the_og
88e93edc6c
CI / Tests (py3.12 / windows-latest) (pull_request) Failing after 16s
CI / Lint (ruff) (pull_request) Successful in 52s
CI / Tests (py3.10 / ubuntu-latest) (pull_request) Successful in 12s
CI / Tests (py3.12 / ubuntu-latest) (pull_request) Successful in 14s
CI / Tests (py3.13 / ubuntu-latest) (pull_request) Successful in 14s
- Pin every basic-tier entry to an exact published version (npm @x.y.z, uvx @x.y.z, docker :tag). Unpinned npx -y <pkg> means a package compromised AFTER we ship auto-upgrades into every user; a pin bounds supply-chain compromise to versions we actually reviewed. - Drop firecrawl from the seed (19 entries). npm publish rights are held solely by hello_sideguide/sideguide.dev, which has no visible relationship to firecrawl.dev, while the package is presented as official. Publisher identity we cannot tie to the vendor is exactly what this catalog must not execute on a user's machine. Retained in the research pool pending confirmation. - postgres: ship --access-mode=restricted, not unrestricted. A curated catalog must not default to handing an LLM write access to your DB. - Add last_release (ISO date, from the live registry) so the UI can show freshness; postgres-mcp and mcp-obsidian are both ~14mo stale.