RedstoneReboot

v1.4.1 — Security & Stability

This release fixes all findings from an independent source code audit.

Security

• LocalScriptBackend: Shell-escape all startup command args for Linux and Windows — prevents command injection via sun.java.command, JVM args, or env vars
• LocalScriptBackend: Filter sensitive JVM args (-Dpassword, -Dsecret, -Dtoken, -Dkey, -Ddb.*, etc.) from generated restart scripts — no more credential leakage to disk

Fixes

• Folia: Async scheduler methods now use getAsyncScheduler() — blocking backend operations no longer freeze the server tick thread
• RestartManager: isRestartInProgress() now checks the backend execution guard — prevents race where a new restart could fire during an active backend call
• Fabric: Title broadcasting now uses reflection to support both 1.20.1 and 1.20.2+ — no more crash on modern Fabric versions
• Pterodactyl: Server IDs are now URL-encoded — special characters in IDs no longer break API requests
• Bukkit TPS: Reflection handles are cached after first lookup — eliminates repeated getMethod/getField calls
• Cleanup: Console logging added for reload-cancelled restarts

What to download

• Bukkit / Spigot / Paper / Purpur → RedstoneReboot-Bukkit-1.4.1.jar
• Folia → RedstoneReboot-Folia-1.4.1.jar
• Fabric → RedstoneReboot-Fabric-1.4.1.jar
• Forge → RedstoneReboot-Forge-1.4.1.jar
• NeoForge → RedstoneReboot-NeoForge-1.4.1.jar