From bcdff005f24eee14a37b5870ea273b946583169e Mon Sep 17 00:00:00 2001 From: Avi Fenesh Date: Thu, 23 Apr 2026 16:27:31 +0300 Subject: [PATCH] fix(version): scope git add to files stamp-version.js writes Replaces 'git add -A' in the npm version lifecycle script with an explicit allowlist: - package.json - package-lock.json (npm version writes this) - .claude-plugin/plugin.json - .claude-plugin/marketplace.json - site/content.json Original PR #339 from xiaolai (NLPM audit) flagged that 'git add -A' sweeps any unrelated working-tree changes into the version commit. This is the broadened-allowlist version per Copilot's review suggestion - preserves the intent (no working-tree sweep) while keeping all version manifests in sync. Co-authored-by: xiaolai --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index f3c1def5..a1d75d6d 100644 --- a/package.json +++ b/package.json @@ -37,7 +37,7 @@ "bump": "node bin/dev-cli.js bump", "detect": "node bin/dev-cli.js detect", "verify": "node bin/dev-cli.js verify", - "version": "node scripts/stamp-version.js && git add -A", + "version": "node scripts/stamp-version.js && git add package.json package-lock.json .claude-plugin/plugin.json .claude-plugin/marketplace.json site/content.json", "setup-hooks": "node bin/dev-cli.js setup-hooks" }, "repository": {