This blog is updated daily.
A general description is here.
It is now easier to use secure downloads from 'https://' URLs on builds which support them: no longer do non-default options need to be selected to do so. In particular, packages can be installed from repositories which offer 'https://' URLs, and those listed by 'setRepositories()' now do so (for some of their mirrors).
Support for 'https://' URLs is available on Windows, and on other platforms if support for 'libcurl' was compiled in and if that supports the 'https' protocol (system installations can be expected to do). So 'https://' support can be expected except on rather old OSes (an example being OS X 'Snow Leopard').
(Windows only) 'setInternet2(TRUE)' is now the default. The command-line option '--internet2' and environment variable 'R_WIN_INTERNET2' are now ignored.
Thus by default the '"internal"' method for 'download.file()' and 'url()' uses the '"wininet"' method: to revert to the previous default use 'setInternet2(FALSE)'.
This means that 'https://' can be read by default by 'download.file()' (they have been readable by 'file()' and 'url()' since R 3.2.0).
There are implications for how proxies need to be set (see '?download.file'): also, 'cacheOK = FALSE' is not supported.