Repository navigation
Pin npx-launched packages to fixed versions - #787
Dextheking1 wants to merge 2 commits into
Conversation
|
Hey @Dextheking1, checked the pins against the registry: One thing worth stating in the PR body: with |
Playwright and Xero MCP configs launch with
npx -y pkg@latest. The statechart renderer runsnpx -y @mermaid-js/mermaid-cliwith no version at all. The agent-compatibility instructions tell the agent to runnpx -y agent-compatibility@latest.Cursor starts stdio MCP servers when a plugin is enabled, and
-yskips the only install prompt. So whatever@latestresolves to that day downloads and runs with the user's environment. For Xero that env includesXERO_CLIENT_IDandXERO_CLIENT_SECRET. A bad publish, a hijacked maintainer account, or a registry incident becomes code execution on every user who has the plugin enabled, with no diff for anyone to review.Fix: pin all four to their current releases.
@playwright/mcp0.0.83@xeroapi/xero-mcp-server0.0.17@mermaid-js/mermaid-cli12.0.0agent-compatibility0.1.7Updates then land as normal version bumps in a PR instead of silently from the registry.
Verified: ran the shipped Playwright command as-is, it fetched and ran 0.0.83.
node scripts/generate-pstack-harness-trees.mjs --checkpasses with both statechart copies edited.Note
Low Risk
Documentation and MCP config-only changes that lock known releases; behavior stays the same until maintainers bump versions in a follow-up PR.
Overview
Replaces
npx …@latest(and equivalent unpinned invocations) with fixed npm versions wherever plugins or agents download and run packages at enable/scan time.Agent Compatibility docs and the
compatibility-scan-reviewagent now call[email protected]instead of@latest. Playwright (mcp.json+ README) pins@playwright/[email protected]. Xero (mcp.json+ README) pins@xeroapi/[email protected].The intent is to stop silent registry drift on stdio MCP startup (including env that carries secrets for Xero) so upgrades show up as explicit version bumps in PRs.
Reviewed by Cursor Bugbot for commit 0e215d9. Bugbot is set up for automated code reviews on this repo. Configure here.