{"version":"2.1.311","anchor":"plugindigests-added-to-the-marketplace-schema-managed-setti","canonical_anchor":"plugindigests-added-to-the-marketplace-schema-managed-setti","heading":"Organizations can pin plugin hooks by digest with pluginDigests","tier":"use","area":"Plugins","scope":"org","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.311\/e\/plugindigests-added-to-the-marketplace-schema-managed-setti","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.311","markdown":"### Organizations can pin plugin hooks by digest with pluginDigests\n\nManaged settings can list `pluginDigests` on a marketplace, so plugins in `prependPlugins` or `appendPlugins` run at the organization tier\n\n**What**\n\nA marketplace is a source that plugins are installed from. A marketplace entry can now carry an optional `pluginDigests` map. The map goes from a plugin's name to digests of its releases. A digest is a fingerprint of the files, so any change to them gives a different digest. This only counts when it comes from trusted managed settings, meaning settings an organization controls and users cannot edit.\n\n- A plugin with a hooks module loads from a folder only if that folder matches one of the listed digests. A hook is code that runs automatically at certain moments. The plugin must also be listed in `prependPlugins` or `appendPlugins`.\n\n- A plugin delivered from a remote source can now take the managed, organization-level tier this way. Before, the warning said such a plugin \"gains the tier in a later release\". It now explains the `pluginDigests` route.\n\n- The check that decides which plugins get the managed tier now skips plugins already vouched for by their digests.\n\n- When a setting ending in `.pluginDigests` changes, the summary of the change now warns that code from your organization will run.\n\n- Events about hooks that were passed over now also include a list of reopened ones.\n\n**Why**\n\nAn administrator can now give a plugin delivered from a remote source managed hook status. Pinning it to exact digests means only those reviewed releases are trusted, and any other version of the folder will not load.\n\n- Area: Plugins\n- Names: `pluginDigests`\n- Tier: Use it now\n- Useful: 5\/5\n- Signal: 3\/5\n- Scope: org\n- Heads-up: no"}