StormtrooperX

What's New

Changed

• Minecraft 26.2 and 26.3 support. The supported range is now Minecraft 1.18 through 26.3.x (previously 26.1.x). No plugin code changed to get there. The release was verified four ways: the full test suite compiles and passes against the Spigot 26.2 and 26.3 APIs; every Bukkit and PlaceholderAPI method and field the shipped JAR references resolves against the Spigot 26.2/26.3, Paper 26.3, and Folia 26.3 APIs, including the Folia scheduler methods the plugin binds reflectively; a live Paper 26.3 server nerfed shots from all six supported mobs (Skeleton, Stray, Bogged, Parched, Pillager, Piglin) with projectile speed preserved, before and after /stormtrooperx reload; and CI's forward-compatibility job now builds against the 26.3 API on every push.

Security

• H2 2.5.252 picks up upstream security fixes. The bundled H2 database (the default h2 backend) includes fixes for connection-URL setting injection (#4381), a missing deserialization filter for JAVA_OBJECT values (#4412), and SecureFileStore skipping decryption on partial reads (#4405). None of these are reachable from StormtrooperX: the H2 URL is built from the plugin data folder and fixed settings only, the opt-out table stores only VARCHAR/BOOLEAN/TIMESTAMP columns, and the database is not encrypted. This is a defense-in-depth update. Upstream references advisory GHSA-x6w5-3gpx-27hm, which has not been published yet; no CVE is assigned.

Dependencies

• MySQL Connector/J 9.7.0 → 26.7.0 (bundled). The version jump is Oracle moving Connector/J onto MySQL Server's calendar versioning; 26.7.0 is the successor to 9.7, not a rewrite. It requires MySQL Server 8.4 or later for the mysql backend (see Upgrade Notes). The 26.7.0 bug fixes (LOAD DATA LOCAL INFILE cleanup, X Protocol connections, getNString UTF-8 aliases) don't affect this plugin: allowLoadLocalInfile is forced off, the X Protocol classes are stripped from the JAR, and the N-character ResultSet methods are unused. No CVEs are addressed.
• H2 2.4.240 → 2.5.252 (bundled, default backend). Besides the security fixes above, this brings MVStore corruption and data-race fixes that apply to the plugin's file-backed opt-out store: "double mark" corruption on reopen after SHUTDOWN (#4387), a chunk-rewrite data race (#4374), and stopping on panic to prevent store corruption (#4343). Existing databases need no migration: a file written by 1.10.1's H2 2.4.240 opens, reads, and accepts upserts under 2.5.252.
• Build and test tooling: maven-compiler-plugin 3.15.0 → 3.16.0, maven-surefire-plugin 3.5.6 → 3.6.0, cyclonedx-maven-plugin 2.9.2 → 2.9.3, JUnit Jupiter 6.1.2 → 6.1.3, Mockito 5.23.0 → 5.24.0. None of these ship in the JAR.

Build

• Release pipeline actions updated, all still pinned to commit SHAs in release.yml: actions/setup-java 5.2.0 → 6.1.0 (v6 also verifies JDK downloads against vendor checksums), actions/attest-build-provenance 4.1.1 → 4.2.2, softprops/action-gh-release 3.0.2 → 3.0.3, and cloudnode-pro/modrinth-publish 2.5.0 → 2.5.2.
• Forward-compatibility CI job moved to the 26.3 API ("Ceiling compat (26.3 API)"), still running on Java 25 to match the server runtime that 26.x requires.

Upgrade Notes

If upgrading from 1.10.x: Drop-in replacement for most servers. No config schema change (config-version: 3 continues to apply, no migration runs), and no permission or command changes.

• H2 users (default): no action needed. Your existing opt-out database is read as-is.
• MySQL users: check your MySQL server version first. The bundled Connector/J 26.7.0 requires MySQL Server 8.4 or later. Because the driver is shaded into the JAR, it can't be swapped for an older one. If your database server runs MySQL 8.0, upgrade the server before updating the plugin, or stay on 1.10.1 until you can.

Server compatibility: Spigot, Paper, Purpur, and Folia 1.20.4+, on Minecraft 1.18 through 26.3.x, Java 17+. Minecraft 26.x servers themselves require Java 25.

JAR verification: Built and attested via GitHub Actions with Sigstore. Verify with gh attestation verify StormtrooperX-1.11.0.jar --repo GooberCraft/StormtrooperX (requires gh 2.43.0+).