In reply to Sarah Gooding.

Right. It is interesting that none of this fallout occurred after Jetpack did the same thing 11 months ago.

My point is that while I expect oddities with Yoast updates normally, this one came from the Security team. It wasn't a third-party update that was forced.

I understand why this bothered people, but a big piece is educating folks on the process. Yoast might fatal an update, but Nacin wouldn't. I wouldn't turn on normal auto-updates for Yoast, but still allow minor/security release updates.

If you don't trust the Core team, then shutting off all auto-updates make sense. This isn't different than 4.1.1 except the same people updating a seriously insecure plugin instead of a core file.