F
Fred Moon
Plugins that wrap a third-party runtime (a rendering SDK, a player, a shader library) must bundle that runtime and pin it to an exact version. That's a sensible rule: code on a published site shouldn't change after review.
The catch is that a pinned component never changes at all. When the library vendor ships a fix, it reaches new insertions only after the plugin releases an update and it clears review. Every component already placed keeps the old version until each user finds it and re-inserts it by hand, and most never will. If the library had a security hole, it would stay live on published sites indefinitely, however quickly the vendor and the plugin developer reacted.
Any of these would close the gap while keeping review in the loop:
  1. Let a plugin publish a reviewed update to a module it hosts, which placed components pick up automatically within a compatible version range.
  2. Show an update notice on placed components whose module has a newer reviewed version, with one click to update every instance in the project.
  3. For plugins that are the official integration of a vendor, allow loading the vendor's own library from the vendor's domain, pinned or verified by hash.
This affects any plugin that inserts code components built on an external library, not just one plugin.