Unverified50% confidenceReleaseExact time
claude-code-setup suggested a PreToolUse hook for this project that blocks direct editing of version-management-related files (manifest.json, src/version.js, package-lock.json, coverage/), because the project synchronizes the version numbers of three files via npm run version:*.
1
Sources
50%
Confidence
Short-term (~14 days)
Relevance
10/17/2026
First Seen
Valid until: 10/31/2026
Sources
Related Entities
Related Claims
UnverifiedUsing lock files (package-lock.json or yarn.lock) can pin dependency versions and avoid inconsistency issues caused by version drift.73% similarUnverifiedFor patch versions that are purely dependency synchronization, projects using a strictly locked lockfile can upgrade as needed and do not have to chase every patch number; projects using range versions (such as ^3.0.0) have already automatically received the update, and need to pay attention to whether the core package's behavior has changed.70% similarUnverifiedIt is recommended to use package-lock.json or pnpm-lock.yaml to precisely lock the actually installed versions, and to submit upgrade PRs on a scheduled basis via tools such as Dependabot or Renovate.68% similarUnverifiedPreviously, when the .claude/settings.local.json file had not yet been created in a project, clicking the 'Always Allow' authorization option could not be saved correctly; after this version's fix, the system will automatically create the file and persist the authorization choice68% similarUnverified版本锁定文件（package-lock.json或yarn.lock）无法完全阻断供应链攻击，因为新建项目首次安装仍会拉取被污染版本，且自动化更新工具可能升级至恶意版本68% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1050797API
curl https://kongchang.com/api/v1/knowledge/claims/1050797MCP
get_claim(id=1050797)