Affaan Mustafa 29102901fa fix(security): pin MCP server versions, add dependabot, pin github-script SHA ...

Critical:
- Pin all npx -y MCP server packages to specific versions in .mcp.json
  to prevent supply chain attacks via version hijacking:
  - @modelcontextprotocol/server-github@2025.4.8
  - @modelcontextprotocol/server-memory@2026.1.26
  - @modelcontextprotocol/server-sequential-thinking@2025.12.18
  - @playwright/mcp@0.0.69 (was 0.0.68)

Medium:
- Add .github/dependabot.yml for weekly npm + github-actions updates
  with grouped minor/patch PRs
- Pin actions/github-script to SHA (was @v7 tag, now pinned to commit)

2026-03-31 02:34:57 -07:00

..

ci.yml

fix: harden unicode safety checks

2026-03-29 21:21:18 -04:00

maintenance.yml

chore: pin actions to commit SHAs and add Skills section to CLAUDE.md

2026-03-29 17:16:56 -04:00

monthly-metrics.yml

fix(security): pin MCP server versions, add dependabot, pin github-script SHA

2026-03-31 02:34:57 -07:00

release.yml

chore: pin actions to commit SHAs and add Skills section to CLAUDE.md

2026-03-29 17:16:56 -04:00

reusable-release.yml

chore: pin actions to commit SHAs and add Skills section to CLAUDE.md

2026-03-29 17:16:56 -04:00

reusable-test.yml

chore: pin actions to commit SHAs and add Skills section to CLAUDE.md

2026-03-29 17:16:56 -04:00

reusable-validate.yml

fix: harden unicode safety checks

2026-03-29 21:21:18 -04:00