LPC Minimessage - Chat Formatter

Security (important — fixes chat click-command exploit)

• Defence-in-depth sanitizer against chat click / hover / insertion exploits. A new ComponentSanitizer recursively strips clickEvent / hoverEvent / insertion from player message and item-name output.
• Closes the exploit reported on Discord where players could type <click:run_command:…> that executes when clicked. The restricted cosmetic parser already rejected these tags; the sanitizer is a belt-and-suspenders guarantee that no interactive event can ever reach chat — even via nested children or a crafted anvil-renamed item.
• Cosmetic styling (colours, decorations) is preserved. Legacy/Spigot output is inherently safe (serializes to §-codes that cannot carry events).
• Tests: 43 (incl. 7 new sanitizer cases), 0 failures.

Platform

• Minecraft 26.2 (Paper 26.2), api-version: 26.2
• Adventure 5.2.0 — the version Paper 26.2 bundles (Paper 26.1 shipped Adventure 4.x, so 4.2.0 requires Paper 26.2+)
• Java 25

⚠️ If you get Unsupported API version 26.2 or the plugin won't load: update to Paper 26.2 + Java 25. Older servers (1.21.x / Java 21) cannot run this build.

Dependency updates (folds in the open Renovate PRs)

• LuckPerms 5.4 → 5.5, PlaceholderAPI 2.11.6 → 2.12.2, Gson 2.13.2 → 2.14.0, JUnit 5.11.4 → 5.14.4, Gradle 8.14 → 8.14.5, actions/setup-java v5, gradle/actions v6

Build & CI

• New build.yml runs clean build on every push/PR (there was no CI before).
• Fixed publish.yml: Gradle 8.14 cannot run on Java 25 (its Groovy rejects class file major 69), so Gradle now runs on Java 21 and compiles via the Java 25 toolchain (auto-provisioned by the new foojay-resolver-convention).

Branding & UX

• Author rebranded Varilx-Development → Veylor-Development (the team behind veylor.net — free plugins on Modrinth).
• /lpc version now reports the detected platform + target (MC 26.2 · Java 25 · Adventure 5).
• README: compatibility table + "Unsupported API version" guidance + a direct answer to "can players use MiniMessage in chat?".

Issues closed

• #22 (PlaceholderAPI placeholder in chat-format crashing) — fixed by the 2.0 pipeline.
• #26 (non-op parsing placeholders) — fixed; player messages are never passed through PlaceholderAPI.
• #37 (/msg question) — answered; LPC is a chat formatter, pair it with EssentialsX/HuskChat.

Full changelog: https://github.com/Ayont/LPC-with-minimessage/compare/4.1.0...4.2.0