A new CraftBukkit build (#677) is now available that contains fixes for a CRITICAL crash exploit (already present in build #674) and prevents malicious users from setting an invalid position which helps them bypass protections within the code.
There should be no breaking changes in this build so anyone updating from #670 or #674 should have no problems. However, you should always be backing your server up before updating to be safe.
A new CraftBukkit build (#670) is now available that fixes a CRITICAL exploit that allows people to easily take down your server.
Please note: plugin names are now set based on the "name:" field in the plugin.yml, not the jar name anymore. This change MAY BREAK SOME PLUGINS. However, it should be easy to address.
With the introduction of the build system we hoped to give us some breathing room with development and provide a stable goal for Plugin Developers and server admins to rely on. And while I can honestly say we've achieved that, to an extent, things aren't going as I planned or expected them to.
While we do expect Plugin Developers to support the latest Recommended Build, we were also hoping that they wouldn't wait until the last minute to push a compatible build out. Basically, what we expected was that plugin devs would be actively following the development of the project (maybe even having a CI setup like we have) so that they would be prepared for whenever a Recommended Build does land. Unfortunately, this doesn't seem to be the case and plugin devs are only developing for Recommended Builds instead.
Although it's not realistic to expect that all Plugin Developers are always on top of new developments, it would...
Effectively immediately, we are no longer allowing the distribution of unofficial builds for several reasons:
It contributes to fragmentation
We have no way of ensuring the build doesn't contain malicious code
It results in an increased support load for a product we don't support, since it's an unofficial build.
It can end up misrepresenting our project if the unofficial builds cause problems. Yes, they're unofficial but, unfortunately, that doesn't usually stop people from letting it reflect badly upon the project.
We strongly recommend against the use of unofficial builds for the above reasons and hope that everyone will heed our warning. Unofficial builds can and have caused map corruption, server crashing and/or have contained security holes and backdoors in the past.
