3.1.0

For a server running v3.0.0, this is a drop-in upgrade. No config, permission, command or database changes are needed. The release adds support for Minecraft 26.3 and expands usage reporting. Each event now carries the plugin version and a random server ID, which is stored in plugins/trace/config.yml so the trace server can count servers instead of raw events. The ID identifies no player, account or IP address. Nothing is generated or written while usage reporting is off.

Changes

Compatibility

• Supports Minecraft 26.3. Supported versions are now declared as 1.19.4, 1.21.11, 26.2 and 26.3, and the plugin's API use is checked against each one (#125, #132).

Usage reporting

• Every event now includes a random server ID as the tag install. The first time reporting runs, the ID is created and added to plugins/trace/config.yml as a server-id: line under a comment explaining it. The rest of the file is left exactly as it was. To get a new ID, delete that line. If the file can't be written, the ID is kept in memory for that run only. If reporting is off (through this plugin's config, the server-wide switch, DO_NOT_TRACK or TRACE_USAGE_REPORTING), no ID is created or written (#130).
• The startup message and the comments in config.yml now mention the server ID and where it is stored (#131).
• Every event, including command events, now includes the plugin version. Before, only the startup event did (#127).
• plugins/trace/config.yml now accepts an optional tags: block whose entries are added to every event from every plugin that reports to trace. For example, set ci: "true" on a test server to keep its events out of real-server figures. A plugin's own tag wins over a server-wide tag with the same name, and entries the trace server would reject are ignored (#126).

Version

v3.0.0 → 3.1.0 — MINOR. Mechanical floor from comparing the two jars: MINOR. Judgment: The plugin now writes new data to disk: on first start with reporting enabled, it adds a random server-id line to plugins/trace/config.yml. Every usage event now also carries that ID as an install tag, so this release adds behaviour and stays at the minor floor. The builder signature change in the bundled TraceClient is in a copied-in helper library, not an API other plugins use. The plugin's commands, permissions, config keys and database are unchanged, and the new line is added to the file without touching what an operator already wrote, so nothing breaks on upgrade.

• minor: storage path changed: src/main/java/com/dansplugins/detectionsystem/AlternateAccountFinder.java

<details><summary>Java API changes (informational — nothing depends on this plugin)</summary>

• com.dansplugins.detectionsystem.trace.TraceClient: removed/changed public static com.dansplugins.detectionsystem.trace.TraceClient$Builder builder(java.lang.String, java.lang.String);
• com.dansplugins.detectionsystem.trace.TraceClient: added public java.lang.String installId();
• com.dansplugins.detectionsystem.trace.TraceClient: added public static com.dansplugins.detectionsystem.trace.TraceClient$Builder builder(java.lang.String, java.lang.String, java.lang.String);
• com.dansplugins.detectionsystem.trace.TraceClient: added public static final java.lang.String VERSION;
• com.dansplugins.detectionsystem.trace.TraceClient$Builder: added public com.dansplugins.detectionsystem.trace.TraceClient$Builder installId(java.lang.String);

</details>

Verification

Verified on a real Spigot server before publication; this release carries the exact jar that was verified.

• boot gate run: booted twice on a fresh Spigot server running Minecraft 1.19.4 (11 assertions passed).
• boot gate run: booted twice on a fresh Spigot server running Minecraft 1.21.11 (11 assertions passed).
• boot gate run: booted twice on a fresh Spigot server running Minecraft 26.2 (11 assertions passed).
• boot gate run: booted twice on a fresh Spigot server running Minecraft 26.3 (11 assertions passed).
• save-compatibility gate run: data written by v3.0.0 was loaded by this release across 5 restart cycles with nothing lost (32 assertions passed).

Install with Dan's Plugin Manager: /dpm get <plugin>. How stable releases are made: Release channels.

drafted by Claude on behalf of Daniel Stephenson

3.0.0

This is a major release for servers running 2.0.0. /aaf ips and its aaf.ips permission are gone. Player IP addresses are now stored encrypted, using a key file the plugin creates in its data folder. On first start, existing plaintext addresses in the database are converted to that format. Once they are converted, 2.0.0 can no longer read them, and losing the key file makes every stored address unrecoverable. This release also adds anonymous usage reporting, which is on by default and can be turned off. Several fixes make startup failures, alt lookups and join notifications more reliable.

Changes

Privacy and data storage

• Removed /aaf ips and the aaf.ips permission, which showed a player's IP addresses in chat. The click-through links to it from /aaf accounts and /aaf alts are gone too (#57, #112).
• IP addresses are now stored encrypted with AES using a key at plugins/AlternateAccountFinder/ip-encryption.key. The key is generated on first start, and a warning about backing it up is logged on every start (#58).
• On startup, existing plaintext addresses are encrypted in a single transaction, and the address column is widened to fit. When every row has converted, a marker file ip-migration-v2.complete is written so later starts skip the check (#58).
• The migration no longer re-encrypts values it cannot read, such as addresses encrypted with a key that has since been replaced. It leaves them unchanged, logs the affected account UUIDs, and tries again on the next start (#71).
• /aaf accounts no longer suggests online players' IP addresses in tab-completion (#69).

Usage reporting

• The plugin now sends a small event to https://trace.danielstephenson.dev at startup and each time /aaf is used. The event contains only the plugin name, its version and the command name, and nothing about players or the server. Sending happens off the main thread and failures are dropped silently (#114).
• On every startup, a console line says whether reporting is on and how to turn it off. A new usage-reporting block in config.yml controls it for this plugin. Existing config.yml files get the block added automatically. Setting enabled: false in plugins/trace/config.yml turns reporting off for every plugin that uses trace. The environment variables TRACE_USAGE_REPORTING=off or DO_NOT_TRACK=1 turn it off for the whole server process (#114, #116).

Startup and shutdown

• The plugin now disables itself with one clear error message if the connection pool, the database migrations or the encryption key fail at startup. Previously it could be left half-enabled on Spigot (#118).
• database.dialect is checked before any connection is opened. It is now case-insensitive, and an invalid value produces an error that names the setting (#102).
• The database connection pool is now closed when the plugin is disabled, so /reload no longer leaves connections open (#98).

Commands

• /aaf accounts and /aaf alts list results newest first, in the same order every time. /aaf alts now looks up the player name off the main thread (#105).
• An account that shares several addresses with a player is listed only once in alt results and join notifications (#81).
• Accounts with no cached name are shown by UUID instead of null, and they no longer break tab-completion (#77, #81).
• Tab-completion for /aaf alts now suggests only online players, which avoids lag on servers with many past players (#78).
• Usage messages now show the required arguments as <ip> and <player> (#85).

Join notifications

• If a player disconnects immediately after joining, the plugin now skips recording that login instead of throwing an error. An invalid notify-users entry is skipped with a warning and no longer blocks the other recipients (#69).
• With RPKit, a recipient that RPKit cannot resolve, or RPKit services that are unavailable, are now skipped with a warning instead of throwing an error (#109).

Upgrade notes

• Back up your database before upgrading. The startup migration rewrites stored addresses in place, and 2.0.0 cannot read the result. To go back to 2.0.0, you need that backup.
• Back up plugins/AlternateAccountFinder/ip-encryption.key after the first start, and keep it with your database backups. If the key is lost or replaced, every stored address becomes unreadable. If startup fails while loading the key, restore it from a backup rather than deleting it.
• After the first start, check the console for the migration summary. If any records are listed as unrecognized or failed, they were left unchanged and will not match lookups until they are resolved.
• Remove aaf.ips from your permission plugin configuration, and update any scripts or habits that use /aaf ips.
• Usage reporting is on by default, including on upgraded servers. To opt out, set usage-reporting.enabled: false in this plugin's config.yml, or enabled: false in plugins/trace/config.yml to opt out for every plugin on the server.
• If database.dialect is set to a value jOOQ does not recognise, the plugin now disables itself at startup. Use H2 or MARIADB.

Version

2.0.0 → 3.0.0 — MAJOR. Mechanical floor from comparing the two jars: MAJOR. Judgment: Keeping the mechanical floor of major. It is also confirmed by changes the jar comparison cannot fully see. /aaf ips and the aaf.ips permission are removed (#57). Stored IP addresses are rewritten in place from plaintext to AES ciphertext by a startup migration (#58), so the database can no longer be read by 2.0.0. Usage reporting is also enabled by default on existing servers, and its config block is written into their existing config.yml (#114, #116). The patches for eight test files were truncated. Only their names were available, and all of them sit under src/test, so they do not ship in the jar. Their effect is otherwise unknown, and nothing in them could lower the level.

• major: permission removed: aaf.ips
• minor: default config key added: usage-reporting.enabled
• minor: default config key added: usage-reporting.endpoint
• minor: default config key added: usage-reporting.key
• minor: storage path changed: src/main/java/com/dansplugins/detectionsystem/AlternateAccountFinder.java
• minor: storage path changed: src/main/java/com/dansplugins/detectionsystem/encryption/IpEncryption.java
• minor: storage path changed: src/main/java/com/dansplugins/detectionsystem/encryption/StoredAddressClassifier.java
• minor: storage path changed: src/main/java/com/dansplugins/detectionsystem/logins/LoginRepository.java

<details><summary>Java API changes (informational — nothing depends on this plugin)</summary>

• public class removed: com.dansplugins.detectionsystem.commands.AafIpsCommand
• public class removed: com.dansplugins.detectionsystem.logins.AccountAddressInfo
• public class removed: com.dansplugins.detectionsystem.logins.AddressInfo
• public class added: com.dansplugins.detectionsystem.commands.PlayerNames
• public class added: com.dansplugins.detectionsystem.encryption.IpEncryption
• public class added: com.dansplugins.detectionsystem.encryption.StoredAddressClassifier
• public class added: com.dansplugins.detectionsystem.encryption.StoredAddressClassifier$Classification
• public class added: com.dansplugins.detectionsystem.trace.TraceClient
• public class added: com.dansplugins.detectionsystem.trace.TraceClient$Builder
• com.dansplugins.detectionsystem.AlternateAccountFinder: added public void onDisable();
• com.dansplugins.detectionsystem.logins.LoginRepository: removed/changed public com.dansplugins.detectionsystem.logins.AccountAddressInfo getAccountInfo(java.util.UUID);
• com.dansplugins.detectionsystem.logins.LoginRepository: removed/changed public com.dansplugins.detectionsystem.logins.LoginRepository(com.dansplugins.detectionsystem.shadow.org.jooq.DSLContext);
• com.dansplugins.detectionsystem.logins.LoginRepository: removed/changed public void saveLogin(org.bukkit.entity.Player);
• com.dansplugins.detectionsystem.logins.LoginRepository: added public com.dansplugins.detectionsystem.logins.LoginRepository(com.dansplugins.detectionsystem.shadow.org.jooq.DSLContext, com.dansplugins.detectionsystem.encryption.IpEncryption);
• com.dansplugins.detectionsystem.logins.LoginRepository: added public void saveLogin(java.util.UUID, java.net.InetAddress);
• com.dansplugins.detectionsystem.logins.LoginService: removed/changed public com.dansplugins.detectionsystem.logins.AccountAddressInfo getAccountInfo(java.util.UUID);
• com.dansplugins.detectionsystem.logins.LoginService: removed/changed public void saveLogin(org.bukkit.entity.Player);
• com.dansplugins.detectionsystem.logins.LoginService: added public void saveLogin(java.util.UUID, java.net.InetAddress);

</details>

Verification

Verified on a real Spigot server before publication; this release carries the exact jar that was verified.

• boot gate run: booted twice on a fresh Spigot server (10 assertions passed).
• save-compatibility gate run: data written by 2.0.0 was loaded by this release across 5 restart cycles with nothing lost (32 assertions passed).
• The current stable release 2.0.0 does not close its database cleanly on shutdown (plugins/AlternateAccountFinder/aaf.trace.db left behind after its own stops); this release does.

Install with Dan's Plugin Manager: /dpm get <plugin>. How stable releases are made: Release channels.

drafted by Claude on behalf of Daniel Stephenson

Snapshot release marking AlternateAccountFinder's move to an AI-first development approach.

Day-to-day feature work, grooming, review and maintenance now run through AI agents working directly against this repository, with the maintainers setting direction and approving what lands. The version bump marks that change in how the project is built — it is not a compatibility break. Behaviour, configuration and stored data are unchanged, and existing installations can upgrade in place.

This is a dated snapshot, not a finished release. It follows the precedent set by Medieval Factions' 6.0.0-SNAPSHOT-7-25-2026: the AI-first line has not yet been verified in live operation, and the snapshot designation stays until it has.

Version changes

• build.gradle: 2.0.0 → 3.0.0-SNAPSHOT-8-8-2026

Opened as https://github.com/Dans-Plugins/AlternateAccountFinder/pull/88.

Drafted by Claude on behalf of Daniel Stephenson.

What's Changed

• v2 by @alyphen in https://github.com/Dans-Plugins/AlternateAccountFinder/pull/50
• Changed version to 2.0.0 for release by @dmccoystephenson in https://github.com/Dans-Plugins/AlternateAccountFinder/pull/51

New Contributors

• @alyphen made their first contribution in https://github.com/Dans-Plugins/AlternateAccountFinder/pull/50

Full Changelog: https://github.com/Dans-Plugins/AlternateAccountFinder/compare/1.2.0...2.0.0

What's Changed

• Moving away from the Singleton pattern. by @dmccoystephenson in https://github.com/Dans-Plugins/AlternateAccountFinder/pull/48

Full Changelog: https://github.com/Dans-Plugins/AlternateAccountFinder/compare/v1.1...1.2.0

Changes in v1.1

• Major code refactoring
• Added /aafsearch (playername), allowing a player with permission to search for information regarding a specific player.
• Ops should now be able to use admin commands by default.
• The plugin should now work for 1.13 - 1.16 servers.
• Integrated bStats

What is this?

Alternate Account Finder keeps track of every IP address that is used to log into your server. If two players log in using the same IP address, that address will be flagged as suspected and the players will show up when you type /aaflist suspected. If two players have logged in more than 3 times using the same IP address, that address will be flagged as probable and the players will show up when you type /aaflist probable. You can also view IP addresses that have logged into your server by typing /aaflist addresses.

Permissions

• aaf.list