v0.4.0 — the update model changed

Why the update model changed

Since v0.1 the plugin could download and install its own updates. That design kept tripping Windows Defender: two separate waves of machine-learning false positives (Sabsik.TE.A!ml, then Wacatac.H!ml) flagged the updater's freshly downloaded plugin file — both times the same staged DLL the auto-updater had just written to disk. The files themselves are clean (VirusTotal: 0 detections across ~70 engines, including Microsoft's own), but the pattern — a program silently downloading a new DLL and writing it to disk — is exactly what Defender's heuristics distrust in software they don't know yet, and every new release is a file Defender has never seen before. v0.3.4 already softened the pattern (explicit consent, apply only after HDT exits) and it still got flagged. A plugin that periodically gets called a trojan loses far more trust than one extra manual step costs, so the auto-download is now gone entirely.

How updating works from v0.4.0 on

The plugin still checks for updates and tells you when one exists — a banner in the F3 overlay, a line in Settings > Updates, and a small "Update available" badge above the in-game search button. Installing is now always done by you, through your browser:

1. Click "Download page" — the GitHub release opens in your browser.
2. Download the zip and extract it.
3. Run install.bat — it closes HDT, installs the update, and offers to start HDT again.

That is the same one-minute flow as the first install. "Skip this version" still works if you want to sit a release out. The plugin itself never downloads or writes program files anymore, so the pattern both false-positive waves fired on no longer exists.

Notes for this particular update

• Getting to v0.4.0 itself still happens through your currently installed version's old mechanism — or manually: if its Download button fails or Defender interferes, just install from this page (download the zip, extract, run install.bat).
• v0.4.0 deletes the old updater's leftover staging files on startup. On some machines those leftovers were re-triggering a Defender warning on every HDT start; that stops once v0.4.0 runs.
• If Defender flags anything during this transition: it is a false positive — add the file to the exclusions list and contact .tantrum. on Discord to help with resolving the issue.