StormtrooperX

What's New

Added

• Folia support via a runtime-detected PluginScheduler abstraction. On Folia 1.20.4+, async work routes through Folia's AsyncScheduler / GlobalRegionScheduler (via reflection so the Spigot API 1.18 compile dependency is unchanged). On Spigot, Paper, and Purpur the legacy BukkitScheduler is used. The scheduler is selected once at plugin enable; plugin.yml declares folia-supported: true.
• Graceful Folia fallback. If RegionizedServer is detected but Folia's scheduler API cannot be bound (e.g., a future signature change), PluginScheduler.create logs a WARNING and falls back to the legacy scheduler instead of failing plugin enable. Async tasks continue working in degraded mode rather than bricking the plugin.

Changed

• DatabaseManager H2 thread safety. H2 operations (isOptedOut, setOptOut) are now serialized through an internal lock. JDBC Connection instances are not thread-safe, and Folia's regional async pool can dispatch concurrent opt-out reads/writes onto the single shared H2 connection. The MySQL path is unchanged — HikariCP gives each thread its own pooled connection, so no lock is taken there.
• UpdateChecker callback contract. The update-check callback is now invoked on the async worker thread instead of being hopped back to the main thread. Logging only (java.util.logging is thread-safe). The previous main-thread hop was unnecessary on Spigot/Paper and forbidden on Folia. Javadoc on UpdateCallback#onComplete documents the off-thread contract.
• Constructor signatures. OptOutManager now takes PluginScheduler in place of Plugin; UpdateChecker now takes an additional PluginScheduler argument. Internal change — affects no plugin.yml/permissions surface, no end-user config.

Security

• Tightened UpdateChecker githubRepo validation to ^[a-zA-Z0-9._-]+/[a-zA-Z0-9._-]+$ (matching GitHub's actual repo-name charset). Defense-in-depth against path traversal, CRLF injection, and arbitrary URL-component characters in the segment that flows into the GitHub API URL. The current call site is hardcoded to GooberCraft/StormtrooperX, so this is preventative only.

Tests

• New PluginSchedulerTest — 7 tests covering the legacy scheduler delegation (via MockedStatic<Bukkit>) and the factory's non-Folia branch
• New UpdateChecker constructor tests — 5 tests covering semicolon injection, multi-segment paths, path traversal, CRLF injection, and the valid-character allowlist
• Total test count: 156 → 170

Upgrade Notes

If upgrading from 1.8.x: No configuration changes required. plugin.yml adds folia-supported: true automatically; existing config.yml files continue to work as-is.

Server compatibility: Folia 1.20.4+ is now supported in addition to Spigot, Paper, and Purpur. Folia is detected automatically at startup — log message confirms which scheduler is in use (Folia detected, using regional schedulers vs Standard Bukkit scheduler in use). No Folia or Paper API dependency was added to the build; the plugin still compiles against Spigot API 1.18.

JAR verification: Built and attested via GitHub Actions with Sigstore. Verify with gh attestation verify StormtrooperX-1.9.0.jar --repo GooberCraft/StormtrooperX (requires gh 2.43.0+).