What probably matters to youSection of the release
What
A marketplace is a source that plugins are installed from. A marketplace entry can now carry an optional pluginDigests map. The map goes from a plugin's name to digests of its releases. A digest is a fingerprint of the files, so any change to them gives a different digest. This only counts when it comes from trusted managed settings, meaning settings an organization controls and users cannot edit.
A plugin with a hooks module loads from a folder only if that folder matches one of the listed digests. A hook is code that runs automatically at certain moments. The plugin must also be listed in prependPlugins or appendPlugins.
A plugin delivered from a remote source can now take the managed, organization-level tier this way. Before, the warning said such a plugin "gains the tier in a later release". It now explains the pluginDigests route.
The check that decides which plugins get the managed tier now skips plugins already vouched for by their digests.
When a setting ending in .pluginDigests changes, the summary of the change now warns that code from your organization will run.
Events about hooks that were passed over now also include a list of reopened ones.
Why
An administrator can now give a plugin delivered from a remote source managed hook status. Pinning it to exact digests means only those reviewed releases are trusted, and any other version of the folder will not load.
