NeuroLag

[1.5.0] — 2026-04-19 — Security Hardening & Stability Release

Fixed — Security

• [Bug #1] Web dashboard weak default token / no rate limiting / no IP filtering (WebDashboard.java, ConfigManager.java, monitors.yml)
  • Auto-generates a cryptographically strong 24-byte random token on first startup whenever the default placeholder "change-this-token-now" is detected. The new token is immediately persisted to monitors.yml and printed to the console.
  • Added per-IP rate limiting (sliding 60-second window, configurable via web-dashboard.rate-limit.max-requests-per-minute, default 60). Returns HTTP 429 when the limit is exceeded.
  • Added optional IP allow-list (web-dashboard.ip-whitelist, disabled by default). When enabled, only explicitly listed IPs can reach /api/status and /api/cmd.

Fixed — Stability

• [Bug #2] Stress test could spawn unlimited mobs with no cooldown (StressTestManager.java, ConfigManager.java, systems.yml)

  • Hard cap: mob count is clamped to stress-test.max-mob-count (default 2 000) regardless of the value passed to /nlag stresstest. The sender is notified when the cap applies.
  • Cooldown: a configurable stress-test.cooldown-seconds (default 300) must elapse between tests. Attempting to start a test during cooldown shows the remaining time.
  • Both limits are enforced by ConfigValidator.

• [Bug #3] Redis subscriber join(3000) always timed out on slow networks (MultiServerSync.java)

  • stop() now holds a volatile reference to the active JedisPubSub instance and calls pubSub.unsubscribe() before interrupt()+join(). This signals the blocking jedis.subscribe() call to return immediately, so join() completes in milliseconds rather than timing out. Prevents connection-pool leaks during rapid /nlag reload cycles.

• [Bug #4] Smart culling could remove hundreds of entities in one pass → lag spike (LagEngine.java)

  • Added CULL_PER_TICK_CAP = 50 — at most 50 entities are removed per cull invocation. If the entity count remains above max-entities-per-world after one pass, the next monitor tick handles the remainder. Eliminates the single-frame mob-removal lag spike seen on servers with thousands of entities.

• [Bug #5] Predictive scheduler lost all historical data on server restart (PredictiveScheduler.java)

  • Hourly TPS samples are now saved to plugins/NeuroLag/predictive-data.json on stop() (server shutdown or /nlag reload) and reloaded on start(). No external library required — uses a compact hand-rolled JSON serializer/parser. The predictor now accumulates knowledge across restarts and becomes effective much faster on busy servers.

• [Bug #6] Full plugin reload caused noticeable server stutter (NeuroLag.java)

  • reloadPluginState() now takes config snapshots before reloading and selectively restarts only the services whose configuration sections actually changed (web dashboard, multi-server sync, predictive scheduler, CPU monitor, boss-bar dashboard). The main monitor task and engine throttle are always restarted cleanly. On a typical /nlag reload that only changes TPS thresholds, zero external services are bounced, eliminating the stutter caused by restarting Redis/MySQL connections unnecessarily.

Changed

• ConfigValidator now validates the new stress-test limits and rate-limit settings.
• systems.yml — added stress-test.max-mob-count and stress-test.cooldown-seconds.
• monitors.yml — added web-dashboard.rate-limit and web-dashboard.ip-whitelist sections.

---