Two download-path hardenings
RenoDX wiki links are allowlisted, and the publisher is named first
The optional RenoDX HDR mod step took whatever .addon64 link the RenoDX project wiki listed for a game — any scheme, any host — and that file is loaded into the game process. The wiki is editable by accounts outside the project, so one edit there could have handed everyone who ticked the box an arbitrary DLL. Reported by gregojoao (#102).
Now a wiki link is followed only when it is https and points at a fork's own GitHub Pages (https://<owner>.github.io/renodx/…) or a fork's GitHub release (https://github.com/<owner>/renodx/releases/download/…). Anything else falls back to the project's own snapshot build, and the note says so. The checkbox and --check name the publisher — "clshortfuse snapshot build" or "'s fork" — before anything is downloaded. All 240 links on the wiki today pass, so no mod is lost.
The Feeder zip is checked against its release page
DLSS5-Feeder's author reports fake copies in circulation (lookalike repositories, zips on personal pages) and, from 1.16.0-beta.3, prints the genuine zip's SHA-256 in each release's notes. This tool only ever downloads from the author's releases; now, when the notes carry a hash, the downloaded bytes must match it or nothing is installed, with both hashes shown. Verified against beta.3.
Everything from v0.13.18 is included.