The plugin was rewritten to allow the development of new features. Expect some bugs.
New features

• Added per-box opening limits supporting custom messages, multiple different limits for one box and permissions to bypass. You can see an example in the default box config in the plugin JAR.
• Target selector format was changed, run /givebox without arguments to read about new format.
• Added world, x, y, z options to the @p target selector. Now you can select nearest player to a given location.
• Now you can use @p in /givebox from the console or other plugins.
• %item%, %box% placeholders and nbtTag now work on all versions (1.8 to 1.15).
• Added option to disable damage from fireworks launched due to box effects. It is enabled by default and is controlled by 'disableDamageFromBoxFirework' setting in the main config.

Changes and improvements

• Config error messages were improved and made more verbose.
• Errors in effect configuration are not ignored now, but instead prevent box from being parsed.
• Default box (9901.yml) now has a legacy version for 1.12 servers and older.
• Source code was temporarily removed from the JAR, it will be available on GitHub soon.
• bStats metrics were added. This is the system used by PaperSpigot, Essentials, ProtocolLib, WE/WG, etc. Plugin page