From 5d896485a9a5f2cdcb6f9904f825e8b38ba11f96 Mon Sep 17 00:00:00 2001 From: Dextheking1 Date: Fri, 23 Oct 2026 12:10:50 +0200 Subject: [PATCH] pin npx-launched packages to fixed versions playwright and xero MCP configs used @latest, the statechart renderer used an unversioned mermaid-cli, and the agent-compatibility instructions used @latest. Pin all four to their current releases. --- agent-compatibility/README.md | 10 +++++----- .../agents/compatibility-scan-review.md | 2 +- .../skills/statechart/scripts/statechart.mjs | 4 ++-- pstack/skills/statechart/scripts/statechart.mjs | 4 ++-- third_party/playwright/README.md | 4 ++-- third_party/playwright/mcp.json | 2 +- third_party/xero/README.md | 2 +- third_party/xero/mcp.json | 2 +- 8 files changed, 15 insertions(+), 15 deletions(-) diff --git a/agent-compatibility/README.md b/agent-compatibility/README.md index 5dcd861da..b9df553b7 100644 --- a/agent-compatibility/README.md +++ b/agent-compatibility/README.md @@ -49,31 +49,31 @@ The plugin does not bundle the scanner. It runs the published npm package when n Default scan (compact terminal dashboard): ```bash -npx -y agent-compatibility@latest . +npx -y agent-compatibility@0.1.7 . ``` JSON output: ```bash -npx -y agent-compatibility@latest --json . +npx -y agent-compatibility@0.1.7 --json . ``` Markdown output: ```bash -npx -y agent-compatibility@latest --md . +npx -y agent-compatibility@0.1.7 --md . ``` Plain text output: ```bash -npx -y agent-compatibility@latest --text . +npx -y agent-compatibility@0.1.7 --text . ``` Config override for ignored paths or weight overrides: ```bash -npx -y agent-compatibility@latest . --config ./agent-compatibility.config.json +npx -y agent-compatibility@0.1.7 . --config ./agent-compatibility.config.json ``` The scanner is heuristic. It scores repo signals and surfaces likely friction, but it is not a full quality verdict on the codebase. diff --git a/agent-compatibility/agents/compatibility-scan-review.md b/agent-compatibility/agents/compatibility-scan-review.md index 97d2419f1..a1375b79e 100644 --- a/agent-compatibility/agents/compatibility-scan-review.md +++ b/agent-compatibility/agents/compatibility-scan-review.md @@ -15,7 +15,7 @@ Use when the task is specifically to run the published `agent-compatibility` sca ## Workflow -1. Try the published scanner first with `npx -y agent-compatibility@latest --json ""`. +1. Try the published scanner first with `npx -y agent-compatibility@0.1.7 --json ""`. 2. If you are clearly working inside the scanner source repo and the published package path fails for an environment reason, fall back to the local scanner entrypoint. 3. Only say the scanner is unavailable after you have actually tried the published package, and the local fallback when it is clearly available. 4. Prefer JSON when you need structured reasoning. Prefer Markdown when the user wants a direct report. diff --git a/harness/pstack/claude-code/skills/statechart/scripts/statechart.mjs b/harness/pstack/claude-code/skills/statechart/scripts/statechart.mjs index 0ff4255c2..b586a9aca 100644 --- a/harness/pstack/claude-code/skills/statechart/scripts/statechart.mjs +++ b/harness/pstack/claude-code/skills/statechart/scripts/statechart.mjs @@ -103,7 +103,7 @@ const COMMON = `Both commands finished last. The command does not use an output folder that has files that it did not write. On a filesystem that cannot rename, the command copies the files into place, and overlapping runs can mix their files. - --png Also render each chart to PNG with npx @mermaid-js/mermaid-cli. + --png Also render each chart to PNG with npx @mermaid-js/mermaid-cli@12.0.0. -h, --help Print this help, and exit 0. Output @@ -634,7 +634,7 @@ function render(charts, shown) { const png = chart.replace(/\.mmd$/, ".png"); const r = spawnSync( "npx", - ["-y", "@mermaid-js/mermaid-cli", "-i", chart, "-o", png, "-s", "2"], + ["-y", "@mermaid-js/mermaid-cli@12.0.0", "-i", chart, "-o", png, "-s", "2"], { encoding: "utf8", }, diff --git a/pstack/skills/statechart/scripts/statechart.mjs b/pstack/skills/statechart/scripts/statechart.mjs index 0ff4255c2..b586a9aca 100644 --- a/pstack/skills/statechart/scripts/statechart.mjs +++ b/pstack/skills/statechart/scripts/statechart.mjs @@ -103,7 +103,7 @@ const COMMON = `Both commands finished last. The command does not use an output folder that has files that it did not write. On a filesystem that cannot rename, the command copies the files into place, and overlapping runs can mix their files. - --png Also render each chart to PNG with npx @mermaid-js/mermaid-cli. + --png Also render each chart to PNG with npx @mermaid-js/mermaid-cli@12.0.0. -h, --help Print this help, and exit 0. Output @@ -634,7 +634,7 @@ function render(charts, shown) { const png = chart.replace(/\.mmd$/, ".png"); const r = spawnSync( "npx", - ["-y", "@mermaid-js/mermaid-cli", "-i", chart, "-o", png, "-s", "2"], + ["-y", "@mermaid-js/mermaid-cli@12.0.0", "-i", chart, "-o", png, "-s", "2"], { encoding: "utf8", }, diff --git a/third_party/playwright/README.md b/third_party/playwright/README.md index c7e57ad91..e13d9fd68 100644 --- a/third_party/playwright/README.md +++ b/third_party/playwright/README.md @@ -14,7 +14,7 @@ Or run `/add-plugin playwright` in chat. ## Requirements -This is a **local stdio** MCP server. Cursor launches it with `npx -y @playwright/mcp@latest`, so the machine running Cursor needs **Node.js** installed and on `PATH`. The `-y` flag skips `npx`'s install confirmation so the first launch cannot hang waiting for interactive input over stdio. +This is a **local stdio** MCP server. Cursor launches it with `npx -y @playwright/mcp@0.0.83`, so the machine running Cursor needs **Node.js** installed and on `PATH`. The `-y` flag skips `npx`'s install confirmation so the first launch cannot hang waiting for interactive input over stdio. The first run downloads Playwright's browser binaries. That can take a minute and needs network access; later runs reuse the cached browsers. @@ -25,7 +25,7 @@ The first run downloads Playwright's browser binaries. That can take a minute an "mcpServers": { "playwright": { "command": "npx", - "args": ["-y", "@playwright/mcp@latest"] + "args": ["-y", "@playwright/mcp@0.0.83"] } } } diff --git a/third_party/playwright/mcp.json b/third_party/playwright/mcp.json index 20d347437..04423eb2c 100644 --- a/third_party/playwright/mcp.json +++ b/third_party/playwright/mcp.json @@ -2,7 +2,7 @@ "mcpServers": { "playwright": { "command": "npx", - "args": ["-y", "@playwright/mcp@latest"] + "args": ["-y", "@playwright/mcp@0.0.83"] } } } diff --git a/third_party/xero/README.md b/third_party/xero/README.md index 3e2ea49b4..4d1f5dcfd 100644 --- a/third_party/xero/README.md +++ b/third_party/xero/README.md @@ -22,7 +22,7 @@ Or run `/add-plugin xero` in chat. "command": "npx", "args": [ "-y", - "@xeroapi/xero-mcp-server@latest" + "@xeroapi/xero-mcp-server@0.0.17" ], "env": { "XERO_CLIENT_ID": "${XERO_CLIENT_ID}", diff --git a/third_party/xero/mcp.json b/third_party/xero/mcp.json index 52ba6ec03..0d8c44c2c 100644 --- a/third_party/xero/mcp.json +++ b/third_party/xero/mcp.json @@ -5,7 +5,7 @@ "command": "npx", "args": [ "-y", - "@xeroapi/xero-mcp-server@latest" + "@xeroapi/xero-mcp-server@0.0.17" ], "env": { "XERO_CLIENT_ID": "${XERO_CLIENT_ID}",