Security fixes are made on main and shipped in the next release. Only the latest release receives fixes. We do not patch older releases.
Please do not open a public issue for security problems.
Report it privately through GitHub instead:
- Open the Security tab of this repository.
- Click Report a vulnerability and describe the problem. If possible, include the affected version, platform (Bukkit / Fabric), Minecraft version and steps to reproduce.
Only the maintainers can see the report. We aim to reply within one month, and we will keep you updated until the issue is fixed and released. With your permission, we will credit you in the release notes.
Official builds are only distributed through GitHub Releases and the official download pages listed in the README. Do not install jars shared in issues, pull requests or other places.