Vanish v3.1.2 - Bug Fixes, Performance Boost & bStats

Targeted fixes, a full internal cleanup and technical improvements for a more stable and performant Vanish.

🐛 Bug Fixes

• Fixed: The vanish metadata key is now a single static final constant and vanish checks no longer go through player metadata - reduces garbage collection overhead
• Fixed: Fake join/quit messages no longer use the deprecated Bukkit.broadcastMessage() - they are sent to every player and the console directly, future-proof
• Fixed: Inventory close events now skip non-vanished players immediately
  • ⚡ Impact: Reduces unnecessary processing for 100% of non-staff players
• Fixed: /vanish <player> with an unknown or offline name no longer toggles your own vanish
• Fixed: Using a subcommand without permission no longer toggles your own vanish
• Fixed: A player who logged out while vanished is no longer left hidden from others after rejoining visible
• Fixed: Players with vanish.join but without vanish.see can no longer see other vanished players
• Fixed: Unvanishing no longer makes players in creative mode or with /fly fall out of the air
• Fixed: Items can no longer be dragged or placed into the Vanish menus
• Fixed: Menus no longer open a new inventory inside the click event, which could cause inventory glitches
• Fixed: Menus use the new accent color right after /vanish color or /vanish reload
• Fixed: Silent containers no longer open twice (once per hand)
• Fixed: Players in the silent container spectator fallback get their game mode back when they disconnect or the server stops
• Fixed: The pressure plate protection no longer overrides other plugins that cancelled the interaction
• Fixed: vanish.* now grants every Vanish permission and respects negated child permissions
• Fixed: A YAML error in config.yml no longer causes the file to be overwritten
• Fixed: The Dynmap integration now also works on Spigot (the plugin was looked up with the wrong name)
• Fixed: With ProtocolLib, silent containers no longer show the closing animation or play the closing sound to nearby players when the container was open for more than 2.5 seconds
• Fixed: Silent containers respect chest protection plugins, and sneak-clicking a container with an item in hand uses the item (e.g. places the block) instead of opening the container
• Fixed: A vanished player is no longer left in spectator mode when another plugin prevents a container from opening
• Fixed: Join and quit messages set by other plugins are now also hidden for vanished players
• Fixed: Plugins that handle the quit after Vanish (such as Discord bridges) still see a quitting vanished player as vanished and no longer announce the quit
• Fixed: Changing the plugin color now sends a confirmation, both with /vanish color <color> and in the color menu
• Fixed: Vanished players no longer show up when hovering over the player count in the server list on Paper 1.20.6
• Fixed: Advancements of vanished players are no longer announced on Spigot 1.21.11 and newer without ProtocolLib (the game rule was renamed, which caused an error on every vanish)
• Fixed: No more ProtocolLib errors in the console when vanished players open containers on 1.21.11, and the container sounds are hidden there again
• Fixed: Vanish now disables itself with a clear error message if it cannot start on an incompatible server

🧱 Stability & Thread Safety (suggested by pupserjapi7-crypto)

• Dependency handling: ProtocolLib, PlaceholderAPI and Dynmap are soft dependencies that load first when present; a missing or broken integration is logged and skipped instead of breaking Vanish
• No disk I/O on the main thread: players.yml is read once at startup and cached in memory - joins and quits never touch the disk
• Asynchronous saving: changes to players.yml are written on a background thread and flushed when the server stops; an unreadable file is never overwritten
• Thread-safe vanish state: vanished players are tracked in a concurrent set with O(1) lookups, safe for packet listeners, PlaceholderAPI and the API
  • ⚡ Impact: No lag spikes on join/quit and no race conditions with async plugins

🔧 Technical Improvements

• Config Reload: /vanish reload now refreshes ALL cached values instantly (settings, messages, player data, boss bar and advancement handling)
  • ⚡ Impact: No more server restarts needed after config changes - ever
• VanishPlayer Caching: Player objects are now cached and reused
  • ⚡ Performance: Eliminates redundant object creation on high-frequency events
• Gradle Shadow: Dependencies properly relocated - no more conflicts with other plugins
  • ⚡ Impact: Better compatibility with plugin ecosystems
• Clean Codebase: The custom framework was replaced by standard Bukkit structure (one plugin class, plain listeners, a TabExecutor command and typed config access), Lombok was removed and unit tests were added
  • ⚡ Impact: Easier to maintain, review and contribute to
• Tested: 66 automated tests on a mock server, plus live tests with bot players on Spigot and Paper from 1.20.1 to 26.2 (26.3: startup and console commands), with and without ProtocolLib, PlaceholderAPI and Dynmap
  • ⚡ Impact: The fixes above were verified on real servers across the supported range

🔐 Security & Dependencies

• Gradle 9.8.1: Fixes three high-severity Gradle security advisories (build tooling only - servers were never affected)
• Verified downloads: The Gradle Wrapper checks the distribution checksum, and third-party repositories may only serve their own artifacts
• Upgraded: Shadow 9.6.1, PlaceholderAPI 2.12.3, JUnit 6.1.3 - removed the unused Gson and Lombok dependencies
• Pinned: Libraries pulled in by the new test suite (commons-lang3, log4j-api, plexus-utils) are forced to patched versions - test only, never shipped with the plugin
• Scanned: All build and test dependencies checked against OSV.dev - 0 known vulnerabilities

🧑‍💻 For Developers

• VanishAPI is unchanged; getVanishedPlayers() now returns a snapshot
• The main class is now nl.fronsky.vanish.VanishPlugin (was Main)
• Removed internal helpers: VanishPlayer.getPlayer(...), VanishPlayer.setState(...) and VisibilityChangeEvent.getData() / getProtocolLib() / isProtocolLibActive() - use VanishAPI instead
• Errors inside API calls are no longer silently swallowed
• Tests run on a mock server with mock players (MockBukkit); Gradle downloads JDK 21 for the tests automatically, while the plugin itself stays on Java 17

⚡ Performance Summary

• VanishPlayer caching: fewer object allocations per event
• Config reload: instant refresh, no restart
• Event filtering: non-vanished players skip processing entirely
• Player data: no file I/O on the main thread
• Vanish checks: O(1) and thread-safe

🛡️ bStats Metrics

• Anonymous, opt-out usage statistics
• Opt out for all plugins at once in plugins/bStats/config.yml
• See live data at https://bstats.org/plugin/bukkit/Fronsky Vanish
  • ⚡ Impact: Helps prioritize development based on real usage data

📋 Config: No config changes required - the new optional message plugin_color_changed in messages.yml falls back to its default

🔄 Compatibility: Spigot/Paper 1.20 - 26.1+ | Java 17