⚡ ServerBooster

This release makes ServerBooster run cleanly on Folia. It resolves the console errors reported on Folia servers, and it changes nothing about how the plugin behaves on Paper, Spigot or Purpur. Fixed: console errors on Folia Reported on a Folia server: a repeating flood of Cannot read world asynchronously and Accessing entity state off owning region's thread, thrown several times per second. What was happening. Folia splits every world across many region threads, and the rules are strict: the global thread may not read a world or an entity at all, and a region thread may only touch the chunks and entities it owns. ServerBooster ran its periodic work on the global thread and then read blocks and entities from there, which Folia rejects outright. Investigating that turned up a deeper cause than the two errors in the report: the plugin's internal helper for "run this on the server thread" also hopped to the global thread, so every module that used it to read an entity was affected, not just the two that happened to be logging. Modules repaired for Folia These now do their work on the thread that actually owns the target, so they run on Folia with full functionality: Hopper Optimizer — its hopper registry was already grouped by chunk, so each chunk's hoppers are now handed to the region that owns them: one hand-off per chunk, not per hopper Redstone Tick Limiter — queued updates are grouped per worldir owning region Item Holograms — the merge scan and death-drop glow run on the thread owning the item, and natural despawns are now detected through a real event instead of a periodic lookup Chunk Block Limiter — every block and tile-entity scan checks ownership first Elytra Optimizer — the firework cooldown is applied on the thread owning that player Entity Limiter — spawn and breeding limits work normally, since Folia fires those events on the owning region One subtle case worth calling out: a hopper on a chunk border pushes into the next chunk, and a block update spreads physics outwards. Owning the centre chunk is not enough for either, so those checks now confirm ow. A hopper straddling a region boundary is left to vanillarather than handled incorrectly. Modules that report themselves unavailable on Folia Some features are built on scanning an entire world at once, which no single thread on Folia is permitted to do. Rather than fail quietly or spam the console, they now show as unavailable in the module menu with the reason stated: Chunk Optimizer Ground Item Cleaner The Entity Limiter's age sweep only — its spawn limits stay fully active Commands that would have to walk a world (/sb count, /sb check, /sb detect, /sb clean, /sb restoreai) now answer with a short explanation instead of throwing. Mob AI self-healing still works on Folia. It keys off chunk loading, which Folia fires on the region that owns the chunk, so a mob left frozen by an earlier Paper session is still returned to vanilla as its chunk comes in. Also fixed on Paper The Villager Optimizer was reading a villager's validity, profession and position directly from a background thread. On Folia that was an outright violation; on Paper it was a race condition that had simply gone unnoticed. It now takes a single consistent snapshot on the server thread, which also removes two of the three thread hand-offs it used to make per villager. The Item Holograms merge scan had the same problem and got the same treatment. Compatibility Paper, Spigot and Purpur from 1.17 through 26.x — behaviour cheduling or latency Folia and Folia-based forks Java 17+ The Web Dashboard remains EXPERIMENTAL. On Folia it reports TPS, memory and module figures normally; per-world entity and chunk counts read as zero, since no thread may collect them. Upgrading Drop in the new JAR. No config changes are needed, and nothingia, open /sb gui after starting to see which modules are active and which stand down on that platform.

This release adds a new module for clearing abandoned ground items, along with a manual cleanup button, and fixes the Restore Vanilla Mob AI action. New module: Ground Item Cleaner Removes dropped items that have been lying on the ground for longer than an age you choose, so forgotten drops stop costing entity ticks and network traffic. It ships disabled. Deleting player items is destructive, so turning it on is your decision. What it can touch — and what it can never touch Only dropped items. Armour stands, minecarts, item frames, paintings, boats and mobs are different entity types, so they cannot be selected by this module no matter how it is configured. That is not a list you could get wrong; it is simply what the module looks at. On top of that, several protections are on by default: Items nobody can pick up are spared. Plugins use these for decorative and display entities, and deleting them would break those plugins. Invulnerable items are spared, since plugins use that flag to mark special drops. Renamed items are spared. This looks at the name carried by the item itself — the one that stays with it after you pick it up — not the floating label shown over a drop. A blacklist of valuables ships filled in: netherite gear and blocks, elytra, totems, dragon egg, beacon, nether star, enchanted golden apples and shulker boxes. An optional whitelist, so you can instead clean only the materials you list. An optional strict mode that limits cleanup to piles merged by the Item Holograms module and ignores everything else. Why this exists when Minecraft already despawns items Vanilla despawns an item once its own timer runs out, but merging a pile resets that timer. A spot where players keep dropping things can therefore hold a stack alive indefinitely, and it never ages out on its own. So this module keeps its own record of how long an item has really been on the ground. That record survives chunk unloads and server restarts, and merging cannot reset it. Fully configurable Minimum age, sweep interval, worlds, protections, blacklist and whitelist, a cap on how many items a single sweep may remove (so cleanup never becomes its own lag spike), an optional countdown warning broadcast before automatic sweeps, an optional result announcement, and console logging. New: manual cleanup A Clean Ground Items button now sits in the module menu, next to Restore Vanilla Mob AI. It works even while the module is switched off, because clearing lag on demand is a different need from running cleanup on a timer. It always applies the same age threshold and protections, so a click can never wipe items a player just dropped. The button also shows live counts before you press it: how many items are on the ground, how many are old enough to go, how many are still too young, and how many are protected. There is a matching /sb clean command for console and scripts, guarded by the new serverbooster.clean permission (default: op). Cleanup always explains itself. Instead of a bare "nothing was removed", every cleanup reports how many items were scanned, how many were too young, how many were protected, and how many were filtered out by your lists — so you can see at a glance why something stayed. Fixed: Restore Vanilla Mob AI did nothing Reported by server owners: the restore action ran without errors but left mobs frozen, and the only thing that worked was clearing the AI flag by hand with a vanilla command. Minecraft has two independent switches that can disable a mob's AI. ServerBooster was clearing one of them and leaving the other untouched, so any mob holding the second flag stayed frozen no matter how many times it was restored. Both are now cleared, independently, so one failing cannot block the other. As before, this only ever affects mobs ServerBooster itself froze. Mobs held without AI by other plugins — NPCs, bosses, quest mobs — are never touched. Compatibility Paper, Spigot and Purpur from 1.17 through 26.x Java 17+ The Ground Item Cleaner reports itself as unavailable on Folia rather than running unsafely Config comments are preserved when toggling modules from the menu The Web Dashboard remains EXPERIMENTAL Upgrading Drop in the new JAR. config_item_cleaner.yml is created on first start with the module disabled, so nothing changes until you switch it on. One thing worth knowing: editing a config file by hand does not take effect until you run /sb reload or toggle that module in the menu. If a change seems to do nothing, that is usually why.

This release makes every module genuinely switchable, guarantees mob AI is always handed back to vanilla, and adds an in-game control menu. It resolves several issues reported by server owners. New: in-game module menu /sb gui opens a control panel listing every module with its live status and the config file that owns it. Toggle any module on or off instantly — no /sb reload required Toggle any module on or off instantly — no /sb reload required Changes are written straight to that module's own config option, so the file stays the single source of truth A Restore Vanilla Mob AI button, and a reload shortcut Built to be tamper-proof: every click and drag inside the menu is denied, the panel holds nothing but decorative icons, permissions are re-checked on every click, and open menus are force-closed before the plugin unloads New permissions: serverbooster.gui and serverbooster.restoreai (both default to op). Fixed: modules could not actually be disabled Reported: "there is no overall enable option in config_optimize_entities.yml, and config_entity_limiter.yml doesn't have a module disable either." Both files were missing a master switch — and worse, the Entity Limiter and Entity Optimizer ignored that option entirely, so adding it by hand did nothing. Added a master enabled option to config_optimize_entities.yml, config_entity_limiter.yml and chunks_optimizer.yml Those options are now actually honoured Every one of the ten modules now has exactly one clear switch — no duplicates, no ambiguity Three modules kept their event listeners attached when switched off at runtime, so they carried on working after being "disabled". Fixed. Fixed: mob AI stayed broken after removing the plugin Reported: "when I remove the plugin the mob AI breaks, especially tamed pets. It only works again after reinstalling." The frozen state is stored inside each entity's saved data, not just in memory, so any mob that was not explicitly restored stayed frozen forever. Mob AI is now returned to vanilla through several independent paths: On a normal server stop, and before any chunk is written to disk The moment the module is switched off, across every world Automatically as chunks load, even while the module is disabled — so a disabled module converges on pure vanilla behaviour A one-time sweep at startup that reaches spawn chunks, which never reload on their own On demand via /sb restoreai or the menu button Pets are now protected by default. Tamed, leashed and sitting animals are never frozen (ignore.tamed, ignore.leashed, ignore.sitting). No more conflicts with other plugins. Mobs that another plugin is deliberately holding without AI are never taken over, and ServerBooster only ever re-enables AI on mobs it froze itself. This also settles a long-standing overlap between the Entity Optimizer and the Villager Optimizer. If you want entity optimization without ever touching mob AI, set disable-ai-for-untracked-entities: false. ▎ Before uninstalling: run /sb restoreai (or use the menu button). AI is restored automatically on a normal shutdown, but a hard crash followed by deleting the JAR leaves nothing behind to wake the mobs. Fixed: Item Holograms bypassed Residence pickup rules Reported: "even if item pickup is disabled within the residence, if two or more items merge into a stack they can be picked up regardless of the permission." Merged stacks are handed to the player directly, and that was happening before region plugins had a chance to object. Pickup handling now runs after protection plugins, so a denial from Residence, WorldGuard, GriefPrevention, Towny or Lands is final. ServerBooster also no longer shortens a pickup delay another plugin has set. Switching Item Holograms off now converts merged piles on the ground back into ordinary stacks, instead of leaving them readable as a single item. Compatibility Paper, Spigot and Purpur from 1.17 through 26.x Java 17+ Folia detection (the Entity Optimizer reports itself as unavailable there rather than failing quietly) Config comments are preserved when toggling from the menu — your documentation and customisations are left untouched The Web Dashboard remains EXPERIMENTAL Upgrading Drop in the new JAR. The new options are added to your existing config files automatically, with the previous behaviour as the default.

This release makes every module genuinely switchable, guarantees mob AI is always handed back to vanilla, and adds an in-game control menu. It resolves several issues reported by server owners. New: in-game module menu /sb gui opens a control panel listing every module with its live status and the config file that owns it. Toggle any module on or off instantly — no /sb reload required Toggle any module on or off instantly — no /sb reload required Changes are written straight to that module's own config option, so the file stays the single source of truth A Restore Vanilla Mob AI button, and a reload shortcut Built to be tamper-proof: every click and drag inside the menu is denied, the panel holds nothing but decorative icons, permissions are re-checked on every click, and open menus are force-closed before the plugin unloads New permissions: serverbooster.gui and serverbooster.restoreai (both default to op). Fixed: modules could not actually be disabled Reported: "there is no overall enable option in config_optimize_entities.yml, and config_entity_limiter.yml doesn't have a module disable either." Both files were missing a master switch — and worse, the Entity Limiter and Entity Optimizer ignored that option entirely, so adding it by hand did nothing. Added a master enabled option to config_optimize_entities.yml, config_entity_limiter.yml and chunks_optimizer.yml Those options are now actually honoured Every one of the ten modules now has exactly one clear switch — no duplicates, no ambiguity Three modules kept their event listeners attached when switched off at runtime, so they carried on working after being "disabled". Fixed. Fixed: mob AI stayed broken after removing the plugin Reported: "when I remove the plugin the mob AI breaks, especially tamed pets. It only works again after reinstalling." The frozen state is stored inside each entity's saved data, not just in memory, so any mob that was not explicitly restored stayed frozen forever. Mob AI is now returned to vanilla through several independent paths: On a normal server stop, and before any chunk is written to disk The moment the module is switched off, across every world Automatically as chunks load, even while the module is disabled — so a disabled module converges on pure vanilla behaviour A one-time sweep at startup that reaches spawn chunks, which never reload on their own On demand via /sb restoreai or the menu button Pets are now protected by default. Tamed, leashed and sitting animals are never frozen (ignore.tamed, ignore.leashed, ignore.sitting). No more conflicts with other plugins. Mobs that another plugin is deliberately holding without AI are never taken over, and ServerBooster only ever re-enables AI on mobs it froze itself. This also settles a long-standing overlap between the Entity Optimizer and the Villager Optimizer. If you want entity optimization without ever touching mob AI, set disable-ai-for-untracked-entities: false. ▎ Before uninstalling: run /sb restoreai (or use the menu button). AI is restored automatically on a normal shutdown, but a hard crash followed by deleting the JAR leaves nothing behind to wake the mobs. Fixed: Item Holograms bypassed Residence pickup rules Reported: "even if item pickup is disabled within the residence, if two or more items merge into a stack they can be picked up regardless of the permission." Merged stacks are handed to the player directly, and that was happening before region plugins had a chance to object. Pickup handling now runs after protection plugins, so a denial from Residence, WorldGuard, GriefPrevention, Towny or Lands is final. ServerBooster also no longer shortens a pickup delay another plugin has set. Switching Item Holograms off now converts merged piles on the ground back into ordinary stacks, instead of leaving them readable as a single item. Compatibility Paper, Spigot and Purpur from 1.17 through 26.x Java 17+ Folia detection (the Entity Optimizer reports itself as unavailable there rather than failing quietly) Config comments are preserved when toggling from the menu — your documentation and customisations are left untouched The Web Dashboard remains EXPERIMENTAL Upgrading Drop in the new JAR. The new options are added to your existing config files automatically, with the previous behaviour as the default.

Item holograms now correctly display custom and renamed items instead of falling back to the base vanilla name. What's new Custom item name support on holograms. Previously, some custom items showed their base name on the merge hologram — for example, a custom "Piña" would display as "Apple x1". Holograms now resolve the item's real name using the full priority order: a. Anvil-renamed / plugin display names (already supported) b. Custom item names used by modern data-driven items, data packs, and many custom-item plugins (this is the new fix) c. Vanilla client-translated name as the fallback (unchanged) New config option in config_holo.yml: merge: hologram: use-custom-item-names: true Enabled by default. Set it to false if you prefer holograms to always show the plain, client-translated vanilla name. Existing configs receive this option automatically on update — no manual editing required. Safety & compatibility Item merging and anti-dupe protection are unchanged. Custom items keep their identity: a "Piña" will not merge with a plain apple, and merged custom items retain their real name. Fully compatible across all supported versions — on servers older than 1.20.5 the behavior is identical to before. Compatibility Paper, Spigot, and Purpur from 1.17 to 26.x Java 17+ Folia detection (EntityOptimizer auto-disables on Folia)

A major update focused on hopper flexibility and a completely rebuilt monitoring dashboard. Hopper System — Sorter-Compatible Mode By popular request, HopperOptimizer now supports redstone item sorters. New sorter-compatible-mode option in config_hopper_optimizer.yml (default: false). When enabled, hoppers move only one item per transfer cycle, exactly like vanilla, so comparator-based item sorters can filter item types reliably. Bulk transfer remains the default for maximum throughput on storage systems. Enable sorter mode only if you run item sorters — you keep the registry-based performance benefits while restoring vanilla single-item flow. Fully backward compatible: existing configs automatically receive the new option without losing any settings, thanks to config auto-merge. Web Dashboard — Complete Redesign (Experimental) The web monitor has been rebuilt from the ground up with a modern dark, calm "night" aesthetic — deep indigo and slate tones with soft ambient lighting, no harsh colors. New live panels: Hopper System — see how the hopper network is performing at a glance: active hoppers, hoppers blocked by redstone, total registered, live throughput (items per second), transfer counts, and a per-world breakdown. Redstone Activity — monitor which redstone machines are working: active chunks, throttled chunks, updates per tick, queued updates, and a live list of the busiest redstone "machines" with click-to-copy teleport coordinates. Refreshed everywhere: Redesigned hero metric cards for TPS, MSPT, Players, Memory, and Uptime, each with live sparkline graphs and health badges. Rebuilt module statistics, worlds, players, entity breakdown, chunk hotspots, and recent actions sections. Matching redesigned login screen. Click any coordinate to copy a teleport command instantly. Player and entity search filters. image Configuration & Security Zero hardcoded values. Alert thresholds (TPS and memory warning/critical levels) and diagnostic limits are now fully configurable in web.yml. Automatic config migration. When you update, new web.yml keys are added automatically without overwriting your existing values. No sensitive data is ever exposed to the browser; strict content security policy is enforced. Carried-Over Fixes (from 26.1.1 – 26.1.4) Hoppers correctly respect redstone locking (powered hoppers stop moving items). Composters, chiseled bookshelves, and other special blocks interact with hoppers normally. Hopper minecart compatibility. Vertically stacked hoppers work regardless of facing direction. Compatibility Paper, Spigot, and Purpur from 1.17 to 26.1 Java 17+ Folia detection (EntityOptimizer auto-disables on Folia)

This patch delivers a major overhaul to the Web Monitor module, critical security hardening across the entire web stack, and targeted performance fixes identified through a full codebase audit.

Note: The Web Monitor Dashboard is currently in EXPERIMENTAL phase. It is disabled by default and must be manually enabled in web.yml. Features, endpoints, and configuration options may change in future releases without prior notice.

FIX JAR (WEB)

--- Web Dashboard — Complete Rewrite (EXPERIMENTAL) - Two-tier data collection system: Fast metrics (TPS, MSPT, memory, players) update every 2 seconds. Heavy data (entity breakdown, chunk hotspots) updates every 10 seconds. This eliminates main thread impact when the dashboard is in use. - Client-awareness gate: Data collection is completely skipped when no one is viewing the dashboard. Zero overhead when unused. - Removed block scanning: The previous triple-nested loop that scanned blocks for pistons every cycle has been replaced with tile entity scanning only — dramatically reducing per-cycle cost. - Chunk scan cap: Hotspot analysis now processes only the top 200 chunks by tile entity count instead of scanning all loaded chunks. - Module Statistics panel: The dashboard now displays real-time stats from active modules — frozen entities (EntityOptimizer), lobotomized villagers (VillagerOptimizer), items moved and registered hoppers (HopperOptimizer), chunks unloaded (ChunkOptimizer), and throttled redstone chunks (RedstoneTickLimiter). - MSPT History chart: A new chart displays MSPT (milliseconds per tick) history alongside the existing TPS chart, with a 50ms danger line indicator. - Alert system: Visual banners appear when TPS drops below 15 (warning) or below 10 (critical), and when memory usage exceeds 85% (warning) or 95% (critical). - Action log: A new section shows recent optimization actions performed by the plugin in real-time. - Copy coordinates: Click any coordinate in the players table or hotspots table to copy a /tp command directly to your clipboard. - Search filters: Filter players by name or world, and filter entities by type using the new search inputs. - Last update indicator: The header now shows "Live" or "Updated Xs ago" so you always know data freshness. - Header color feedback: The header border subtly changes color based on server health — green (healthy), yellow (moderate), red (critical). - Favicon: Both the login page and dashboard now display a branded "S" favicon. --- Security Hardening - PBKDF2 password hashing: Upgraded from SHA-256 (single-pass) to PBKDF2-HMAC-SHA256 with 600,000 iterations. Passwords are automatically re-hashed on first startup. The plain-text password is removed from web.yml and replaced with the hash. - Zero hardcode policy enforced: All configuration values (port, host, username, password, session timeout, login attempts, lockout duration, update interval, TPS history size) are read exclusively from web.yml. Missing or invalid values disable the web module with a warning — no fallback defaults in code. - Timing-safe username comparison: Username verification now uses MessageDigest.isEqual() for constant-time comparison, preventing timing attacks. - CORS enforcement: The allowed-origins configuration is now actively enforced against the Origin header. Previously loaded but never applied. - CSP tightened: Removed 'unsafe-inline' from Content-Security-Policy. Removed broad ws: wss: from connect-src. Added frame-ancestors 'none'. Login page CSS and JS moved to external files to comply. - Removed deprecated X-XSS-Protection header: This header has been deprecated since Chrome 78 and can cause issues in modern browsers. - WebSocket connection cap: Maximum 10 simultaneous WebSocket connections. Excess connections are rejected with code 4008. - WebSocket session re-validation: Active WebSocket connections now re-validate their session token on every broadcast cycle. Expired sessions are automatically disconnected. - Session cleanup scheduled: Expired sessions and lockout entries are now automatically cleaned every 60 seconds. - Version information reduced: The dashboard now displays only the Minecraft version (e.g., "1.21.1") instead of the full server string that previously exposed the server software, fork name, and build number. - Protected /api/status: This endpoint now requires authentication. Previously accessible without login. - Unauthenticated /health endpoint: A new /health endpoint returns only {"status":"ok"} for external monitoring tools (UptimeRobot, Pterodactyl health probes) without exposing any server details. - No-cache headers: All responses include Cache-Control: no-store and Pragma: no-cache to prevent browser caching of sensitive dashboard data. - Safe resource loading: Internal path exposure removed — missing resources return an empty string instead of "Resource not found: path/to/file". - Silenced Javalin/SLF4J stderr output: Javalin startup logs and SLF4J warnings no longer pollute the server console. - Default host changed to 127.0.0.1: New installations bind to localhost only instead of all interfaces, preventing accidental public exposure. --- Performance Fixes - EntityOptimizer cleanup: O(1) instead of O(n*m): The frozen entity cleanup task previously scanned world.livingEntities for every cached entity ID. Now - EntityOptimizer cleanup: O(1) instead of O(n*m): The frozen entity cleanup task previously scanned world.livingEntities for every cached entity ID. Now uses UUID-based Bukkit.getEntity() lookups — constant time per entity instead of linear scan. - Dead code removed: Deleted optimizeWorld() (~60 lines) and restoreNearbyEntities() (~30 lines) — both superseded by their batched counterparts but still present in the codebase. - forceOptimize() no longer stalls main thread: Previously called the unbatched optimizeWorld() method. Now uses inline iteration with try-catch per entity. - Shared suspendOnMainThread utility: Extracted the duplicated runOnMainThread suspend function from EntityOptimizer and VillagerOptimizer into a shared SchedulerUtil.suspendOnMainThread() method. - Shutdown deadlock fixed: Replaced runBlocking { scope.cancelAndJoin() } in onDisable() with non-blocking scope.cancel(). The previous implementation could deadlock if any coroutine was awaiting the main thread via suspendOnMainThread. - Redundant shutdown scan removed: nmsManager.restoreAllEntities() was called in onDisable() after entityOptimizer.shutdown() — which already restores all entities. The duplicate full-world scan has been removed. - WebSocket broadcast optimized: gson.toJson() is now called once per broadcast cycle instead of once per connected client. --- Configuration Changes web.yml — The following defaults have changed: - host default changed from "0.0.0.0" to "127.0.0.1" - auth.password is now automatically hashed on first startup (prefixed with HASHED:) - All fields are now required — missing fields disable the web module --- Compatibility - Supports Paper, Spigot, and Purpur from 1.17 to 26.1 - Folia detection present (EntityOptimizer auto-disables on Folia) - Java 17+ required