Aurelium

v1.4.2 - Security & Performance Hardening

This update is mandatory for all servers using the web dashboard.

Security

• Session tokens for the web dashboard now use cryptographically secure SecureRandom (256-bit entropy) instead of UUID.randomUUID() (122-bit), preventing potential token prediction attacks
• Added explanatory comments to CloudSyncManager for exceptions that are safely ignored

Performance

• Cloud dashboard registration retries no longer block a ForkJoinPool thread for 15 seconds between attempts, replaced Thread.sleep(15_000) with Bukkit's non-blocking runTaskLaterAsynchronously scheduler
• Offline earnings cleanup now uses a single bulk DELETE SQL query instead of N+1 individual queries when a player joins, significantly reducing database load on servers with many offline earnings records

Fixes

• Added proper exception logging to previously empty catch blocks in ShopGUI and CloudSyncManager, making debugging much easier
• Fixed a bug in ShopGUI where target was used instead of clicker for certain player interactions
• BungeeCord/Velocity Sync: Fixed a major bug where player balances could stay "stale" when switching servers due to permanent RAM caching. Player data is now refreshed from MySQL immediately upon joining a new server instance.

Internal

• Bumped version in pom.xml to 1.4.2 to ensure consistent builds across Maven and Gradle.
• Updated README.md to clarify that MySQL is mandatory for cross-server synchronization and that Market Prices remain per-server for regional economy support.