PremiumUUID

PremiumUUID v1.3.1

Security & Fixes

• Unauthorized Pardon (security): Any player, even without op, could type /pardon <player> and the plugin would lift that player's bans on every known identity. Identities are now only pardoned when the sender is allowed to use /pardon, or when the command itself lifted a ban. Updating is recommended for every server.
• IP & Third-Party Bans Respected: The plugin no longer lets in players kicked as banned when the ban did not come from the vanilla profile ban list. IP bans (/ban-ip) and bans from other plugins are now always kept.
• Whitelist Op Bypass: Ops who are not in whitelist.json are no longer kicked by the plugin, matching vanilla behaviour.
• Kick Messages Preserved: Players rejected for another reason, such as a full server, no longer see "You are not whitelisted".
• Login Resilience: Unusual nicknames or a malformed response from the Mojang API could throw errors during login. The player now joins with the offline UUID instead.
• Mojang API Timeouts & Rate Limits: timeout-ms now limits the whole lookup, and the plugin backs off after a rate limit (HTTP 429) or a failed lookup instead of querying Mojang again on every reconnect.
• Reload Feedback: /premiumuuid reload now warns that a change to cache.file only takes effect after a restart.

Under the Hood

• Lighter Disk I/O: The UUID cache is only written when it changed, and command-triggered writes no longer block the main thread.
• Thread-Safe Config: Configuration values are swapped atomically on reload, so async logins never read a half-updated config.
• E2E Version Matrix: The Mineflayer E2E suite now runs against seven Paper versions on every commit, including a new test that a non-op /pardon is ignored.
• Extended Test Coverage: Unit tests went from 8 to 33, covering the pardon authorization, ban/whitelist handling, Mojang API client, cache and config reload.
• Docs: Documented that ban, whitelist and pardon handling stays active when premium-uuid-enabled is false, so earlier premium identities cannot be used to evade bans.