. The existing availability policy is unchanged: missing VPN votes do not count as positive votes; if the threshold is not met, the connection proceeds. A missing geo response supplies no geo verdict. This is not a fail-closed mode.

Validation and compatibility

- 48 Java 8 regression tests, including local HTTP fixtures, thresholds, provider recovery, geo caching and cache startup. - Combined JAR packaging and Java bytecode checks: Java 8 for core/Spigot/BungeeCord, Java 17 for Velocity; server software can require a newer Java version. - Real Velocity 3.4.0 build 566 on Java 21: startup, controlled HTTP VPN detection, pre-login rejection, SQLite cache reuse, provider HTTP-503 recovery, negative verdict passing the plugin, command output, reload and shutdown. - Repeated builds compared by SHA-256. GitHub CI checks the archive independently. Spigot and BungeeCord retain their existing APIs. This release does not claim a new Minecraft version range. Full backend joins, all server versions, LuckPerms/Floodgate integration and Redis runtime operation are not covered by this release's proxy fixture. Provider fixtures establish behavior for controlled responses, not real-world detection accuracy. Full changelog: https://github.com/gerolndnr/connection-guard/compare/0.4…

Changelog can be found on [GitHub](https://github.com/gerolndnr/connection-guard/releases/ta…