You'll noticeTier: how much it should matter to you
3Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
PluginsArea: what it touches
ImprovementsKind: in v2.1.238,
ImprovementsSection of the release
What
Downloaded plugin binaries now land in a cache entry named by their sha256 and verified against it, staged in a temporary directory first and written with restrictive permissions, then swept on a time-to-live. Transient download failures retry on a backoff schedule bounded by a deadline.
Details
Staging directories are prefixed .binary-staging-.
The hashed-storage path is conditional; a direct filesystem fallback is retained.
Storage failures are wrapped in a distinctly named error rather than surfacing raw.
Evidence
.binary-staging-
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
