Unverified50% confidenceReleaseExact time
claude-code-setup suggested a PreToolUse hook for this project that blocks direct editing of version-management-related files (manifest.json, src/version.js, package-lock.json, coverage/), because the project synchronizes the version numbers of three files via npm run version:*.
1
Sources
50%
Confidence
Short-term (~14 days)
Relevance
10/17/2026
First Seen
Valid until: 10/31/2026
Sources
Related Entities
Related Claims
UnverifiedUsing lock files (package-lock.json or yarn.lock) can pin dependency versions and avoid inconsistency issues caused by version drift.73% similarUnverified面对纯依赖同步的补丁版本，使用 lockfile 严格锁定的项目可以按需升级，不必追赶每一个补丁号；使用范围版本号（如 ^3.0.0）的项目已自动拿到更新，需关注核心包行为是否变化。70% similarUnverifiedIt is recommended to use package-lock.json or pnpm-lock.yaml to precisely lock the actually installed versions, and to submit upgrade PRs on a scheduled basis via tools such as Dependabot or Renovate.68% similarUnverifiedPreviously, when the .claude/settings.local.json file had not yet been created in a project, clicking the 'Always Allow' authorization option could not be saved correctly; after this version's fix, the system will automatically create the file and persist the authorization choice68% similarUnverified版本锁定文件（package-lock.json或yarn.lock）无法完全阻断供应链攻击，因为新建项目首次安装仍会拉取被污染版本，且自动化更新工具可能升级至恶意版本68% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1050797API
curl https://kongchang.com/api/v1/knowledge/claims/1050797MCP
get_claim(id=1050797)