BasicStats

🛡️ Reliability, security & compatibility bugfixes

• Fixed shift-click crafting counts: multi-craft recipes now consume a shared in-memory ingredient budget for the complete event instead of reusing the original matrix on every loop. Items crafted are no longer inflated by the number of possible attempts.
• Fixed achievement unlock edge cases: achievements unlock when the configured target is actually reached; rounded display percentages can no longer unlock an achievement too early.
• Fixed maximum rank progression: the final rank can now reach its real maximum score and displays 100% progress instead of stopping one point short.
• Fixed /basicstats reload: rank monitoring, streak tracking, achievement checks and goal notifications now stop and restart with the new configuration, so changed intervals and enable/disable settings apply immediately.
• Fixed death-counter scoreboard interference: BasicStats no longer replaces scoreboards owned by other plugins. The death counter is added to BasicStats sidebars without taking ownership of unrelated player scoreboards.
• Hardened the local dashboard: request workers are bounded, concurrent requests are capped, oversized settings bodies return a clear 413, response security headers are sent, and malformed JSON is rejected instead of being partially interpreted.
• Protected dashboard credentials: temporary admin tokens are no longer written to the server log or appended to browser URLs. The clickable dashboard link and the short-lived token are delivered separately.
• Protected hosted HTTP access: remote dashboard URLs must use HTTPS by default. Plain HTTP requires the explicit dashboard.allow-insecure-remote: true opt-in for trusted private networks.
• Made Explorer quota handling safe: the plugin tracks accepted uploads per UTC day and spaces the configured 15-minute minimum to a quota-safe interval of about 55 minutes when necessary. Daily-limit responses no longer trigger retries, and no more than 26 uploads are intentionally scheduled per server and day.
• Made Explorer quota updates atomic: the D1 update rechecks the daily ceiling inside the database update, preventing concurrent uploads from consuming the same final quota slot.
• Improved Explorer address validation: public IPv6 addresses are normalized safely while loopback, private and link-local ranges remain rejected.
• Hardened dashboard settings parsing: settings are parsed as a real JSON object with type validation; unknown fields are ignored and malformed structures are rejected cleanly.
• Isolated bundled runtime libraries: Gson and the optional MariaDB driver are shaded/relocated, while MariaDB service loading remains available without a hard-coded unshaded driver class name.
• Removed the duplicate Explorer D1 migration: the migration directory now contains one canonical 0001_explorer_servers.sql schema with the active upload quota columns.
• Updated the README, Explorer documentation, homepage build metadata and compatibility notes for 2.4.4.
• No existing commands, permissions, statistics, dashboard features, Explorer pairing, YAML keys or stored player data were removed. Existing configurations continue to receive additive defaults.