StormtrooperX

What's New

Fixed

- Shaded-JAR JDBC driver discovery. H2 and MySQL Connector/J both ship a META-INF/services/java.sql.Driver file. The shade previously kept only H2's, verbatim and unrelocated, so ServiceLoader-based driver discovery pointed at a class name that didn't exist in the JAR for H2, and was missing entirely for MySQL. The shade plugin now merges service files via ServicesResourceTransformer and relocates their contents; the shipped java.sql.Driver entry lists both bundled drivers under their relocated names. - MySQL connections now use the bundled driver by design. DatabaseManager sets HikariCP's driverClassName explicitly, so the pool loads the shaded Connector/J 9.7.0 instead of silently falling back through DriverManager to whatever MySQL driver the server platform happens to bundle. MySQL setups now get the pinned, attested driver version regardless of server flavor.

Changed

- JAR slimmed ~36% (7.7 MB → 4.9 MB). Excluded protobuf-java and Connector/J's X-protocol classes (com/mysql/cj/x/**) from the shade, both exist solely for the X DevAPI, which Oracle removed upstream in Connector/J 9.0, so they were dead code (~7.4 MB uncompressed). - No more unrelocated classes in the JAR. org.slf4j (HikariCP's transitive dependency) is now relocated under com.goobercraft.stormtrooperx.slf4j like every other shaded dependency, eliminating a potential classpath conflict with other plugins or the server's own slf4j. Dependency metadata that survives shading uselessly (module-info.class, META-INF/maven/**, META-INF/versions/**, META-INF/native-image/**) is stripped.

Dependencies

- Bumped me.clip:placeholderapi from 2.12.2 to 2.12.3 (provided scope, soft dependency, not shaded into the JAR). - Bumped org.junit.jupiter:junit-jupiter from 6.1.0 to 6.1.2 (test scope).

Upgrade Notes

If upgrading from 1.10.0: Drop-in replacement. No config schema change (config-version: 3 continues to apply, no migration runs), no permission changes, no command changes. - H2 users (default): no behavior change, just a smaller download. - MySQL users: connections now always use the plugin's bundled Connector/J 9.7.0. If your setup was unknowingly relying on the server's own bundled MySQL driver version, this release pins you to the attested one shipped in the JAR. Server compatibility: Unchanged - Spigot, Paper, Purpur, and Folia 1.20.4+, on Minecraft 1.18 through 26.1.x, Java 17+. JAR verification: Built and attested via GitHub Actions with Sigstore. Verify with gh attestation verify StormtrooperX-1.10.1.jar --repo GooberCraft/StormtrooperX (requires gh 2.43.0+).

What's New

Added

- Permission-aware tab completion for /stormtrooperx. The first argument completes to only the subcommands the sender may actually run; for optout/optin, the second argument completes to online player names — but only for admins holding stormtrooperx.optout.others. Tab-completion pools are pre-sorted and computed once at startup. - `/stormtrooperx help` lists only the commands the sender has permission to run, so a regular player no longer sees admin-only subcommands they can't use. - Idempotent `optout` and new `optin`. optout no longer toggles — it always sets opted-out (reporting "already opted out" instead of silently flipping). optin is the symmetric counterpart. toggle is retained for the flip behavior. - Admin opt-out management. /stormtrooperx optout|optin <player> lets admins manage opt-out state for any online player, gated by the new stormtrooperx.optout.others permission. The target receives a chat notification of the change. - `stormtrooperx.admin` permission, required for /stormtrooperx reload and granting stormtrooperx.optout.others via permission children. The previous setup had no clean "give one player everything" knob. - Join-time opt-out reminder. When an opted-out player's state finishes loading from the database, they get a one-shot chat message confirming the status. - PlaceholderAPI soft dependency. When PlaceholderAPI is present, %stormtrooperx_optout% resolves to true/false for the requesting player. The expansion persists across /papi reload. PAPI is a soft dependency only — the plugin loads and runs identically without it.

Changed

- Projectile math extracted. The speed-preserving direction perturbation now lives in a package-private ProjectileNerf.perturb(Vector, double, Supplier<Vector>) with an injectable random source, making the pure-math invariants directly unit-testable without event mocking. Runtime behavior is unchanged. - `stormtrooperx.use` default flipped from `op` to `true` so non-op players can actually reach /stormtrooperx optout (itself default: true). The old default made the public opt-out command unreachable for the audience it was meant for. - Ignores cancelled `EntityShootBowEvent`. onBowShoot now declares @EventHandler(ignoreCancelled = true) — if an upstream plugin cancels the shoot event, we no longer perturb the (cancelled) projectile's velocity. - HikariCP MySQL pool sets the Connector/J performance properties from the HikariCP wiki: useServerPrepStmts, useLocalSessionState, rewriteBatchedStatements, cacheResultSetMetadata, cacheServerConfiguration, elideSetAutoCommits, maintainTimeStats=false. No config change needed. - Hot-path micro-optimizations in onBowShoot: lengthSquared() for the zero-velocity guard, cached projectile and isH2 references, pattern-matching instanceof.

Fixed

- Folia regional-thread safety on `/stormtrooperx reload`. entityConfigs and debug are now volatile, and loadConfiguration publishes a freshly-built EnumMap in a single reference write instead of mutating the live map. The old code could expose a partially populated map to a regional EntityShootBowEvent thread during a reload.

Security

- CWE-117 log injection — release tags. Closed log-injection vectors in UpdateChecker. GitHub release tags pass a validateReleaseTag barrier (^v?\d+(\.\d+){0,3}([-+][A-Za-z0-9.-]+)?$) before reaching any logger or version compare; malformed tags are dropped at the source. - CWE-117 log injection — sink-side allowlist. A new sanitizeForLog helper reduces logged version strings at the sink to [A-Za-z0-9._+-] via a negated-character-class replaceAll — the form CodeQL recognizes as a sanitizer (a [\r\n] denylist does not satisfy java/log-injection). - JDBC parameter smuggling. DatabaseManager now validates the MySQL properties map against an explicit allowlist (SAFE_MYSQL_PROPERTY_KEYS) and URL-encodes values. Unsupported keys throw IllegalArgumentException at initialize(). This closes a parameter-smuggling vector that could otherwise enable high-risk Connector/J flags (allowLoadLocalInfile, autoDeserialize, queryInterceptors, …) with RCE / file-read history. - Defense-in-depth Connector/J defaults. Even with the allowlist, dataSourceProperties forces allowLoadLocalInfile=false, allowUrlInLocalInfile=false, autoDeserialize=false, and allowPublicKeyRetrieval=false at the HikariCP layer. - Chat-injection echo. Player names echoed by the offline branch of /stormtrooperx optout|optin <player> are run through a new sanitizeNameForEcho (strips control chars and §, caps at 16 chars), closing a low-severity chat-injection vector on offline-mode servers. - AssertJ pinned to 3.27.7 (test-scope), clear of CVE-2026-24400 (GHSA-rqfh-9r24-8c9r — XXE in the unused isXmlEqualTo).

Build

- CycloneDX SBOM. Added cyclonedx-maven-plugin on the verify phase; release.yml uploads bom.xml/bom.json alongside the JAR. - `release.yml` actions pinned to commit SHAs (with # vX.Y.Z trailers) instead of mutable major tags — the release job holds id-token / attestations: write scope. Dependabot keeps the pins current.

Tests

- AssertJ added. Migrated assertions to fluent assertThat(...) style for richer failure messages. Mockito 5.x + JUnit Jupiter 6.x stack is unchanged. - Branch-coverage gate. Jacoco now enforces BRANCH COVEREDRATIO >= 0.50 per package alongside the existing 0.60 line-coverage rule. Current: 72% line / 75% branch. - CI runs `mvn clean verify` instead of package, so the Jacoco gate (bound to verify) is enforced in CI — not just locally. - Shared test infrastructure. New support/ test package: TestSupport (reflective field/method access) and InlinePluginScheduler (shared inline scheduler), replacing duplicated boilerplate across test classes. - YAML fixtures under src/test/resources/fixtures/ (config-v2.yml, config-v3.yml); ConfigMigrationTest exercises real-load → migrate → assert instead of synthetic YamlConfiguration objects. - New `ProjectileNerfTest` for the extracted pure function — speed preservation, zero-velocity guard, mutation semantics, accuracy clamping. Plus expanded UpdateCheckerTest covering validateReleaseTag accept/reject sets.

Dependencies

- Bumped me.clip:placeholderapi from 2.11.6 to 2.12.2 (provided scope, soft dependency — not shaded into the JAR).

Documentation

- OptOutManager#isOptedOut, StormtrooperXExpansion, and the README PlaceholderAPI section all document the online-only semantics of %stormtrooperx_optout%: offline players resolve to false regardless of persisted state. - DatabaseManager.initializeH2 Javadoc now warns against enabling AUTO_SERVER=TRUE / H2 server mode without revisiting the hardcoded sa/empty credentials.

Upgrade Notes

If upgrading from 1.9.x: - Behavior change — `/stormtrooperx optout`. Previously toggled; now it always sets opted-out. Use /stormtrooperx toggle for the old flip behavior. If you bind macros or scripts to the command, this is a one-line update. - Permission default change — `stormtrooperx.use`. Default flipped from op to true so the optout subcommand (always default: true) is reachable for the intended audience. Servers using a permissions plugin that explicitly granted stormtrooperx.use to non-ops are unaffected; servers relying on the old default should explicitly deny stormtrooperx.use to revert. - New permissions to wire up (admins): stormtrooperx.admin (grants reload and optout.others via children) and stormtrooperx.optout.others (grants admin opt-out commands for other players). Both default to op. - PlaceholderAPI is optional. To use %stormtrooperx_optout%, install PlaceholderAPI; no config change required. - Config: No schema chan

What's New

Added

- Folia support via a runtime-detected PluginScheduler abstraction. On Folia 1.20.4+, async work routes through Folia's AsyncScheduler / GlobalRegionScheduler (via reflection so the Spigot API 1.18 compile dependency is unchanged). On Spigot, Paper, and Purpur the legacy BukkitScheduler is used. The scheduler is selected once at plugin enable; plugin.yml declares folia-supported: true. - Graceful Folia fallback. If RegionizedServer is detected but Folia's scheduler API cannot be bound (e.g., a future signature change), PluginScheduler.create logs a WARNING and falls back to the legacy scheduler instead of failing plugin enable. Async tasks continue working in degraded mode rather than bricking the plugin.

Changed

- `DatabaseManager` H2 thread safety. H2 operations (isOptedOut, setOptOut) are now serialized through an internal lock. JDBC Connection instances are not thread-safe, and Folia's regional async pool can dispatch concurrent opt-out reads/writes onto the single shared H2 connection. The MySQL path is unchanged — HikariCP gives each thread its own pooled connection, so no lock is taken there. - `UpdateChecker` callback contract. The update-check callback is now invoked on the async worker thread instead of being hopped back to the main thread. Logging only (java.util.logging is thread-safe). The previous main-thread hop was unnecessary on Spigot/Paper and forbidden on Folia. Javadoc on UpdateCallback#onComplete documents the off-thread contract. - Constructor signatures. OptOutManager now takes PluginScheduler in place of Plugin; UpdateChecker now takes an additional PluginScheduler argument. Internal change — affects no plugin.yml/permissions surface, no end-user config.

Security

- Tightened `UpdateChecker` `githubRepo` validation to ^[a-zA-Z0-9._-]+/[a-zA-Z0-9._-]+$ (matching GitHub's actual repo-name charset). Defense-in-depth against path traversal, CRLF injection, and arbitrary URL-component characters in the segment that flows into the GitHub API URL. The current call site is hardcoded to GooberCraft/StormtrooperX, so this is preventative only.

Tests

- New PluginSchedulerTest — 7 tests covering the legacy scheduler delegation (via MockedStatic<Bukkit>) and the factory's non-Folia branch - New UpdateChecker constructor tests — 5 tests covering semicolon injection, multi-segment paths, path traversal, CRLF injection, and the valid-character allowlist - Total test count: 156 → 170

Upgrade Notes

If upgrading from 1.8.x: No configuration changes required. plugin.yml adds folia-supported: true automatically; existing config.yml files continue to work as-is. Server compatibility: Folia 1.20.4+ is now supported in addition to Spigot, Paper, and Purpur. Folia is detected automatically at startup — log message confirms which scheduler is in use (Folia detected, using regional schedulers vs Standard Bukkit scheduler in use). No Folia or Paper API dependency was added to the build; the plugin still compiles against Spigot API 1.18. JAR verification: Built and attested via GitHub Actions with Sigstore. Verify with gh attestation verify StormtrooperX-1.9.0.jar --repo GooberCraft/StormtrooperX (requires gh 2.43.0+).

What's New

Added

- Parched mob support (Minecraft 1.21.11+, Mounts of Mayhem) — the new desert skeleton variant that fires Arrows of Weakness with a bow. Treated as a standard bow user for accuracy nerfing. Gracefully disabled on servers older than 1.21.11.

Tests

- Added EntityConfigLoadingTest — 10 tests covering both loadEntityConfig variants, the version-gated IllegalArgumentException fallback (the path Parched takes on older servers), and the displayEntityStatus Disabled branch - Total test count: 146 → 156 - StormtrooperX class line coverage improved from 61% → 72% - Tightened Jacoco package line-coverage minimum from 0.50 → 0.60

Dependencies

- Bump JUnit Jupiter from 5.14.3 → 6.0.3 (major version; transparent upgrade with no production-code impact)

Documentation

- Backfilled CHANGELOG entries for v1.6.3 (Modrinth publishing + dependabot/CI bumps) and v1.7.0 (Java 11 drop, MC 1.18 baseline, +5 test classes) which previously shipped without release notes

Upgrade Notes

If upgrading from 1.7.x: No configuration changes required. The new parched: entry is added with sensible defaults (enabled, accuracy 0.7) on first config regeneration; existing configs continue to work as-is. Server compatibility: Parched only spawns/exists on Minecraft 1.21.11+. On earlier versions, the plugin logs Entity 'Parched' is not available in this Minecraft version (1.21.11+ required) and continues normally — no errors, no startup failures.

What's New

Compatibility

- Dropped Java 11 support — minimum is now Java 17 - Raised minimum Minecraft version to 1.18 — drops support for 1.13–1.17 - Added Minecraft 26.1.x support - Added Java 25 to CI test matrix (17, 21, 25)

Dependencies

- Bump mysql-connector-j 9.6.0 → 9.7.0

CI / GitHub Actions

- Bump codecov/codecov-action v5 → v6 (Node 20 → 24) - Bump softprops/action-gh-release v2 → v3 (Node 20 → 24)

Tests

- Added BowShootEventTest — 8 tests covering onBowShoot() event handler - Added CommandHandlerTest — 11 tests covering all onCommand() paths - Added ConfigMigrationTest — 4 tests covering migrateConfigToV3() - Expanded OptOutManagerTest — async DB exception handling coverage - Expanded PluginResourceTest — api-version assertion

Upgrade Notes

If upgrading from 1.6.x: No configuration changes required. Your existing config.yml is fully compatible. Java requirement: Java 17 or higher is now required. Minecraft 1.18+ already requires Java 17, so this should have no impact on existing servers.

Dependency Updates - Updated mysql-connector-j from 9.5.0 to 9.6.0 (7 bug fixes including multihost URL and batch statement handling) - Updated bstats-bukkit from 3.1.0 to 3.2.1 (improved robustness against exceptions) - Updated org.jetbrains:annotations from 26.0.2 to 26.1.0 - Updated Maven build plugins (compiler 3.15.0, surefire 3.5.5, shade 3.6.2)

What's Changed

Performance

- Use EnumMap for faster entity config lookups (~30% improvement)

Bug Fixes

- Guard against zero-length velocity vectors (prevents NaN in edge cases) - Validate MySQL pool configuration values with clear warnings for invalid settings

Documentation

- Document valid ranges for MySQL pool settings in config.yml

Dependencies

- Update Mockito from 5.15.2 to 5.20.0 Full Changelog: https://github.com/GooberCraft/StormtrooperX/compare/v1.6…