🔒 UPDATE 4.0.2 Security Hotfix
CocoVaults Lite - Released February 16th, 2026
⚠️ CRITICAL SECURITY UPDATE
This update patches multiple item duplication exploits and data integrity vulnerabilities.
All servers should update immediately.
🔒 Critical Security Fixes
• Race Condition Dupe Fixed - Fixed race condition where delayed click tasks could overwrite vault saves on close, causing item duplication or loss
• Blacklist Save Failure Exploit Fixed - Blacklisted items are now only returned to players after successful save, preventing duplication on save failures
✨ Data Integrity Improvements
• Thread-Safe Vault Data - VaultData now uses proper synchronization to prevent corruption from concurrent access
• Thread-Safe Active Vaults - Fixed non-thread-safe ArrayList causing potential crashes in ACTIVE_VAULTS registry
• Async Save Performance - Vault close saves are now fully async, eliminating main thread blocking during slow I/O operations
🛠️ Additional Fixes
• Event Priority Corrected - InventoryCloseEvent changed from MONITOR to HIGH priority to properly handle state modifications
• Debounced Save Race Fixed - Fixed race condition where async removal could delete newly scheduled saves
• Click Task Leak Fixed - Pending click/drag delayed tasks are now properly cancelled when vaults close
📋 Update Instructions
1. BACKUP YOUR VAULT DATA - Always backup your plugins/CocoVaults folder before updating
2. Stop your server
3. Replace the old CocoVaults.jar with version 4.0.2
4. Start your server
5. Monitor console for any errors during startup
⚠️ Critical Notes
• UPDATE IMMEDIATELY - Multiple critical duplication exploits have been patched
• No configuration changes required
• Fully compatible with existing vault data (JSON/YAML)
• Improves stability and prevents item loss
• All async operations now properly synchronized
📝 Technical Details
For server admins & developers:
• VaultData fields now use volatile for thread visibility
• Synchronized access methods prevent data races
• CopyOnWriteArrayList used for concurrent vault tracking
• Async saves with proper completion callbacks
• Race condition guards in close/save pipeline
• Defensive copies prevent external modification