Ricotta now uses a whitelist to enable plugins.