"Pinned to a SHA" is a lie your coding agent told you. Here's the Git trick behind Plugin4Shell.
This story is from 2026-09-28. It is preserved in the archive; the latest stories are on the live feed.
You pinned the plugin to an exact commit SHA. Forty hex characters. Immutable. That's the whole point of pinning — the code can't change under you. Except it can. And for a few weeks this month, across four of the most popular AI coding agents, it did — with zero clicks from you. On 17 September, A…
Read the full story at DEV Community — AI ↗
Timeline · 1 report
- 2026-09-28 18:23 · DEV Community — AI
"Pinned to a SHA" is a lie your coding agent told you. Here's the Git trick behind Plugin4Shell.