tl;dr update your server by repeating the steps you used to install it.

Hi All

We have just pushed some out of schedule security releases for Spigot. These releases work around a security issue in log4j2, the logging library used by Minecraft. BungeeCord is unaffected.

The following versions have been patched:
  • 1.8.8 (BuildTools rev 582-a)
  • 1.9.4 (BuildTools rev 849-a)
  • 1.10.2 (BuildTools rev 986-a)
  • 1.11.2 (BuildTools rev 1251-a)
  • 1.12.2 (BuildTools rev 1573-k)
  • 1.13.2 (BuildTools rev 2148-d)
  • 1.14.4 (BuildTools rev 2502-c)
  • 1.15.2 (BuildTools rev 2703-a)
  • 1.16.5 (BuildTools rev 3096-a)
  • 1.17.1 (BuildTools rev 3284-a)
  • 1.18 (all versions after 10 December)
  • 1.18.1 (all versions)
You can obtain a patched server jar by re-running BuildTools with the appropriate revision, eg, java -jar BuildTools.jar --rev 1.12.2.

If you are using < 1.17.1 and a custom log4j2.xml, for example by modifying the server jar or using the -Dlog4j.configurationFile= Java argument, you will need to replace all occurrences of %msg with %msg{nolookups}.

It is also highly recommended you update your Java to the latest build of the relevant version. This is always good practice.

We are not currently aware of the exploit having any possible permanent effects on your server if you are/were running an up to date version of Java (any version from the last ~ 3 years, including Java 8 updates released within that timeframe).

Please check this thread regularly for any further updates.
Edit: 1.18.1 is now available with --rev 1.18.1. A BungeeCord update is not required.

Edit (9 December): 1.18 is now the default version.

Edit: 1.18 release is now available.

Dear All

As we mark the 9-year anniversary of, it is my pleasure to announce that development/preview builds of Spigot for Minecraft 1.18 are now available. Owing to the shorter interval between 1.17 and 1.18 this is a smaller update than previous major releases. There are however still some significant changes, particularly around world generation and biomes, so some initial caution is advised.

Plugin Updates
With the exception of plugins referencing removed biomes/particles and changes to third-party libraries (especially MySQL), there are no breakages expected. As a server owner, if a plugin is breaking on Minecraft updates, you should be encouraging developers to code their plugin in a way that it does not break (read: use the API). Doing this once is much more efficient than depending on an update every release. As a developer you should use the API wherever possible — a stable API is what distinguishes plugins from mods. If you cannot use the API, then you should contribute one, or at least open a feature request stating the API desired and why you need it. This will prevent you needing to update your plugin each release and will cumulatively save server owners and the community thousands of hours each year. You should consider it your duty to the community to do this.

Java Version
Mojang has decided to make Minecraft 1.18 require Java 17 or later. You can install this from a third party such as Azul Zulu or your Linux package manager. Please note that the --illegal-access=permit workaround is no longer possible on this version. Please also note that current versions of Java 17 have a bug which may affect users on single-core systems. If you have such a...
Update 6 July 2021: We have updated to 1.17.1. This is a minor but important update. All users are advised to upgrade.

Dear SpigotMC Community

We are pleased to announce the first builds of Spigot for Minecraft 1.17 are now available. Although this is a moderately sized update overall there are some major changes and very important points to note, so please read the following carefully.

Java Version
Mojang has decided to make Minecraft 1.17 require Java 16 or later. As this is not an LTS version, it is not available by default in the repositories of some popular Linux distributions. You may therefore have to manually install it from a third party such as Azul Zulu. If you see an error message that looks similar to Unsupported Java detected (55.0). This version of Minecraft requires at least Java 16. your Java version is incompatible and you will need to upgrade. If you are using a shared host you should contact your host for instructions on how to do this, otherwise if you are hosting yourself you can check your java version with java -version.

If you have problems with plugins after updating Java you may be able to temporarily work around this by adding --illegal-access=permit straight after java in your command line. Please note however that this is a temporary workaround and might not work in future Java versions.

Caves and Cliffs
Mojang has delayed many features, including extended world heights, generation changes, and certain blocks/items to Minecraft 1.18. Although most of these features are still accessible in 1.17 through the use of either the experimental datapack or commands, and Spigot provides APIs for them, it must be remembered that these features are experimental/disabled for a reason. You are welcome to test them, report Spigot bugs, and contribute API, but be cautious and wary of bugs and the potential for...
Update 16 January 2021: We have updated to 1.16.5. This change is almost completely compatible with 1.16.4 and simply aligns with Vanilla (crash bug already fixed by Spigot).

Update 3 November 2020: We have updated to 1.16.4.

Update 11 September 2020: We have updated to 1.16.3. This version fixes a single bug with pathfinding (the duplication was already fixed by Spigot).


A short while ago Mojang released Minecraft 1.16.5 and we have now also updated.

It has also come to our attention that a number of mirror sites have been advertising severely outdated builds of Spigot as the 'latest' version. This caused significant issues for many users when 1.16.1 launched as users were reporting critical bugs for weeks after they were fixed. Please ensure you use the /version command to check your server version before reporting any bugs. BuildTools is the only official source of Spigot builds.

In order to get 1.16.5, simply run the latest BuildTools.
Code (Text):
java -jar BuildTools.jar
If you haven't used BuildTools to create a server jar yet, it is suggested you first read the 1.8 announcement and the additional BuildTools info thread.

BungeeCord is also updated and can be found on Jenkins.

Dear SpigotMC Community,

The first builds of our software for Minecraft 1.16.1 have now been released. Although this is a minor update for plugin developers it is a relatively large update overall. In particular multi-world support was rewritten several times relatively late in the snapshot cycle, so extra caution is recommended if your server has more than the three default worlds (world, world_nether, world_the_end). Although this now means that the Vanilla server (in theory) has (experimental) multi-world support, we have retained the existing Spigot structure and approach for various reasons. Accordingly, you should continue to use your existing plugins and folders for multi-world management and not the Vanilla system.

Although upgrades from between any two version pairs are technically possible, it is recommended that all upgrades are conducted from 1.15.2. This means that you should first upgrade your world completely on 1.15.2 using the --forceUpgrade server argument, and then do the same on 1.16.1.

Bug Reports
If you are reporting a bug to JIRA, please make sure that you read the guidelines and have compared the results between Vanilla & Spigot, and also the 1.15.2 versions before reporting — this speeds up the process for us immensely.

Please see below post.

Expectations & Entitlement
I'm not sure if the addition of a Discord server has caused this behaviour to become more visible or whether it is a new phenomenon within the community, but in either case I am writing this message to make both my stance and the stance of the rest of the SpigotMC Team clear. We love SpigotMC. We love Minecraft (yesterday was my nine year anniversary). We love that you're all excited for new releases. What we don't love is entitlement and demands — something we have seen a lot of in the last two days. SpigotMC is not our life. SpigotMC is not even our...