All three MCP servers used `npx -y <package>` without version pins,
causing npx to auto-install the latest version on each invocation.
A compromised or breaking release would silently affect all users.
Pinned to current stable versions verified against npm registry:
- @playwright/mcp@0.0.70
- @upstash/context7-mcp@2.1.8
- deepwiki-mcp@0.0.6
Update these pins deliberately when upgrading rather than auto-pulling.
Co-Authored-By: Claude Code <noreply@anthropic.com>
hooks.py logs full hook event data (including tool_input, which may contain
file contents or command arguments) to .claude/hooks/logs/hooks-log.jsonl.
This log file was not excluded from git, creating a risk of accidentally
committing sensitive data such as file contents passed to Write/Edit tools
or command arguments passed to Bash.
Added .claude/hooks/logs/ to .gitignore to prevent accidental commits.
Co-Authored-By: Claude Code <noreply@anthropic.com>
claude[bot]andClaude Code