{"version":"2.1.323","anchor":"plugin-submodule-sha-pin-verification-gated-by-tengu-tidal-k","canonical_anchor":"plugin-submodule-sha-pin-verification-gated-by-tengu-tidal-k","heading":"Plugin repositories are refused when submodules do not match their recorded commits","tier":"notice","area":"Plugins","scope":"individual","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.323\/e\/plugin-submodule-sha-pin-verification-gated-by-tengu-tidal-k","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.323","markdown":"### Plugin repositories are refused when submodules do not match their recorded commits\n\nAfter cloning a plugin, Claude Code can check its submodules against the recorded commits and refuse the repository on a mismatch\n\n**Unclear.** Whether this check is switched on is not known.\n\n**What**\n\nSome plugin and marketplace repositories include submodules, which are other repositories pulled in at a specific recorded commit. After cloning a plugin, Claude Code now checks that each submodule is at the commit the main repository records. A mismatch refuses the repository with \"SHA pin verification failed\". If the check cannot be confirmed, Claude Code also refuses to use it. The check is controlled by a server-side switch.\n\n**Why**\n\nIt stops a plugin from quietly pulling in different code than its repository says it uses.\n\n- Area: Plugins\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 2\/5\n- Scope: individual\n- Heads-up: yes"}