Download File

### Security (important — fixes chat click-command exploit) - **Defence-in-depth sanitizer** against chat click / hover / insertion exploits. A new `ComponentSanitizer` recursively strips `clickEvent` / `hoverEvent` / `insertion` from **player message** and **item-name** output. - Closes the exploit reported on Discord where players could type `<click:run_command:…>` that executes when clicked. The restricted cosmetic parser already rejected these tags; the sanitizer is a belt-and-suspenders guarantee that no interactive event can ever reach chat — even via nested children or a crafted anvil-renamed item. - Cosmetic styling (colours, decorations) is preserved. Legacy/Spigot output is inherently safe (serializes to `§`-codes that cannot carry events). - Tests: 43 (incl. 7 new sanitizer cases), 0 failures. ### Platform - **Minecraft 26.2** (Paper 26.2), `api-version: 26.2` - **Adventure 5.2.0** — the version Paper 26.2 bundles (Paper 26.1 shipped Adventure 4.x, so 4.2.0 requires Paper 26.2+) - **Java 25** > ⚠️ If you get `Unsupported API version 26.2` or the plugin won't load: update to **Paper 26.2 + Java 25**. Older servers (1.21.x / Java 21) cannot run this build. ### Dependency updates (folds in the open Renovate PRs) - LuckPerms `5.4 → 5.5`, PlaceholderAPI `2.11.6 → 2.12.2`, Gson `2.13.2 → 2.14.0`, JUnit `5.11.4 → 5.14.4`, Gradle `8.14 → 8.14.5`, `actions/setup-java v5`, `gradle/actions v6` ### Build & CI - **New `build.yml`** runs `clean build` on every push/PR (there was no CI before). - Fixed `publish.yml`: Gradle 8.14 cannot run on Java 25 (its Groovy rejects class file major 69), so Gradle now runs on **Java 21** and compiles via the **Java 25 toolchain** (auto-provisioned by the new `foojay-resolver-convention`). ### Branding & UX - Author rebranded **Varilx-Development → Veylor-Development** (the team behind veylor.net — free plugins on Modrinth). - `/lpc version` now reports the detected platform + target (MC 26.2 · Java 25 · Adventure 5). - README: compatibility table + "Unsupported API version" guidance + a direct answer to "can players use MiniMessage in chat?". ### Issues closed - #22 (PlaceholderAPI placeholder in `chat-format` crashing) — fixed by the 2.0 pipeline. - #26 (non-op parsing placeholders) — fixed; player messages are never passed through PlaceholderAPI. - #37 (/msg question) — answered; LPC is a chat formatter, pair it with EssentialsX/HuskChat. **Full changelog:** https://github.com/Ayont/LPC-with-minimessage/compare/4.1.0...4.2.0