Skip to content

v26.1.1

Latest
Latest

Choose a tag to compare

View all tags
@SrCodexStudio SrCodexStudio released this 19 Jun 01:20
v26.1.1
99a0864
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v26.1.1 — Security Hardening, Thread Safety & Performance Overhaul

A major security and stability release addressing 10 findings from a comprehensive multi-agent audit (12 analysts, 6 review rounds). This update resolves 2 critical vulnerabilities, 3 high-severity issues, and multiple medium/low improvements.

Critical Fixes

  • Plugin Scope Lifecycle — Fixed a critical bug where the coroutine scope would silently die after a plugin reload, causing all async operations (alt detection, VPN checks, join processing) to stop working without any error or warning
  • GeoIP Rate Limiter Bypass — Replaced the token bucket with a sliding window implementation and added deny-by-default behavior for rate-limited or unresolved lookups, preventing attackers from bypassing VPN detection and country restrictions through API exhaustion

Security

  • GeoIP lookups now default to HTTPS providers first, preventing IP addresses from being transmitted in plaintext
  • Discord webhook URLs are now validated against a domain allowlist to prevent SSRF attacks
  • Import command now validates all fields post-deserialization, preventing injection of malformed data
  • Tab completion for ban commands now requires proper permissions before exposing IP addresses

Thread Safety & Folia Compatibility

  • Fixed unsafe Bukkit API access from IO threads when kicking banned players — previously caused intermittent crashes and guaranteed failures on Folia
  • All cache clearing operations now use atomic swap patterns to prevent readers from observing partially-cleared state
  • Country rule initialization now uses volatile fields with atomic swap for safe concurrent access

Performance

  • SQLite connection pool reduced from 10 to 3, eliminating SQLITE_BUSY contention under load (SQLite only supports a single concurrent writer)
  • Fixed operator precedence bug in CIDR IP count estimation that produced incorrect values for prefix lengths below 12

Database Safety

  • Automatic database backup is now created before schema migration on every startup
  • Schema manager remains fully backward-compatible — only adds new columns, never drops existing data

Other Changes

  • Updated bStats plugin ID
  • Supports Minecraft 1.17 through 26.1.2
  • Folia-compatible scheduling throughout

Full Changelog: 10 findings addressed across 11 source files
Compatibility: Paper, Spigot, Folia — Minecraft 1.17+

Assets 3
Loading