Halloween Plugin v3.0.6 - Rapid-Click Exploit Hotfix!

Release Date: October 18, 2025
Type: Security hotfix - single critical exploit fix

Security Fix

v3.0.6 - Rapid-Click Boss Spawn Exploit Prevention

• FIXED: Players could spawn multiple bosses by rapid-clicking pumpkin head structure
• FIXED: Exploit allowed spawning 5+ bosses within 1 second from single structure
• ADDED: Per-block click debounce (3 second default cooldown between clicks)
• IMPROVED: More consistent boss spawn behavior

What This Means for Admins

Boss Spawn Control:
Players can no longer exploit the pumpkin head structures by rapid-clicking:

• Zombie Boss (fence + pumpkin) - protected from rapid spawning (1 click per second maximum)
• Skeleton Boss (lapis + pumpkin) - protected from rapid spawning (1 click per second maximum)
• This is now hardcoded - ALWAYS 3 second between clicks on same block, no exceptions

Installation

1. Stop your server
2. Replace halloween-plugin-3.0.5.jar with halloween-plugin-3.0.6.jar
3. Start your server
4. No config changes needed - hotfix is fully backward compatible

Compatibility: v3.0.5 → v3.0.6 = No migration (configs fully compatible)
Minecraft: 1.21.1+ (Paper/Purpur recommended)
Java: 17+

Release Notes

This is a maintenance hotfix addressing a single but important exploit:

• Tight click detection prevents rapid boss spawning
• Individual block tracking ensures fair gameplay
• No breaking changes - drop-in replacement for v3.0.5

Bug Reports

Keeping your server fair and Halloween fun!