[1.5.1] — 2026-06-03

Fixed

• [HIGH] Protection-plugin bypass — veinmine queued before WorldGuard/Lands/GriefPrevention could cancel the event — onBlockBreak listened at EventPriority.NORMAL. Protection plugins (WorldGuard, Lands, GriefPrevention, Residence) typically cancel BlockBreakEvent at HIGH priority, after NORMAL. When a player tried to break a protected ore, the protection plugin had not yet cancelled the event when BVM ran, so VeinmineTask was scheduled with runTask(). One tick later, the task fired: the origin block was still intact (its break was cancelled), but all extra vein blocks within the protected region were broken without the player having any permission to do so. Changed to EventPriority.HIGH with ignoreCancelled = true. Protection plugins that act at NORMAL or LOW still cancel the event first; protection plugins at HIGH that cancel before BVM now prevent the task from being queued entirely.

• [SMALL] BFS visited-cap break only exited the inner faces loop, not the BFS while-loop — When the visited set reached the visitedCap (maxBlocks × 4) sentinel, the break statement inside the for (int[] d : FACES) loop exited the for body but left the outer while (!queue.isEmpty()) loop running. The queue continued draining, processing each already-enqueued block and attempting to expand further neighbours on every poll (immediately re-hitting the cap check each time). For a world-gen-modded server with a very large ore deposit this was a redundant tight loop running every BFS iteration until the capped queue finally drained. Replaced with a Java labeled-break (break bfs) that exits the outer while-loop immediately when the cap is reached.

• [COSMETIC] Stale version comment in config.yml — Header comment still read Better Veinminer v1.2.0 — Configuration since the file was not updated during the v1.4.0 or v1.5.0 releases. Updated to v1.5.1.

[1.5.0] — 2026-05-22

Fixed

• [HIGH] Daily-limit counter not persisted — restart bypass — dailyUsageTracker existed only in RAM. A server restart mid-day cleared the map to zero, allowing players who had already reached their daily cap to veinmine freely after any restart or plugin reload. The map is now saved to data.yml via the serialised BVM-StatsIO executor on shutdown and on every daily reset. It is restored during onEnable() before the reset check, so the data is properly cleared (not silently discarded) when a day boundary is crossed while the server was offline.

• [HIGH] Blocking file I/O from async timer thread — saveLastResetDate() called YamlConfiguration.save() directly on the runTaskTimerAsynchronously thread, bypassing the BVM-StatsIO executor that serialises every other write in the plugin. This could race with onDisable() flushing the same file. The method is replaced by saveDataYmlAsync(), which snapshots both the reset date and usage counters on the calling thread and submits the actual I/O to the existing BVM-StatsIO executor.

• [MEDIUM] Cooldown message with {remaining} placeholder never sent — When a player triggered veinmine while still on cooldown, the listener silently returned without feedback. The config already declared a cooldown message key with a {remaining} placeholder; it was simply never used. The remaining milliseconds are now calculated and the formatted message is sent to the player's action bar, matching the UX pattern of the success message.

• [MEDIUM] Permission priority non-deterministic — VIP+Premium received random limits — getEffectiveCooldown() and getEffectiveMaxBlocks() iterated HashMap whose entry order is not defined by Java. A player holding both betterveinminer.vip and betterveinminer.premium could receive either tier's limits depending on hash collisions that vary between JVM instances and restarts. The permissionMaxBlocks and permissionCooldowns maps are now LinkedHashMap instances whose entries are inserted during PluginConfig.reload() sorted by max-blocks descending. Iteration therefore always encounters the highest-privilege permission first.

• [MEDIUM] Daily counter incremented before veinmine task confirmed success — dailyUsageTracker was incremented in onBlockBreak() before VeinmineTask ran. If the BetterVeinmineEvent was cancelled by another plugin, or all extra blocks were denied by protection plugins (extraCount == 0), the player lost one daily use without breaking anything. The increment is now deferred to inside VeinmineTask.run(), executed only after extraCount > 0 is confirmed.

• [MEDIUM] Cooldown cleanup evicted active entries for long per-ore cooldowns — The cleanup timer removed cooldowns entries older than config.getCooldownMs() (default 200 ms). If a per-ore cooldown (e.g. EMERALD_ORE: 1500) or a permission cooldown was longer than the base, an entry could be evicted while still within its own active window. The player's next break would find null in the map and bypass the cooldown. The timer now calls config.getMaxConfiguredCooldown(), which returns the maximum of the base, all per-ore, and all permission cooldown values.

• [SMALL] breakNaturally(tool) used stale 1-tick-old tool snapshot — VeinmineTask captured the held ItemStack at BlockBreakEvent time and used it for every breakNaturally() call one tick later. If a player legitimately swapped to a higher-Fortune pickaxe during that tick, all drops were calculated with the old tool's enchantments. The task now reads the item currently in the recorded slot at break time and falls back to the snapshot only if the slot is empty.

• [SMALL] instance static field not cleared on disable — onDisable() did not set instance = null. If a third-party plugin cached the return value of BetterVeinminer.getInstance() and called it after the plugin was disabled (e.g. during /reload), it received a fully torn-down instance whose statsManager and config fields had already been discarded, potentially causing NPEs. instance is now set to null as the last action in onDisable().

• [SMALL] BFS visited set unbounded on abnormally large ore clusters — The BFS loop stopped adding to toBreak at maxBlocks, but continued enqueuing and visiting neighbours until the queue drained. On a world-gen-modded server with a massive ore deposit, visited could accumulate tens of thousands of entries in a single tick. A hard cap of maxBlocks × 4 entries is now enforced on the visited set; the loop breaks immediately when the cap is reached.

Changed

• BetterVeinminer.onDisable() now flushes data.yml (daily usage + reset date) via saveDataYmlAsync() before calling statsManager.shutdown(), ensuring all data is written to the serialised executor queue before the 5-second drain begins.
• StatsManager.getIoExecutor() added to expose the single-threaded executor to other components within the plugin.
• PluginConfig.getMaxConfiguredCooldown() added to return the longest cooldown value across all configuration sources.
• BetterVeinminer.getDailyUsageTracker() added to allow VeinmineTask (inner class) to increment the map after confirmed success, without requiring a public field.

[1.4.0] — 2026-05-14

Fixed

• [CRITICAL] Async save race condition — StatsManager.saveAll() was scheduled as an async task and read PlayerStats fields directly while the main thread was still writing to them. A player could lose stats or receive a corrupted save file depending on thread timing. The auto-save timer now runs on the main thread to take a point-in-time snapshot via the new PlayerStats.copy(), then hands each snapshot to a single-threaded ExecutorService for file I/O. The snapshot is fully consistent; the I/O thread never sees a half-written state.

• [CRITICAL] Concurrent YAML write corruption — The async auto-save timer and the onQuit async save could both be writing the same player's file simultaneously, producing a truncated or structurally invalid YAML file. All disk writes are now submitted to a single-threaded ExecutorService (BVM-StatsIO). Only one write per file can be in progress at any time. StatsManager.shutdown() called from onDisable() blocks up to 5 seconds to guarantee all pending writes complete before the plugin unloads.

• [CRITICAL] Daily reset based on server uptime, not real calendar date — The reset used 24 * 60 * 60 * 20L ticks (24 hours of server uptime). TPS lag caused the timer to drift, and a server restart before 24 hours elapsed reset the timer entirely, effectively disabling the daily limit. Replaced with a LocalDate.now() comparison: the last reset date is persisted to plugins/BetterVeinminer/data.yml and checked on startup (to catch any resets missed while the server was offline) and every 2 minutes (to detect midnight without requiring an exact timer).

• [HIGH] Cooldown cleanup removed entries too aggressively — The cleanup task that evicts stale entries from the cooldowns map used a hardcoded 60-second cutoff (System.currentTimeMillis() - 60_000L). If the configured cooldown exceeded 60 seconds, player entries were evicted while the cooldown was still active. On the next vein break the lookup returned null and the cooldown was silently bypassed. The cutoff now uses config.getCooldownMs().

• [HIGH] Protection plugin bypass — Extra blocks in the vein were broken with block.breakNaturally(tool) without first firing a BlockBreakEvent. WorldGuard, GriefPrevention, Lands, and Residence listen to BlockBreakEvent to enforce region protection; because no event was fired, blocks in protected regions could be destroyed. A BlockBreakEvent is now fired for each extra block before it is broken; if any listener cancels the event, that block is skipped.

• [HIGH] Missing anti-recursion guard — The protection-plugin fix above fires BlockBreakEvent programmatically, which caused the plugin's own onBlockBreak listener to trigger again for each block, scheduling a new VeinmineTask per block and creating an infinite chain. A miningPlayers Set<UUID> marks any player whose veinmine session is currently active; onBlockBreak returns immediately if the player's UUID is already present. The set is always cleared in a finally block to ensure a player can never be permanently locked out.

• [MEDIUM] 26-direction BFS linked separate nearby veins — The BFS scanned all 26 neighbours (3×3×3 cube), allowing diagonal connections to bridge two distinct ore veins that happened to be close together. Vanilla Minecraft generates ores using face-adjacent placement only, so diagonal connections are always false positives. Changed to 6-direction (face-adjacent) BFS. This also reduces the maximum queue size by up to 4×, improving TPS on large veins.

• [MEDIUM] Unbreaking durability formula was deterministic, not vanilla-accurate — The old calcDamage() computed Math.round(hits × multiplier × 1/(unbreaking+1)) and clamped to a minimum of 1. Vanilla Minecraft independently rolls each hit: each has a 1/(unbreaking+1) chance to actually apply damage. The clamped average could never produce 0 damage even with high Unbreaking levels and few hits. calcDamage() now performs a per-hit Bernoulli trial using Math.random(), matching vanilla behaviour including the possibility of 0 damage.

• [MEDIUM] PlayerStats exposed public mutable fields — All four fields (blocksMined, totalOresCollected, currentTier, veinminesUsed) were public, allowing any code to set them to negative or overflowed values without validation. All fields are now private. Setters clamp values to valid ranges (e.g. tier ≥ 1, counts ≥ 0). The new copy() method supports safe async snapshotting.

• [MEDIUM] Config accepted invalid numeric values — Values such as max-blocks: -1 or damage-multiplier: -100 were loaded without validation, producing undefined behaviour (negative BFS limit, inverted durability, server lag). All numeric fields are now clamped on load: max-blocks → [1, 1000], cooldown-ms → [0, 300000], damage-multiplier → [0.1, 10.0], limit-per-day → [1, 100000], base-exp → [0, 10000].

Clarified (not a bug)

• Tool swap exploit (audit report #7) — The report described a tool-swap exploit where a player could switch items during the 1-tick task delay to bypass restrictions. This was already fixed in v1.2.1: VeinmineTask records the inventory slot and tool snapshot at event time, then re-validates with isSimilar() before applying durability. No change needed.

Changed

• Auto-save timer switched from runTaskTimerAsynchronously to runTaskTimer (main thread) so snapshot collection is always synchronised with game state. The actual file I/O is still off the main thread via the BVM-StatsIO executor.
• onDisable() now calls statsManager.shutdown() (blocking flush with 5 s timeout) instead of saveAll() directly, guaranteeing all pending I/O completes before the plugin unloads.

[1.3.0] — 2026-04-25

Added

• BetterVeinmineEvent — Custom cancellable Bukkit event fired just before extra blocks are broken. Other plugins can now:
  • Cancel the entire veinmine via event.setCancelled(true)
  • Inspect the block list via event.getBlocks() (unmodifiable)
  • Override the EXP reward via event.setExpReward(int)
  • Read the ore type via event.getOreType()
• StatsManager — Full YAML persistence for PlayerStats. Stats are now saved to plugins/BetterVeinminer/stats/<uuid>.yml and survive server restarts.
  • Stats load synchronously on PlayerJoinEvent (file is tiny, no noticeable delay)
  • Stats save asynchronously on PlayerQuitEvent
  • Auto-save every 5 minutes (async) while the server is running
  • Final synchronous flush in onDisable() to guarantee no data loss on shutdown

Fixed

• NullPointerException on missing config sections — PluginConfig.reload() called .getKeys(false) directly on the return value of getConfigurationSection(...), which returns null when the section is absent from config.yml. This caused an NPE crash on any server where ore-multipliers.multipliers, per-ore-cooldowns.cooldowns, or permission-levels were omitted or empty. All three sites now null-check the section before iterating.
• Player-offline NPE in VeinmineTask — The task is scheduled 1 tick after the BlockBreakEvent. If the player disconnects in that window (network drop, kick, crash), every subsequent field access on the Player object threw a NullPointerException. Added an early if (!player.isOnline()) return; guard at the top of run().
• {uses} placeholder never replaced in /bvm stats — showStats() built the message with {blocks} and {tier} substitutions but forgot {uses}, so the literal string {uses} was printed to the player.
• {blocks} placeholder never replaced in tier-up message — The tier-up message template "You reached Tier {tier}! New max blocks: {blocks}" only had {tier} replaced; {blocks} was left as-is in the output.
• sendActionBar(String) deprecated in Paper 1.21 — Replaced with the Adventure API: player.sendActionBar(LegacyComponentSerializer.legacySection().deserialize(msg)). This eliminates the deprecation warning in server logs and future-proofs the call.
• Scheduler tasks not cancelled on disable — onDisable() cleared data maps but never called Bukkit.getScheduler().cancelTasks(this). The cooldown-cleanup and daily-reset runnables could fire after the plugin was disabled (e.g. during /reload), accessing a partially torn-down plugin instance. cancelTasks(this) is now the first action in onDisable(), before any data is flushed or cleared.

Changed

• onDisable() now cancels all plugin tasks before flushing data, then calls statsManager.saveAll() as a final synchronous write to guarantee persistence.
• VeinmineTask now collects extra blocks into a List<Block> (instead of iterating Set<Block> with an origin equality check) to pass cleanly to BetterVeinmineEvent.
• EXP calculation is now performed before the event is fired so listeners can read and override the reward via event.setExpReward(int).

fix bug

[1.2.1] — 2026-03-16

Fixed

• Critical Item Swap Bug — Fixed a bug where switching items during a veinmine task (0.05s delay) could overwrite a new item in the player's hand with the old tool, potentially causing item loss. The task now tracks the specific inventory slot and verifies the tool's identity before applying durability changes.
• UX Improvement — Success messages are now sent to the Action Bar instead of the chat to prevent spamming the chat history for active miners.

[1.2.0] — 2026-03-14

Added

• Tier System — Players automatically progress through 4 tiers as they mine more blocks:
  • Tier 1: 32 max blocks (0 blocks mined)
  • Tier 2: 64 max blocks (100k blocks mined)
  • Tier 3: 128 max blocks (500k blocks mined)
  • Tier 4: 256 max blocks (1M blocks mined)
• Player Statistics — Track blocks mined, veinmines used, and current tier
• New Commands: /bvm stats and /bvm tier for player progression tracking
• Ore Multipliers — Configure different drop multipliers for different ore types (e.g., diamonds worth 1.5x)
• Per-Ore Cooldowns — Optional: Set different cooldown times per ore type
• Permission-based Limits — VIP (betterveinminer.vip) and Premium (betterveinminer.premium) tiers
• Daily Limits — Optional: Prevent abuse by limiting veinmines per player per day
• Advanced Effect Settings — Customizable particle types, colors, speeds, and sounds
• Custom Messages — Fully customizable player notifications with placeholders
• EXP Rewards — Optional custom experience points for veinmining
• PlayerStats.java — New data class for tracking individual player progress

Changed

• Version bumped to 1.2.0 with major feature expansion
• pom.xml — Fixed XML syntax errors (typo: <n> → <n>)
• PluginConfig.java — Expanded from ~90 lines to ~300+ lines with comprehensive settings
• BetterVeinminer.java — Refactored to support tier system, stats, permissions, and daily limits
• config.yml — Completely rewritten with organized sections for each feature
• plugin.yml — Added 3 new commands and 2 new permission levels

Improved

• Much better tier progression system that rewards dedicated miners
• More granular permission-based control for VIP/Premium players
• Enhanced logging and player feedback with customizable messages
• Better code organization with dedicated helper methods

fixed