[26.1.2] v0.9.13

Minecraft 26.1.2 support. This release adds support for Paper/Velocity 26.1.2 (the server now requires Java 25) and bundles ~5 months of features, fixes, and reliability work since v0.9.11.

✨ New features

• Minecraft 26.1.2 support — the plugin recognizes and runs on Paper/Velocity 26.1.2 (protocol 775). Requires Java 25 on the server. The verification QR GUI was migrated to InventoryFramework 0.12.0 so it renders correctly on 26.1.2.
• Age Group & Confidence Score — surfaces the player's age group and the GamerSafer confidence score in the authentication flow.
• Verify Once — player verification now persists across server restarts, so verified players are not re-prompted after a restart.
• Expanded authentication flow — new staff, verification-member, and non-verified stages, plus an unverification path.

🔧 Improvements

• Verification flow UX — removed the behavior that auto-opened the QR/info book on join (which could trap the player in a pop-up). Verification is now initiated when the player clicks the verify button (/verify) in the onboarding chat message, or when re-prompted on a blocked action.
• Staff command protection (staff-reauthentication.commands-to-check) — protected commands are now staff-only as defense in depth: a player without gsauth.authentication is denied outright, and a player with it must (re-)authenticate. Added multi-word command matching (e.g. lwc admin purge, co purge), namespace- and case-insensitive.
• Observability — added Sentry error tracking (opt-in via sentry.dsn) and a telemetry service that reports auth events to the GamerSafer datalake (toggle with telemetry.enabled).

🐛 Fixes

• Proxy mode — backend-originated plugin messages are now processed correctly in proxy (Velocity) mode.
• Under always-require-authentication: true, the first protected command after join now correctly requires /auth (previously it could run unauthenticated).

🏗️ Internal

• Common-module test coverage expanded from 21% → 72%.
• Build tooling: Gradle 8.5 → 8.14.3 and aligned Gradle plugin versions.

---

Assets: gsauth-paper-0.9.13-all.jar (Paper servers), gsauth-velocity-0.9.13-all.jar (Velocity proxies), source.zip (GPLv3 source snapshot).

[1.21.11] v0.9.11

• Updated to latest 1.21.11

[1.21.10] v0.9.10

• Fixed timeout messages
• Fixed warning notifications on first-time authentication
• Fixed an issue where, in some situations, the message was not being sent to the chat.

[1.21.10] v0.9.9

-1.21.10 support

[1.21.8] v0.9.8

Updated to latest 1.21.8

[1.21.4] v0.9.7

This includes support for 1.21.4, and additional improvements.

v0.9.3 - 1.20.4 & Cleanup Support

This updates to 1.20.4 and includes a variety of bug fixes.

v0.9.0 - The Big Split [MASSIVE UPDATE]

Downloads are located at the bottom of this post

Since early 2023, we have been hard at work on a massive update that touched 274 files and over 17,000 lines of code. This update sees a dramatic change in installation, configuration, and general usage of the service.

GSAuth v0.9.0 is primarily built as a modern, advanced Staff 2FA plugin for Minecraft server teams that want the highest level of security they can get.

Old installs will no longer be compatible, so if you are updating from a previous version, you will want to do an entirely new install. However, we've made installation as simple as possible this time around, so getting back up and running should be far easier and faster than ever before.

You can use the integrated Wiki and Issues tabs for support and bug reports.

You can purchase GSAuth Iron, Gold, and Diamond tier plans here. After checkout, you will receive an API Key and Guild ID to activate this plugin.
New GSAuth Signup

What has gone away?

Instead of focusing first on what is new in the plugin, let's talk about what was removed. Here's the quick list:

• MySQL or MariaDB is no longer required, and SQLite support has been added with it being the default storage method
• An open firewall port is no longer needed, nor will the plugin generate a webhook URL for receiving data from the GamerSafer services
• LuckPerms is no longer required or used for complicated management of player accesses. This does have the downside of being somewhat less flexible than the previous version of the plugin, but at a massive improvement to the setup process, stability, and accessibility to a wider variety of server setups that use other permission plugins
• Punishment features and commands are no longer included as part of the GSAuth plugin, but if you install v0.4.0+ of our GSBans plugin you will see the two work very nicely together. GSBans also includes many new features such as Discord integration, a new punishment list GUI, and more, which you can check out on BuiltByBit, here: https://builtbybit.com/resources/gsbans-beta.22802/
• The onboarding world has been removed in favor of the new onboarding flow
• QR codes are no longer generated on maps in the actual game world, in favor of the new onboarding flow
• The plugin now only supports Java Edition servers running 1.18.2 or newer
• The preferences.yml file has been removed in favor of a new system being released in the future

New:

Removing those items above was primarily about making installation and usage far simpler and more stable than before, but that comes with a variety of newly added improvements which you should know about:

• SQLite storage option (is now default)
• When running a proxied network (Velocity, Bungee, Waterfall, etc...), child servers (Paper, Spigot, etc...) have an updated config to reflect how the proxy server handles all of the major configuration options and communication with our API
• GSAuth now communicates properly with GSBans v0.4.0+ when both plugins are installed together
• If you want to require a player to perform an authentication on login, give them the gsauth.verify permission in the permissions plugin of your choice. The plugin will grant or deny access based on what you set in the config.yml file
• Commands can be whitelisted for players to use before they authenticate in a new section in the config.yml file
• QR codes are now displayed in the Cartography table GUI. Scan the QR code with the GamerSafer app just as you did in previous versions, then click the green Emerald Block to confirm the scan was completed

• Players can hover over the book in the GUI and click to swap hands (usually the F key) to close this GUI (if enabled in the config).
• After the GamerSafer account has been linked, when a player with the gsauth.verify permission logs in again they will be asked to authenticate using the push notification sent to their phone. They will be shown a book in the game with a message telling them what to do. Once they complete the authentication, they can click the re-verify link in the book to close the book and continue.

• Players can click the "X" in the top left corner of the book to close it and play as normal, if this option is enabled in the config.
• Type /gslink [playerName] to show the QR code again if the player closed the book or cartography table
• Improvements to plugin and GamerSafer APIs
• Many improvements to crush bugs, compatibility errors, conflicts, and unoptimized events

v0.8.2 - A New Home

This update focuses on a number of quality of life improvements before a major restructuring is done with v0.9.0 later this year.

Important:

Moving forward we will be releasing the GSAuth plugin jars here on Github. You can download the plugin files here for free, but you will still need an API key in order to use our integrated service.

You can use the integrated Wiki and Issues tabs for support and bug reports.

We also have an entirely new checkout process for GSAuth Iron, Gold, and Diamond tier plans. Existing customers should sign up on the new checkout site in order to keep their service active.
New GSAuth Signup

New:

• New player-preferences.yml sets the groundwork for a future feature allowing servers to adjust in-game settings and permissions for players based on their GamerSafer profile. This first feature allows restricting chat based on the self-assigned age group of the player (no PII is shared)

adult:
   allow-send-chat: true
youth:
   allow-send-chat: true
minor:
   allow-send-chat: true

• New optional -b parameter in punishment commands for broadcasting to the server
• New messages.yml format to define messages for players already in the guild versus non-guild member players (learn more in the messages.yml section of the wiki)
• If a server network is running 1.19.1 with signed chat messages disabled, and a player in the latest version of the game with signed chat messages tries to chat while the player is muted (for any number of reasons), the chat message is no longer cancelled but the player is kicked from the server. This is an error relating to how Velocity handles chat signing and canceling, and while we wait for Velocity (or Mojang) to make it possible to cancel these chat messages, we have opted instead to kick the player with a message that explains to them what happened. If we do not kick the player, the server will automatically kick the player with an error message that is not helpful to the player. You can change the message for this kick screen in messages.yml

kick-1191plus-onchat-screen: <color:#d84684><b>You are muted!<reset>

Changes/Fixes:

• Updated default config and message settings for quicker install
• Players are no longer invisible to each other in /gsroom
• Players that are required to authenticate with GS (those with a gs-required perm) are no longer added to the NotAuth group in LuckPerms
• Fixed some issues with confusing console logs relating to punishments
• Fixed some issues relating to login logic when a player has been punished or unpunished
• Fixed a bug where the reminder message timer was not properly repeating at the set interval
• Fixed a bug where unsaved maps in the world could be wiped when a player completed QR code scanning
• Console log now shows what LuckPerms groups were added and removed during player login and authentication steps
• Fixed an error relating to improperly formatted language files