|
I'll let Kevin speak for himself (as he already has while I was typing this!), but I think as long as you're clear up front that your plugin is downloading updates from GitHub (and you provide a mechanism for the user to disable the updates), it should be fine.
Maybe default the auto-update feature to disabled, and then explain how those who want the dependency to be automatically kept up to date can enable it for themselves?
|