EternalCore is a modern, actively maintained alternative to EssentialsX. It provides the most important server features
GH-1391 26.2 (#1391)
dependency: Update actions/upload-artifact action to v7
Update gradle.yml
dependency: Update actions/checkout action to v7
dependency: Update gradle/actions action to v6
dependency: Update hmarr/auto-approve-action action to v4
dependency: Update actions/cache action to v6
harden: verify dependency integrity and add download timeouts
Fixes two findings from the loader audit:
Runtime-downloaded dependencies were loaded with no integrity check. DependencyDownloader now verifies every artifact against the strongest checksum the repository publishes (sha512 > sha256 > sha1) before it is written to the local cache and added to the classpath. Fails closed: a mismatch or the absence of any published checksum rejects that repository so resolution falls back to another source (and errors if none can vouch for the artifact). Adds a pure, unit-tested Checksum utility.
Jar, checksum, and POM fetches had no connect/read timeouts, so a slow or half-open repository could stall plugin startup. All three now set a 15s connect / 30s read timeout.
Co-Authored-By: Claude Opus 4.8 [email protected] Claude-Session: https://claude.ai/code/session_01JrkLFxzmmn7BpB9y6vMTeg
- security: require distinct permission to enchant another player's item
Both /enchant execute overloads were gated only by the class-level @Permission("eternalcore.enchant"), so anyone allowed to enchant their own item could also modify other players' held items.
Follow the FlyCommand convention: drop the class-level permission and gate each overload individually — eternalcore.enchant for the self variant and eternalcore.enchant.other for the "" variant.
Note: servers that previously granted eternalcore.enchant to allow enchanting others must now also grant eternalcore.enchant.other.
Co-Authored-By: Claude Opus 4.8 [email protected] Claude-Session: https://claude.ai/code/session_01JrkLFxzmmn7BpB9y6vMTeg
dependency: Update dependency fr.skytasul:glowingentities to v2
dependency: Update dependency com.gradleup.shadow:shadow-gradle-plugin to v9.5.1
26.2 in runServer
Revert "harden: verify dependency integrity and add download timeouts"
This reverts commit ebbd343b5832e685908c862fbb4855aa5301c682.
- Add 26.2 in paperVersions property
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 [email protected]