[github-actions]

Upstream Dependency Sync

Upstream changes detected by the daily tracker workflow.

Changes Detected

---

Review Checklist

• Check for breaking API changes in updated dependencies
• Update SKILL.md if upstream capabilities changed
• Update install.sh if install methods changed
• Update checklists if needed
• Update README.md if an install command, tier label, or pack list changed — it is user-facing and drifts silently otherwise
• Bump version in plugin.json if changes made
• Run install.sh --dry-run to verify
• Run bash tests/install-smoke.sh to verify the installer still exits cleanly

This PR was automatically created by the upstream tracker workflow.

[github-actions]

New upstream changes detected (2026-08-04)

Updated by the upstream tracker workflow.

[github-actions]

New upstream changes detected (2026-08-05)

Updated by the upstream tracker workflow.

[github-actions]

New upstream changes detected (2026-08-06)

Updated by the upstream tracker workflow.

[github-actions]

New upstream changes detected (2026-08-07)

context7

• New release: @upstash/context7-mcp@4.0.0 (was @upstash/context7-mcp@3.2.5)
• Release notes:

### Major Changes

- 8d52608: Migrate the MCP server to the v2 SDK (`@modelcontextprotocol/{node,server,client}` 2.0.0) and the 2026-07-28 protocol revision. HTTP serving is now stateless for both modern and legacy clients, and Redis-backed sessions are removed.

• Impact: 🟡 review (code touched)
• Commit mix: 2 chore · 4 docs · 1 feat · 1 fix · 1 other
• Files touched: code=16 docs=34 ci=0 test=4 other=5
• 9 new commit(s) since last check
• Latest: 8276a7c — chore(release): version packages (#2997)
• Recent commits:
• 6c343ae [docs] docs(enterprise): changelog for v1.2.4 through v1.3.0 (#2953)
• 80f9d6c [docs] docs(enterprise): add library access control page (#2928)
• b89a04e [fix] fix(cli): write the API key as an Authorization header (#2957)
• 38422b1 [chore] chore(release): version packages (#2960)
• 6153deb [docs] docs(enterprise): document external Postgres with the embedded vector index (#2954)

lightrag

• New release: v1.5.6 (was v1.5.5rc1)
• Release notes:

## Important Notes

Introducing **PGTableGraphStorage**, a new graph storage backend built on native PostgreSQL tables. By eliminating the dependency on Apache AGE, it not only simplifies deployment but also delivers significantly higher graph storage performance with reduced storage footprint. It will replace the AGE-based `PGGraphStorage` as the preferred graph storage solution for PostgreSQL. This makes **PostgreSQL** the go-to **all-in-one backend database** for LightRAG, enabling a single database to cover all four storage types.

## What's New

* feat(kg): add PGTableGraphStorage — PostgreSQL-native graph backend (no AGE dependency) by @ysys143 in https://github.com/HKUDS/LightRAG/pull/3103
* docs(pipeline): rewrite the dedup and concurrency chapters from a user's view by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3583

## What's Changed

* Implement fail-closed recovery proof for whole-document purge by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3535
* docs: fix broken links and correct VLM gating semantics by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3539
* docs: extract parser service deployment runbooks by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3540
* docs: restructure FileProcessingPipeline into a usable guide by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3541
* docs: fix documentation typos, grammar errors, and incorrect warning messages by @Rythamo8055 in https://github.com/HKUDS/LightRAG/pull/3538
* feat(utils): bound thread-pool submission and pin the tokenizer contract by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3543
* fix(deps): sync uv.lock with the tiktoken floor and correct the restore rationale by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3546
* fix(api): bound request bodies and take token counting off the event loop by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3544
* fix(pipeline): take chunking off the event loop and bound the separator cascade by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3547

• Impact: 🔴 likely matters (breaking change)
• Commit mix: 5 build · 1 chore · 2 ci · 17 docs · 8 feat · 78 fix · 117 other · 2 perf · 2 refactor · 2 style · 16 test
• Files touched: code=0 docs=26 ci=12 test=164 other=98
• 436 new commit(s) since last check
• Latest: b33c6b0 — Merge pull request #3583 from HKUDS/docs/pipeline-run-control-and-retry
• Recent commits:
• 65723c0 [other] Merge pull request #3493 from santhreal/fix/weighted-polling-nonpositive-max
• 1557d82 [other] Merge pull request #3470 from santhreal/fix/semantic-reject-nonfinite-breakpoint-amount
• 7f555ea [fix] fix(retrieval): preserve WEIGHT fallback and improve partial-vector diagnostics
• a98d8bf [fix] fix(tools): migrate multimodal analysis caches
• 394fa7b [other] Merge pull request #3504 from HKUDS/fix/migrate-analysis-llm-cache

everything-claude-code

• New release: v2.1.0 (was v2.0.0)
• Release notes:

# ECC 2.1.0: Plan Canvas, Kimi Harness, and Self-Hosted Compute

ECC 2.1 turns plan review into a visual loop and opens the harness to self-hosted models. Plan Canvas lets you review agent plans in the browser. Point at the part you mean instead of retyping it in chat. A new Kimi Code install target and a verified Itô GPU path make ECC + open-source models a first-class setup, backed by our public sponsors: Moonshot AI (Kimi), Itô, and Atlas Cloud.

## Plan Canvas: review plans by pointing, not retyping

![Plan Canvas demo: reviewing an ECC plan, attaching an annotation, chatting with the agent, and approving the plan](https://raw.githubusercontent.com/affaan-m/ECC/main/docs/releases/2.1.0/assets/ecc-plan-canvas-demo.gif)

[Download the MP4 demo](https://raw.githubusercontent.com/affaan-m/ECC/main/docs/releases/2.1.0/assets/ecc-plan-canvas-demo.mp4)

`/plan` ends with a confirm gate, and until now that review was a wall of markdown in the terminal. Now the agent opens the plan in a loopback-only browser canvas:

- Click elements or select text to attach numbered annotations
- Chat with the agent from a side rail while it works in the terminal
- **Approve plan** / **Request changes** buttons map directly onto `/plan`'s CONFIRM gate
- Mermaid diagrams, tables, and task lists render natively; file edits live-reload the page
- Model- and harness-agnostic: a plain CLI + JSON protocol (`ecc-plan-canvas`), no Claude-only dependency

## Kimi harness: Moonshot AI partnership

• Impact: 🟡 review (code touched)
• Commit mix: 7 chore · 5 docs · 4 feat · 21 fix · 4 other · 2 test
• Files touched: code=0 docs=41 ci=7 test=73 other=85
• 43 new commit(s) since last check
• Latest: 9aac858 — fix(skills): default GAN harness models to sonnet (#2442) (#2695)
• Recent commits:
• b06c78c [docs] docs: add 2.1.0 release notes and Plan Canvas demo assets
• 1ffaa75 [fix] fix(release): match the ECC banner name when bumping versions
• 4099794 [fix] fix(release): bump the claude marketplace and zh-CN heading on macOS
• 6f452d4 [chore] chore: bump plugin version to 2.1.0
• edaf6fe [fix] fix(release): drop the dead OMP adapter verification step

marketing-skills

• New release: v2.10.0 (was v2.9.0)
• Release notes:

**attribution** (new, 1.1.0): a dedicated skill for the hardest question in marketing — which efforts actually drive conversions and revenue. Fills a real gap: attribution was scattered across analytics (UTM setup), ads (platform pixels), revops (pipeline), and ai-seo (the AI blind spot), but no skill owned the *models* or the *reconciliation problem*. Two pillars. **(A) Interpretation** — the six attribution models and when each lies; MTA vs. MMM vs. incrementality and how to choose; self-reported attribution; reconciling the platform-vs-GA-vs-CRM-vs-survey disagreement (never sum across platforms; pick one source of truth; read directional trends); and the direct / branded-search / dark-social / AI blind spots. **(B) Own your attribution (first-party)** — a build runbook for instrumenting attribution yourself when you control the site/app: the identity graph, closing the `identify()` gap (adapted from Tessa Kriesel's PostHog approach), stitching conversions on third-party domains you don't own (SavvyCal/Calendly/Stripe) via metadata passthrough + webhook identity-merge, fail-closed anonymity guards, and first-touch data-quality cleanup — distilled from real production builds (Conversion Factory + Truelist). Four references (`attribution-models.md`, `measurement-paradigms.md`, `by-business-type.md` with B2B/DTC playbooks, `first-party-tracking.md`) and 7 evals covering reconciliation, model choice, the third-party stitch, ROAS incrementality, the direct/branded blind spot, the analytics boundary, and the DTC measurement stack. Pillar B also folds in **production feedback from Tessa Kriesel** (credited): the CRM last mile (sync a `source` field with confidence + basis and a paid-vs-non-paid read onto the account → revops), storing the full ordered touch path so the build track can run Pillar A's multi-touch models on real data, the "expect ~zero until the cross-subdomain stitch is verified in prod" window with a narrowly-scoped campaign-window fallback + pre-stitch backfill, and account-level rollup (excluding free-mail domains) for B2B.
**analytics** (2.0.0 → 2.0.1): description now hands off attribution modeling and reconciliation to the new attribution skill, keeping analytics scoped to tracking setup, event taxonomy, and UTMs.

• Impact: 🟡 review (code touched)
• Commit mix: 1 chore · 2 feat · 5 other
• Files touched: code=0 docs=10 ci=0 test=0 other=4
• 8 new commit(s) since last check
• Latest: 7868cb9 — chore: sync skills with marketplace.json, plugin.json, and README
• Recent commits:
• 804c512 [feat] feat(attribution): new skill — models, reconciliation, and first-party attribution (2.10.0) (#473)
• 789ef02 [feat] feat(attribution): Tessa Kriesel production feedback → first-party runbook (1.1.0, part of 2.10.0) (#483)
• 3c51add [other] release(2.9.1): pricing-page teardown with AI-agent-readiness axis (#487)
• 2c13acc [other] Merge pull request #492 from coreyhaines31/hotfix/487-pricing-2.9.1
• fc2f33b [other] sync: main -> development after 2.9.1 pricing release

ui-ux-pro-max

• New release: v2.14.1 (was v2.11.2)
• Release notes:

## [2.14.1](https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/compare/v2.14.0...v2.14.1) (2026-08-06)

• Impact: 🟡 review (code touched)
• Commit mix: 3 feat · 4 fix
• Files touched: code=4 docs=3 ci=1 test=0 other=48
• 7 new commit(s) since last check
• Latest: abb7f2f — fix: bump skill.json version to 2.13.0 (#438)
• Recent commits:
• 4857a2c [fix] fix(cli): sync shadcn test asset (#433)
• ec1f2a9 [fix] fix(design-system): resolve palette and anti-patterns against the style's mode (#428) (#434)
• b0ebb17 [fix] fix(copilot): generate .prompt.md file for VS Code Copilot slash commands (#328)
• 14ddef5 [feat] feat(gallery): add Style Detail Modal with phone UI controls preview (#155)
• 4d140cf [feat] feat(cli): add --global flag to uipro update and support --ai universal target (#435, #436) (#437)

superpowers

• Impact: 🟢 skim (docs/ci/test only)
• Commit mix: 1 docs
• Files touched: code=0 docs=1 ci=0 test=0 other=0
• 1 new commit(s) since last check
• Latest: 44c9b2d — docs: remove the "We're Hiring" section from the README
• Recent commits:
• 44c9b2d [docs] docs: remove the "We're Hiring" section from the README

knowledge-work-plugins

• Impact: 🟡 review (code touched)
• Commit mix: 101 other
• Files touched: code=0 docs=0 ci=0 test=0 other=2
• 101 new commit(s) since last check
• Latest: 5ee4541 — bump(carta-investors): 874158e8 → 7a9428c8 (#803)
• Recent commits:
• d10c2c9 [other] bump(wix): 87c6b285 → 6f402cef (#709)
• 7f1ce6b [other] bump(wix): 6f402cef → dd567862 (#710)
• 372e3b2 [other] bump(langfuse): 13a79944 → 93d82827 (#713)
• 9d92c5e [other] bump(wix): dd567862 → 9e3b2d55 (#711)
• 37820dc [other] bump(carta-cap-table): 0ee76454 → 35c25847 (#712)

n8n-mcp

• New release: v2.68.2 (was v2.66.1)
• Release notes:

# Release v2.68.2

Generating release notes from v2.68.0 to HEAD
### 📚 Documentation

- Sync skills pack to n8n-skills v1.28.0 (folder management) (#976) (607ab7c)
- Sync skills pack to n8n-skills v1.28.0 (folder management) (#976) (7cd172c)

### 📝 Other Changes

- chore(telemetry): rotate publishable key, 60s flush, drop workflow_before, fix shutdown flush (#980) (9be5080)

---

**Release Statistics:**
- 3 commits
- 1 contributor
- Contributors: Romuald Członkowski

---

• Impact: 🟡 review (code touched)
• Commit mix: 2 chore · 4 docs · 2 feat · 3 fix
• Files touched: code=32 docs=15 ci=1 test=28 other=7
• 11 new commit(s) since last check
• Latest: 9be5080 — chore(telemetry): rotate publishable key, 60s flush, drop workflow_before, fix shutdown flush (#980)
• Recent commits:
• b14f3c1 [docs] docs: sync skills pack v1.26.0 — canvas groups (nodeGroups) (#951)
• 1d15fc2 [fix] fix: AI-tool validation follow-ups from the 2.31.3 update review (#953–#956) (#962)
• 268f577 [fix] fix: bracket-index path updates and fabricated community node types (#950, #949) (#964)
• 3293e61 [feat] feat: add run and cancel actions to n8n_evaluations (#936) (#963)
• 8265427 [docs] docs: sync skills pack to n8n-skills v1.27.0 (evaluations run/cancel) (#966)

skillspector

• New release: v2.8.1 (was none)
• Release notes:

# SkillSpector v2.8.1

Released: 2026-08-06

## Summary

This release includes 1 public-facing change(s) since release/2.8.0.

## Highlights

- fix(llm): isolate malformed structured responses per batch

## Added

- None.

## Changed

- None.

• Impact: 🟡 review (code touched)
• Commit mix: 3 chore · 1 docs · 3 feat · 10 fix · 4 other · 1 test
• Files touched: code=48 docs=15 ci=3 test=49 other=10
• 22 new commit(s) since last check
• Latest: 0a1546b — chore: public OSS release 2.8.1 (#352)
• Recent commits:
• 34f6030 [feat] feat: publish 2.5.0 execution accounting (#308)
• da5cb13 [feat] feat(llm): make analyzer fan-out concurrency configurable via env (#305)
• 3f11bfa [other] release: publish OSS snapshot 2.5.1 (#320)
• e48fc1a [fix] fix(input-handler): bound URL, zip, and git ingest paths (#164)
• 1df69ad [fix] fix(analyzer): reduce instructional-prose false positives in static scans (#103) (#232)

transitions

• Impact: 🟡 review (code touched)
• Commit mix: 1 feat · 4 fix
• Files touched: code=0 docs=0 ci=0 test=0 other=8
• 5 new commit(s) since last check
• Latest: 67d5c67 — fix(pro): restore smoky dissolve + image open tilt to their original photo
• Recent commits:
• 0ec87b1 [fix] fix: sidebar edge fade, footer alignment, and mobile layout issues
• 1eea31f [feat] feat(pro): add gooey plus menu, drag & drop physics, spinner→check morph
• 9ab8174 [fix] fix(pro): drag no longer opens the detail page; use the stack's middle photo
• c10106d [fix] fix(pro): make the gooey merge readable in dark mode; woman photo for drag & drop
• 67d5c67 [fix] fix(pro): restore smoky dissolve + image open tilt to their original photo

claude-mem

• New release: v13.13.1 (was v13.12.4)
• Release notes:

## What’s new

- Adds an interactive `/mode-creator` workflow that turns a user’s domain and note-taking needs into a custom claude-mem mode.
- Guides capture-type and tag design, including specialized suggestions when standard code mode is a useful baseline.
- Installs custom modes in durable user storage and reports the active mode in startup context.
- Adds optional tag-triggered Telegram notifications with guided bot configuration and verification.
- Includes mode-authoring and Telegram references, secure helper scripts, documentation, distribution coverage, and runtime tests.

## Compatibility

This patch release has no intended breaking changes.

• Impact: 🟡 review (code touched)
• Commit mix: 2 chore · 2 docs · 2 feat · 1 fix
• Files touched: code=9 docs=6 ci=0 test=7 other=20
• 7 new commit(s) since last check
• Latest: f85bb28 — docs: update changelog for v13.13.1
• Recent commits:
• a90066f [fix] fix(chroma): prevent concurrent write storms (#3462)
• dd68d21 [feat] feat(observations): add "sensitive" type with Telegram notification (#3468)
• ce92132 [chore] chore: bump version to 13.13.0
• b368aba [docs] docs: update changelog for v13.13.0
• 9326fae [feat] feat: add custom mode creator skill (#3487)

caveman

• New release: v1.10.0 (was v1.9.1)
• Release notes:

## Install

```bash
curl -fsSL https://raw.githubusercontent.com/JuliusBrussee/caveman/main/install.sh | bash

irm https://raw.githubusercontent.com/JuliusBrussee/caveman/main/install.ps1 | iex

Features

• /caveman-stats reports net savings, not just gross (#145, #677). The skill costs ~1–1.5k input tokens per turn. Stats now subtracts that instead of only counting output saved, so a net-negative workload shows up as net-negative.

Fixes

• Compress no longer loses data on Windows (#652, #655, #686). Explicit UTF-8 plus atomic writes. A crash mid-write can no longer truncate the file it was rewriting.
• Installer moved bin/ → cli/, with hardened Windows quoting and a clean uninstall path.
• Hooks share one parser (caveman-parse.js), unwrap the payload envelope, and survive resume/clear/compact re-fires — a mid-session /caveman <level> switch is no longer reset by a SessionStart re-fire.
• Skill hardening: negation safety, tool-call silence, language-drift.

  - **Impact:** 🟡 review (code touched)
  - **Commit mix:** 2 chore · 1 ci · 1 docs · 1 feat · 4 fix · 2 other
  - **Files touched:** code=12 docs=19 ci=1 test=15 other=17
  - **11 new commit(s)** since last check
  - Latest: `ec83e5b` — Update README for clarity on coding runs
  - Recent commits:
  - `710173f` [fix] fix(skill): negation safety, tool-call silence, language-drift hardening
  - `7693a04` [fix] fix(hooks): shared parser, envelope unwrap, resume-safe SessionStart
  - `d833f4a` [feat] feat(stats): surface net savings, not just gross (#145, #677)
  - `dcd51f1` [fix] fix(compress): stop Windows data loss — UTF-8 + atomic writes (#652, #655, #686)
  - `ed1fbb7` [fix] fix(install): rename bin/ to cli/, harden Windows quoting, clean uninstall

### [playwright-mcp](https://github.com/microsoft/playwright-mcp)

  - **New release:** `v0.0.79` (was `v0.0.78`)
  - Release notes:

What's New

Tool Improvements

• browser_take_screenshot — WebP format — New type option to pick the image format (png, jpeg or webp); when unset, the format is inferred from the filename extension (#41152)
• --codegen — more languages — Code generation now supports python, java and csharp in addition to typescript (#42106)
• Configurable settle delay — New --timeout-settle flag (and timeouts.settle config option) to control how long to wait after each action for triggered work (navigations, requests) to settle, defaults to 500ms (#41924)

Fixes

• Aria snapshot capture is skipped when the response discards it (#41923)
• New --snapshot-boxes flag (and snapshot.boxes config option) to enable bounding boxes in snapshots globally — previously this was only available per command (#42102)
• Reconnect to the browser after a disconnect (#41966)
• Report malformed JSON config instead of silently falling back to INI parsing (#41909)
• Clear the dialog modal state when a dialog is closed out of band (#42032)
• Detect downloads via the download event instead of guessing from net::ERR_ABORTED navigation errors (#41933)
• Surface the missing executable path when a browser isn't installed (#41941)
• Escape user input in codegen output (#41962)
• Removed the stale --output-mode CLI option (#41833)

  - **Impact:** 🟡 review (code touched)
  - **Commit mix:** 6 chore
  - **Files touched:** code=0 docs=1 ci=0 test=0 other=4
  - **6 new commit(s)** since last check
  - Latest: `4c50776` — chore: mark v0.0.79 (#1707)
  - Recent commits:
  - `30710c8` [chore] chore(deps-dev): bump fast-uri from 3.1.2 to 3.1.4 (#1692)
  - `42e792a` [chore] chore(deps-dev): bump hono from 4.12.26 to 4.12.31 (#1687)
  - `f2db2c2` [chore] chore(deps-dev): bump ip-address from 10.2.0 to 10.4.0 (#1703)
  - `8414d57` [chore] chore(deps): bump @hono/node-server and @modelcontextprotocol/sdk (#1702)
  - `4ed35bf` [chore] chore: roll Playwright to 1.63.0-alpha-2026-08-05 (#1706)


*Updated by the upstream tracker workflow.*

[github-actions]

New upstream changes detected (2026-08-08)

context7

• New release: @upstash/context7-mcp@4.0.0 (was @upstash/context7-mcp@3.2.5)
• Release notes:

### Major Changes

- 8d52608: Migrate the MCP server to the v2 SDK (`@modelcontextprotocol/{node,server,client}` 2.0.0) and the 2026-07-28 protocol revision. HTTP serving is now stateless for both modern and legacy clients, and Redis-backed sessions are removed.

• Impact: 🟡 review (code touched)
• Commit mix: 2 chore · 4 docs · 1 feat · 1 fix · 1 other
• Files touched: code=16 docs=34 ci=0 test=4 other=5
• 9 new commit(s) since last check
• Latest: 8276a7c — chore(release): version packages (#2997)
• Recent commits:
• 6c343ae [docs] docs(enterprise): changelog for v1.2.4 through v1.3.0 (#2953)
• 80f9d6c [docs] docs(enterprise): add library access control page (#2928)
• b89a04e [fix] fix(cli): write the API key as an Authorization header (#2957)
• 38422b1 [chore] chore(release): version packages (#2960)
• 6153deb [docs] docs(enterprise): document external Postgres with the embedded vector index (#2954)

lightrag

• New release: v1.5.6 (was v1.5.5rc1)
• Release notes:

## Important Notes

Introducing **PGTableGraphStorage**, a new graph storage backend built on native PostgreSQL tables. By eliminating the dependency on Apache AGE, it not only simplifies deployment but also delivers significantly higher graph storage performance with reduced storage footprint. It will replace the AGE-based `PGGraphStorage` as the preferred graph storage solution for PostgreSQL. This makes **PostgreSQL** the go-to **all-in-one backend database** for LightRAG, enabling a single database to cover all four storage types.

## What's New

* feat(kg): add PGTableGraphStorage — PostgreSQL-native graph backend (no AGE dependency) by @ysys143 in https://github.com/HKUDS/LightRAG/pull/3103
* docs(pipeline): rewrite the dedup and concurrency chapters from a user's view by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3583

## What's Changed

* Implement fail-closed recovery proof for whole-document purge by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3535
* docs: fix broken links and correct VLM gating semantics by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3539
* docs: extract parser service deployment runbooks by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3540
* docs: restructure FileProcessingPipeline into a usable guide by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3541
* docs: fix documentation typos, grammar errors, and incorrect warning messages by @Rythamo8055 in https://github.com/HKUDS/LightRAG/pull/3538
* feat(utils): bound thread-pool submission and pin the tokenizer contract by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3543
* fix(deps): sync uv.lock with the tiktoken floor and correct the restore rationale by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3546
* fix(api): bound request bodies and take token counting off the event loop by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3544
* fix(pipeline): take chunking off the event loop and bound the separator cascade by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3547

• Impact: 🔴 likely matters (breaking change)
• Commit mix: 5 build · 1 chore · 2 ci · 17 docs · 8 feat · 77 fix · 117 other · 2 perf · 2 refactor · 2 style · 17 test
• Files touched: code=0 docs=26 ci=12 test=164 other=98
• 446 new commit(s) since last check
• Latest: 08bfdad — Merge pull request #3590 from santhreal/fix/update-flags-status-bool
• Recent commits:
• b5633cb [feat] feat(chunker): scan all blocks for references by default
• 38074a1 [other] Merge pull request #3508 from HKUDS/feat/p-reference-scan-all-default
• 39122fa [fix] fix(webui): reliable follow-scroll recovery and jump-to-bottom button
• fa36839 [other] Merge pull request #3509 from HKUDS/fix/webui-follow-scroll
• 331a539 [other] Bump API version to 0323

everything-claude-code

• New release: v2.1.0 (was v2.0.0)
• Release notes:

# ECC 2.1.0: Plan Canvas, Kimi Harness, and Self-Hosted Compute

ECC 2.1 turns plan review into a visual loop and opens the harness to self-hosted models. Plan Canvas lets you review agent plans in the browser. Point at the part you mean instead of retyping it in chat. A new Kimi Code install target and a verified Itô GPU path make ECC + open-source models a first-class setup, backed by our public sponsors: Moonshot AI (Kimi), Itô, and Atlas Cloud.

## Plan Canvas: review plans by pointing, not retyping

![Plan Canvas demo: reviewing an ECC plan, attaching an annotation, chatting with the agent, and approving the plan](https://raw.githubusercontent.com/affaan-m/ECC/main/docs/releases/2.1.0/assets/ecc-plan-canvas-demo.gif)

[Download the MP4 demo](https://raw.githubusercontent.com/affaan-m/ECC/main/docs/releases/2.1.0/assets/ecc-plan-canvas-demo.mp4)

`/plan` ends with a confirm gate, and until now that review was a wall of markdown in the terminal. Now the agent opens the plan in a loopback-only browser canvas:

- Click elements or select text to attach numbered annotations
- Chat with the agent from a side rail while it works in the terminal
- **Approve plan** / **Request changes** buttons map directly onto `/plan`'s CONFIRM gate
- Mermaid diagrams, tables, and task lists render natively; file edits live-reload the page
- Model- and harness-agnostic: a plain CLI + JSON protocol (`ecc-plan-canvas`), no Claude-only dependency

## Kimi harness: Moonshot AI partnership

• Impact: 🟡 review (code touched)
• Commit mix: 7 chore · 6 docs · 4 feat · 25 fix · 8 other · 2 test
• Files touched: code=0 docs=47 ci=9 test=79 other=89
• 52 new commit(s) since last check
• Latest: 59a99d6 — fix(ci): restore green main for the Itô skill test suite (#2720)
• Recent commits:
• b06c78c [docs] docs: add 2.1.0 release notes and Plan Canvas demo assets
• 1ffaa75 [fix] fix(release): match the ECC banner name when bumping versions
• 4099794 [fix] fix(release): bump the claude marketplace and zh-CN heading on macOS
• 6f452d4 [chore] chore: bump plugin version to 2.1.0
• edaf6fe [fix] fix(release): drop the dead OMP adapter verification step

marketing-skills

• New release: v2.10.0 (was v2.9.0)
• Release notes:

**attribution** (new, 1.1.0): a dedicated skill for the hardest question in marketing — which efforts actually drive conversions and revenue. Fills a real gap: attribution was scattered across analytics (UTM setup), ads (platform pixels), revops (pipeline), and ai-seo (the AI blind spot), but no skill owned the *models* or the *reconciliation problem*. Two pillars. **(A) Interpretation** — the six attribution models and when each lies; MTA vs. MMM vs. incrementality and how to choose; self-reported attribution; reconciling the platform-vs-GA-vs-CRM-vs-survey disagreement (never sum across platforms; pick one source of truth; read directional trends); and the direct / branded-search / dark-social / AI blind spots. **(B) Own your attribution (first-party)** — a build runbook for instrumenting attribution yourself when you control the site/app: the identity graph, closing the `identify()` gap (adapted from Tessa Kriesel's PostHog approach), stitching conversions on third-party domains you don't own (SavvyCal/Calendly/Stripe) via metadata passthrough + webhook identity-merge, fail-closed anonymity guards, and first-touch data-quality cleanup — distilled from real production builds (Conversion Factory + Truelist). Four references (`attribution-models.md`, `measurement-paradigms.md`, `by-business-type.md` with B2B/DTC playbooks, `first-party-tracking.md`) and 7 evals covering reconciliation, model choice, the third-party stitch, ROAS incrementality, the direct/branded blind spot, the analytics boundary, and the DTC measurement stack. Pillar B also folds in **production feedback from Tessa Kriesel** (credited): the CRM last mile (sync a `source` field with confidence + basis and a paid-vs-non-paid read onto the account → revops), storing the full ordered touch path so the build track can run Pillar A's multi-touch models on real data, the "expect ~zero until the cross-subdomain stitch is verified in prod" window with a narrowly-scoped campaign-window fallback + pre-stitch backfill, and account-level rollup (excluding free-mail domains) for B2B.
**analytics** (2.0.0 → 2.0.1): description now hands off attribution modeling and reconciliation to the new attribution skill, keeping analytics scoped to tracking setup, event taxonomy, and UTMs.

• Impact: 🟡 review (code touched)
• Commit mix: 1 chore · 2 feat · 5 other
• Files touched: code=0 docs=10 ci=0 test=0 other=4
• 8 new commit(s) since last check
• Latest: 7868cb9 — chore: sync skills with marketplace.json, plugin.json, and README
• Recent commits:
• 804c512 [feat] feat(attribution): new skill — models, reconciliation, and first-party attribution (2.10.0) (#473)
• 789ef02 [feat] feat(attribution): Tessa Kriesel production feedback → first-party runbook (1.1.0, part of 2.10.0) (#483)
• 3c51add [other] release(2.9.1): pricing-page teardown with AI-agent-readiness axis (#487)
• 2c13acc [other] Merge pull request #492 from coreyhaines31/hotfix/487-pricing-2.9.1
• fc2f33b [other] sync: main -> development after 2.9.1 pricing release

ui-ux-pro-max

• New release: v2.14.1 (was v2.11.2)
• Release notes:

## [2.14.1](https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/compare/v2.14.0...v2.14.1) (2026-08-06)

• Impact: 🟡 review (code touched)
• Commit mix: 3 feat · 4 fix
• Files touched: code=4 docs=3 ci=1 test=0 other=48
• 7 new commit(s) since last check
• Latest: abb7f2f — fix: bump skill.json version to 2.13.0 (#438)
• Recent commits:
• 4857a2c [fix] fix(cli): sync shadcn test asset (#433)
• ec1f2a9 [fix] fix(design-system): resolve palette and anti-patterns against the style's mode (#428) (#434)
• b0ebb17 [fix] fix(copilot): generate .prompt.md file for VS Code Copilot slash commands (#328)
• 14ddef5 [feat] feat(gallery): add Style Detail Modal with phone UI controls preview (#155)
• 4d140cf [feat] feat(cli): add --global flag to uipro update and support --ai universal target (#435, #436) (#437)

superpowers

• Impact: 🟢 skim (docs/ci/test only)
• Commit mix: 1 docs
• Files touched: code=0 docs=1 ci=0 test=0 other=0
• 1 new commit(s) since last check
• Latest: 44c9b2d — docs: remove the "We're Hiring" section from the README
• Recent commits:
• 44c9b2d [docs] docs: remove the "We're Hiring" section from the README

anthropic-skills

• Impact: 🟢 skim (docs/ci/test only)
• Commit mix: 1 other
• Files touched: code=0 docs=18 ci=0 test=0 other=0
• 1 new commit(s) since last check
• Latest: f17010c — Update claude-api skill: Managed Agents August launch wave (#1532)
• Recent commits:
• f17010c [other] Update claude-api skill: Managed Agents August launch wave (#1532)

knowledge-work-plugins

• Impact: 🟡 review (code touched)
• Commit mix: 118 other
• Files touched: code=0 docs=0 ci=0 test=0 other=4
• 118 new commit(s) since last check
• Latest: 26a4625 — bump(fastly-agent-toolkit): 172b2fd5 → 3502e4ba (#823)
• Recent commits:
• d10c2c9 [other] bump(wix): 87c6b285 → 6f402cef (#709)
• 7f1ce6b [other] bump(wix): 6f402cef → dd567862 (#710)
• 372e3b2 [other] bump(langfuse): 13a79944 → 93d82827 (#713)
• 9d92c5e [other] bump(wix): dd567862 → 9e3b2d55 (#711)
• 37820dc [other] bump(carta-cap-table): 0ee76454 → 35c25847 (#712)

n8n-mcp

• New release: v2.68.4 (was v2.66.1)
• Release notes:

# Release v2.68.4

Generating release notes from v2.68.3 to HEAD
### 🐛 Bug Fixes

- Ship skill assets, not just markdown (v2.68.4) (#982) (e87d62b)

---

**Release Statistics:**
- 1 commit
- 1 contributor
- Contributors: Romuald Członkowski

---

## Installation

### NPM Package
```bash

• Impact: 🟡 review (code touched)
• Commit mix: 2 chore · 4 docs · 2 feat · 5 fix
• Files touched: code=38 docs=15 ci=4 test=30 other=13
• 13 new commit(s) since last check
• Latest: e87d62b — fix: ship skill assets, not just markdown (v2.68.4) (#982)
• Recent commits:
• b14f3c1 [docs] docs: sync skills pack v1.26.0 — canvas groups (nodeGroups) (#951)
• 1d15fc2 [fix] fix: AI-tool validation follow-ups from the 2.31.3 update review (#953–#956) (#962)
• 268f577 [fix] fix: bracket-index path updates and fabricated community node types (#950, #949) (#964)
• 3293e61 [feat] feat: add run and cancel actions to n8n_evaluations (#936) (#963)
• 8265427 [docs] docs: sync skills pack to n8n-skills v1.27.0 (evaluations run/cancel) (#966)

skillspector

• New release: v2.8.2 (was none)
• Release notes:

# SkillSpector v2.8.2

Released: 2026-08-07

## Summary

This patch release improves the resilience of MCP tool-poisoning analysis when a model returns malformed structured output. Affected assessments are retried through the shared structured-output analyzer lifecycle rather than causing an immediate scan failure.

## Highlights

- MCP tool-poisoning TP4 checks now use the shared typed structured-output analyzer lifecycle.

## Added

- None.

## Changed

- Structured TP4 responses are validated through a typed schema with the same per-batch isolation behavior used by other LLM analyzers.

• Impact: 🟡 review (code touched)
• Commit mix: 4 chore · 1 docs · 3 feat · 10 fix · 4 other · 1 test
• Files touched: code=48 docs=16 ci=3 test=49 other=10
• 23 new commit(s) since last check
• Latest: 2bc641f — chore: public OSS release 2.8.2 (#353)
• Recent commits:
• 34f6030 [feat] feat: publish 2.5.0 execution accounting (#308)
• da5cb13 [feat] feat(llm): make analyzer fan-out concurrency configurable via env (#305)
• 3f11bfa [other] release: publish OSS snapshot 2.5.1 (#320)
• e48fc1a [fix] fix(input-handler): bound URL, zip, and git ingest paths (#164)
• 1df69ad [fix] fix(analyzer): reduce instructional-prose false positives in static scans (#103) (#232)

transitions

• Impact: 🟡 review (code touched)
• Commit mix: 1 feat · 6 fix
• Files touched: code=0 docs=0 ci=0 test=0 other=11
• 7 new commit(s) since last check
• Latest: 06f8195 — fix(account): explain the wrong-email case instead of bare "No active plan"
• Recent commits:
• 0ec87b1 [fix] fix: sidebar edge fade, footer alignment, and mobile layout issues
• 1eea31f [feat] feat(pro): add gooey plus menu, drag & drop physics, spinner→check morph
• 9ab8174 [fix] fix(pro): drag no longer opens the detail page; use the stack's middle photo
• c10106d [fix] fix(pro): make the gooey merge readable in dark mode; woman photo for drag & drop
• 67d5c67 [fix] fix(pro): restore smoky dissolve + image open tilt to their original photo

claude-mem

• New release: v13.14.0 (was v13.12.4)
• Release notes:

## CMEM Pro is now the first option in the installer

`npx claude-mem` now leads its provider prompt with **CMEM Pro**, and every option shows what it actually costs per 1,000 observations — so the choice is made on price rather than brand recognition.

◆ Which memory provider do you want to use?
│ ● CMEM Pro — observer model, off your plan ($0/1k observations · $30/mo, cloud sync included) Recommended
│ ○ OpenRouter / any OpenAI-compatible key ($2.73/1k observations, billed to you)
│ ○ Gemini API key ($3.39/1k observations, billed to you)
│ ○ Use your Anthropic plan (~$8.91/1k observations, billed to your Claude plan)

Anthropic moves last: it is the most expensive per observation and it bills your own Claude plan.

### Picking CMEM Pro

Opens `cmem.ai/pro?from=installer`, waits for the `cm_pro_…` key the signup flow hands back, writes it to settings, and points you at the browser to finish cloud sync. The key is pasted by hand — no polling, no device-code handshake.

### No new provider code

• Impact: 🟡 review (code touched)
• Commit mix: 3 chore · 3 docs · 3 feat · 1 fix
• Files touched: code=11 docs=6 ci=0 test=7 other=20
• 10 new commit(s) since last check
• Latest: 5eb4e55 — docs: update changelog for v13.14.0
• Recent commits:
• a90066f [fix] fix(chroma): prevent concurrent write storms (#3462)
• dd68d21 [feat] feat(observations): add "sensitive" type with Telegram notification (#3468)
• ce92132 [chore] chore: bump version to 13.13.0
• b368aba [docs] docs: update changelog for v13.13.0
• 9326fae [feat] feat: add custom mode creator skill (#3487)

caveman

• New release: v1.10.0 (was v1.9.1)
• Release notes:

## Install

```bash
curl -fsSL https://raw.githubusercontent.com/JuliusBrussee/caveman/main/install.sh | bash

irm https://raw.githubusercontent.com/JuliusBrussee/caveman/main/install.ps1 | iex

Features

• /caveman-stats reports net savings, not just gross (#145, #677). The skill costs ~1–1.5k input tokens per turn. Stats now subtracts that instead of only counting output saved, so a net-negative workload shows up as net-negative.

Fixes

• Compress no longer loses data on Windows (#652, #655, #686). Explicit UTF-8 plus atomic writes. A crash mid-write can no longer truncate the file it was rewriting.
• Installer moved bin/ → cli/, with hardened Windows quoting and a clean uninstall path.
• Hooks share one parser (caveman-parse.js), unwrap the payload envelope, and survive resume/clear/compact re-fires — a mid-session /caveman <level> switch is no longer reset by a SessionStart re-fire.
• Skill hardening: negation safety, tool-call silence, language-drift.

  - **Impact:** 🟡 review (code touched)
  - **Commit mix:** 2 chore · 1 ci · 2 docs · 1 feat · 4 fix · 2 other
  - **Files touched:** code=12 docs=19 ci=1 test=15 other=17
  - **12 new commit(s)** since last check
  - Latest: `14d4f2e` — docs: add Trendshift badge to README header
  - Recent commits:
  - `710173f` [fix] fix(skill): negation safety, tool-call silence, language-drift hardening
  - `7693a04` [fix] fix(hooks): shared parser, envelope unwrap, resume-safe SessionStart
  - `d833f4a` [feat] feat(stats): surface net savings, not just gross (#145, #677)
  - `dcd51f1` [fix] fix(compress): stop Windows data loss — UTF-8 + atomic writes (#652, #655, #686)
  - `ed1fbb7` [fix] fix(install): rename bin/ to cli/, harden Windows quoting, clean uninstall

### [playwright-mcp](https://github.com/microsoft/playwright-mcp)

  - **New release:** `v0.0.79` (was `v0.0.78`)
  - Release notes:

What's New

Tool Improvements

• browser_take_screenshot — WebP format — New type option to pick the image format (png, jpeg or webp); when unset, the format is inferred from the filename extension (#41152)
• --codegen — more languages — Code generation now supports python, java and csharp in addition to typescript (#42106)
• Configurable settle delay — New --timeout-settle flag (and timeouts.settle config option) to control how long to wait after each action for triggered work (navigations, requests) to settle, defaults to 500ms (#41924)

Fixes

• Aria snapshot capture is skipped when the response discards it (#41923)
• New --snapshot-boxes flag (and snapshot.boxes config option) to enable bounding boxes in snapshots globally — previously this was only available per command (#42102)
• Reconnect to the browser after a disconnect (#41966)
• Report malformed JSON config instead of silently falling back to INI parsing (#41909)
• Clear the dialog modal state when a dialog is closed out of band (#42032)
• Detect downloads via the download event instead of guessing from net::ERR_ABORTED navigation errors (#41933)
• Surface the missing executable path when a browser isn't installed (#41941)
• Escape user input in codegen output (#41962)
• Removed the stale --output-mode CLI option (#41833)

  - **Impact:** 🟡 review (code touched)
  - **Commit mix:** 6 chore · 1 other
  - **Files touched:** code=0 docs=1 ci=0 test=0 other=5
  - **7 new commit(s)** since last check
  - Latest: `7e0457a` — devops: add ESRP pipeline for publishing npm alpha versions (#1709)
  - Recent commits:
  - `30710c8` [chore] chore(deps-dev): bump fast-uri from 3.1.2 to 3.1.4 (#1692)
  - `42e792a` [chore] chore(deps-dev): bump hono from 4.12.26 to 4.12.31 (#1687)
  - `f2db2c2` [chore] chore(deps-dev): bump ip-address from 10.2.0 to 10.4.0 (#1703)
  - `8414d57` [chore] chore(deps): bump @hono/node-server and @modelcontextprotocol/sdk (#1702)
  - `4ed35bf` [chore] chore: roll Playwright to 1.63.0-alpha-2026-08-05 (#1706)


*Updated by the upstream tracker workflow.*

[github-actions]

New upstream changes detected (2026-08-09)

context7

• New release: @upstash/context7-mcp@4.0.0 (was @upstash/context7-mcp@3.2.5)
• Release notes:

### Major Changes

- 8d52608: Migrate the MCP server to the v2 SDK (`@modelcontextprotocol/{node,server,client}` 2.0.0) and the 2026-07-28 protocol revision. HTTP serving is now stateless for both modern and legacy clients, and Redis-backed sessions are removed.

• Impact: 🟡 review (code touched)
• Commit mix: 2 chore · 4 docs · 1 feat · 1 fix · 1 other
• Files touched: code=16 docs=34 ci=0 test=4 other=5
• 9 new commit(s) since last check
• Latest: 8276a7c — chore(release): version packages (#2997)
• Recent commits:
• 6c343ae [docs] docs(enterprise): changelog for v1.2.4 through v1.3.0 (#2953)
• 80f9d6c [docs] docs(enterprise): add library access control page (#2928)
• b89a04e [fix] fix(cli): write the API key as an Authorization header (#2957)
• 38422b1 [chore] chore(release): version packages (#2960)
• 6153deb [docs] docs(enterprise): document external Postgres with the embedded vector index (#2954)

lightrag

• New release: v1.5.6 (was v1.5.5rc1)
• Release notes:

## Important Notes

Introducing **PGTableGraphStorage**, a new graph storage backend built on native PostgreSQL tables. By eliminating the dependency on Apache AGE, it not only simplifies deployment but also delivers significantly higher graph storage performance with reduced storage footprint. It will replace the AGE-based `PGGraphStorage` as the preferred graph storage solution for PostgreSQL. This makes **PostgreSQL** the go-to **all-in-one backend database** for LightRAG, enabling a single database to cover all four storage types.

## What's New

* feat(kg): add PGTableGraphStorage — PostgreSQL-native graph backend (no AGE dependency) by @ysys143 in https://github.com/HKUDS/LightRAG/pull/3103
* docs(pipeline): rewrite the dedup and concurrency chapters from a user's view by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3583

## What's Changed

* Implement fail-closed recovery proof for whole-document purge by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3535
* docs: fix broken links and correct VLM gating semantics by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3539
* docs: extract parser service deployment runbooks by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3540
* docs: restructure FileProcessingPipeline into a usable guide by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3541
* docs: fix documentation typos, grammar errors, and incorrect warning messages by @Rythamo8055 in https://github.com/HKUDS/LightRAG/pull/3538
* feat(utils): bound thread-pool submission and pin the tokenizer contract by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3543
* fix(deps): sync uv.lock with the tiktoken floor and correct the restore rationale by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3546
* fix(api): bound request bodies and take token counting off the event loop by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3544
* fix(pipeline): take chunking off the event loop and bound the separator cascade by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3547

• Impact: 🔴 likely matters (breaking change)
• Commit mix: 5 build · 1 chore · 2 ci · 19 docs · 7 feat · 84 fix · 109 other · 2 perf · 3 refactor · 2 style · 16 test
• Files touched: code=0 docs=26 ci=12 test=161 other=101
• 475 new commit(s) since last check
• Latest: b47c682 — Merge pull request #3595 from santhreal/fix/json-doc-status-track-id-type-error
• Recent commits:
• cb84f4b [other] Merge branch 'main' into codex/fix-3499-docling-suffixes
• 93ff1ae [other] Merge pull request #3501 from bm1016bm-svg/codex/fix-3499-docling-suffixes
• 3b78642 [other] Merge pull request #3514 from santhreal/fix/aggregate-chunk-scores-out-of-bounds-idx
• 9af16c7 [fix] fix(pipeline): log the equation fallback and narrow its alias handling
• c2cc892 [other] Merge pull request #3515 from Solaris-star/fix/3502-equation-field-fallback

everything-claude-code

• New release: v2.1.0 (was v2.0.0)
• Release notes:

# ECC 2.1.0: Plan Canvas, Kimi Harness, and Self-Hosted Compute

ECC 2.1 turns plan review into a visual loop and opens the harness to self-hosted models. Plan Canvas lets you review agent plans in the browser. Point at the part you mean instead of retyping it in chat. A new Kimi Code install target and a verified Itô GPU path make ECC + open-source models a first-class setup, backed by our public sponsors: Moonshot AI (Kimi), Itô, and Atlas Cloud.

## Plan Canvas: review plans by pointing, not retyping

![Plan Canvas demo: reviewing an ECC plan, attaching an annotation, chatting with the agent, and approving the plan](https://raw.githubusercontent.com/affaan-m/ECC/main/docs/releases/2.1.0/assets/ecc-plan-canvas-demo.gif)

[Download the MP4 demo](https://raw.githubusercontent.com/affaan-m/ECC/main/docs/releases/2.1.0/assets/ecc-plan-canvas-demo.mp4)

`/plan` ends with a confirm gate, and until now that review was a wall of markdown in the terminal. Now the agent opens the plan in a loopback-only browser canvas:

- Click elements or select text to attach numbered annotations
- Chat with the agent from a side rail while it works in the terminal
- **Approve plan** / **Request changes** buttons map directly onto `/plan`'s CONFIRM gate
- Mermaid diagrams, tables, and task lists render natively; file edits live-reload the page
- Model- and harness-agnostic: a plain CLI + JSON protocol (`ecc-plan-canvas`), no Claude-only dependency

## Kimi harness: Moonshot AI partnership

• Impact: 🟡 review (code touched)
• Commit mix: 7 chore · 6 docs · 4 feat · 26 fix · 8 other · 2 test
• Files touched: code=0 docs=48 ci=9 test=80 other=90
• 53 new commit(s) since last check
• Latest: 51a6950 — fix(memory-vault): compare dev only when both stats report one (#2637)
• Recent commits:
• b06c78c [docs] docs: add 2.1.0 release notes and Plan Canvas demo assets
• 1ffaa75 [fix] fix(release): match the ECC banner name when bumping versions
• 4099794 [fix] fix(release): bump the claude marketplace and zh-CN heading on macOS
• 6f452d4 [chore] chore: bump plugin version to 2.1.0
• edaf6fe [fix] fix(release): drop the dead OMP adapter verification step

marketing-skills

• New release: v2.10.0 (was v2.9.0)
• Release notes:

**attribution** (new, 1.1.0): a dedicated skill for the hardest question in marketing — which efforts actually drive conversions and revenue. Fills a real gap: attribution was scattered across analytics (UTM setup), ads (platform pixels), revops (pipeline), and ai-seo (the AI blind spot), but no skill owned the *models* or the *reconciliation problem*. Two pillars. **(A) Interpretation** — the six attribution models and when each lies; MTA vs. MMM vs. incrementality and how to choose; self-reported attribution; reconciling the platform-vs-GA-vs-CRM-vs-survey disagreement (never sum across platforms; pick one source of truth; read directional trends); and the direct / branded-search / dark-social / AI blind spots. **(B) Own your attribution (first-party)** — a build runbook for instrumenting attribution yourself when you control the site/app: the identity graph, closing the `identify()` gap (adapted from Tessa Kriesel's PostHog approach), stitching conversions on third-party domains you don't own (SavvyCal/Calendly/Stripe) via metadata passthrough + webhook identity-merge, fail-closed anonymity guards, and first-touch data-quality cleanup — distilled from real production builds (Conversion Factory + Truelist). Four references (`attribution-models.md`, `measurement-paradigms.md`, `by-business-type.md` with B2B/DTC playbooks, `first-party-tracking.md`) and 7 evals covering reconciliation, model choice, the third-party stitch, ROAS incrementality, the direct/branded blind spot, the analytics boundary, and the DTC measurement stack. Pillar B also folds in **production feedback from Tessa Kriesel** (credited): the CRM last mile (sync a `source` field with confidence + basis and a paid-vs-non-paid read onto the account → revops), storing the full ordered touch path so the build track can run Pillar A's multi-touch models on real data, the "expect ~zero until the cross-subdomain stitch is verified in prod" window with a narrowly-scoped campaign-window fallback + pre-stitch backfill, and account-level rollup (excluding free-mail domains) for B2B.
**analytics** (2.0.0 → 2.0.1): description now hands off attribution modeling and reconciliation to the new attribution skill, keeping analytics scoped to tracking setup, event taxonomy, and UTMs.

• Impact: 🟡 review (code touched)
• Commit mix: 1 chore · 2 feat · 5 other
• Files touched: code=0 docs=10 ci=0 test=0 other=4
• 8 new commit(s) since last check
• Latest: 7868cb9 — chore: sync skills with marketplace.json, plugin.json, and README
• Recent commits:
• 804c512 [feat] feat(attribution): new skill — models, reconciliation, and first-party attribution (2.10.0) (#473)
• 789ef02 [feat] feat(attribution): Tessa Kriesel production feedback → first-party runbook (1.1.0, part of 2.10.0) (#483)
• 3c51add [other] release(2.9.1): pricing-page teardown with AI-agent-readiness axis (#487)
• 2c13acc [other] Merge pull request #492 from coreyhaines31/hotfix/487-pricing-2.9.1
• fc2f33b [other] sync: main -> development after 2.9.1 pricing release

ui-ux-pro-max

• New release: v2.14.1 (was v2.11.2)
• Release notes:

## [2.14.1](https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/compare/v2.14.0...v2.14.1) (2026-08-06)

• Impact: 🟡 review (code touched)
• Commit mix: 3 feat · 4 fix
• Files touched: code=4 docs=3 ci=1 test=0 other=48
• 7 new commit(s) since last check
• Latest: abb7f2f — fix: bump skill.json version to 2.13.0 (#438)
• Recent commits:
• 4857a2c [fix] fix(cli): sync shadcn test asset (#433)
• ec1f2a9 [fix] fix(design-system): resolve palette and anti-patterns against the style's mode (#428) (#434)
• b0ebb17 [fix] fix(copilot): generate .prompt.md file for VS Code Copilot slash commands (#328)
• 14ddef5 [feat] feat(gallery): add Style Detail Modal with phone UI controls preview (#155)
• 4d140cf [feat] feat(cli): add --global flag to uipro update and support --ai universal target (#435, #436) (#437)

superpowers

• Impact: 🟢 skim (docs/ci/test only)
• Commit mix: 1 docs
• Files touched: code=0 docs=1 ci=0 test=0 other=0
• 1 new commit(s) since last check
• Latest: 44c9b2d — docs: remove the "We're Hiring" section from the README
• Recent commits:
• 44c9b2d [docs] docs: remove the "We're Hiring" section from the README

anthropic-skills

• Impact: 🟢 skim (docs/ci/test only)
• Commit mix: 1 other
• Files touched: code=0 docs=18 ci=0 test=0 other=0
• 1 new commit(s) since last check
• Latest: f17010c — Update claude-api skill: Managed Agents August launch wave (#1532)
• Recent commits:
• f17010c [other] Update claude-api skill: Managed Agents August launch wave (#1532)

knowledge-work-plugins

• Impact: 🟡 review (code touched)
• Commit mix: 124 other
• Files touched: code=0 docs=0 ci=0 test=0 other=4
• 124 new commit(s) since last check
• Latest: 0d3cc18 — bump(fastly-agent-toolkit): 3502e4ba → f6dc3106 (#831)
• Recent commits:
• d10c2c9 [other] bump(wix): 87c6b285 → 6f402cef (#709)
• 7f1ce6b [other] bump(wix): 6f402cef → dd567862 (#710)
• 372e3b2 [other] bump(langfuse): 13a79944 → 93d82827 (#713)
• 9d92c5e [other] bump(wix): dd567862 → 9e3b2d55 (#711)
• 37820dc [other] bump(carta-cap-table): 0ee76454 → 35c25847 (#712)

n8n-mcp

• New release: v2.68.4 (was v2.66.1)
• Release notes:

# Release v2.68.4

Generating release notes from v2.68.3 to HEAD
### 🐛 Bug Fixes

- Ship skill assets, not just markdown (v2.68.4) (#982) (e87d62b)

---

**Release Statistics:**
- 1 commit
- 1 contributor
- Contributors: Romuald Członkowski

---

## Installation

### NPM Package
```bash

• Impact: 🟡 review (code touched)
• Commit mix: 2 chore · 4 docs · 2 feat · 5 fix
• Files touched: code=38 docs=15 ci=4 test=30 other=13
• 13 new commit(s) since last check
• Latest: e87d62b — fix: ship skill assets, not just markdown (v2.68.4) (#982)
• Recent commits:
• b14f3c1 [docs] docs: sync skills pack v1.26.0 — canvas groups (nodeGroups) (#951)
• 1d15fc2 [fix] fix: AI-tool validation follow-ups from the 2.31.3 update review (#953–#956) (#962)
• 268f577 [fix] fix: bracket-index path updates and fabricated community node types (#950, #949) (#964)
• 3293e61 [feat] feat: add run and cancel actions to n8n_evaluations (#936) (#963)
• 8265427 [docs] docs: sync skills pack to n8n-skills v1.27.0 (evaluations run/cancel) (#966)

skillspector

• New release: v2.8.2 (was none)
• Release notes:

# SkillSpector v2.8.2

Released: 2026-08-07

## Summary

This patch release improves the resilience of MCP tool-poisoning analysis when a model returns malformed structured output. Affected assessments are retried through the shared structured-output analyzer lifecycle rather than causing an immediate scan failure.

## Highlights

- MCP tool-poisoning TP4 checks now use the shared typed structured-output analyzer lifecycle.

## Added

- None.

## Changed

- Structured TP4 responses are validated through a typed schema with the same per-batch isolation behavior used by other LLM analyzers.

• Impact: 🟡 review (code touched)
• Commit mix: 4 chore · 1 docs · 3 feat · 10 fix · 4 other · 1 test
• Files touched: code=48 docs=16 ci=3 test=49 other=10
• 23 new commit(s) since last check
• Latest: 2bc641f — chore: public OSS release 2.8.2 (#353)
• Recent commits:
• 34f6030 [feat] feat: publish 2.5.0 execution accounting (#308)
• da5cb13 [feat] feat(llm): make analyzer fan-out concurrency configurable via env (#305)
• 3f11bfa [other] release: publish OSS snapshot 2.5.1 (#320)
• e48fc1a [fix] fix(input-handler): bound URL, zip, and git ingest paths (#164)
• 1df69ad [fix] fix(analyzer): reduce instructional-prose false positives in static scans (#103) (#232)

transitions

• Impact: 🟡 review (code touched)
• Commit mix: 1 feat · 6 fix
• Files touched: code=0 docs=0 ci=0 test=0 other=11
• 7 new commit(s) since last check
• Latest: 06f8195 — fix(account): explain the wrong-email case instead of bare "No active plan"
• Recent commits:
• 0ec87b1 [fix] fix: sidebar edge fade, footer alignment, and mobile layout issues
• 1eea31f [feat] feat(pro): add gooey plus menu, drag & drop physics, spinner→check morph
• 9ab8174 [fix] fix(pro): drag no longer opens the detail page; use the stack's middle photo
• c10106d [fix] fix(pro): make the gooey merge readable in dark mode; woman photo for drag & drop
• 67d5c67 [fix] fix(pro): restore smoky dissolve + image open tilt to their original photo

claude-mem

• New release: v13.14.0 (was v13.12.4)
• Release notes:

## CMEM Pro is now the first option in the installer

`npx claude-mem` now leads its provider prompt with **CMEM Pro**, and every option shows what it actually costs per 1,000 observations — so the choice is made on price rather than brand recognition.

◆ Which memory provider do you want to use?
│ ● CMEM Pro — observer model, off your plan ($0/1k observations · $30/mo, cloud sync included) Recommended
│ ○ OpenRouter / any OpenAI-compatible key ($2.73/1k observations, billed to you)
│ ○ Gemini API key ($3.39/1k observations, billed to you)
│ ○ Use your Anthropic plan (~$8.91/1k observations, billed to your Claude plan)

Anthropic moves last: it is the most expensive per observation and it bills your own Claude plan.

### Picking CMEM Pro

Opens `cmem.ai/pro?from=installer`, waits for the `cm_pro_…` key the signup flow hands back, writes it to settings, and points you at the browser to finish cloud sync. The key is pasted by hand — no polling, no device-code handshake.

### No new provider code

• Impact: 🟡 review (code touched)
• Commit mix: 3 chore · 3 docs · 3 feat · 2 fix
• Files touched: code=11 docs=6 ci=0 test=7 other=20
• 11 new commit(s) since last check
• Latest: 4702c33 — fix(install): fetch model pricing live instead of hardcoding it (#3515)
• Recent commits:
• a90066f [fix] fix(chroma): prevent concurrent write storms (#3462)
• dd68d21 [feat] feat(observations): add "sensitive" type with Telegram notification (#3468)
• ce92132 [chore] chore: bump version to 13.13.0
• b368aba [docs] docs: update changelog for v13.13.0
• 9326fae [feat] feat: add custom mode creator skill (#3487)

caveman

• New release: v1.10.0 (was v1.9.1)
• Release notes:

## Install

```bash
curl -fsSL https://raw.githubusercontent.com/JuliusBrussee/caveman/main/install.sh | bash

irm https://raw.githubusercontent.com/JuliusBrussee/caveman/main/install.ps1 | iex

Features

• /caveman-stats reports net savings, not just gross (#145, #677). The skill costs ~1–1.5k input tokens per turn. Stats now subtracts that instead of only counting output saved, so a net-negative workload shows up as net-negative.

Fixes

• Compress no longer loses data on Windows (#652, #655, #686). Explicit UTF-8 plus atomic writes. A crash mid-write can no longer truncate the file it was rewriting.
• Installer moved bin/ → cli/, with hardened Windows quoting and a clean uninstall path.
• Hooks share one parser (caveman-parse.js), unwrap the payload envelope, and survive resume/clear/compact re-fires — a mid-session /caveman <level> switch is no longer reset by a SessionStart re-fire.
• Skill hardening: negation safety, tool-call silence, language-drift.

  - **Impact:** 🟡 review (code touched)
  - **Commit mix:** 2 chore · 1 ci · 3 docs · 1 feat · 4 fix · 2 other
  - **Files touched:** code=12 docs=19 ci=2 test=15 other=17
  - **13 new commit(s)** since last check
  - Latest: `11ddc0c` — docs: simplify install section
  - Recent commits:
  - `710173f` [fix] fix(skill): negation safety, tool-call silence, language-drift hardening
  - `7693a04` [fix] fix(hooks): shared parser, envelope unwrap, resume-safe SessionStart
  - `d833f4a` [feat] feat(stats): surface net savings, not just gross (#145, #677)
  - `dcd51f1` [fix] fix(compress): stop Windows data loss — UTF-8 + atomic writes (#652, #655, #686)
  - `ed1fbb7` [fix] fix(install): rename bin/ to cli/, harden Windows quoting, clean uninstall

### [playwright-mcp](https://github.com/microsoft/playwright-mcp)

  - **New release:** `v0.0.79` (was `v0.0.78`)
  - Release notes:

What's New

Tool Improvements

• browser_take_screenshot — WebP format — New type option to pick the image format (png, jpeg or webp); when unset, the format is inferred from the filename extension (#41152)
• --codegen — more languages — Code generation now supports python, java and csharp in addition to typescript (#42106)
• Configurable settle delay — New --timeout-settle flag (and timeouts.settle config option) to control how long to wait after each action for triggered work (navigations, requests) to settle, defaults to 500ms (#41924)

Fixes

• Aria snapshot capture is skipped when the response discards it (#41923)
• New --snapshot-boxes flag (and snapshot.boxes config option) to enable bounding boxes in snapshots globally — previously this was only available per command (#42102)
• Reconnect to the browser after a disconnect (#41966)
• Report malformed JSON config instead of silently falling back to INI parsing (#41909)
• Clear the dialog modal state when a dialog is closed out of band (#42032)
• Detect downloads via the download event instead of guessing from net::ERR_ABORTED navigation errors (#41933)
• Surface the missing executable path when a browser isn't installed (#41941)
• Escape user input in codegen output (#41962)
• Removed the stale --output-mode CLI option (#41833)

  - **Impact:** 🟡 review (code touched)
  - **Commit mix:** 6 chore · 1 other
  - **Files touched:** code=0 docs=1 ci=0 test=0 other=5
  - **7 new commit(s)** since last check
  - Latest: `7e0457a` — devops: add ESRP pipeline for publishing npm alpha versions (#1709)
  - Recent commits:
  - `30710c8` [chore] chore(deps-dev): bump fast-uri from 3.1.2 to 3.1.4 (#1692)
  - `42e792a` [chore] chore(deps-dev): bump hono from 4.12.26 to 4.12.31 (#1687)
  - `f2db2c2` [chore] chore(deps-dev): bump ip-address from 10.2.0 to 10.4.0 (#1703)
  - `8414d57` [chore] chore(deps): bump @hono/node-server and @modelcontextprotocol/sdk (#1702)
  - `4ed35bf` [chore] chore: roll Playwright to 1.63.0-alpha-2026-08-05 (#1706)


*Updated by the upstream tracker workflow.*

[github-actions]

New upstream changes detected (2026-08-10)

context7

• New release: @upstash/context7-mcp@4.0.0 (was @upstash/context7-mcp@3.2.5)
• Release notes:

### Major Changes

- 8d52608: Migrate the MCP server to the v2 SDK (`@modelcontextprotocol/{node,server,client}` 2.0.0) and the 2026-07-28 protocol revision. HTTP serving is now stateless for both modern and legacy clients, and Redis-backed sessions are removed.

• Impact: 🟡 review (code touched)
• Commit mix: 2 chore · 5 docs · 2 feat · 1 fix · 1 other
• Files touched: code=16 docs=39 ci=0 test=4 other=8
• 11 new commit(s) since last check
• Latest: 9c7068a — docs: remove broken Smithery badge and Star History chart from READMEs (#3004)
• Recent commits:
• 6c343ae [docs] docs(enterprise): changelog for v1.2.4 through v1.3.0 (#2953)
• 80f9d6c [docs] docs(enterprise): add library access control page (#2928)
• b89a04e [fix] fix(cli): write the API key as an Authorization header (#2957)
• 38422b1 [chore] chore(release): version packages (#2960)
• 6153deb [docs] docs(enterprise): document external Postgres with the embedded vector index (#2954)

lightrag

• New release: v1.5.6 (was v1.5.5rc1)
• Release notes:

## Important Notes

Introducing **PGTableGraphStorage**, a new graph storage backend built on native PostgreSQL tables. By eliminating the dependency on Apache AGE, it not only simplifies deployment but also delivers significantly higher graph storage performance with reduced storage footprint. It will replace the AGE-based `PGGraphStorage` as the preferred graph storage solution for PostgreSQL. This makes **PostgreSQL** the go-to **all-in-one backend database** for LightRAG, enabling a single database to cover all four storage types.

## What's New

* feat(kg): add PGTableGraphStorage — PostgreSQL-native graph backend (no AGE dependency) by @ysys143 in https://github.com/HKUDS/LightRAG/pull/3103
* docs(pipeline): rewrite the dedup and concurrency chapters from a user's view by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3583

## What's Changed

* Implement fail-closed recovery proof for whole-document purge by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3535
* docs: fix broken links and correct VLM gating semantics by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3539
* docs: extract parser service deployment runbooks by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3540
* docs: restructure FileProcessingPipeline into a usable guide by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3541
* docs: fix documentation typos, grammar errors, and incorrect warning messages by @Rythamo8055 in https://github.com/HKUDS/LightRAG/pull/3538
* feat(utils): bound thread-pool submission and pin the tokenizer contract by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3543
* fix(deps): sync uv.lock with the tiktoken floor and correct the restore rationale by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3546
* fix(api): bound request bodies and take token counting off the event loop by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3544
* fix(pipeline): take chunking off the event loop and bound the separator cascade by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3547

• Impact: 🔴 likely matters (breaking change)
• Commit mix: 1 build · 1 chore · 2 ci · 21 docs · 4 feat · 96 fix · 98 other · 4 perf · 3 refactor · 1 revert · 2 style · 17 test
• Files touched: code=0 docs=26 ci=12 test=154 other=108
• 510 new commit(s) since last check
• Latest: 419aaab — Merge pull request #3587 from ysys143/fix/rebuild-vdb-drop-lossy-agtype-quote-strip
• Recent commits:
• ce217d8 [fix] fix(rerank): reject boolean scores
• 327a41f [other] Merge pull request #3529 from HKUDS/fix/rerank-malformed-response-guard
• 3fb9116 [other] Bump API version to 0324
• 4f6936f [fix] fix(pipeline): scrub persisted sentence_split_regex on resume
• bceb68e [other] Fix lintings

everything-claude-code

• New release: v2.1.0 (was v2.0.0)
• Release notes:

# ECC 2.1.0: Plan Canvas, Kimi Harness, and Self-Hosted Compute

ECC 2.1 turns plan review into a visual loop and opens the harness to self-hosted models. Plan Canvas lets you review agent plans in the browser. Point at the part you mean instead of retyping it in chat. A new Kimi Code install target and a verified Itô GPU path make ECC + open-source models a first-class setup, backed by our public sponsors: Moonshot AI (Kimi), Itô, and Atlas Cloud.

## Plan Canvas: review plans by pointing, not retyping

![Plan Canvas demo: reviewing an ECC plan, attaching an annotation, chatting with the agent, and approving the plan](https://raw.githubusercontent.com/affaan-m/ECC/main/docs/releases/2.1.0/assets/ecc-plan-canvas-demo.gif)

[Download the MP4 demo](https://raw.githubusercontent.com/affaan-m/ECC/main/docs/releases/2.1.0/assets/ecc-plan-canvas-demo.mp4)

`/plan` ends with a confirm gate, and until now that review was a wall of markdown in the terminal. Now the agent opens the plan in a loopback-only browser canvas:

- Click elements or select text to attach numbered annotations
- Chat with the agent from a side rail while it works in the terminal
- **Approve plan** / **Request changes** buttons map directly onto `/plan`'s CONFIRM gate
- Mermaid diagrams, tables, and task lists render natively; file edits live-reload the page
- Model- and harness-agnostic: a plain CLI + JSON protocol (`ecc-plan-canvas`), no Claude-only dependency

## Kimi harness: Moonshot AI partnership

• Impact: 🟡 review (code touched)
• Commit mix: 7 chore · 6 docs · 4 feat · 30 fix · 8 other · 2 test
• Files touched: code=0 docs=50 ci=11 test=84 other=98
• 57 new commit(s) since last check
• Latest: ae303fb — fix(plan-canvas): deliver browser chat to the agent every time (#2739)
• Recent commits:
• b06c78c [docs] docs: add 2.1.0 release notes and Plan Canvas demo assets
• 1ffaa75 [fix] fix(release): match the ECC banner name when bumping versions
• 4099794 [fix] fix(release): bump the claude marketplace and zh-CN heading on macOS
• 6f452d4 [chore] chore: bump plugin version to 2.1.0
• edaf6fe [fix] fix(release): drop the dead OMP adapter verification step

marketing-skills

• New release: v2.10.0 (was v2.9.0)
• Release notes:

**attribution** (new, 1.1.0): a dedicated skill for the hardest question in marketing — which efforts actually drive conversions and revenue. Fills a real gap: attribution was scattered across analytics (UTM setup), ads (platform pixels), revops (pipeline), and ai-seo (the AI blind spot), but no skill owned the *models* or the *reconciliation problem*. Two pillars. **(A) Interpretation** — the six attribution models and when each lies; MTA vs. MMM vs. incrementality and how to choose; self-reported attribution; reconciling the platform-vs-GA-vs-CRM-vs-survey disagreement (never sum across platforms; pick one source of truth; read directional trends); and the direct / branded-search / dark-social / AI blind spots. **(B) Own your attribution (first-party)** — a build runbook for instrumenting attribution yourself when you control the site/app: the identity graph, closing the `identify()` gap (adapted from Tessa Kriesel's PostHog approach), stitching conversions on third-party domains you don't own (SavvyCal/Calendly/Stripe) via metadata passthrough + webhook identity-merge, fail-closed anonymity guards, and first-touch data-quality cleanup — distilled from real production builds (Conversion Factory + Truelist). Four references (`attribution-models.md`, `measurement-paradigms.md`, `by-business-type.md` with B2B/DTC playbooks, `first-party-tracking.md`) and 7 evals covering reconciliation, model choice, the third-party stitch, ROAS incrementality, the direct/branded blind spot, the analytics boundary, and the DTC measurement stack. Pillar B also folds in **production feedback from Tessa Kriesel** (credited): the CRM last mile (sync a `source` field with confidence + basis and a paid-vs-non-paid read onto the account → revops), storing the full ordered touch path so the build track can run Pillar A's multi-touch models on real data, the "expect ~zero until the cross-subdomain stitch is verified in prod" window with a narrowly-scoped campaign-window fallback + pre-stitch backfill, and account-level rollup (excluding free-mail domains) for B2B.
**analytics** (2.0.0 → 2.0.1): description now hands off attribution modeling and reconciliation to the new attribution skill, keeping analytics scoped to tracking setup, event taxonomy, and UTMs.

• Impact: 🟡 review (code touched)
• Commit mix: 1 chore · 2 feat · 5 other
• Files touched: code=0 docs=10 ci=0 test=0 other=4
• 8 new commit(s) since last check
• Latest: 7868cb9 — chore: sync skills with marketplace.json, plugin.json, and README
• Recent commits:
• 804c512 [feat] feat(attribution): new skill — models, reconciliation, and first-party attribution (2.10.0) (#473)
• 789ef02 [feat] feat(attribution): Tessa Kriesel production feedback → first-party runbook (1.1.0, part of 2.10.0) (#483)
• 3c51add [other] release(2.9.1): pricing-page teardown with AI-agent-readiness axis (#487)
• 2c13acc [other] Merge pull request #492 from coreyhaines31/hotfix/487-pricing-2.9.1
• fc2f33b [other] sync: main -> development after 2.9.1 pricing release

ui-ux-pro-max

• New release: v2.14.1 (was v2.11.2)
• Release notes:

## [2.14.1](https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/compare/v2.14.0...v2.14.1) (2026-08-06)

• Impact: 🟡 review (code touched)
• Commit mix: 3 feat · 4 fix
• Files touched: code=4 docs=3 ci=1 test=0 other=48
• 7 new commit(s) since last check
• Latest: abb7f2f — fix: bump skill.json version to 2.13.0 (#438)
• Recent commits:
• 4857a2c [fix] fix(cli): sync shadcn test asset (#433)
• ec1f2a9 [fix] fix(design-system): resolve palette and anti-patterns against the style's mode (#428) (#434)
• b0ebb17 [fix] fix(copilot): generate .prompt.md file for VS Code Copilot slash commands (#328)
• 14ddef5 [feat] feat(gallery): add Style Detail Modal with phone UI controls preview (#155)
• 4d140cf [feat] feat(cli): add --global flag to uipro update and support --ai universal target (#435, #436) (#437)

superpowers

• Impact: 🟢 skim (docs/ci/test only)
• Commit mix: 1 docs
• Files touched: code=0 docs=1 ci=0 test=0 other=0
• 1 new commit(s) since last check
• Latest: 44c9b2d — docs: remove the "We're Hiring" section from the README
• Recent commits:
• 44c9b2d [docs] docs: remove the "We're Hiring" section from the README

anthropic-skills

• Impact: 🟢 skim (docs/ci/test only)
• Commit mix: 1 other
• Files touched: code=0 docs=18 ci=0 test=0 other=0
• 1 new commit(s) since last check
• Latest: f17010c — Update claude-api skill: Managed Agents August launch wave (#1532)
• Recent commits:
• f17010c [other] Update claude-api skill: Managed Agents August launch wave (#1532)

knowledge-work-plugins

• Impact: 🟡 review (code touched)
• Commit mix: 128 other
• Files touched: code=0 docs=0 ci=0 test=0 other=4
• 128 new commit(s) since last check
• Latest: e9753d7 — bump(qodo-skills): 5c630679 → e7e9a207 (#835)
• Recent commits:
• d10c2c9 [other] bump(wix): 87c6b285 → 6f402cef (#709)
• 7f1ce6b [other] bump(wix): 6f402cef → dd567862 (#710)
• 372e3b2 [other] bump(langfuse): 13a79944 → 93d82827 (#713)
• 9d92c5e [other] bump(wix): dd567862 → 9e3b2d55 (#711)
• 37820dc [other] bump(carta-cap-table): 0ee76454 → 35c25847 (#712)

n8n-mcp

• New release: v2.69.0 (was v2.66.1)
• Release notes:

# Release v2.69.0

Generating release notes from v2.68.4 to HEAD
### 📝 Other Changes

- Merge commit from fork (5e3c425)

---

**Release Statistics:**
- 1 commit
- 1 contributor
- Contributors: Romuald Członkowski

---

## Installation

### NPM Package
```bash

• Impact: 🟡 review (code touched)
• Commit mix: 2 chore · 4 docs · 2 feat · 5 fix · 1 other
• Files touched: code=39 docs=16 ci=4 test=31 other=13
• 14 new commit(s) since last check
• Latest: 5e3c425 — Merge commit from fork
• Recent commits:
• b14f3c1 [docs] docs: sync skills pack v1.26.0 — canvas groups (nodeGroups) (#951)
• 1d15fc2 [fix] fix: AI-tool validation follow-ups from the 2.31.3 update review (#953–#956) (#962)
• 268f577 [fix] fix: bracket-index path updates and fabricated community node types (#950, #949) (#964)
• 3293e61 [feat] feat: add run and cancel actions to n8n_evaluations (#936) (#963)
• 8265427 [docs] docs: sync skills pack to n8n-skills v1.27.0 (evaluations run/cancel) (#966)

skillspector

• New release: v2.8.2 (was none)
• Release notes:

# SkillSpector v2.8.2

Released: 2026-08-07

## Summary

This patch release improves the resilience of MCP tool-poisoning analysis when a model returns malformed structured output. Affected assessments are retried through the shared structured-output analyzer lifecycle rather than causing an immediate scan failure.

## Highlights

- MCP tool-poisoning TP4 checks now use the shared typed structured-output analyzer lifecycle.

## Added

- None.

## Changed

- Structured TP4 responses are validated through a typed schema with the same per-batch isolation behavior used by other LLM analyzers.

• Impact: 🟡 review (code touched)
• Commit mix: 4 chore · 1 docs · 3 feat · 10 fix · 4 other · 1 test
• Files touched: code=48 docs=16 ci=3 test=49 other=10
• 23 new commit(s) since last check
• Latest: 2bc641f — chore: public OSS release 2.8.2 (#353)
• Recent commits:
• 34f6030 [feat] feat: publish 2.5.0 execution accounting (#308)
• da5cb13 [feat] feat(llm): make analyzer fan-out concurrency configurable via env (#305)
• 3f11bfa [other] release: publish OSS snapshot 2.5.1 (#320)
• e48fc1a [fix] fix(input-handler): bound URL, zip, and git ingest paths (#164)
• 1df69ad [fix] fix(analyzer): reduce instructional-prose false positives in static scans (#103) (#232)

transitions

• Impact: 🟡 review (code touched)
• Commit mix: 1 feat · 6 fix
• Files touched: code=0 docs=0 ci=0 test=0 other=11
• 7 new commit(s) since last check
• Latest: 06f8195 — fix(account): explain the wrong-email case instead of bare "No active plan"
• Recent commits:
• 0ec87b1 [fix] fix: sidebar edge fade, footer alignment, and mobile layout issues
• 1eea31f [feat] feat(pro): add gooey plus menu, drag & drop physics, spinner→check morph
• 9ab8174 [fix] fix(pro): drag no longer opens the detail page; use the stack's middle photo
• c10106d [fix] fix(pro): make the gooey merge readable in dark mode; woman photo for drag & drop
• 67d5c67 [fix] fix(pro): restore smoky dissolve + image open tilt to their original photo

claude-mem

• New release: v13.14.0 (was v13.12.4)
• Release notes:

## CMEM Pro is now the first option in the installer

`npx claude-mem` now leads its provider prompt with **CMEM Pro**, and every option shows what it actually costs per 1,000 observations — so the choice is made on price rather than brand recognition.

◆ Which memory provider do you want to use?
│ ● CMEM Pro — observer model, off your plan ($0/1k observations · $30/mo, cloud sync included) Recommended
│ ○ OpenRouter / any OpenAI-compatible key ($2.73/1k observations, billed to you)
│ ○ Gemini API key ($3.39/1k observations, billed to you)
│ ○ Use your Anthropic plan (~$8.91/1k observations, billed to your Claude plan)

Anthropic moves last: it is the most expensive per observation and it bills your own Claude plan.

### Picking CMEM Pro

Opens `cmem.ai/pro?from=installer`, waits for the `cm_pro_…` key the signup flow hands back, writes it to settings, and points you at the browser to finish cloud sync. The key is pasted by hand — no polling, no device-code handshake.

### No new provider code

• Impact: 🟡 review (code touched)
• Commit mix: 3 chore · 3 docs · 3 feat · 2 fix
• Files touched: code=11 docs=6 ci=0 test=7 other=20
• 11 new commit(s) since last check
• Latest: 4702c33 — fix(install): fetch model pricing live instead of hardcoding it (#3515)
• Recent commits:
• a90066f [fix] fix(chroma): prevent concurrent write storms (#3462)
• dd68d21 [feat] feat(observations): add "sensitive" type with Telegram notification (#3468)
• ce92132 [chore] chore: bump version to 13.13.0
• b368aba [docs] docs: update changelog for v13.13.0
• 9326fae [feat] feat: add custom mode creator skill (#3487)

caveman

• New release: v1.10.0 (was v1.9.1)
• Release notes:

## Install

```bash
curl -fsSL https://raw.githubusercontent.com/JuliusBrussee/caveman/main/install.sh | bash

irm https://raw.githubusercontent.com/JuliusBrussee/caveman/main/install.ps1 | iex

Features

• /caveman-stats reports net savings, not just gross (#145, #677). The skill costs ~1–1.5k input tokens per turn. Stats now subtracts that instead of only counting output saved, so a net-negative workload shows up as net-negative.

Fixes

• Compress no longer loses data on Windows (#652, #655, #686). Explicit UTF-8 plus atomic writes. A crash mid-write can no longer truncate the file it was rewriting.
• Installer moved bin/ → cli/, with hardened Windows quoting and a clean uninstall path.
• Hooks share one parser (caveman-parse.js), unwrap the payload envelope, and survive resume/clear/compact re-fires — a mid-session /caveman <level> switch is no longer reset by a SessionStart re-fire.
• Skill hardening: negation safety, tool-call silence, language-drift.

  - **Impact:** 🟡 review (code touched)
  - **Commit mix:** 2 chore · 1 ci · 3 docs · 1 feat · 4 fix · 2 other
  - **Files touched:** code=12 docs=19 ci=2 test=15 other=17
  - **13 new commit(s)** since last check
  - Latest: `11ddc0c` — docs: simplify install section
  - Recent commits:
  - `710173f` [fix] fix(skill): negation safety, tool-call silence, language-drift hardening
  - `7693a04` [fix] fix(hooks): shared parser, envelope unwrap, resume-safe SessionStart
  - `d833f4a` [feat] feat(stats): surface net savings, not just gross (#145, #677)
  - `dcd51f1` [fix] fix(compress): stop Windows data loss — UTF-8 + atomic writes (#652, #655, #686)
  - `ed1fbb7` [fix] fix(install): rename bin/ to cli/, harden Windows quoting, clean uninstall

### [playwright-mcp](https://github.com/microsoft/playwright-mcp)

  - **New release:** `v0.0.79` (was `v0.0.78`)
  - Release notes:

What's New

Tool Improvements

• browser_take_screenshot — WebP format — New type option to pick the image format (png, jpeg or webp); when unset, the format is inferred from the filename extension (#41152)
• --codegen — more languages — Code generation now supports python, java and csharp in addition to typescript (#42106)
• Configurable settle delay — New --timeout-settle flag (and timeouts.settle config option) to control how long to wait after each action for triggered work (navigations, requests) to settle, defaults to 500ms (#41924)

Fixes

• Aria snapshot capture is skipped when the response discards it (#41923)
• New --snapshot-boxes flag (and snapshot.boxes config option) to enable bounding boxes in snapshots globally — previously this was only available per command (#42102)
• Reconnect to the browser after a disconnect (#41966)
• Report malformed JSON config instead of silently falling back to INI parsing (#41909)
• Clear the dialog modal state when a dialog is closed out of band (#42032)
• Detect downloads via the download event instead of guessing from net::ERR_ABORTED navigation errors (#41933)
• Surface the missing executable path when a browser isn't installed (#41941)
• Escape user input in codegen output (#41962)
• Removed the stale --output-mode CLI option (#41833)

  - **Impact:** 🟡 review (code touched)
  - **Commit mix:** 6 chore · 1 other
  - **Files touched:** code=0 docs=1 ci=0 test=0 other=5
  - **7 new commit(s)** since last check
  - Latest: `7e0457a` — devops: add ESRP pipeline for publishing npm alpha versions (#1709)
  - Recent commits:
  - `30710c8` [chore] chore(deps-dev): bump fast-uri from 3.1.2 to 3.1.4 (#1692)
  - `42e792a` [chore] chore(deps-dev): bump hono from 4.12.26 to 4.12.31 (#1687)
  - `f2db2c2` [chore] chore(deps-dev): bump ip-address from 10.2.0 to 10.4.0 (#1703)
  - `8414d57` [chore] chore(deps): bump @hono/node-server and @modelcontextprotocol/sdk (#1702)
  - `4ed35bf` [chore] chore: roll Playwright to 1.63.0-alpha-2026-08-05 (#1706)


*Updated by the upstream tracker workflow.*

[github-actions]

New upstream changes detected (2026-08-11)

context7

• New release: @upstash/context7-mcp@4.0.0 (was @upstash/context7-mcp@3.2.5)
• Release notes:

### Major Changes

- 8d52608: Migrate the MCP server to the v2 SDK (`@modelcontextprotocol/{node,server,client}` 2.0.0) and the 2026-07-28 protocol revision. HTTP serving is now stateless for both modern and legacy clients, and Redis-backed sessions are removed.

• Impact: 🟡 review (code touched)
• Commit mix: 2 chore · 6 docs · 2 feat · 1 fix · 1 other
• Files touched: code=16 docs=41 ci=0 test=4 other=8
• 12 new commit(s) since last check
• Latest: 895c5c3 — docs: document running on-premise as a non-root user (#3005)
• Recent commits:
• 6c343ae [docs] docs(enterprise): changelog for v1.2.4 through v1.3.0 (#2953)
• 80f9d6c [docs] docs(enterprise): add library access control page (#2928)
• b89a04e [fix] fix(cli): write the API key as an Authorization header (#2957)
• 38422b1 [chore] chore(release): version packages (#2960)
• 6153deb [docs] docs(enterprise): document external Postgres with the embedded vector index (#2954)

lightrag

• New release: v1.5.6 (was v1.5.5rc1)
• Release notes:

## Important Notes

Introducing **PGTableGraphStorage**, a new graph storage backend built on native PostgreSQL tables. By eliminating the dependency on Apache AGE, it not only simplifies deployment but also delivers significantly higher graph storage performance with reduced storage footprint. It will replace the AGE-based `PGGraphStorage` as the preferred graph storage solution for PostgreSQL. This makes **PostgreSQL** the go-to **all-in-one backend database** for LightRAG, enabling a single database to cover all four storage types.

## What's New

* feat(kg): add PGTableGraphStorage — PostgreSQL-native graph backend (no AGE dependency) by @ysys143 in https://github.com/HKUDS/LightRAG/pull/3103
* docs(pipeline): rewrite the dedup and concurrency chapters from a user's view by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3583

## What's Changed

* Implement fail-closed recovery proof for whole-document purge by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3535
* docs: fix broken links and correct VLM gating semantics by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3539
* docs: extract parser service deployment runbooks by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3540
* docs: restructure FileProcessingPipeline into a usable guide by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3541
* docs: fix documentation typos, grammar errors, and incorrect warning messages by @Rythamo8055 in https://github.com/HKUDS/LightRAG/pull/3538
* feat(utils): bound thread-pool submission and pin the tokenizer contract by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3543
* fix(deps): sync uv.lock with the tiktoken floor and correct the restore rationale by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3546
* fix(api): bound request bodies and take token counting off the event loop by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3544
* fix(pipeline): take chunking off the event loop and bound the separator cascade by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3547

• Impact: 🔴 likely matters (breaking change)
• Commit mix: 2 build · 1 chore · 2 ci · 21 docs · 3 feat · 104 fix · 93 other · 4 perf · 3 refactor · 1 revert · 2 style · 14 test
• Files touched: code=0 docs=26 ci=12 test=153 other=109
• 543 new commit(s) since last check
• Latest: 2b67343 — Merge pull request #3623 from HKUDS/fix/graph-attribute-injection-validation
• Recent commits:
• 4f37faa [fix] fix(purge): do not require a proof when nothing attribution-bearing is deleted
• efea173 [docs] docs(purge): align kg_write_state comments with its monotonic contract
• a5a4e2e [test] test(purge): cover zero-entity extraction end to end
• 6134f84 [fix] fix(kg): make whole-graph enumeration complete-or-raise on AGE
• bca0ed0 [fix] fix(audit): read doc_status strictly and in batches for the anchorless scan

everything-claude-code

• New release: v2.1.0 (was v2.0.0)
• Release notes:

# ECC 2.1.0: Plan Canvas, Kimi Harness, and Self-Hosted Compute

ECC 2.1 turns plan review into a visual loop and opens the harness to self-hosted models. Plan Canvas lets you review agent plans in the browser. Point at the part you mean instead of retyping it in chat. A new Kimi Code install target and a verified Itô GPU path make ECC + open-source models a first-class setup, backed by our public sponsors: Moonshot AI (Kimi), Itô, and Atlas Cloud.

## Plan Canvas: review plans by pointing, not retyping

![Plan Canvas demo: reviewing an ECC plan, attaching an annotation, chatting with the agent, and approving the plan](https://raw.githubusercontent.com/affaan-m/ECC/main/docs/releases/2.1.0/assets/ecc-plan-canvas-demo.gif)

[Download the MP4 demo](https://raw.githubusercontent.com/affaan-m/ECC/main/docs/releases/2.1.0/assets/ecc-plan-canvas-demo.mp4)

`/plan` ends with a confirm gate, and until now that review was a wall of markdown in the terminal. Now the agent opens the plan in a loopback-only browser canvas:

- Click elements or select text to attach numbered annotations
- Chat with the agent from a side rail while it works in the terminal
- **Approve plan** / **Request changes** buttons map directly onto `/plan`'s CONFIRM gate
- Mermaid diagrams, tables, and task lists render natively; file edits live-reload the page
- Model- and harness-agnostic: a plain CLI + JSON protocol (`ecc-plan-canvas`), no Claude-only dependency

## Kimi harness: Moonshot AI partnership

• Impact: 🟡 review (code touched)
• Commit mix: 9 chore · 6 docs · 6 feat · 32 fix · 9 other · 2 test
• Files touched: code=0 docs=56 ci=11 test=87 other=102
• 64 new commit(s) since last check
• Latest: 9b08128 — chore(deps): integrate safe Dependabot runtime updates (#2762)
• Recent commits:
• b06c78c [docs] docs: add 2.1.0 release notes and Plan Canvas demo assets
• 1ffaa75 [fix] fix(release): match the ECC banner name when bumping versions
• 4099794 [fix] fix(release): bump the claude marketplace and zh-CN heading on macOS
• 6f452d4 [chore] chore: bump plugin version to 2.1.0
• edaf6fe [fix] fix(release): drop the dead OMP adapter verification step

marketing-skills

• New release: v2.10.0 (was v2.9.0)
• Release notes:

**attribution** (new, 1.1.0): a dedicated skill for the hardest question in marketing — which efforts actually drive conversions and revenue. Fills a real gap: attribution was scattered across analytics (UTM setup), ads (platform pixels), revops (pipeline), and ai-seo (the AI blind spot), but no skill owned the *models* or the *reconciliation problem*. Two pillars. **(A) Interpretation** — the six attribution models and when each lies; MTA vs. MMM vs. incrementality and how to choose; self-reported attribution; reconciling the platform-vs-GA-vs-CRM-vs-survey disagreement (never sum across platforms; pick one source of truth; read directional trends); and the direct / branded-search / dark-social / AI blind spots. **(B) Own your attribution (first-party)** — a build runbook for instrumenting attribution yourself when you control the site/app: the identity graph, closing the `identify()` gap (adapted from Tessa Kriesel's PostHog approach), stitching conversions on third-party domains you don't own (SavvyCal/Calendly/Stripe) via metadata passthrough + webhook identity-merge, fail-closed anonymity guards, and first-touch data-quality cleanup — distilled from real production builds (Conversion Factory + Truelist). Four references (`attribution-models.md`, `measurement-paradigms.md`, `by-business-type.md` with B2B/DTC playbooks, `first-party-tracking.md`) and 7 evals covering reconciliation, model choice, the third-party stitch, ROAS incrementality, the direct/branded blind spot, the analytics boundary, and the DTC measurement stack. Pillar B also folds in **production feedback from Tessa Kriesel** (credited): the CRM last mile (sync a `source` field with confidence + basis and a paid-vs-non-paid read onto the account → revops), storing the full ordered touch path so the build track can run Pillar A's multi-touch models on real data, the "expect ~zero until the cross-subdomain stitch is verified in prod" window with a narrowly-scoped campaign-window fallback + pre-stitch backfill, and account-level rollup (excluding free-mail domains) for B2B.
**analytics** (2.0.0 → 2.0.1): description now hands off attribution modeling and reconciliation to the new attribution skill, keeping analytics scoped to tracking setup, event taxonomy, and UTMs.

• Impact: 🟡 review (code touched)
• Commit mix: 1 chore · 2 feat · 5 other
• Files touched: code=0 docs=10 ci=0 test=0 other=4
• 8 new commit(s) since last check
• Latest: 7868cb9 — chore: sync skills with marketplace.json, plugin.json, and README
• Recent commits:
• 804c512 [feat] feat(attribution): new skill — models, reconciliation, and first-party attribution (2.10.0) (#473)
• 789ef02 [feat] feat(attribution): Tessa Kriesel production feedback → first-party runbook (1.1.0, part of 2.10.0) (#483)
• 3c51add [other] release(2.9.1): pricing-page teardown with AI-agent-readiness axis (#487)
• 2c13acc [other] Merge pull request #492 from coreyhaines31/hotfix/487-pricing-2.9.1
• fc2f33b [other] sync: main -> development after 2.9.1 pricing release

ui-ux-pro-max

• New release: v2.14.1 (was v2.11.2)
• Release notes:

## [2.14.1](https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/compare/v2.14.0...v2.14.1) (2026-08-06)

• Impact: 🟡 review (code touched)
• Commit mix: 3 feat · 4 fix
• Files touched: code=4 docs=3 ci=1 test=0 other=48
• 7 new commit(s) since last check
• Latest: abb7f2f — fix: bump skill.json version to 2.13.0 (#438)
• Recent commits:
• 4857a2c [fix] fix(cli): sync shadcn test asset (#433)
• ec1f2a9 [fix] fix(design-system): resolve palette and anti-patterns against the style's mode (#428) (#434)
• b0ebb17 [fix] fix(copilot): generate .prompt.md file for VS Code Copilot slash commands (#328)
• 14ddef5 [feat] feat(gallery): add Style Detail Modal with phone UI controls preview (#155)
• 4d140cf [feat] feat(cli): add --global flag to uipro update and support --ai universal target (#435, #436) (#437)

superpowers

• Impact: 🟢 skim (docs/ci/test only)
• Commit mix: 1 docs
• Files touched: code=0 docs=1 ci=0 test=0 other=0
• 1 new commit(s) since last check
• Latest: 44c9b2d — docs: remove the "We're Hiring" section from the README
• Recent commits:
• 44c9b2d [docs] docs: remove the "We're Hiring" section from the README

anthropic-skills

• Impact: 🟢 skim (docs/ci/test only)
• Commit mix: 1 other
• Files touched: code=0 docs=18 ci=0 test=0 other=0
• 1 new commit(s) since last check
• Latest: f17010c — Update claude-api skill: Managed Agents August launch wave (#1532)
• Recent commits:
• f17010c [other] Update claude-api skill: Managed Agents August launch wave (#1532)

knowledge-work-plugins

• Impact: 🟡 review (code touched)
• Commit mix: 137 other
• Files touched: code=0 docs=0 ci=0 test=0 other=4
• 137 new commit(s) since last check
• Latest: 2cf4294 — bump(carta-cap-table): 7b02f62b → f95f76bc (#842)
• Recent commits:
• d10c2c9 [other] bump(wix): 87c6b285 → 6f402cef (#709)
• 7f1ce6b [other] bump(wix): 6f402cef → dd567862 (#710)
• 372e3b2 [other] bump(langfuse): 13a79944 → 93d82827 (#713)
• 9d92c5e [other] bump(wix): dd567862 → 9e3b2d55 (#711)
• 37820dc [other] bump(carta-cap-table): 0ee76454 → 35c25847 (#712)

n8n-mcp

• New release: v2.69.0 (was v2.66.1)
• Release notes:

# Release v2.69.0

Generating release notes from v2.68.4 to HEAD
### 📝 Other Changes

- Merge commit from fork (5e3c425)

---

**Release Statistics:**
- 1 commit
- 1 contributor
- Contributors: Romuald Członkowski

---

## Installation

### NPM Package
```bash

• Impact: 🟡 review (code touched)
• Commit mix: 2 chore · 4 docs · 2 feat · 5 fix · 1 other
• Files touched: code=39 docs=16 ci=4 test=31 other=13
• 14 new commit(s) since last check
• Latest: 5e3c425 — Merge commit from fork
• Recent commits:
• b14f3c1 [docs] docs: sync skills pack v1.26.0 — canvas groups (nodeGroups) (#951)
• 1d15fc2 [fix] fix: AI-tool validation follow-ups from the 2.31.3 update review (#953–#956) (#962)
• 268f577 [fix] fix: bracket-index path updates and fabricated community node types (#950, #949) (#964)
• 3293e61 [feat] feat: add run and cancel actions to n8n_evaluations (#936) (#963)
• 8265427 [docs] docs: sync skills pack to n8n-skills v1.27.0 (evaluations run/cancel) (#966)

skillspector

• New release: v2.9.2 (was none)
• Release notes:

# SkillSpector v2.9.2

Released: 2026-08-10

## Summary

This patch release makes structured LLM response handling more resilient to transient malformed payloads. It retries validation and structured-output parse failures with bounded backoff while retaining fail-closed batch isolation after the retry budget is exhausted.

## Highlights

- Structured LLM response failures now receive bounded retries before a batch is isolated.

## Added

- None.

## Changed

- Applied the structured-response retry policy centrally to semantic analyzers, the meta-analyzer, TP4, and gap-fill paths.

• Impact: 🟡 review (code touched)
• Commit mix: 6 chore · 1 docs · 3 feat · 10 fix · 4 other · 1 test
• Files touched: code=49 docs=19 ci=3 test=49 other=11
• 25 new commit(s) since last check
• Latest: 81e2c4d — chore: public OSS release 2.9.2 (#359)
• Recent commits:
• 34f6030 [feat] feat: publish 2.5.0 execution accounting (#308)
• da5cb13 [feat] feat(llm): make analyzer fan-out concurrency configurable via env (#305)
• 3f11bfa [other] release: publish OSS snapshot 2.5.1 (#320)
• e48fc1a [fix] fix(input-handler): bound URL, zip, and git ingest paths (#164)
• 1df69ad [fix] fix(analyzer): reduce instructional-prose false positives in static scans (#103) (#232)

transitions

• Impact: 🟡 review (code touched)
• Commit mix: 1 feat · 6 fix
• Files touched: code=0 docs=0 ci=0 test=0 other=11
• 7 new commit(s) since last check
• Latest: 06f8195 — fix(account): explain the wrong-email case instead of bare "No active plan"
• Recent commits:
• 0ec87b1 [fix] fix: sidebar edge fade, footer alignment, and mobile layout issues
• 1eea31f [feat] feat(pro): add gooey plus menu, drag & drop physics, spinner→check morph
• 9ab8174 [fix] fix(pro): drag no longer opens the detail page; use the stack's middle photo
• c10106d [fix] fix(pro): make the gooey merge readable in dark mode; woman photo for drag & drop
• 67d5c67 [fix] fix(pro): restore smoky dissolve + image open tilt to their original photo

claude-mem

• New release: v13.15.0 (was v13.12.4)
• Release notes:

## 7-day Pro trial in the installer

The npx installer can now start a free week of CMEM Pro end to end:

- **Trial funnel in `npx claude-mem install`** — pitch → email entry → magic-link → Stripe checkout, with the installer polling the pairing API and finishing setup automatically once the trial starts (#3524)
- **Device-code approval** — the terminal shows a short code (XXXX-XXXX) that you confirm in the browser before credentials are delivered, closing a pairing-secret disclosure vector (#3524)
- **Live model pricing** — the installer now fetches model pricing from the API instead of shipping hardcoded numbers (#3515)

Requires the cmem.ai backend released today (trial routes + `cli_pairings` device-authorization grant).

• Impact: 🟡 review (code touched)
• Commit mix: 4 chore · 4 docs · 3 feat · 2 fix · 1 other
• Files touched: code=12 docs=6 ci=0 test=7 other=20
• 14 new commit(s) since last check
• Latest: d768ba3 — docs: update changelog for v13.15.0
• Recent commits:
• a90066f [fix] fix(chroma): prevent concurrent write storms (#3462)
• dd68d21 [feat] feat(observations): add "sensitive" type with Telegram notification (#3468)
• ce92132 [chore] chore: bump version to 13.13.0
• b368aba [docs] docs: update changelog for v13.13.0
• 9326fae [feat] feat: add custom mode creator skill (#3487)

caveman

• New release: v1.10.0 (was v1.9.1)
• Release notes:

## Install

```bash
curl -fsSL https://raw.githubusercontent.com/JuliusBrussee/caveman/main/install.sh | bash

irm https://raw.githubusercontent.com/JuliusBrussee/caveman/main/install.ps1 | iex

Features

• /caveman-stats reports net savings, not just gross (#145, #677). The skill costs ~1–1.5k input tokens per turn. Stats now subtracts that instead of only counting output saved, so a net-negative workload shows up as net-negative.

Fixes

• Compress no longer loses data on Windows (#652, #655, #686). Explicit UTF-8 plus atomic writes. A crash mid-write can no longer truncate the file it was rewriting.
• Installer moved bin/ → cli/, with hardened Windows quoting and a clean uninstall path.
• Hooks share one parser (caveman-parse.js), unwrap the payload envelope, and survive resume/clear/compact re-fires — a mid-session /caveman <level> switch is no longer reset by a SessionStart re-fire.
• Skill hardening: negation safety, tool-call silence, language-drift.

  - **Impact:** 🟡 review (code touched)
  - **Commit mix:** 2 chore · 1 ci · 3 docs · 1 feat · 4 fix · 3 other
  - **Files touched:** code=12 docs=19 ci=2 test=15 other=17
  - **14 new commit(s)** since last check
  - Latest: `3098342` — Update README.md with Skills.sh badge (#338)
  - Recent commits:
  - `710173f` [fix] fix(skill): negation safety, tool-call silence, language-drift hardening
  - `7693a04` [fix] fix(hooks): shared parser, envelope unwrap, resume-safe SessionStart
  - `d833f4a` [feat] feat(stats): surface net savings, not just gross (#145, #677)
  - `dcd51f1` [fix] fix(compress): stop Windows data loss — UTF-8 + atomic writes (#652, #655, #686)
  - `ed1fbb7` [fix] fix(install): rename bin/ to cli/, harden Windows quoting, clean uninstall

### [playwright-mcp](https://github.com/microsoft/playwright-mcp)

  - **New release:** `v0.0.79` (was `v0.0.78`)
  - Release notes:

What's New

Tool Improvements

• browser_take_screenshot — WebP format — New type option to pick the image format (png, jpeg or webp); when unset, the format is inferred from the filename extension (#41152)
• --codegen — more languages — Code generation now supports python, java and csharp in addition to typescript (#42106)
• Configurable settle delay — New --timeout-settle flag (and timeouts.settle config option) to control how long to wait after each action for triggered work (navigations, requests) to settle, defaults to 500ms (#41924)

Fixes

• Aria snapshot capture is skipped when the response discards it (#41923)
• New --snapshot-boxes flag (and snapshot.boxes config option) to enable bounding boxes in snapshots globally — previously this was only available per command (#42102)
• Reconnect to the browser after a disconnect (#41966)
• Report malformed JSON config instead of silently falling back to INI parsing (#41909)
• Clear the dialog modal state when a dialog is closed out of band (#42032)
• Detect downloads via the download event instead of guessing from net::ERR_ABORTED navigation errors (#41933)
• Surface the missing executable path when a browser isn't installed (#41941)
• Escape user input in codegen output (#41962)
• Removed the stale --output-mode CLI option (#41833)

  - **Impact:** 🟡 review (code touched)
  - **Commit mix:** 6 chore · 1 other
  - **Files touched:** code=0 docs=1 ci=0 test=0 other=5
  - **7 new commit(s)** since last check
  - Latest: `7e0457a` — devops: add ESRP pipeline for publishing npm alpha versions (#1709)
  - Recent commits:
  - `30710c8` [chore] chore(deps-dev): bump fast-uri from 3.1.2 to 3.1.4 (#1692)
  - `42e792a` [chore] chore(deps-dev): bump hono from 4.12.26 to 4.12.31 (#1687)
  - `f2db2c2` [chore] chore(deps-dev): bump ip-address from 10.2.0 to 10.4.0 (#1703)
  - `8414d57` [chore] chore(deps): bump @hono/node-server and @modelcontextprotocol/sdk (#1702)
  - `4ed35bf` [chore] chore: roll Playwright to 1.63.0-alpha-2026-08-05 (#1706)


*Updated by the upstream tracker workflow.*

[github-actions]

New upstream changes detected (2026-08-12)

context7

• New release: @upstash/context7-mcp@4.0.2 (was @upstash/context7-mcp@3.2.5)
• Release notes:

### Patch Changes

- 67528f2: Add a 60s `AbortSignal.timeout()` to both Context7 API calls in `lib/api.ts`. Without a signal a stalled backend call rides undici's ~300s default before failing. 60s is generous: these are vector queries with p99.9 ~3.2s, and no request exceeded 30s across a full day of production traffic.
- c68104e: Disable SSE keepalive heartbeats on the HTTP handler (`keepAliveMs: 0`). Every tool is a millisecond vector query, so no legitimate exchange needs a heartbeat — but a hung exchange kept alive by heartbeats can never be reaped by a proxy's stream idle timeout. One such hang is deterministic: a 2025-era JSON-RPC batch carrying a request plus its own `notifications/cancelled` gets no response for the cancelled request (per spec), the SDK transport then never closes the stream, and heartbeats kept it alive until the gateway's 1200s hard cap — the dominant source of leaked upstream connections in the 2026-08-11 mcp.context7.com outage. With heartbeats off, silent hangs go idle and the proxy reaps them at its idle timeout.

• Impact: 🟡 review (code touched)
• Commit mix: 4 chore · 6 docs · 2 feat · 2 fix · 4 other
• Files touched: code=25 docs=41 ci=0 test=7 other=8
• 18 new commit(s) since last check
• Latest: ef14a58 — chore(release): version packages (#3021)
• Recent commits:
• 6c343ae [docs] docs(enterprise): changelog for v1.2.4 through v1.3.0 (#2953)
• 80f9d6c [docs] docs(enterprise): add library access control page (#2928)
• b89a04e [fix] fix(cli): write the API key as an Authorization header (#2957)
• 38422b1 [chore] chore(release): version packages (#2960)
• 6153deb [docs] docs(enterprise): document external Postgres with the embedded vector index (#2954)

lightrag

• New release: v1.5.6 (was v1.5.5rc1)
• Release notes:

## Important Notes

Introducing **PGTableGraphStorage**, a new graph storage backend built on native PostgreSQL tables. By eliminating the dependency on Apache AGE, it not only simplifies deployment but also delivers significantly higher graph storage performance with reduced storage footprint. It will replace the AGE-based `PGGraphStorage` as the preferred graph storage solution for PostgreSQL. This makes **PostgreSQL** the go-to **all-in-one backend database** for LightRAG, enabling a single database to cover all four storage types.

## What's New

* feat(kg): add PGTableGraphStorage — PostgreSQL-native graph backend (no AGE dependency) by @ysys143 in https://github.com/HKUDS/LightRAG/pull/3103
* docs(pipeline): rewrite the dedup and concurrency chapters from a user's view by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3583

## What's Changed

* Implement fail-closed recovery proof for whole-document purge by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3535
* docs: fix broken links and correct VLM gating semantics by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3539
* docs: extract parser service deployment runbooks by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3540
* docs: restructure FileProcessingPipeline into a usable guide by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3541
* docs: fix documentation typos, grammar errors, and incorrect warning messages by @Rythamo8055 in https://github.com/HKUDS/LightRAG/pull/3538
* feat(utils): bound thread-pool submission and pin the tokenizer contract by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3543
* fix(deps): sync uv.lock with the tiktoken floor and correct the restore rationale by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3546
* fix(api): bound request bodies and take token counting off the event loop by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3544
* fix(pipeline): take chunking off the event loop and bound the separator cascade by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3547

• Impact: 🟡 review (code touched)
• Commit mix: 1 build · 1 chore · 2 ci · 11 docs · 2 feat · 110 fix · 96 other · 5 perf · 4 refactor · 1 revert · 3 style · 14 test
• Files touched: code=0 docs=26 ci=12 test=153 other=109
• 581 new commit(s) since last check
• Latest: 6f50fdd — Merge pull request #3629 from El-Tatane/fix/milvus-3584-query-paging
• Recent commits:
• 4954051 [other] Merge pull request #3549 from HKUDS/dependabot/github_actions/github-actions-84c3d95bcf
• 91735af [other] Merge pull request #3550 from HKUDS/fix/chunker-separator-warning-cache
• b47ed82 [other] 📝 docs(env.example): move request limit settings up
• 301e715 [other] 📝 docs(README): link chinese translations explicitly
• 216c6a4 [fix] fix(utils): return 0.0 for cosine_similarity on non-finite vectors

everything-claude-code

• New release: v2.1.0 (was v2.0.0)
• Release notes:

# ECC 2.1.0: Plan Canvas, Kimi Harness, and Self-Hosted Compute

ECC 2.1 turns plan review into a visual loop and opens the harness to self-hosted models. Plan Canvas lets you review agent plans in the browser. Point at the part you mean instead of retyping it in chat. A new Kimi Code install target and a verified Itô GPU path make ECC + open-source models a first-class setup, backed by our public sponsors: Moonshot AI (Kimi), Itô, and Atlas Cloud.

## Plan Canvas: review plans by pointing, not retyping

![Plan Canvas demo: reviewing an ECC plan, attaching an annotation, chatting with the agent, and approving the plan](https://raw.githubusercontent.com/affaan-m/ECC/main/docs/releases/2.1.0/assets/ecc-plan-canvas-demo.gif)

[Download the MP4 demo](https://raw.githubusercontent.com/affaan-m/ECC/main/docs/releases/2.1.0/assets/ecc-plan-canvas-demo.mp4)

`/plan` ends with a confirm gate, and until now that review was a wall of markdown in the terminal. Now the agent opens the plan in a loopback-only browser canvas:

- Click elements or select text to attach numbered annotations
- Chat with the agent from a side rail while it works in the terminal
- **Approve plan** / **Request changes** buttons map directly onto `/plan`'s CONFIRM gate
- Mermaid diagrams, tables, and task lists render natively; file edits live-reload the page
- Model- and harness-agnostic: a plain CLI + JSON protocol (`ecc-plan-canvas`), no Claude-only dependency

## Kimi harness: Moonshot AI partnership

• Impact: 🟡 review (code touched)
• Commit mix: 10 chore · 1 ci · 8 docs · 8 feat · 36 fix · 9 other · 2 test
• Files touched: code=0 docs=184 ci=15 test=0 other=101
• 74 new commit(s) since last check
• Latest: 569b1d5 — fix: disable Claude co-author attribution by default (#2758)
• Recent commits:
• b06c78c [docs] docs: add 2.1.0 release notes and Plan Canvas demo assets
• 1ffaa75 [fix] fix(release): match the ECC banner name when bumping versions
• 4099794 [fix] fix(release): bump the claude marketplace and zh-CN heading on macOS
• 6f452d4 [chore] chore: bump plugin version to 2.1.0
• edaf6fe [fix] fix(release): drop the dead OMP adapter verification step

marketing-skills

• New release: v2.10.0 (was v2.9.0)
• Release notes:

**attribution** (new, 1.1.0): a dedicated skill for the hardest question in marketing — which efforts actually drive conversions and revenue. Fills a real gap: attribution was scattered across analytics (UTM setup), ads (platform pixels), revops (pipeline), and ai-seo (the AI blind spot), but no skill owned the *models* or the *reconciliation problem*. Two pillars. **(A) Interpretation** — the six attribution models and when each lies; MTA vs. MMM vs. incrementality and how to choose; self-reported attribution; reconciling the platform-vs-GA-vs-CRM-vs-survey disagreement (never sum across platforms; pick one source of truth; read directional trends); and the direct / branded-search / dark-social / AI blind spots. **(B) Own your attribution (first-party)** — a build runbook for instrumenting attribution yourself when you control the site/app: the identity graph, closing the `identify()` gap (adapted from Tessa Kriesel's PostHog approach), stitching conversions on third-party domains you don't own (SavvyCal/Calendly/Stripe) via metadata passthrough + webhook identity-merge, fail-closed anonymity guards, and first-touch data-quality cleanup — distilled from real production builds (Conversion Factory + Truelist). Four references (`attribution-models.md`, `measurement-paradigms.md`, `by-business-type.md` with B2B/DTC playbooks, `first-party-tracking.md`) and 7 evals covering reconciliation, model choice, the third-party stitch, ROAS incrementality, the direct/branded blind spot, the analytics boundary, and the DTC measurement stack. Pillar B also folds in **production feedback from Tessa Kriesel** (credited): the CRM last mile (sync a `source` field with confidence + basis and a paid-vs-non-paid read onto the account → revops), storing the full ordered touch path so the build track can run Pillar A's multi-touch models on real data, the "expect ~zero until the cross-subdomain stitch is verified in prod" window with a narrowly-scoped campaign-window fallback + pre-stitch backfill, and account-level rollup (excluding free-mail domains) for B2B.
**analytics** (2.0.0 → 2.0.1): description now hands off attribution modeling and reconciliation to the new attribution skill, keeping analytics scoped to tracking setup, event taxonomy, and UTMs.

• Impact: 🟡 review (code touched)
• Commit mix: 1 chore · 2 feat · 5 other
• Files touched: code=0 docs=10 ci=0 test=0 other=4
• 8 new commit(s) since last check
• Latest: 7868cb9 — chore: sync skills with marketplace.json, plugin.json, and README
• Recent commits:
• 804c512 [feat] feat(attribution): new skill — models, reconciliation, and first-party attribution (2.10.0) (#473)
• 789ef02 [feat] feat(attribution): Tessa Kriesel production feedback → first-party runbook (1.1.0, part of 2.10.0) (#483)
• 3c51add [other] release(2.9.1): pricing-page teardown with AI-agent-readiness axis (#487)
• 2c13acc [other] Merge pull request #492 from coreyhaines31/hotfix/487-pricing-2.9.1
• fc2f33b [other] sync: main -> development after 2.9.1 pricing release

ui-ux-pro-max

• New release: v2.14.1 (was v2.11.2)
• Release notes:

## [2.14.1](https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/compare/v2.14.0...v2.14.1) (2026-08-06)

• Impact: 🟡 review (code touched)
• Commit mix: 3 feat · 4 fix
• Files touched: code=4 docs=3 ci=1 test=0 other=48
• 7 new commit(s) since last check
• Latest: abb7f2f — fix: bump skill.json version to 2.13.0 (#438)
• Recent commits:
• 4857a2c [fix] fix(cli): sync shadcn test asset (#433)
• ec1f2a9 [fix] fix(design-system): resolve palette and anti-patterns against the style's mode (#428) (#434)
• b0ebb17 [fix] fix(copilot): generate .prompt.md file for VS Code Copilot slash commands (#328)
• 14ddef5 [feat] feat(gallery): add Style Detail Modal with phone UI controls preview (#155)
• 4d140cf [feat] feat(cli): add --global flag to uipro update and support --ai universal target (#435, #436) (#437)

superpowers

• Impact: 🟢 skim (docs/ci/test only)
• Commit mix: 1 docs
• Files touched: code=0 docs=1 ci=0 test=0 other=0
• 1 new commit(s) since last check
• Latest: 44c9b2d — docs: remove the "We're Hiring" section from the README
• Recent commits:
• 44c9b2d [docs] docs: remove the "We're Hiring" section from the README

anthropic-skills

• Impact: 🟢 skim (docs/ci/test only)
• Commit mix: 1 other
• Files touched: code=0 docs=18 ci=0 test=0 other=0
• 1 new commit(s) since last check
• Latest: f17010c — Update claude-api skill: Managed Agents August launch wave (#1532)
• Recent commits:
• f17010c [other] Update claude-api skill: Managed Agents August launch wave (#1532)

knowledge-work-plugins

• Impact: 🟡 review (code touched)
• Commit mix: 166 other
• Files touched: code=0 docs=0 ci=0 test=0 other=4
• 166 new commit(s) since last check
• Latest: 2002f63 — bump(fastly-agent-toolkit): 9e537250 → d5a80622 (#885)
• Recent commits:
• d10c2c9 [other] bump(wix): 87c6b285 → 6f402cef (#709)
• 7f1ce6b [other] bump(wix): 6f402cef → dd567862 (#710)
• 372e3b2 [other] bump(langfuse): 13a79944 → 93d82827 (#713)
• 9d92c5e [other] bump(wix): dd567862 → 9e3b2d55 (#711)
• 37820dc [other] bump(carta-cap-table): 0ee76454 → 35c25847 (#712)

n8n-mcp

• New release: v2.69.0 (was v2.66.1)
• Release notes:

# Release v2.69.0

Generating release notes from v2.68.4 to HEAD
### 📝 Other Changes

- Merge commit from fork (5e3c425)

---

**Release Statistics:**
- 1 commit
- 1 contributor
- Contributors: Romuald Członkowski

---

## Installation

### NPM Package
```bash

• Impact: 🟡 review (code touched)
• Commit mix: 2 chore · 4 docs · 2 feat · 5 fix · 1 other
• Files touched: code=39 docs=16 ci=4 test=31 other=13
• 14 new commit(s) since last check
• Latest: 5e3c425 — Merge commit from fork
• Recent commits:
• b14f3c1 [docs] docs: sync skills pack v1.26.0 — canvas groups (nodeGroups) (#951)
• 1d15fc2 [fix] fix: AI-tool validation follow-ups from the 2.31.3 update review (#953–#956) (#962)
• 268f577 [fix] fix: bracket-index path updates and fabricated community node types (#950, #949) (#964)
• 3293e61 [feat] feat: add run and cancel actions to n8n_evaluations (#936) (#963)
• 8265427 [docs] docs: sync skills pack to n8n-skills v1.27.0 (evaluations run/cancel) (#966)

skillspector

• New release: v2.9.3 (was none)
• Release notes:

# SkillSpector v2.9.3

Released: 2026-08-11

## Summary

This patch makes malformed structured LLM responses non-fatal during analysis. Affected analysis work is now recorded as skipped so reports clearly show degraded, incomplete results while preserving the remaining analysis output.

## Highlights

- Improve resilience to malformed structured responses from LLM-backed analyzers without masking the affected analysis outcome.

## Added

- None.

## Changed

- Analysis ledger and analyzer status handling consistently represent malformed structured-response batches as skipped and degraded rather than failed.

• Impact: 🟡 review (code touched)
• Commit mix: 7 chore · 1 docs · 3 feat · 11 fix · 5 other · 1 test
• Files touched: code=50 docs=20 ci=3 test=51 other=11
• 28 new commit(s) since last check
• Latest: 12bd99f — Detect whitespace padding used to hide prompt-injection instructions (P9) (chore: upstream dependency sync 2026-05-25 #24)
• Recent commits:
• 34f6030 [feat] feat: publish 2.5.0 execution accounting (#308)
• da5cb13 [feat] feat(llm): make analyzer fan-out concurrency configurable via env (#305)
• 3f11bfa [other] release: publish OSS snapshot 2.5.1 (#320)
• e48fc1a [fix] fix(input-handler): bound URL, zip, and git ingest paths (#164)
• 1df69ad [fix] fix(analyzer): reduce instructional-prose false positives in static scans (#103) (#232)

transitions

• Impact: 🟡 review (code touched)
• Commit mix: 2 feat · 6 fix
• Files touched: code=0 docs=0 ci=0 test=0 other=11
• 8 new commit(s) since last check
• Latest: aeaac1a — feat(auth): sign-in code entry on activate page + sign-in modal
• Recent commits:
• 0ec87b1 [fix] fix: sidebar edge fade, footer alignment, and mobile layout issues
• 1eea31f [feat] feat(pro): add gooey plus menu, drag & drop physics, spinner→check morph
• 9ab8174 [fix] fix(pro): drag no longer opens the detail page; use the stack's middle photo
• c10106d [fix] fix(pro): make the gooey merge readable in dark mode; woman photo for drag & drop
• 67d5c67 [fix] fix(pro): restore smoky dissolve + image open tilt to their original photo

claude-mem

• New release: v13.15.0 (was v13.12.4)
• Release notes:

## 7-day Pro trial in the installer

The npx installer can now start a free week of CMEM Pro end to end:

- **Trial funnel in `npx claude-mem install`** — pitch → email entry → magic-link → Stripe checkout, with the installer polling the pairing API and finishing setup automatically once the trial starts (#3524)
- **Device-code approval** — the terminal shows a short code (XXXX-XXXX) that you confirm in the browser before credentials are delivered, closing a pairing-secret disclosure vector (#3524)
- **Live model pricing** — the installer now fetches model pricing from the API instead of shipping hardcoded numbers (#3515)

Requires the cmem.ai backend released today (trial routes + `cli_pairings` device-authorization grant).

• Impact: 🟡 review (code touched)
• Commit mix: 4 chore · 4 docs · 3 feat · 2 fix · 1 other
• Files touched: code=12 docs=6 ci=0 test=7 other=20
• 14 new commit(s) since last check
• Latest: d768ba3 — docs: update changelog for v13.15.0
• Recent commits:
• a90066f [fix] fix(chroma): prevent concurrent write storms (#3462)
• dd68d21 [feat] feat(observations): add "sensitive" type with Telegram notification (#3468)
• ce92132 [chore] chore: bump version to 13.13.0
• b368aba [docs] docs: update changelog for v13.13.0
• 9326fae [feat] feat: add custom mode creator skill (#3487)

caveman

• New release: v2.0.0 (was v1.9.1)
• Release notes:

**Caveman 2 — the engine ships.** v1 shrank the model's mouth (output). v2 adds the ears: a real compression engine that squeezes what the model *reads* — tool outputs, logs, code, JSON — before it ever hits the model. One line in front of any LLM app. Free, local, BYOK.

**The skill is untouched and still MIT.** Nothing about your `/caveman` install changed.

Real run: a 40-record JSON went `16,098 → 1,091 tokens` (93% smaller), byte-safe, fully recoverable via CCR. Savings are **inferred** — measured on your machine, not projected, not "verified."

**Licensing:** MIT for the skill, CLI, SDKs, kit, evals, contracts, catalog, and extension shell. BSL-1.1 for the engine/proxy/mcp/shrink/cavemem-core/platform — self-host your own traffic (incl. production) free; only reselling Caveman-as-a-service needs a commercial license. Sunsets to Apache-2.0 in ~4 years.

**Ships now:** engine, proxy, CLI, SDKs (as the packages resolve). **Coming soon:** browser extension. Install commands and pip/npm/docker badges go live when the packages publish.

Want to help? New content-type compressors are the highest-leverage contribution — check `good first issue`.

• Impact: 🟡 review (code touched)
• Commit mix: 3 chore · 1 ci · 6 docs · 2 feat · 5 fix · 3 other
• Files touched: code=0 docs=40 ci=8 test=72 other=180
• 20 new commit(s) since last check
• Latest: a010997 — docs: move skill usage into skill section, restore v1.10.0 benchmark
• Recent commits:
• 710173f [fix] fix(skill): negation safety, tool-call silence, language-drift hardening
• 7693a04 [fix] fix(hooks): shared parser, envelope unwrap, resume-safe SessionStart
• d833f4a [feat] feat(stats): surface net savings, not just gross (#145, #677)
• dcd51f1 [fix] fix(compress): stop Windows data loss — UTF-8 + atomic writes (#652, #655, #686)
• ed1fbb7 [fix] fix(install): rename bin/ to cli/, harden Windows quoting, clean uninstall

playwright-mcp

• New release: v0.0.79 (was v0.0.78)
• Release notes:

## What's New

### Tool Improvements

- **`browser_take_screenshot` — WebP format** — New `type` option to pick the image format (`png`, `jpeg` or `webp`); when unset, the format is inferred from the filename extension ([#41152](https://github.com/microsoft/playwright/pull/41152))
- **`--codegen` — more languages** — Code generation now supports `python`, `java` and `csharp` in addition to `typescript` ([#42106](https://github.com/microsoft/playwright/pull/42106))
- **Configurable settle delay** — New `--timeout-settle` flag (and `timeouts.settle` config option) to control how long to wait after each action for triggered work (navigations, requests) to settle, defaults to 500ms ([#41924](https://github.com/microsoft/playwright/pull/41924))

## Fixes

- Aria snapshot capture is skipped when the response discards it ([#41923](https://github.com/microsoft/playwright/pull/41923))
- New `--snapshot-boxes` flag (and `snapshot.boxes` config option) to enable bounding boxes in snapshots globally — previously this was only available per command ([#42102](https://github.com/microsoft/playwright/pull/42102))
- Reconnect to the browser after a disconnect ([#41966](https://github.com/microsoft/playwright/pull/41966))
- Report malformed JSON config instead of silently falling back to INI parsing ([#41909](https://github.com/microsoft/playwright/pull/41909))
- Clear the dialog modal state when a dialog is closed out of band ([#42032](https://github.com/microsoft/playwright/pull/42032))
- Detect downloads via the download event instead of guessing from `net::ERR_ABORTED` navigation errors ([#41933](https://github.com/microsoft/playwright/pull/41933))
- Surface the missing executable path when a browser isn't installed ([#41941](https://github.com/microsoft/playwright/pull/41941))
- Escape user input in codegen output ([#41962](https://github.com/microsoft/playwright/pull/41962))
- Removed the stale `--output-mode` CLI option ([#41833](https://github.com/microsoft/playwright/pull/41833))

• Impact: 🟡 review (code touched)
• Commit mix: 6 chore · 1 other
• Files touched: code=0 docs=1 ci=0 test=0 other=5
• 7 new commit(s) since last check
• Latest: 7e0457a — devops: add ESRP pipeline for publishing npm alpha versions (#1709)
• Recent commits:
• 30710c8 [chore] chore(deps-dev): bump fast-uri from 3.1.2 to 3.1.4 (#1692)
• 42e792a [chore] chore(deps-dev): bump hono from 4.12.26 to 4.12.31 (#1687)
• f2db2c2 [chore] chore(deps-dev): bump ip-address from 10.2.0 to 10.4.0 (#1703)
• 8414d57 [chore] chore(deps): bump @hono/node-server and @modelcontextprotocol/sdk (#1702)
• 4ed35bf [chore] chore: roll Playwright to 1.63.0-alpha-2026-08-05 (#1706)

Updated by the upstream tracker workflow.

[github-actions]

New upstream changes detected (2026-08-13)

social-media-skills

• Impact: 🟡 review (code touched)
• Commit mix: 3 other
• Files touched: code=0 docs=1 ci=0 test=0 other=1
• 3 new commit(s) since last check
• Latest: 69d9488 — Correct follower count to 415k+ and skill count to 17
• Recent commits:
• b232b9b [other] Add exposure-audit skill (18 skills, v1.1.0)
• 43d6fc4 [other] Revert "Add exposure-audit skill (18 skills, v1.1.0)"
• 69d9488 [other] Correct follower count to 415k+ and skill count to 17

context7

• New release: @upstash/context7-mcp@4.0.2 (was @upstash/context7-mcp@3.2.5)
• Release notes:

### Patch Changes

- 67528f2: Add a 60s `AbortSignal.timeout()` to both Context7 API calls in `lib/api.ts`. Without a signal a stalled backend call rides undici's ~300s default before failing. 60s is generous: these are vector queries with p99.9 ~3.2s, and no request exceeded 30s across a full day of production traffic.
- c68104e: Disable SSE keepalive heartbeats on the HTTP handler (`keepAliveMs: 0`). Every tool is a millisecond vector query, so no legitimate exchange needs a heartbeat — but a hung exchange kept alive by heartbeats can never be reaped by a proxy's stream idle timeout. One such hang is deterministic: a 2025-era JSON-RPC batch carrying a request plus its own `notifications/cancelled` gets no response for the cancelled request (per spec), the SDK transport then never closes the stream, and heartbeats kept it alive until the gateway's 1200s hard cap — the dominant source of leaked upstream connections in the 2026-08-11 mcp.context7.com outage. With heartbeats off, silent hangs go idle and the proxy reaps them at its idle timeout.

• Impact: 🟡 review (code touched)
• Commit mix: 4 chore · 7 docs · 2 feat · 2 fix · 4 other
• Files touched: code=25 docs=41 ci=0 test=7 other=8
• 19 new commit(s) since last check
• Latest: ca15df0 — docs: correct non-root image version floor to 1.3.2 (#3014)
• Recent commits:
• 6c343ae [docs] docs(enterprise): changelog for v1.2.4 through v1.3.0 (#2953)
• 80f9d6c [docs] docs(enterprise): add library access control page (#2928)
• b89a04e [fix] fix(cli): write the API key as an Authorization header (#2957)
• 38422b1 [chore] chore(release): version packages (#2960)
• 6153deb [docs] docs(enterprise): document external Postgres with the embedded vector index (#2954)

lightrag

• New release: v1.5.6 (was v1.5.5rc1)
• Release notes:

## Important Notes

Introducing **PGTableGraphStorage**, a new graph storage backend built on native PostgreSQL tables. By eliminating the dependency on Apache AGE, it not only simplifies deployment but also delivers significantly higher graph storage performance with reduced storage footprint. It will replace the AGE-based `PGGraphStorage` as the preferred graph storage solution for PostgreSQL. This makes **PostgreSQL** the go-to **all-in-one backend database** for LightRAG, enabling a single database to cover all four storage types.

## What's New

* feat(kg): add PGTableGraphStorage — PostgreSQL-native graph backend (no AGE dependency) by @ysys143 in https://github.com/HKUDS/LightRAG/pull/3103
* docs(pipeline): rewrite the dedup and concurrency chapters from a user's view by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3583

## What's Changed

* Implement fail-closed recovery proof for whole-document purge by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3535
* docs: fix broken links and correct VLM gating semantics by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3539
* docs: extract parser service deployment runbooks by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3540
* docs: restructure FileProcessingPipeline into a usable guide by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3541
* docs: fix documentation typos, grammar errors, and incorrect warning messages by @Rythamo8055 in https://github.com/HKUDS/LightRAG/pull/3538
* feat(utils): bound thread-pool submission and pin the tokenizer contract by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3543
* fix(deps): sync uv.lock with the tiktoken floor and correct the restore rationale by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3546
* fix(api): bound request bodies and take token counting off the event loop by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3544
* fix(pipeline): take chunking off the event loop and bound the separator cascade by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3547

• Impact: 🟡 review (code touched)
• Commit mix: 1 build · 2 chore · 2 ci · 12 docs · 2 feat · 109 fix · 98 other · 5 perf · 4 refactor · 1 revert · 1 style · 13 test
• Files touched: code=0 docs=30 ci=12 test=148 other=110
• 597 new commit(s) since last check
• Latest: 71f7b23 — Merge pull request #3633 from qianheng-aws/fix/tolerant-doc-status-rehydration
• Recent commits:
• 673ec78 [other] Merge pull request #3554 from santhreal/fix/utils-get-env-value-padded-bool
• 704ff3b [other] Merge pull request #3558 from santhreal/fix-networkx-get-kg-is-truncated
• 4088df3 [other] Merge pull request #3553 from santhreal/fix/utils-cosine-similarity-nonfinite
• 4bf6cdb [fix] fix(kg): report is_truncated correctly in mongo/neo4j/opensearch BFS fallbacks
• 20ac1b7 [other] Merge pull request #3564 from HKUDS/fix-graph-storage-is-truncated-followups

vercel-agent-skills

• Impact: 🟢 skim (docs/ci/test only)
• Commit mix: 3 other
• Files touched: code=0 docs=3 ci=0 test=0 other=0
• 3 new commit(s) since last check
• Latest: b8caa26 — Merge pull request #318 from vercel-labs/codex/update-view-transitions-skill
• Recent commits:
• 9542f4e [other] Document prefetched route transitions
• 3798a79 [other] Scope content readiness guidance
• b8caa26 [other] Merge pull request #318 from vercel-labs/codex/update-view-transitions-skill

everything-claude-code

• New release: v2.1.0 (was v2.0.0)
• Release notes:

# ECC 2.1.0: Plan Canvas, Kimi Harness, and Self-Hosted Compute

ECC 2.1 turns plan review into a visual loop and opens the harness to self-hosted models. Plan Canvas lets you review agent plans in the browser. Point at the part you mean instead of retyping it in chat. A new Kimi Code install target and a verified Itô GPU path make ECC + open-source models a first-class setup, backed by our public sponsors: Moonshot AI (Kimi), Itô, and Atlas Cloud.

## Plan Canvas: review plans by pointing, not retyping

![Plan Canvas demo: reviewing an ECC plan, attaching an annotation, chatting with the agent, and approving the plan](https://raw.githubusercontent.com/affaan-m/ECC/main/docs/releases/2.1.0/assets/ecc-plan-canvas-demo.gif)

[Download the MP4 demo](https://raw.githubusercontent.com/affaan-m/ECC/main/docs/releases/2.1.0/assets/ecc-plan-canvas-demo.mp4)

`/plan` ends with a confirm gate, and until now that review was a wall of markdown in the terminal. Now the agent opens the plan in a loopback-only browser canvas:

- Click elements or select text to attach numbered annotations
- Chat with the agent from a side rail while it works in the terminal
- **Approve plan** / **Request changes** buttons map directly onto `/plan`'s CONFIRM gate
- Mermaid diagrams, tables, and task lists render natively; file edits live-reload the page
- Model- and harness-agnostic: a plain CLI + JSON protocol (`ecc-plan-canvas`), no Claude-only dependency

## Kimi harness: Moonshot AI partnership

• Impact: 🟡 review (code touched)
• Commit mix: 10 chore · 1 ci · 8 docs · 10 feat · 38 fix · 9 other · 2 test
• Files touched: code=0 docs=179 ci=15 test=0 other=106
• 78 new commit(s) since last check
• Latest: eb49702 — feat: thin Pi adapter mounting ECC's canonical skills and commands (#2759)
• Recent commits:
• b06c78c [docs] docs: add 2.1.0 release notes and Plan Canvas demo assets
• 1ffaa75 [fix] fix(release): match the ECC banner name when bumping versions
• 4099794 [fix] fix(release): bump the claude marketplace and zh-CN heading on macOS
• 6f452d4 [chore] chore: bump plugin version to 2.1.0
• edaf6fe [fix] fix(release): drop the dead OMP adapter verification step

marketing-skills

• New release: v2.10.0 (was v2.9.0)
• Release notes:

**attribution** (new, 1.1.0): a dedicated skill for the hardest question in marketing — which efforts actually drive conversions and revenue. Fills a real gap: attribution was scattered across analytics (UTM setup), ads (platform pixels), revops (pipeline), and ai-seo (the AI blind spot), but no skill owned the *models* or the *reconciliation problem*. Two pillars. **(A) Interpretation** — the six attribution models and when each lies; MTA vs. MMM vs. incrementality and how to choose; self-reported attribution; reconciling the platform-vs-GA-vs-CRM-vs-survey disagreement (never sum across platforms; pick one source of truth; read directional trends); and the direct / branded-search / dark-social / AI blind spots. **(B) Own your attribution (first-party)** — a build runbook for instrumenting attribution yourself when you control the site/app: the identity graph, closing the `identify()` gap (adapted from Tessa Kriesel's PostHog approach), stitching conversions on third-party domains you don't own (SavvyCal/Calendly/Stripe) via metadata passthrough + webhook identity-merge, fail-closed anonymity guards, and first-touch data-quality cleanup — distilled from real production builds (Conversion Factory + Truelist). Four references (`attribution-models.md`, `measurement-paradigms.md`, `by-business-type.md` with B2B/DTC playbooks, `first-party-tracking.md`) and 7 evals covering reconciliation, model choice, the third-party stitch, ROAS incrementality, the direct/branded blind spot, the analytics boundary, and the DTC measurement stack. Pillar B also folds in **production feedback from Tessa Kriesel** (credited): the CRM last mile (sync a `source` field with confidence + basis and a paid-vs-non-paid read onto the account → revops), storing the full ordered touch path so the build track can run Pillar A's multi-touch models on real data, the "expect ~zero until the cross-subdomain stitch is verified in prod" window with a narrowly-scoped campaign-window fallback + pre-stitch backfill, and account-level rollup (excluding free-mail domains) for B2B.
**analytics** (2.0.0 → 2.0.1): description now hands off attribution modeling and reconciliation to the new attribution skill, keeping analytics scoped to tracking setup, event taxonomy, and UTMs.

• Impact: 🟡 review (code touched)
• Commit mix: 1 chore · 2 feat · 5 other
• Files touched: code=0 docs=10 ci=0 test=0 other=4
• 8 new commit(s) since last check
• Latest: 7868cb9 — chore: sync skills with marketplace.json, plugin.json, and README
• Recent commits:
• 804c512 [feat] feat(attribution): new skill — models, reconciliation, and first-party attribution (2.10.0) (#473)
• 789ef02 [feat] feat(attribution): Tessa Kriesel production feedback → first-party runbook (1.1.0, part of 2.10.0) (#483)
• 3c51add [other] release(2.9.1): pricing-page teardown with AI-agent-readiness axis (#487)
• 2c13acc [other] Merge pull request #492 from coreyhaines31/hotfix/487-pricing-2.9.1
• fc2f33b [other] sync: main -> development after 2.9.1 pricing release

ui-ux-pro-max

• New release: v2.14.2 (was v2.11.2)
• Release notes:

## [2.14.2](https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/compare/v2.14.1...v2.14.2) (2026-08-12)

• Impact: 🟡 review (code touched)
• Commit mix: 2 docs · 3 feat · 5 fix
• Files touched: code=5 docs=6 ci=2 test=1 other=48
• 10 new commit(s) since last check
• Latest: 97eb2a2 — docs: clarify asset sync workflow (#443)
• Recent commits:
• 4857a2c [fix] fix(cli): sync shadcn test asset (#433)
• ec1f2a9 [fix] fix(design-system): resolve palette and anti-patterns against the style's mode (#428) (#434)
• b0ebb17 [fix] fix(copilot): generate .prompt.md file for VS Code Copilot slash commands (#328)
• 14ddef5 [feat] feat(gallery): add Style Detail Modal with phone UI controls preview (#155)
• 4d140cf [feat] feat(cli): add --global flag to uipro update and support --ai universal target (#435, #436) (#437)

superpowers

• New release: v6.3.0 (was v6.2.0)
• Release notes:

### Harness Support

- **Devin CLI**: `devin plugins install obra/superpowers` now works, and skills auto-trigger at session start. (#1995)
- **Hermes Agent**: install from a git clone; skills register with Hermes' native loader and the bootstrap loads on the first turn. (#1922, #2025)
- **Grok Build CLI** added to the install docs. (#1919)

### Brainstorming

- **Ceremony now scales to the task.** Requests are classified as spike, bounded, or architectural; small tasks skip the two-document ritual. Every path still stops for your approval before implementation. (#2063)

### Subagent-Driven Development

- **Controllers no longer stall on plan conflicts.** Non-catastrophic conflicts and ambiguities get a recorded ruling and work continues; only destructive or irreversible actions still stop for a human. One donated session had sat blocked for almost nine hours on a question the controller could have decided. (#2077)
- **The pre-dispatch conflict scan records its checks in the ledger** instead of just asserting the plan is clean. (#2080)
- **Small same-shape tasks batch into one dispatch**, cutting subagent cost sharply on micro-task plans; batch reviews verify every file in the brief made it into the diff. (#2078)
- **Implementers and reviewers may not spawn their own subagents**, which was producing duplicate reviews. (#2059)
- **Plans carry a `Spec:` pointer** and SDD reads the spec at setup, so plan conflicts get resolved against the design instead of guessed at. (#2086)
- Reviewers re-read evidence they find illegible instead of re-running the test suite (#2089), and circuit-breaker rulings now show up in the Finish report.

• Impact: 🟡 review (code touched)
• Commit mix: 1 docs · 1 other
• Files touched: code=0 docs=18 ci=1 test=7 other=14
• 2 new commit(s) since last check
• Latest: b36e082 — Release v6.3.0: Devin CLI and Hermes Agent support, brainstorming three-path router, SDD/Codex efficiency fixes (#2125)
• Recent commits:
• 44c9b2d [docs] docs: remove the "We're Hiring" section from the README
• b36e082 [other] Release v6.3.0: Devin CLI and Hermes Agent support, brainstorming three-path router, SDD/Codex efficiency fixes (#2125)

anthropic-skills

• Impact: 🟢 skim (docs/ci/test only)
• Commit mix: 1 other
• Files touched: code=0 docs=18 ci=0 test=0 other=0
• 1 new commit(s) since last check
• Latest: f17010c — Update claude-api skill: Managed Agents August launch wave (#1532)
• Recent commits:
• f17010c [other] Update claude-api skill: Managed Agents August launch wave (#1532)

knowledge-work-plugins

• Impact: 🟡 review (code touched)
• Commit mix: 182 other
• Files touched: code=0 docs=0 ci=0 test=0 other=4
• 182 new commit(s) since last check
• Latest: e1f73c1 — bump(carta-investors): 791f5afc → f29d4c77 (#900)
• Recent commits:
• d10c2c9 [other] bump(wix): 87c6b285 → 6f402cef (#709)
• 7f1ce6b [other] bump(wix): 6f402cef → dd567862 (#710)
• 372e3b2 [other] bump(langfuse): 13a79944 → 93d82827 (#713)
• 9d92c5e [other] bump(wix): dd567862 → 9e3b2d55 (#711)
• 37820dc [other] bump(carta-cap-table): 0ee76454 → 35c25847 (#712)

n8n-mcp

• New release: v2.69.0 (was v2.66.1)
• Release notes:

# Release v2.69.0

Generating release notes from v2.68.4 to HEAD
### 📝 Other Changes

- Merge commit from fork (5e3c425)

---

**Release Statistics:**
- 1 commit
- 1 contributor
- Contributors: Romuald Członkowski

---

## Installation

### NPM Package
```bash

• Impact: 🟡 review (code touched)
• Commit mix: 2 chore · 4 docs · 2 feat · 5 fix · 1 other
• Files touched: code=39 docs=16 ci=4 test=31 other=13
• 14 new commit(s) since last check
• Latest: 5e3c425 — Merge commit from fork
• Recent commits:
• b14f3c1 [docs] docs: sync skills pack v1.26.0 — canvas groups (nodeGroups) (#951)
• 1d15fc2 [fix] fix: AI-tool validation follow-ups from the 2.31.3 update review (#953–#956) (#962)
• 268f577 [fix] fix: bracket-index path updates and fabricated community node types (#950, #949) (#964)
• 3293e61 [feat] feat: add run and cancel actions to n8n_evaluations (#936) (#963)
• 8265427 [docs] docs: sync skills pack to n8n-skills v1.27.0 (evaluations run/cancel) (#966)

skillspector

• New release: v2.9.4 (was none)
• Release notes:

# SkillSpector v2.9.4

Released: 2026-08-12

## Summary

This patch strengthens SkillSpector’s safe handling of MCP requests and untrusted skill content, while adding broader prompt-injection and supply-chain detection coverage. It also improves permission guidance, ships a companion Skill Inspector guide, and refreshes project documentation.

## Highlights

- HTTP-exposed MCP servers now reject caller-controlled local scan targets and local YARA-rule directories while preserving local scanning for trusted stdio use.
- Detect whitespace-padding prompt-injection attempts and shipped Python bytecode, with improved minimum risk scoring for high-impact findings.

## Added

- Add detection for whitespace padding used to hide prompt-injection instructions.
- Add a HIGH SC8 finding when a skill ships Python bytecode or `__pycache__` content.
- Add the Skill Inspector companion skill guide.

## Changed

• Impact: 🟡 review (code touched)
• Commit mix: 8 chore · 1 docs · 3 feat · 13 fix · 7 other · 1 test
• Files touched: code=52 docs=23 ci=3 test=54 other=11
• 33 new commit(s) since last check
• Latest: 2d198ab — release: SkillSpector 2.9.4 (#369)
• Recent commits:
• 34f6030 [feat] feat: publish 2.5.0 execution accounting (#308)
• da5cb13 [feat] feat(llm): make analyzer fan-out concurrency configurable via env (#305)
• 3f11bfa [other] release: publish OSS snapshot 2.5.1 (#320)
• e48fc1a [fix] fix(input-handler): bound URL, zip, and git ingest paths (#164)
• 1df69ad [fix] fix(analyzer): reduce instructional-prose false positives in static scans (#103) (#232)

transitions

• Impact: 🟡 review (code touched)
• Commit mix: 2 feat · 8 fix · 1 perf
• Files touched: code=0 docs=0 ci=0 test=0 other=11
• 11 new commit(s) since last check
• Latest: b512578 — perf(pro): mask-free organic shimmer, tighter gooey filter region
• Recent commits:
• 0ec87b1 [fix] fix: sidebar edge fade, footer alignment, and mobile layout issues
• 1eea31f [feat] feat(pro): add gooey plus menu, drag & drop physics, spinner→check morph
• 9ab8174 [fix] fix(pro): drag no longer opens the detail page; use the stack's middle photo
• c10106d [fix] fix(pro): make the gooey merge readable in dark mode; woman photo for drag & drop
• 67d5c67 [fix] fix(pro): restore smoky dissolve + image open tilt to their original photo

claude-mem

• New release: v13.15.0 (was v13.12.4)
• Release notes:

## 7-day Pro trial in the installer

The npx installer can now start a free week of CMEM Pro end to end:

- **Trial funnel in `npx claude-mem install`** — pitch → email entry → magic-link → Stripe checkout, with the installer polling the pairing API and finishing setup automatically once the trial starts (#3524)
- **Device-code approval** — the terminal shows a short code (XXXX-XXXX) that you confirm in the browser before credentials are delivered, closing a pairing-secret disclosure vector (#3524)
- **Live model pricing** — the installer now fetches model pricing from the API instead of shipping hardcoded numbers (#3515)

Requires the cmem.ai backend released today (trial routes + `cli_pairings` device-authorization grant).

• Impact: 🟡 review (code touched)
• Commit mix: 4 chore · 4 docs · 3 feat · 2 fix · 1 other
• Files touched: code=12 docs=6 ci=0 test=7 other=20
• 14 new commit(s) since last check
• Latest: d768ba3 — docs: update changelog for v13.15.0
• Recent commits:
• a90066f [fix] fix(chroma): prevent concurrent write storms (#3462)
• dd68d21 [feat] feat(observations): add "sensitive" type with Telegram notification (#3468)
• ce92132 [chore] chore: bump version to 13.13.0
• b368aba [docs] docs: update changelog for v13.13.0
• 9326fae [feat] feat: add custom mode creator skill (#3487)

caveman

• New release: v2.0.0 (was v1.9.1)
• Release notes:

**Caveman 2 — the engine ships.** v1 shrank the model's mouth (output). v2 adds the ears: a real compression engine that squeezes what the model *reads* — tool outputs, logs, code, JSON — before it ever hits the model. One line in front of any LLM app. Free, local, BYOK.

**The skill is untouched and still MIT.** Nothing about your `/caveman` install changed.

Real run: a 40-record JSON went `16,098 → 1,091 tokens` (93% smaller), byte-safe, fully recoverable via CCR. Savings are **inferred** — measured on your machine, not projected, not "verified."

**Licensing:** MIT for the skill, CLI, SDKs, kit, evals, contracts, catalog, and extension shell. BSL-1.1 for the engine/proxy/mcp/shrink/cavemem-core/platform — self-host your own traffic (incl. production) free; only reselling Caveman-as-a-service needs a commercial license. Sunsets to Apache-2.0 in ~4 years.

**Ships now:** engine, proxy, CLI, SDKs (as the packages resolve). **Coming soon:** browser extension. Install commands and pip/npm/docker badges go live when the packages publish.

Want to help? New content-type compressors are the highest-leverage contribution — check `good first issue`.

• Impact: 🟡 review (code touched)
• Commit mix: 6 chore · 1 ci · 8 docs · 3 feat · 9 fix · 4 other · 2 test
• Files touched: code=0 docs=40 ci=8 test=72 other=180
• 33 new commit(s) since last check
• Latest: 613d7f0 — Merge origin/main into main
• Recent commits:
• 710173f [fix] fix(skill): negation safety, tool-call silence, language-drift hardening
• 7693a04 [fix] fix(hooks): shared parser, envelope unwrap, resume-safe SessionStart
• d833f4a [feat] feat(stats): surface net savings, not just gross (#145, #677)
• dcd51f1 [fix] fix(compress): stop Windows data loss — UTF-8 + atomic writes (#652, #655, #686)
• ed1fbb7 [fix] fix(install): rename bin/ to cli/, harden Windows quoting, clean uninstall

playwright-mcp

• New release: v0.0.79 (was v0.0.78)
• Release notes:

## What's New

### Tool Improvements

- **`browser_take_screenshot` — WebP format** — New `type` option to pick the image format (`png`, `jpeg` or `webp`); when unset, the format is inferred from the filename extension ([#41152](https://github.com/microsoft/playwright/pull/41152))
- **`--codegen` — more languages** — Code generation now supports `python`, `java` and `csharp` in addition to `typescript` ([#42106](https://github.com/microsoft/playwright/pull/42106))
- **Configurable settle delay** — New `--timeout-settle` flag (and `timeouts.settle` config option) to control how long to wait after each action for triggered work (navigations, requests) to settle, defaults to 500ms ([#41924](https://github.com/microsoft/playwright/pull/41924))

## Fixes

- Aria snapshot capture is skipped when the response discards it ([#41923](https://github.com/microsoft/playwright/pull/41923))
- New `--snapshot-boxes` flag (and `snapshot.boxes` config option) to enable bounding boxes in snapshots globally — previously this was only available per command ([#42102](https://github.com/microsoft/playwright/pull/42102))
- Reconnect to the browser after a disconnect ([#41966](https://github.com/microsoft/playwright/pull/41966))
- Report malformed JSON config instead of silently falling back to INI parsing ([#41909](https://github.com/microsoft/playwright/pull/41909))
- Clear the dialog modal state when a dialog is closed out of band ([#42032](https://github.com/microsoft/playwright/pull/42032))
- Detect downloads via the download event instead of guessing from `net::ERR_ABORTED` navigation errors ([#41933](https://github.com/microsoft/playwright/pull/41933))
- Surface the missing executable path when a browser isn't installed ([#41941](https://github.com/microsoft/playwright/pull/41941))
- Escape user input in codegen output ([#41962](https://github.com/microsoft/playwright/pull/41962))
- Removed the stale `--output-mode` CLI option ([#41833](https://github.com/microsoft/playwright/pull/41833))

• Impact: 🟡 review (code touched)
• Commit mix: 6 chore · 1 other
• Files touched: code=0 docs=1 ci=0 test=0 other=5
• 7 new commit(s) since last check
• Latest: 7e0457a — devops: add ESRP pipeline for publishing npm alpha versions (#1709)
• Recent commits:
• 30710c8 [chore] chore(deps-dev): bump fast-uri from 3.1.2 to 3.1.4 (#1692)
• 42e792a [chore] chore(deps-dev): bump hono from 4.12.26 to 4.12.31 (#1687)
• f2db2c2 [chore] chore(deps-dev): bump ip-address from 10.2.0 to 10.4.0 (#1703)
• 8414d57 [chore] chore(deps): bump @hono/node-server and @modelcontextprotocol/sdk (#1702)
• 4ed35bf [chore] chore: roll Playwright to 1.63.0-alpha-2026-08-05 (#1706)

Updated by the upstream tracker workflow.

[github-actions]

New upstream changes detected (2026-08-14)

social-media-skills

• Impact: 🟡 review (code touched)
• Commit mix: 3 other
• Files touched: code=0 docs=1 ci=0 test=0 other=1
• 3 new commit(s) since last check
• Latest: 69d9488 — Correct follower count to 415k+ and skill count to 17
• Recent commits:
• b232b9b [other] Add exposure-audit skill (18 skills, v1.1.0)
• 43d6fc4 [other] Revert "Add exposure-audit skill (18 skills, v1.1.0)"
• 69d9488 [other] Correct follower count to 415k+ and skill count to 17

context7

• New release: @upstash/context7-mcp@4.0.2 (was @upstash/context7-mcp@3.2.5)
• Release notes:

### Patch Changes

- 67528f2: Add a 60s `AbortSignal.timeout()` to both Context7 API calls in `lib/api.ts`. Without a signal a stalled backend call rides undici's ~300s default before failing. 60s is generous: these are vector queries with p99.9 ~3.2s, and no request exceeded 30s across a full day of production traffic.
- c68104e: Disable SSE keepalive heartbeats on the HTTP handler (`keepAliveMs: 0`). Every tool is a millisecond vector query, so no legitimate exchange needs a heartbeat — but a hung exchange kept alive by heartbeats can never be reaped by a proxy's stream idle timeout. One such hang is deterministic: a 2025-era JSON-RPC batch carrying a request plus its own `notifications/cancelled` gets no response for the cancelled request (per spec), the SDK transport then never closes the stream, and heartbeats kept it alive until the gateway's 1200s hard cap — the dominant source of leaked upstream connections in the 2026-08-11 mcp.context7.com outage. With heartbeats off, silent hangs go idle and the proxy reaps them at its idle timeout.

• Impact: 🟡 review (code touched)
• Commit mix: 4 chore · 2 ci · 7 docs · 2 feat · 2 fix · 4 other
• Files touched: code=26 docs=41 ci=2 test=8 other=8
• 21 new commit(s) since last check
• Latest: 7274d72 — ci: use OIDC for Bedrock tests (#3031)
• Recent commits:
• 6c343ae [docs] docs(enterprise): changelog for v1.2.4 through v1.3.0 (#2953)
• 80f9d6c [docs] docs(enterprise): add library access control page (#2928)
• b89a04e [fix] fix(cli): write the API key as an Authorization header (#2957)
• 38422b1 [chore] chore(release): version packages (#2960)
• 6153deb [docs] docs(enterprise): document external Postgres with the embedded vector index (#2954)

lightrag

• New release: v1.5.6 (was v1.5.5rc1)
• Release notes:

## Important Notes

Introducing **PGTableGraphStorage**, a new graph storage backend built on native PostgreSQL tables. By eliminating the dependency on Apache AGE, it not only simplifies deployment but also delivers significantly higher graph storage performance with reduced storage footprint. It will replace the AGE-based `PGGraphStorage` as the preferred graph storage solution for PostgreSQL. This makes **PostgreSQL** the go-to **all-in-one backend database** for LightRAG, enabling a single database to cover all four storage types.

## What's New

* feat(kg): add PGTableGraphStorage — PostgreSQL-native graph backend (no AGE dependency) by @ysys143 in https://github.com/HKUDS/LightRAG/pull/3103
* docs(pipeline): rewrite the dedup and concurrency chapters from a user's view by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3583

## What's Changed

* Implement fail-closed recovery proof for whole-document purge by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3535
* docs: fix broken links and correct VLM gating semantics by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3539
* docs: extract parser service deployment runbooks by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3540
* docs: restructure FileProcessingPipeline into a usable guide by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3541
* docs: fix documentation typos, grammar errors, and incorrect warning messages by @Rythamo8055 in https://github.com/HKUDS/LightRAG/pull/3538
* feat(utils): bound thread-pool submission and pin the tokenizer contract by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3543
* fix(deps): sync uv.lock with the tiktoken floor and correct the restore rationale by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3546
* fix(api): bound request bodies and take token counting off the event loop by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3544
* fix(pipeline): take chunking off the event loop and bound the separator cascade by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3547

• Impact: 🟡 review (code touched)
• Commit mix: 6 build · 2 chore · 2 ci · 11 docs · 1 feat · 104 fix · 99 other · 5 perf · 4 refactor · 1 revert · 1 style · 14 test
• Files touched: code=0 docs=30 ci=12 test=147 other=111
• 615 new commit(s) since last check
• Latest: 3cb207c — ♻️ refactor(vite): use import.meta.dirname for paths
• Recent commits:
• 58d33d9 [other] Merge pull request #3555 from santhreal/fix/milvus-escape-filter-string-literals
• a5c22c0 [fix] fix(graph): normalize manually managed entity names
• 8699826 [fix] fix(graph): normalize custom KG entity names
• 6ef94bf [fix] fix(graph): normalize entity merge names
• 455f0fd [other] Merge pull request #3566 from danielaskdd/fix/manual-entity-name-normalization

vercel-agent-skills

• Impact: 🟢 skim (docs/ci/test only)
• Commit mix: 3 other
• Files touched: code=0 docs=3 ci=0 test=0 other=0
• 3 new commit(s) since last check
• Latest: b8caa26 — Merge pull request #318 from vercel-labs/codex/update-view-transitions-skill
• Recent commits:
• 9542f4e [other] Document prefetched route transitions
• 3798a79 [other] Scope content readiness guidance
• b8caa26 [other] Merge pull request #318 from vercel-labs/codex/update-view-transitions-skill

everything-claude-code

• New release: v2.1.0 (was v2.0.0)
• Release notes:

# ECC 2.1.0: Plan Canvas, Kimi Harness, and Self-Hosted Compute

ECC 2.1 turns plan review into a visual loop and opens the harness to self-hosted models. Plan Canvas lets you review agent plans in the browser. Point at the part you mean instead of retyping it in chat. A new Kimi Code install target and a verified Itô GPU path make ECC + open-source models a first-class setup, backed by our public sponsors: Moonshot AI (Kimi), Itô, and Atlas Cloud.

## Plan Canvas: review plans by pointing, not retyping

![Plan Canvas demo: reviewing an ECC plan, attaching an annotation, chatting with the agent, and approving the plan](https://raw.githubusercontent.com/affaan-m/ECC/main/docs/releases/2.1.0/assets/ecc-plan-canvas-demo.gif)

[Download the MP4 demo](https://raw.githubusercontent.com/affaan-m/ECC/main/docs/releases/2.1.0/assets/ecc-plan-canvas-demo.mp4)

`/plan` ends with a confirm gate, and until now that review was a wall of markdown in the terminal. Now the agent opens the plan in a loopback-only browser canvas:

- Click elements or select text to attach numbered annotations
- Chat with the agent from a side rail while it works in the terminal
- **Approve plan** / **Request changes** buttons map directly onto `/plan`'s CONFIRM gate
- Mermaid diagrams, tables, and task lists render natively; file edits live-reload the page
- Model- and harness-agnostic: a plain CLI + JSON protocol (`ecc-plan-canvas`), no Claude-only dependency

## Kimi harness: Moonshot AI partnership

• Impact: 🟡 review (code touched)
• Commit mix: 10 chore · 1 ci · 8 docs · 10 feat · 49 fix · 10 other · 3 test
• Files touched: code=0 docs=170 ci=15 test=0 other=115
• 91 new commit(s) since last check
• Latest: c9de8f5 — Merge pull request #2784 from affaan-m/fix/installer-hotfix-2.2
• Recent commits:
• b06c78c [docs] docs: add 2.1.0 release notes and Plan Canvas demo assets
• 1ffaa75 [fix] fix(release): match the ECC banner name when bumping versions
• 4099794 [fix] fix(release): bump the claude marketplace and zh-CN heading on macOS
• 6f452d4 [chore] chore: bump plugin version to 2.1.0
• edaf6fe [fix] fix(release): drop the dead OMP adapter verification step

marketing-skills

• New release: v2.10.0 (was v2.9.0)
• Release notes:

**attribution** (new, 1.1.0): a dedicated skill for the hardest question in marketing — which efforts actually drive conversions and revenue. Fills a real gap: attribution was scattered across analytics (UTM setup), ads (platform pixels), revops (pipeline), and ai-seo (the AI blind spot), but no skill owned the *models* or the *reconciliation problem*. Two pillars. **(A) Interpretation** — the six attribution models and when each lies; MTA vs. MMM vs. incrementality and how to choose; self-reported attribution; reconciling the platform-vs-GA-vs-CRM-vs-survey disagreement (never sum across platforms; pick one source of truth; read directional trends); and the direct / branded-search / dark-social / AI blind spots. **(B) Own your attribution (first-party)** — a build runbook for instrumenting attribution yourself when you control the site/app: the identity graph, closing the `identify()` gap (adapted from Tessa Kriesel's PostHog approach), stitching conversions on third-party domains you don't own (SavvyCal/Calendly/Stripe) via metadata passthrough + webhook identity-merge, fail-closed anonymity guards, and first-touch data-quality cleanup — distilled from real production builds (Conversion Factory + Truelist). Four references (`attribution-models.md`, `measurement-paradigms.md`, `by-business-type.md` with B2B/DTC playbooks, `first-party-tracking.md`) and 7 evals covering reconciliation, model choice, the third-party stitch, ROAS incrementality, the direct/branded blind spot, the analytics boundary, and the DTC measurement stack. Pillar B also folds in **production feedback from Tessa Kriesel** (credited): the CRM last mile (sync a `source` field with confidence + basis and a paid-vs-non-paid read onto the account → revops), storing the full ordered touch path so the build track can run Pillar A's multi-touch models on real data, the "expect ~zero until the cross-subdomain stitch is verified in prod" window with a narrowly-scoped campaign-window fallback + pre-stitch backfill, and account-level rollup (excluding free-mail domains) for B2B.
**analytics** (2.0.0 → 2.0.1): description now hands off attribution modeling and reconciliation to the new attribution skill, keeping analytics scoped to tracking setup, event taxonomy, and UTMs.

• Impact: 🟡 review (code touched)
• Commit mix: 1 chore · 2 feat · 5 other
• Files touched: code=0 docs=10 ci=0 test=0 other=4
• 8 new commit(s) since last check
• Latest: 7868cb9 — chore: sync skills with marketplace.json, plugin.json, and README
• Recent commits:
• 804c512 [feat] feat(attribution): new skill — models, reconciliation, and first-party attribution (2.10.0) (#473)
• 789ef02 [feat] feat(attribution): Tessa Kriesel production feedback → first-party runbook (1.1.0, part of 2.10.0) (#483)
• 3c51add [other] release(2.9.1): pricing-page teardown with AI-agent-readiness axis (#487)
• 2c13acc [other] Merge pull request #492 from coreyhaines31/hotfix/487-pricing-2.9.1
• fc2f33b [other] sync: main -> development after 2.9.1 pricing release

ui-ux-pro-max

• New release: v2.15.0 (was v2.11.2)
• Release notes:

## UI UX Pro Max v2.15.0

This release is a broad search, data-quality, and agent-guidance upgrade. It keeps the existing CLI/install contract while improving how agents retrieve, reason about, and apply UI/UX guidance.

### Search and reasoning

- Reworked BM25 routing, query rewriting, abstention, typo recovery, suggestions, and cache safety.
- Added a 90-case graded relevance corpus covering 12 domains, 22 stacks, hard negatives, routing, and design-system coherence.
- Added deterministic current-versus-legacy framework routing so old-version queries return labeled legacy guidance or abstain instead of mixing generations.
- Strengthened exact style, landing-pattern, palette, and product-reasoning identity resolution.
- Completed exact reasoning coverage for all 192 product types and made generated source identities traceable.

### Curated UI/UX data

- Refreshed the style taxonomy: 79 searchable styles, including 50 active and 29 supplemental styles; 9 legacy entries remain deprecated and redirect to supported replacements.
- Expanded the catalog to 119 UX guidelines and 1,260 stack-specific guidelines across 22 stacks.
- Updated accessibility guidance for contrast roles, focus indicators, icons, charts, error summaries, reduced motion, loading states, and interaction feedback.
- Added resilient text-layout guidance for heading balance, long tokens, reflow, text scaling, essential text, chips, tags, badges, live counts, and cancellable micro-interactions.
- Refreshed current and legacy guidance for React, Next.js, Vue, Nuxt, Nuxt UI, Svelte, Astro, Tailwind CSS, shadcn/ui, Flutter, React Native, SwiftUI, Three.js, Laravel, JavaFX, WPF, WinUI, UWP, Avalonia, and Uno Platform.

• Impact: 🟡 review (code touched)
• Commit mix: 2 docs · 4 feat · 5 fix
• Files touched: code=70 docs=15 ci=7 test=5 other=205
• 11 new commit(s) since last check
• Latest: a38d04c — feat(search): overhaul relevance and curated design data
• Recent commits:
• 4857a2c [fix] fix(cli): sync shadcn test asset (#433)
• ec1f2a9 [fix] fix(design-system): resolve palette and anti-patterns against the style's mode (#428) (#434)
• b0ebb17 [fix] fix(copilot): generate .prompt.md file for VS Code Copilot slash commands (#328)
• 14ddef5 [feat] feat(gallery): add Style Detail Modal with phone UI controls preview (#155)
• 4d140cf [feat] feat(cli): add --global flag to uipro update and support --ai universal target (#435, #436) (#437)

superpowers

• New release: v6.3.0 (was v6.2.0)
• Release notes:

### Harness Support

- **Devin CLI**: `devin plugins install obra/superpowers` now works, and skills auto-trigger at session start. (#1995)
- **Hermes Agent**: install from a git clone; skills register with Hermes' native loader and the bootstrap loads on the first turn. (#1922, #2025)
- **Grok Build CLI** added to the install docs. (#1919)

### Brainstorming

- **Ceremony now scales to the task.** Requests are classified as spike, bounded, or architectural; small tasks skip the two-document ritual. Every path still stops for your approval before implementation. (#2063)

### Subagent-Driven Development

- **Controllers no longer stall on plan conflicts.** Non-catastrophic conflicts and ambiguities get a recorded ruling and work continues; only destructive or irreversible actions still stop for a human. One donated session had sat blocked for almost nine hours on a question the controller could have decided. (#2077)
- **The pre-dispatch conflict scan records its checks in the ledger** instead of just asserting the plan is clean. (#2080)
- **Small same-shape tasks batch into one dispatch**, cutting subagent cost sharply on micro-task plans; batch reviews verify every file in the brief made it into the diff. (#2078)
- **Implementers and reviewers may not spawn their own subagents**, which was producing duplicate reviews. (#2059)
- **Plans carry a `Spec:` pointer** and SDD reads the spec at setup, so plan conflicts get resolved against the design instead of guessed at. (#2086)
- Reviewers re-read evidence they find illegible instead of re-running the test suite (#2089), and circuit-breaker rulings now show up in the Finish report.

• Impact: 🟡 review (code touched)
• Commit mix: 1 docs · 1 other
• Files touched: code=0 docs=18 ci=1 test=7 other=14
• 2 new commit(s) since last check
• Latest: b36e082 — Release v6.3.0: Devin CLI and Hermes Agent support, brainstorming three-path router, SDD/Codex efficiency fixes (#2125)
• Recent commits:
• 44c9b2d [docs] docs: remove the "We're Hiring" section from the README
• b36e082 [other] Release v6.3.0: Devin CLI and Hermes Agent support, brainstorming three-path router, SDD/Codex efficiency fixes (#2125)

anthropic-skills

• Impact: 🟢 skim (docs/ci/test only)
• Commit mix: 2 other
• Files touched: code=0 docs=20 ci=0 test=0 other=0
• 2 new commit(s) since last check
• Latest: f6656c1 — Update claude-api skill: prompt-audit subcommand (#1557)
• Recent commits:
• f17010c [other] Update claude-api skill: Managed Agents August launch wave (#1532)
• f6656c1 [other] Update claude-api skill: prompt-audit subcommand (#1557)

knowledge-work-plugins

• Impact: 🟡 review (code touched)
• Commit mix: 193 other
• Files touched: code=0 docs=0 ci=0 test=0 other=4
• 193 new commit(s) since last check
• Latest: ba3b765 — bump(twilio-developer-kit): d7b0f231 → 8aba46fb (#913)
• Recent commits:
• d10c2c9 [other] bump(wix): 87c6b285 → 6f402cef (#709)
• 7f1ce6b [other] bump(wix): 6f402cef → dd567862 (#710)
• 372e3b2 [other] bump(langfuse): 13a79944 → 93d82827 (#713)
• 9d92c5e [other] bump(wix): dd567862 → 9e3b2d55 (#711)
• 37820dc [other] bump(carta-cap-table): 0ee76454 → 35c25847 (#712)

n8n-mcp

• New release: v2.69.0 (was v2.66.1)
• Release notes:

# Release v2.69.0

Generating release notes from v2.68.4 to HEAD
### 📝 Other Changes

- Merge commit from fork (5e3c425)

---

**Release Statistics:**
- 1 commit
- 1 contributor
- Contributors: Romuald Członkowski

---

## Installation

### NPM Package
```bash

• Impact: 🟡 review (code touched)
• Commit mix: 2 chore · 4 docs · 2 feat · 5 fix · 1 other
• Files touched: code=39 docs=16 ci=4 test=31 other=13
• 14 new commit(s) since last check
• Latest: 5e3c425 — Merge commit from fork
• Recent commits:
• b14f3c1 [docs] docs: sync skills pack v1.26.0 — canvas groups (nodeGroups) (#951)
• 1d15fc2 [fix] fix: AI-tool validation follow-ups from the 2.31.3 update review (#953–#956) (#962)
• 268f577 [fix] fix: bracket-index path updates and fabricated community node types (#950, #949) (#964)
• 3293e61 [feat] feat: add run and cancel actions to n8n_evaluations (#936) (#963)
• 8265427 [docs] docs: sync skills pack to n8n-skills v1.27.0 (evaluations run/cancel) (#966)

skillspector

• New release: v2.9.4 (was none)
• Release notes:

# SkillSpector v2.9.4

Released: 2026-08-12

## Summary

This patch strengthens SkillSpector’s safe handling of MCP requests and untrusted skill content, while adding broader prompt-injection and supply-chain detection coverage. It also improves permission guidance, ships a companion Skill Inspector guide, and refreshes project documentation.

## Highlights

- HTTP-exposed MCP servers now reject caller-controlled local scan targets and local YARA-rule directories while preserving local scanning for trusted stdio use.
- Detect whitespace-padding prompt-injection attempts and shipped Python bytecode, with improved minimum risk scoring for high-impact findings.

## Added

- Add detection for whitespace padding used to hide prompt-injection instructions.
- Add a HIGH SC8 finding when a skill ships Python bytecode or `__pycache__` content.
- Add the Skill Inspector companion skill guide.

## Changed

• Impact: 🟡 review (code touched)
• Commit mix: 8 chore · 1 docs · 3 feat · 13 fix · 7 other · 1 test
• Files touched: code=52 docs=23 ci=3 test=54 other=11
• 33 new commit(s) since last check
• Latest: 2d198ab — release: SkillSpector 2.9.4 (#369)
• Recent commits:
• 34f6030 [feat] feat: publish 2.5.0 execution accounting (#308)
• da5cb13 [feat] feat(llm): make analyzer fan-out concurrency configurable via env (#305)
• 3f11bfa [other] release: publish OSS snapshot 2.5.1 (#320)
• e48fc1a [fix] fix(input-handler): bound URL, zip, and git ingest paths (#164)
• 1df69ad [fix] fix(analyzer): reduce instructional-prose false positives in static scans (#103) (#232)

transitions

• Impact: 🟡 review (code touched)
• Commit mix: 2 feat · 8 fix · 1 perf
• Files touched: code=0 docs=0 ci=0 test=0 other=11
• 11 new commit(s) since last check
• Latest: b512578 — perf(pro): mask-free organic shimmer, tighter gooey filter region
• Recent commits:
• 0ec87b1 [fix] fix: sidebar edge fade, footer alignment, and mobile layout issues
• 1eea31f [feat] feat(pro): add gooey plus menu, drag & drop physics, spinner→check morph
• 9ab8174 [fix] fix(pro): drag no longer opens the detail page; use the stack's middle photo
• c10106d [fix] fix(pro): make the gooey merge readable in dark mode; woman photo for drag & drop
• 67d5c67 [fix] fix(pro): restore smoky dissolve + image open tilt to their original photo

claude-mem

• New release: v13.15.0 (was v13.12.4)
• Release notes:

## 7-day Pro trial in the installer

The npx installer can now start a free week of CMEM Pro end to end:

- **Trial funnel in `npx claude-mem install`** — pitch → email entry → magic-link → Stripe checkout, with the installer polling the pairing API and finishing setup automatically once the trial starts (#3524)
- **Device-code approval** — the terminal shows a short code (XXXX-XXXX) that you confirm in the browser before credentials are delivered, closing a pairing-secret disclosure vector (#3524)
- **Live model pricing** — the installer now fetches model pricing from the API instead of shipping hardcoded numbers (#3515)

Requires the cmem.ai backend released today (trial routes + `cli_pairings` device-authorization grant).

• Impact: 🟡 review (code touched)
• Commit mix: 4 chore · 4 docs · 3 feat · 2 fix · 1 other
• Files touched: code=12 docs=6 ci=0 test=7 other=20
• 14 new commit(s) since last check
• Latest: d768ba3 — docs: update changelog for v13.15.0
• Recent commits:
• a90066f [fix] fix(chroma): prevent concurrent write storms (#3462)
• dd68d21 [feat] feat(observations): add "sensitive" type with Telegram notification (#3468)
• ce92132 [chore] chore: bump version to 13.13.0
• b368aba [docs] docs: update changelog for v13.13.0
• 9326fae [feat] feat: add custom mode creator skill (#3487)

caveman

• New release: v2.0.0 (was v1.9.1)
• Release notes:

**Caveman 2 — the engine ships.** v1 shrank the model's mouth (output). v2 adds the ears: a real compression engine that squeezes what the model *reads* — tool outputs, logs, code, JSON — before it ever hits the model. One line in front of any LLM app. Free, local, BYOK.

**The skill is untouched and still MIT.** Nothing about your `/caveman` install changed.

Real run: a 40-record JSON went `16,098 → 1,091 tokens` (93% smaller), byte-safe, fully recoverable via CCR. Savings are **inferred** — measured on your machine, not projected, not "verified."

**Licensing:** MIT for the skill, CLI, SDKs, kit, evals, contracts, catalog, and extension shell. BSL-1.1 for the engine/proxy/mcp/shrink/cavemem-core/platform — self-host your own traffic (incl. production) free; only reselling Caveman-as-a-service needs a commercial license. Sunsets to Apache-2.0 in ~4 years.

**Ships now:** engine, proxy, CLI, SDKs (as the packages resolve). **Coming soon:** browser extension. Install commands and pip/npm/docker badges go live when the packages publish.

Want to help? New content-type compressors are the highest-leverage contribution — check `good first issue`.

• Impact: 🟡 review (code touched)
• Commit mix: 6 chore · 1 ci · 8 docs · 3 feat · 10 fix · 4 other · 2 test
• Files touched: code=0 docs=40 ci=8 test=73 other=179
• 34 new commit(s) since last check
• Latest: c72984e — fix(windows): harden hooks and BSL docs
• Recent commits:
• 710173f [fix] fix(skill): negation safety, tool-call silence, language-drift hardening
• 7693a04 [fix] fix(hooks): shared parser, envelope unwrap, resume-safe SessionStart
• d833f4a [feat] feat(stats): surface net savings, not just gross (#145, #677)
• dcd51f1 [fix] fix(compress): stop Windows data loss — UTF-8 + atomic writes (#652, #655, #686)
• ed1fbb7 [fix] fix(install): rename bin/ to cli/, harden Windows quoting, clean uninstall

playwright-mcp

• New release: v0.0.79 (was v0.0.78)
• Release notes:

## What's New

### Tool Improvements

- **`browser_take_screenshot` — WebP format** — New `type` option to pick the image format (`png`, `jpeg` or `webp`); when unset, the format is inferred from the filename extension ([#41152](https://github.com/microsoft/playwright/pull/41152))
- **`--codegen` — more languages** — Code generation now supports `python`, `java` and `csharp` in addition to `typescript` ([#42106](https://github.com/microsoft/playwright/pull/42106))
- **Configurable settle delay** — New `--timeout-settle` flag (and `timeouts.settle` config option) to control how long to wait after each action for triggered work (navigations, requests) to settle, defaults to 500ms ([#41924](https://github.com/microsoft/playwright/pull/41924))

## Fixes

- Aria snapshot capture is skipped when the response discards it ([#41923](https://github.com/microsoft/playwright/pull/41923))
- New `--snapshot-boxes` flag (and `snapshot.boxes` config option) to enable bounding boxes in snapshots globally — previously this was only available per command ([#42102](https://github.com/microsoft/playwright/pull/42102))
- Reconnect to the browser after a disconnect ([#41966](https://github.com/microsoft/playwright/pull/41966))
- Report malformed JSON config instead of silently falling back to INI parsing ([#41909](https://github.com/microsoft/playwright/pull/41909))
- Clear the dialog modal state when a dialog is closed out of band ([#42032](https://github.com/microsoft/playwright/pull/42032))
- Detect downloads via the download event instead of guessing from `net::ERR_ABORTED` navigation errors ([#41933](https://github.com/microsoft/playwright/pull/41933))
- Surface the missing executable path when a browser isn't installed ([#41941](https://github.com/microsoft/playwright/pull/41941))
- Escape user input in codegen output ([#41962](https://github.com/microsoft/playwright/pull/41962))
- Removed the stale `--output-mode` CLI option ([#41833](https://github.com/microsoft/playwright/pull/41833))

• Impact: 🟡 review (code touched)
• Commit mix: 6 chore · 1 other
• Files touched: code=0 docs=1 ci=0 test=0 other=5
• 7 new commit(s) since last check
• Latest: 7e0457a — devops: add ESRP pipeline for publishing npm alpha versions (#1709)
• Recent commits:
• 30710c8 [chore] chore(deps-dev): bump fast-uri from 3.1.2 to 3.1.4 (#1692)
• 42e792a [chore] chore(deps-dev): bump hono from 4.12.26 to 4.12.31 (#1687)
• f2db2c2 [chore] chore(deps-dev): bump ip-address from 10.2.0 to 10.4.0 (#1703)
• 8414d57 [chore] chore(deps): bump @hono/node-server and @modelcontextprotocol/sdk (#1702)
• 4ed35bf [chore] chore: roll Playwright to 1.63.0-alpha-2026-08-05 (#1706)

Updated by the upstream tracker workflow.

[github-actions]

New upstream changes detected (2026-08-15)

social-media-skills

• Impact: 🟡 review (code touched)
• Commit mix: 3 other
• Files touched: code=0 docs=1 ci=0 test=0 other=1
• 3 new commit(s) since last check
• Latest: 69d9488 — Correct follower count to 415k+ and skill count to 17
• Recent commits:
• b232b9b [other] Add exposure-audit skill (18 skills, v1.1.0)
• 43d6fc4 [other] Revert "Add exposure-audit skill (18 skills, v1.1.0)"
• 69d9488 [other] Correct follower count to 415k+ and skill count to 17

context7

• New release: @upstash/context7-mcp@4.0.2 (was @upstash/context7-mcp@3.2.5)
• Release notes:

### Patch Changes

- 67528f2: Add a 60s `AbortSignal.timeout()` to both Context7 API calls in `lib/api.ts`. Without a signal a stalled backend call rides undici's ~300s default before failing. 60s is generous: these are vector queries with p99.9 ~3.2s, and no request exceeded 30s across a full day of production traffic.
- c68104e: Disable SSE keepalive heartbeats on the HTTP handler (`keepAliveMs: 0`). Every tool is a millisecond vector query, so no legitimate exchange needs a heartbeat — but a hung exchange kept alive by heartbeats can never be reaped by a proxy's stream idle timeout. One such hang is deterministic: a 2025-era JSON-RPC batch carrying a request plus its own `notifications/cancelled` gets no response for the cancelled request (per spec), the SDK transport then never closes the stream, and heartbeats kept it alive until the gateway's 1200s hard cap — the dominant source of leaked upstream connections in the 2026-08-11 mcp.context7.com outage. With heartbeats off, silent hangs go idle and the proxy reaps them at its idle timeout.

• Impact: 🟡 review (code touched)
• Commit mix: 4 chore · 2 ci · 8 docs · 2 feat · 2 fix · 5 other
• Files touched: code=26 docs=46 ci=2 test=8 other=8
• 23 new commit(s) since last check
• Latest: 0e3298e — docs: add Gerrit integration guide (#3035)
• Recent commits:
• 6c343ae [docs] docs(enterprise): changelog for v1.2.4 through v1.3.0 (#2953)
• 80f9d6c [docs] docs(enterprise): add library access control page (#2928)
• b89a04e [fix] fix(cli): write the API key as an Authorization header (#2957)
• 38422b1 [chore] chore(release): version packages (#2960)
• 6153deb [docs] docs(enterprise): document external Postgres with the embedded vector index (#2954)

lightrag

• New release: v1.5.6 (was v1.5.5rc1)
• Release notes:

## Important Notes

Introducing **PGTableGraphStorage**, a new graph storage backend built on native PostgreSQL tables. By eliminating the dependency on Apache AGE, it not only simplifies deployment but also delivers significantly higher graph storage performance with reduced storage footprint. It will replace the AGE-based `PGGraphStorage` as the preferred graph storage solution for PostgreSQL. This makes **PostgreSQL** the go-to **all-in-one backend database** for LightRAG, enabling a single database to cover all four storage types.

## What's New

* feat(kg): add PGTableGraphStorage — PostgreSQL-native graph backend (no AGE dependency) by @ysys143 in https://github.com/HKUDS/LightRAG/pull/3103
* docs(pipeline): rewrite the dedup and concurrency chapters from a user's view by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3583

## What's Changed

* Implement fail-closed recovery proof for whole-document purge by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3535
* docs: fix broken links and correct VLM gating semantics by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3539
* docs: extract parser service deployment runbooks by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3540
* docs: restructure FileProcessingPipeline into a usable guide by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3541
* docs: fix documentation typos, grammar errors, and incorrect warning messages by @Rythamo8055 in https://github.com/HKUDS/LightRAG/pull/3538
* feat(utils): bound thread-pool submission and pin the tokenizer contract by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3543
* fix(deps): sync uv.lock with the tiktoken floor and correct the restore rationale by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3546
* fix(api): bound request bodies and take token counting off the event loop by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3544
* fix(pipeline): take chunking off the event loop and bound the separator cascade by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3547

• Impact: 🟡 review (code touched)
• Commit mix: 6 build · 1 chore · 1 ci · 15 docs · 4 feat · 108 fix · 87 other · 3 perf · 9 refactor · 1 revert · 1 style · 14 test
• Files touched: code=0 docs=31 ci=12 test=144 other=113
• 660 new commit(s) since last check
• Latest: 12e35cb — Merge pull request #3632 from pengpengyi92/agent/preserve-duplicate-source-files
• Recent commits:
• fa59a18 [other] 📝 docs(env.example): clarify parser routing examples
• e0c4059 [other] Bump API version to 0328
• ca98a0e [fix] fix(parser): shorten SVG rasterizer startup warning message
• fd256a2 [fix] fix(docs): require sudo for Linux libcairo install, list per-platform commands in splash warning
• bd36f0f [fix] fix(rerank): validate results at query boundary

vercel-agent-skills

• Impact: 🟢 skim (docs/ci/test only)
• Commit mix: 3 other
• Files touched: code=0 docs=3 ci=0 test=0 other=0
• 3 new commit(s) since last check
• Latest: b8caa26 — Merge pull request #318 from vercel-labs/codex/update-view-transitions-skill
• Recent commits:
• 9542f4e [other] Document prefetched route transitions
• 3798a79 [other] Scope content readiness guidance
• b8caa26 [other] Merge pull request #318 from vercel-labs/codex/update-view-transitions-skill

everything-claude-code

• New release: v2.1.0 (was v2.0.0)
• Release notes:

# ECC 2.1.0: Plan Canvas, Kimi Harness, and Self-Hosted Compute

ECC 2.1 turns plan review into a visual loop and opens the harness to self-hosted models. Plan Canvas lets you review agent plans in the browser. Point at the part you mean instead of retyping it in chat. A new Kimi Code install target and a verified Itô GPU path make ECC + open-source models a first-class setup, backed by our public sponsors: Moonshot AI (Kimi), Itô, and Atlas Cloud.

## Plan Canvas: review plans by pointing, not retyping

![Plan Canvas demo: reviewing an ECC plan, attaching an annotation, chatting with the agent, and approving the plan](https://raw.githubusercontent.com/affaan-m/ECC/main/docs/releases/2.1.0/assets/ecc-plan-canvas-demo.gif)

[Download the MP4 demo](https://raw.githubusercontent.com/affaan-m/ECC/main/docs/releases/2.1.0/assets/ecc-plan-canvas-demo.mp4)

`/plan` ends with a confirm gate, and until now that review was a wall of markdown in the terminal. Now the agent opens the plan in a loopback-only browser canvas:

- Click elements or select text to attach numbered annotations
- Chat with the agent from a side rail while it works in the terminal
- **Approve plan** / **Request changes** buttons map directly onto `/plan`'s CONFIRM gate
- Mermaid diagrams, tables, and task lists render natively; file edits live-reload the page
- Model- and harness-agnostic: a plain CLI + JSON protocol (`ecc-plan-canvas`), no Claude-only dependency

## Kimi harness: Moonshot AI partnership

• Impact: 🟡 review (code touched)
• Commit mix: 10 chore · 1 ci · 8 docs · 10 feat · 49 fix · 10 other · 3 test
• Files touched: code=0 docs=170 ci=15 test=0 other=115
• 91 new commit(s) since last check
• Latest: c9de8f5 — Merge pull request #2784 from affaan-m/fix/installer-hotfix-2.2
• Recent commits:
• b06c78c [docs] docs: add 2.1.0 release notes and Plan Canvas demo assets
• 1ffaa75 [fix] fix(release): match the ECC banner name when bumping versions
• 4099794 [fix] fix(release): bump the claude marketplace and zh-CN heading on macOS
• 6f452d4 [chore] chore: bump plugin version to 2.1.0
• edaf6fe [fix] fix(release): drop the dead OMP adapter verification step

marketing-skills

• New release: v2.10.0 (was v2.9.0)
• Release notes:

**attribution** (new, 1.1.0): a dedicated skill for the hardest question in marketing — which efforts actually drive conversions and revenue. Fills a real gap: attribution was scattered across analytics (UTM setup), ads (platform pixels), revops (pipeline), and ai-seo (the AI blind spot), but no skill owned the *models* or the *reconciliation problem*. Two pillars. **(A) Interpretation** — the six attribution models and when each lies; MTA vs. MMM vs. incrementality and how to choose; self-reported attribution; reconciling the platform-vs-GA-vs-CRM-vs-survey disagreement (never sum across platforms; pick one source of truth; read directional trends); and the direct / branded-search / dark-social / AI blind spots. **(B) Own your attribution (first-party)** — a build runbook for instrumenting attribution yourself when you control the site/app: the identity graph, closing the `identify()` gap (adapted from Tessa Kriesel's PostHog approach), stitching conversions on third-party domains you don't own (SavvyCal/Calendly/Stripe) via metadata passthrough + webhook identity-merge, fail-closed anonymity guards, and first-touch data-quality cleanup — distilled from real production builds (Conversion Factory + Truelist). Four references (`attribution-models.md`, `measurement-paradigms.md`, `by-business-type.md` with B2B/DTC playbooks, `first-party-tracking.md`) and 7 evals covering reconciliation, model choice, the third-party stitch, ROAS incrementality, the direct/branded blind spot, the analytics boundary, and the DTC measurement stack. Pillar B also folds in **production feedback from Tessa Kriesel** (credited): the CRM last mile (sync a `source` field with confidence + basis and a paid-vs-non-paid read onto the account → revops), storing the full ordered touch path so the build track can run Pillar A's multi-touch models on real data, the "expect ~zero until the cross-subdomain stitch is verified in prod" window with a narrowly-scoped campaign-window fallback + pre-stitch backfill, and account-level rollup (excluding free-mail domains) for B2B.
**analytics** (2.0.0 → 2.0.1): description now hands off attribution modeling and reconciliation to the new attribution skill, keeping analytics scoped to tracking setup, event taxonomy, and UTMs.

• Impact: 🟡 review (code touched)
• Commit mix: 1 chore · 2 feat · 5 other
• Files touched: code=0 docs=10 ci=0 test=0 other=4
• 8 new commit(s) since last check
• Latest: 7868cb9 — chore: sync skills with marketplace.json, plugin.json, and README
• Recent commits:
• 804c512 [feat] feat(attribution): new skill — models, reconciliation, and first-party attribution (2.10.0) (#473)
• 789ef02 [feat] feat(attribution): Tessa Kriesel production feedback → first-party runbook (1.1.0, part of 2.10.0) (#483)
• 3c51add [other] release(2.9.1): pricing-page teardown with AI-agent-readiness axis (#487)
• 2c13acc [other] Merge pull request #492 from coreyhaines31/hotfix/487-pricing-2.9.1
• fc2f33b [other] sync: main -> development after 2.9.1 pricing release

ui-ux-pro-max

• New release: v2.15.0 (was v2.11.2)
• Release notes:

## UI UX Pro Max v2.15.0

This release is a broad search, data-quality, and agent-guidance upgrade. It keeps the existing CLI/install contract while improving how agents retrieve, reason about, and apply UI/UX guidance.

### Search and reasoning

- Reworked BM25 routing, query rewriting, abstention, typo recovery, suggestions, and cache safety.
- Added a 90-case graded relevance corpus covering 12 domains, 22 stacks, hard negatives, routing, and design-system coherence.
- Added deterministic current-versus-legacy framework routing so old-version queries return labeled legacy guidance or abstain instead of mixing generations.
- Strengthened exact style, landing-pattern, palette, and product-reasoning identity resolution.
- Completed exact reasoning coverage for all 192 product types and made generated source identities traceable.

### Curated UI/UX data

- Refreshed the style taxonomy: 79 searchable styles, including 50 active and 29 supplemental styles; 9 legacy entries remain deprecated and redirect to supported replacements.
- Expanded the catalog to 119 UX guidelines and 1,260 stack-specific guidelines across 22 stacks.
- Updated accessibility guidance for contrast roles, focus indicators, icons, charts, error summaries, reduced motion, loading states, and interaction feedback.
- Added resilient text-layout guidance for heading balance, long tokens, reflow, text scaling, essential text, chips, tags, badges, live counts, and cancellable micro-interactions.
- Refreshed current and legacy guidance for React, Next.js, Vue, Nuxt, Nuxt UI, Svelte, Astro, Tailwind CSS, shadcn/ui, Flutter, React Native, SwiftUI, Three.js, Laravel, JavaFX, WPF, WinUI, UWP, Avalonia, and Uno Platform.

• Impact: 🟡 review (code touched)
• Commit mix: 2 docs · 4 feat · 5 fix
• Files touched: code=70 docs=15 ci=7 test=5 other=205
• 11 new commit(s) since last check
• Latest: a38d04c — feat(search): overhaul relevance and curated design data
• Recent commits:
• 4857a2c [fix] fix(cli): sync shadcn test asset (#433)
• ec1f2a9 [fix] fix(design-system): resolve palette and anti-patterns against the style's mode (#428) (#434)
• b0ebb17 [fix] fix(copilot): generate .prompt.md file for VS Code Copilot slash commands (#328)
• 14ddef5 [feat] feat(gallery): add Style Detail Modal with phone UI controls preview (#155)
• 4d140cf [feat] feat(cli): add --global flag to uipro update and support --ai universal target (#435, #436) (#437)

superpowers

• New release: v6.3.0 (was v6.2.0)
• Release notes:

### Harness Support

- **Devin CLI**: `devin plugins install obra/superpowers` now works, and skills auto-trigger at session start. (#1995)
- **Hermes Agent**: install from a git clone; skills register with Hermes' native loader and the bootstrap loads on the first turn. (#1922, #2025)
- **Grok Build CLI** added to the install docs. (#1919)

### Brainstorming

- **Ceremony now scales to the task.** Requests are classified as spike, bounded, or architectural; small tasks skip the two-document ritual. Every path still stops for your approval before implementation. (#2063)

### Subagent-Driven Development

- **Controllers no longer stall on plan conflicts.** Non-catastrophic conflicts and ambiguities get a recorded ruling and work continues; only destructive or irreversible actions still stop for a human. One donated session had sat blocked for almost nine hours on a question the controller could have decided. (#2077)
- **The pre-dispatch conflict scan records its checks in the ledger** instead of just asserting the plan is clean. (#2080)
- **Small same-shape tasks batch into one dispatch**, cutting subagent cost sharply on micro-task plans; batch reviews verify every file in the brief made it into the diff. (#2078)
- **Implementers and reviewers may not spawn their own subagents**, which was producing duplicate reviews. (#2059)
- **Plans carry a `Spec:` pointer** and SDD reads the spec at setup, so plan conflicts get resolved against the design instead of guessed at. (#2086)
- Reviewers re-read evidence they find illegible instead of re-running the test suite (#2089), and circuit-breaker rulings now show up in the Finish report.

• Impact: 🟡 review (code touched)
• Commit mix: 1 docs · 1 other
• Files touched: code=0 docs=18 ci=1 test=7 other=14
• 2 new commit(s) since last check
• Latest: b36e082 — Release v6.3.0: Devin CLI and Hermes Agent support, brainstorming three-path router, SDD/Codex efficiency fixes (#2125)
• Recent commits:
• 44c9b2d [docs] docs: remove the "We're Hiring" section from the README
• b36e082 [other] Release v6.3.0: Devin CLI and Hermes Agent support, brainstorming three-path router, SDD/Codex efficiency fixes (#2125)

anthropic-skills

• Impact: 🟢 skim (docs/ci/test only)
• Commit mix: 2 other
• Files touched: code=0 docs=20 ci=0 test=0 other=0
• 2 new commit(s) since last check
• Latest: f6656c1 — Update claude-api skill: prompt-audit subcommand (#1557)
• Recent commits:
• f17010c [other] Update claude-api skill: Managed Agents August launch wave (#1532)
• f6656c1 [other] Update claude-api skill: prompt-audit subcommand (#1557)

knowledge-work-plugins

• Impact: 🟡 review (code touched)
• Commit mix: 204 other
• Files touched: code=0 docs=0 ci=0 test=0 other=4
• 204 new commit(s) since last check
• Latest: 2374e85 — bump(carta-investors): dd0c286b → e9bb21cb (#927)
• Recent commits:
• d10c2c9 [other] bump(wix): 87c6b285 → 6f402cef (#709)
• 7f1ce6b [other] bump(wix): 6f402cef → dd567862 (#710)
• 372e3b2 [other] bump(langfuse): 13a79944 → 93d82827 (#713)
• 9d92c5e [other] bump(wix): dd567862 → 9e3b2d55 (#711)
• 37820dc [other] bump(carta-cap-table): 0ee76454 → 35c25847 (#712)

n8n-mcp

• New release: v2.69.0 (was v2.66.1)
• Release notes:

# Release v2.69.0

Generating release notes from v2.68.4 to HEAD
### 📝 Other Changes

- Merge commit from fork (5e3c425)

---

**Release Statistics:**
- 1 commit
- 1 contributor
- Contributors: Romuald Członkowski

---

## Installation

### NPM Package
```bash

• Impact: 🟡 review (code touched)
• Commit mix: 2 chore · 4 docs · 2 feat · 5 fix · 1 other
• Files touched: code=39 docs=16 ci=4 test=31 other=13
• 14 new commit(s) since last check
• Latest: 5e3c425 — Merge commit from fork
• Recent commits:
• b14f3c1 [docs] docs: sync skills pack v1.26.0 — canvas groups (nodeGroups) (#951)
• 1d15fc2 [fix] fix: AI-tool validation follow-ups from the 2.31.3 update review (#953–#956) (#962)
• 268f577 [fix] fix: bracket-index path updates and fabricated community node types (#950, #949) (#964)
• 3293e61 [feat] feat: add run and cancel actions to n8n_evaluations (#936) (#963)
• 8265427 [docs] docs: sync skills pack to n8n-skills v1.27.0 (evaluations run/cancel) (#966)

skillspector

• New release: v2.9.4 (was none)
• Release notes:

# SkillSpector v2.9.4

Released: 2026-08-12

## Summary

This patch strengthens SkillSpector’s safe handling of MCP requests and untrusted skill content, while adding broader prompt-injection and supply-chain detection coverage. It also improves permission guidance, ships a companion Skill Inspector guide, and refreshes project documentation.

## Highlights

- HTTP-exposed MCP servers now reject caller-controlled local scan targets and local YARA-rule directories while preserving local scanning for trusted stdio use.
- Detect whitespace-padding prompt-injection attempts and shipped Python bytecode, with improved minimum risk scoring for high-impact findings.

## Added

- Add detection for whitespace padding used to hide prompt-injection instructions.
- Add a HIGH SC8 finding when a skill ships Python bytecode or `__pycache__` content.
- Add the Skill Inspector companion skill guide.

## Changed

• Impact: 🟡 review (code touched)
• Commit mix: 8 chore · 1 docs · 6 feat · 14 fix · 10 other · 1 test
• Files touched: code=63 docs=23 ci=3 test=58 other=11
• 40 new commit(s) since last check
• Latest: 5680c2c — Scope the locality guard to the namespace (#365)
• Recent commits:
• 34f6030 [feat] feat: publish 2.5.0 execution accounting (#308)
• da5cb13 [feat] feat(llm): make analyzer fan-out concurrency configurable via env (#305)
• 3f11bfa [other] release: publish OSS snapshot 2.5.1 (#320)
• e48fc1a [fix] fix(input-handler): bound URL, zip, and git ingest paths (#164)
• 1df69ad [fix] fix(analyzer): reduce instructional-prose false positives in static scans (#103) (#232)

transitions

• Impact: 🟡 review (code touched)
• Commit mix: 3 feat · 8 fix · 1 perf
• Files touched: code=0 docs=0 ci=0 test=0 other=11
• 12 new commit(s) since last check
• Latest: 45d02c7 — feat(pro): pass ?code= from the pricing page into checkout
• Recent commits:
• 0ec87b1 [fix] fix: sidebar edge fade, footer alignment, and mobile layout issues
• 1eea31f [feat] feat(pro): add gooey plus menu, drag & drop physics, spinner→check morph
• 9ab8174 [fix] fix(pro): drag no longer opens the detail page; use the stack's middle photo
• c10106d [fix] fix(pro): make the gooey merge readable in dark mode; woman photo for drag & drop
• 67d5c67 [fix] fix(pro): restore smoky dissolve + image open tilt to their original photo

claude-mem

• New release: v13.15.0 (was v13.12.4)
• Release notes:

## 7-day Pro trial in the installer

The npx installer can now start a free week of CMEM Pro end to end:

- **Trial funnel in `npx claude-mem install`** — pitch → email entry → magic-link → Stripe checkout, with the installer polling the pairing API and finishing setup automatically once the trial starts (#3524)
- **Device-code approval** — the terminal shows a short code (XXXX-XXXX) that you confirm in the browser before credentials are delivered, closing a pairing-secret disclosure vector (#3524)
- **Live model pricing** — the installer now fetches model pricing from the API instead of shipping hardcoded numbers (#3515)

Requires the cmem.ai backend released today (trial routes + `cli_pairings` device-authorization grant).

• Impact: 🟡 review (code touched)
• Commit mix: 4 chore · 4 docs · 3 feat · 2 fix · 1 other
• Files touched: code=12 docs=6 ci=0 test=7 other=20
• 14 new commit(s) since last check
• Latest: d768ba3 — docs: update changelog for v13.15.0
• Recent commits:
• a90066f [fix] fix(chroma): prevent concurrent write storms (#3462)
• dd68d21 [feat] feat(observations): add "sensitive" type with Telegram notification (#3468)
• ce92132 [chore] chore: bump version to 13.13.0
• b368aba [docs] docs: update changelog for v13.13.0
• 9326fae [feat] feat: add custom mode creator skill (#3487)

caveman

• New release: v2.0.0 (was v1.9.1)
• Release notes:

**Caveman 2 — the engine ships.** v1 shrank the model's mouth (output). v2 adds the ears: a real compression engine that squeezes what the model *reads* — tool outputs, logs, code, JSON — before it ever hits the model. One line in front of any LLM app. Free, local, BYOK.

**The skill is untouched and still MIT.** Nothing about your `/caveman` install changed.

Real run: a 40-record JSON went `16,098 → 1,091 tokens` (93% smaller), byte-safe, fully recoverable via CCR. Savings are **inferred** — measured on your machine, not projected, not "verified."

**Licensing:** MIT for the skill, CLI, SDKs, kit, evals, contracts, catalog, and extension shell. BSL-1.1 for the engine/proxy/mcp/shrink/cavemem-core/platform — self-host your own traffic (incl. production) free; only reselling Caveman-as-a-service needs a commercial license. Sunsets to Apache-2.0 in ~4 years.

**Ships now:** engine, proxy, CLI, SDKs (as the packages resolve). **Coming soon:** browser extension. Install commands and pip/npm/docker badges go live when the packages publish.

Want to help? New content-type compressors are the highest-leverage contribution — check `good first issue`.

• Impact: 🟡 review (code touched)
• Commit mix: 6 chore · 1 ci · 8 docs · 3 feat · 10 fix · 6 other · 2 test
• Files touched: code=0 docs=40 ci=8 test=73 other=179
• 36 new commit(s) since last check
• Latest: 27d5a39 — README: whole-cave table gains status column, Browse row, frozen tier
• Recent commits:
• 710173f [fix] fix(skill): negation safety, tool-call silence, language-drift hardening
• 7693a04 [fix] fix(hooks): shared parser, envelope unwrap, resume-safe SessionStart
• d833f4a [feat] feat(stats): surface net savings, not just gross (#145, #677)
• dcd51f1 [fix] fix(compress): stop Windows data loss — UTF-8 + atomic writes (#652, #655, #686)
• ed1fbb7 [fix] fix(install): rename bin/ to cli/, harden Windows quoting, clean uninstall

playwright-mcp

• New release: v0.0.79 (was v0.0.78)
• Release notes:

## What's New

### Tool Improvements

- **`browser_take_screenshot` — WebP format** — New `type` option to pick the image format (`png`, `jpeg` or `webp`); when unset, the format is inferred from the filename extension ([#41152](https://github.com/microsoft/playwright/pull/41152))
- **`--codegen` — more languages** — Code generation now supports `python`, `java` and `csharp` in addition to `typescript` ([#42106](https://github.com/microsoft/playwright/pull/42106))
- **Configurable settle delay** — New `--timeout-settle` flag (and `timeouts.settle` config option) to control how long to wait after each action for triggered work (navigations, requests) to settle, defaults to 500ms ([#41924](https://github.com/microsoft/playwright/pull/41924))

## Fixes

- Aria snapshot capture is skipped when the response discards it ([#41923](https://github.com/microsoft/playwright/pull/41923))
- New `--snapshot-boxes` flag (and `snapshot.boxes` config option) to enable bounding boxes in snapshots globally — previously this was only available per command ([#42102](https://github.com/microsoft/playwright/pull/42102))
- Reconnect to the browser after a disconnect ([#41966](https://github.com/microsoft/playwright/pull/41966))
- Report malformed JSON config instead of silently falling back to INI parsing ([#41909](https://github.com/microsoft/playwright/pull/41909))
- Clear the dialog modal state when a dialog is closed out of band ([#42032](https://github.com/microsoft/playwright/pull/42032))
- Detect downloads via the download event instead of guessing from `net::ERR_ABORTED` navigation errors ([#41933](https://github.com/microsoft/playwright/pull/41933))
- Surface the missing executable path when a browser isn't installed ([#41941](https://github.com/microsoft/playwright/pull/41941))
- Escape user input in codegen output ([#41962](https://github.com/microsoft/playwright/pull/41962))
- Removed the stale `--output-mode` CLI option ([#41833](https://github.com/microsoft/playwright/pull/41833))

• Impact: 🟡 review (code touched)
• Commit mix: 6 chore · 1 other
• Files touched: code=0 docs=1 ci=0 test=0 other=5
• 7 new commit(s) since last check
• Latest: 7e0457a — devops: add ESRP pipeline for publishing npm alpha versions (#1709)
• Recent commits:
• 30710c8 [chore] chore(deps-dev): bump fast-uri from 3.1.2 to 3.1.4 (#1692)
• 42e792a [chore] chore(deps-dev): bump hono from 4.12.26 to 4.12.31 (#1687)
• f2db2c2 [chore] chore(deps-dev): bump ip-address from 10.2.0 to 10.4.0 (#1703)
• 8414d57 [chore] chore(deps): bump @hono/node-server and @modelcontextprotocol/sdk (#1702)
• 4ed35bf [chore] chore: roll Playwright to 1.63.0-alpha-2026-08-05 (#1706)

Updated by the upstream tracker workflow.

[github-actions]

New upstream changes detected (2026-08-16)

social-media-skills

• Impact: 🟡 review (code touched)
• Commit mix: 3 other
• Files touched: code=0 docs=1 ci=0 test=0 other=1
• 3 new commit(s) since last check
• Latest: 69d9488 — Correct follower count to 415k+ and skill count to 17
• Recent commits:
• b232b9b [other] Add exposure-audit skill (18 skills, v1.1.0)
• 43d6fc4 [other] Revert "Add exposure-audit skill (18 skills, v1.1.0)"
• 69d9488 [other] Correct follower count to 415k+ and skill count to 17

context7

• New release: @upstash/context7-mcp@4.0.2 (was @upstash/context7-mcp@3.2.5)
• Release notes:

### Patch Changes

- 67528f2: Add a 60s `AbortSignal.timeout()` to both Context7 API calls in `lib/api.ts`. Without a signal a stalled backend call rides undici's ~300s default before failing. 60s is generous: these are vector queries with p99.9 ~3.2s, and no request exceeded 30s across a full day of production traffic.
- c68104e: Disable SSE keepalive heartbeats on the HTTP handler (`keepAliveMs: 0`). Every tool is a millisecond vector query, so no legitimate exchange needs a heartbeat — but a hung exchange kept alive by heartbeats can never be reaped by a proxy's stream idle timeout. One such hang is deterministic: a 2025-era JSON-RPC batch carrying a request plus its own `notifications/cancelled` gets no response for the cancelled request (per spec), the SDK transport then never closes the stream, and heartbeats kept it alive until the gateway's 1200s hard cap — the dominant source of leaked upstream connections in the 2026-08-11 mcp.context7.com outage. With heartbeats off, silent hangs go idle and the proxy reaps them at its idle timeout.

• Impact: 🟡 review (code touched)
• Commit mix: 4 chore · 2 ci · 9 docs · 2 feat · 2 fix · 5 other
• Files touched: code=26 docs=47 ci=2 test=8 other=8
• 24 new commit(s) since last check
• Latest: d27c0f1 — docs: add eve integration guide (#3038)
• Recent commits:
• 6c343ae [docs] docs(enterprise): changelog for v1.2.4 through v1.3.0 (#2953)
• 80f9d6c [docs] docs(enterprise): add library access control page (#2928)
• b89a04e [fix] fix(cli): write the API key as an Authorization header (#2957)
• 38422b1 [chore] chore(release): version packages (#2960)
• 6153deb [docs] docs(enterprise): document external Postgres with the embedded vector index (#2954)

lightrag

• New release: v1.5.6 (was v1.5.5rc1)
• Release notes:

## Important Notes

Introducing **PGTableGraphStorage**, a new graph storage backend built on native PostgreSQL tables. By eliminating the dependency on Apache AGE, it not only simplifies deployment but also delivers significantly higher graph storage performance with reduced storage footprint. It will replace the AGE-based `PGGraphStorage` as the preferred graph storage solution for PostgreSQL. This makes **PostgreSQL** the go-to **all-in-one backend database** for LightRAG, enabling a single database to cover all four storage types.

## What's New

* feat(kg): add PGTableGraphStorage — PostgreSQL-native graph backend (no AGE dependency) by @ysys143 in https://github.com/HKUDS/LightRAG/pull/3103
* docs(pipeline): rewrite the dedup and concurrency chapters from a user's view by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3583

## What's Changed

* Implement fail-closed recovery proof for whole-document purge by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3535
* docs: fix broken links and correct VLM gating semantics by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3539
* docs: extract parser service deployment runbooks by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3540
* docs: restructure FileProcessingPipeline into a usable guide by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3541
* docs: fix documentation typos, grammar errors, and incorrect warning messages by @Rythamo8055 in https://github.com/HKUDS/LightRAG/pull/3538
* feat(utils): bound thread-pool submission and pin the tokenizer contract by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3543
* fix(deps): sync uv.lock with the tiktoken floor and correct the restore rationale by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3546
* fix(api): bound request bodies and take token counting off the event loop by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3544
* fix(pipeline): take chunking off the event loop and bound the separator cascade by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3547

• Impact: 🟡 review (code touched)
• Commit mix: 6 build · 1 chore · 18 docs · 4 feat · 111 fix · 88 other · 3 perf · 8 refactor · 1 revert · 1 style · 9 test
• Files touched: code=0 docs=31 ci=12 test=137 other=120
• 684 new commit(s) since last check
• Latest: 4ba8074 — Bump API version to 0331
• Recent commits:
• ec082e0 [docs] docs(pipeline): rewrite the dedup and concurrency chapters from a user's view
• b33c6b0 [other] Merge pull request #3583 from HKUDS/docs/pipeline-run-control-and-retry
• 02c4147 [fix] fix(rebuild_vdb): drop lossy agtype quote-strip that corrupts quote-bearing entity_ids
• 6cffc91 [test] test(rebuild_vdb): pin quote-bearing ids across every former strip site
• 9cd1a69 [fix] fix(kg): return copies from NetworkXStorage get_node and get_edge

vercel-agent-skills

• Impact: 🟢 skim (docs/ci/test only)
• Commit mix: 3 other
• Files touched: code=0 docs=3 ci=0 test=0 other=0
• 3 new commit(s) since last check
• Latest: b8caa26 — Merge pull request #318 from vercel-labs/codex/update-view-transitions-skill
• Recent commits:
• 9542f4e [other] Document prefetched route transitions
• 3798a79 [other] Scope content readiness guidance
• b8caa26 [other] Merge pull request #318 from vercel-labs/codex/update-view-transitions-skill

everything-claude-code

• New release: v2.1.0 (was v2.0.0)
• Release notes:

# ECC 2.1.0: Plan Canvas, Kimi Harness, and Self-Hosted Compute

ECC 2.1 turns plan review into a visual loop and opens the harness to self-hosted models. Plan Canvas lets you review agent plans in the browser. Point at the part you mean instead of retyping it in chat. A new Kimi Code install target and a verified Itô GPU path make ECC + open-source models a first-class setup, backed by our public sponsors: Moonshot AI (Kimi), Itô, and Atlas Cloud.

## Plan Canvas: review plans by pointing, not retyping

![Plan Canvas demo: reviewing an ECC plan, attaching an annotation, chatting with the agent, and approving the plan](https://raw.githubusercontent.com/affaan-m/ECC/main/docs/releases/2.1.0/assets/ecc-plan-canvas-demo.gif)

[Download the MP4 demo](https://raw.githubusercontent.com/affaan-m/ECC/main/docs/releases/2.1.0/assets/ecc-plan-canvas-demo.mp4)

`/plan` ends with a confirm gate, and until now that review was a wall of markdown in the terminal. Now the agent opens the plan in a loopback-only browser canvas:

- Click elements or select text to attach numbered annotations
- Chat with the agent from a side rail while it works in the terminal
- **Approve plan** / **Request changes** buttons map directly onto `/plan`'s CONFIRM gate
- Mermaid diagrams, tables, and task lists render natively; file edits live-reload the page
- Model- and harness-agnostic: a plain CLI + JSON protocol (`ecc-plan-canvas`), no Claude-only dependency

## Kimi harness: Moonshot AI partnership

• Impact: 🟡 review (code touched)
• Commit mix: 11 chore · 1 ci · 11 docs · 11 feat · 51 fix · 15 other · 8 test
• Files touched: code=0 docs=164 ci=15 test=0 other=121
• 108 new commit(s) since last check
• Latest: 50743ce — Merge pull request #2802 from affaan-m/affaan/nasiko-windows-ci-hotfix
• Recent commits:
• b06c78c [docs] docs: add 2.1.0 release notes and Plan Canvas demo assets
• 1ffaa75 [fix] fix(release): match the ECC banner name when bumping versions
• 4099794 [fix] fix(release): bump the claude marketplace and zh-CN heading on macOS
• 6f452d4 [chore] chore: bump plugin version to 2.1.0
• edaf6fe [fix] fix(release): drop the dead OMP adapter verification step

marketing-skills

• New release: v2.10.0 (was v2.9.0)
• Release notes:

**attribution** (new, 1.1.0): a dedicated skill for the hardest question in marketing — which efforts actually drive conversions and revenue. Fills a real gap: attribution was scattered across analytics (UTM setup), ads (platform pixels), revops (pipeline), and ai-seo (the AI blind spot), but no skill owned the *models* or the *reconciliation problem*. Two pillars. **(A) Interpretation** — the six attribution models and when each lies; MTA vs. MMM vs. incrementality and how to choose; self-reported attribution; reconciling the platform-vs-GA-vs-CRM-vs-survey disagreement (never sum across platforms; pick one source of truth; read directional trends); and the direct / branded-search / dark-social / AI blind spots. **(B) Own your attribution (first-party)** — a build runbook for instrumenting attribution yourself when you control the site/app: the identity graph, closing the `identify()` gap (adapted from Tessa Kriesel's PostHog approach), stitching conversions on third-party domains you don't own (SavvyCal/Calendly/Stripe) via metadata passthrough + webhook identity-merge, fail-closed anonymity guards, and first-touch data-quality cleanup — distilled from real production builds (Conversion Factory + Truelist). Four references (`attribution-models.md`, `measurement-paradigms.md`, `by-business-type.md` with B2B/DTC playbooks, `first-party-tracking.md`) and 7 evals covering reconciliation, model choice, the third-party stitch, ROAS incrementality, the direct/branded blind spot, the analytics boundary, and the DTC measurement stack. Pillar B also folds in **production feedback from Tessa Kriesel** (credited): the CRM last mile (sync a `source` field with confidence + basis and a paid-vs-non-paid read onto the account → revops), storing the full ordered touch path so the build track can run Pillar A's multi-touch models on real data, the "expect ~zero until the cross-subdomain stitch is verified in prod" window with a narrowly-scoped campaign-window fallback + pre-stitch backfill, and account-level rollup (excluding free-mail domains) for B2B.
**analytics** (2.0.0 → 2.0.1): description now hands off attribution modeling and reconciliation to the new attribution skill, keeping analytics scoped to tracking setup, event taxonomy, and UTMs.

• Impact: 🟡 review (code touched)
• Commit mix: 1 chore · 2 feat · 5 other
• Files touched: code=0 docs=10 ci=0 test=0 other=4
• 8 new commit(s) since last check
• Latest: 7868cb9 — chore: sync skills with marketplace.json, plugin.json, and README
• Recent commits:
• 804c512 [feat] feat(attribution): new skill — models, reconciliation, and first-party attribution (2.10.0) (#473)
• 789ef02 [feat] feat(attribution): Tessa Kriesel production feedback → first-party runbook (1.1.0, part of 2.10.0) (#483)
• 3c51add [other] release(2.9.1): pricing-page teardown with AI-agent-readiness axis (#487)
• 2c13acc [other] Merge pull request #492 from coreyhaines31/hotfix/487-pricing-2.9.1
• fc2f33b [other] sync: main -> development after 2.9.1 pricing release

ui-ux-pro-max

• New release: v2.15.0 (was v2.11.2)
• Release notes:

## UI UX Pro Max v2.15.0

This release is a broad search, data-quality, and agent-guidance upgrade. It keeps the existing CLI/install contract while improving how agents retrieve, reason about, and apply UI/UX guidance.

### Search and reasoning

- Reworked BM25 routing, query rewriting, abstention, typo recovery, suggestions, and cache safety.
- Added a 90-case graded relevance corpus covering 12 domains, 22 stacks, hard negatives, routing, and design-system coherence.
- Added deterministic current-versus-legacy framework routing so old-version queries return labeled legacy guidance or abstain instead of mixing generations.
- Strengthened exact style, landing-pattern, palette, and product-reasoning identity resolution.
- Completed exact reasoning coverage for all 192 product types and made generated source identities traceable.

### Curated UI/UX data

- Refreshed the style taxonomy: 79 searchable styles, including 50 active and 29 supplemental styles; 9 legacy entries remain deprecated and redirect to supported replacements.
- Expanded the catalog to 119 UX guidelines and 1,260 stack-specific guidelines across 22 stacks.
- Updated accessibility guidance for contrast roles, focus indicators, icons, charts, error summaries, reduced motion, loading states, and interaction feedback.
- Added resilient text-layout guidance for heading balance, long tokens, reflow, text scaling, essential text, chips, tags, badges, live counts, and cancellable micro-interactions.
- Refreshed current and legacy guidance for React, Next.js, Vue, Nuxt, Nuxt UI, Svelte, Astro, Tailwind CSS, shadcn/ui, Flutter, React Native, SwiftUI, Three.js, Laravel, JavaFX, WPF, WinUI, UWP, Avalonia, and Uno Platform.

• Impact: 🟡 review (code touched)
• Commit mix: 2 docs · 4 feat · 5 fix
• Files touched: code=70 docs=15 ci=7 test=5 other=205
• 11 new commit(s) since last check
• Latest: a38d04c — feat(search): overhaul relevance and curated design data
• Recent commits:
• 4857a2c [fix] fix(cli): sync shadcn test asset (#433)
• ec1f2a9 [fix] fix(design-system): resolve palette and anti-patterns against the style's mode (#428) (#434)
• b0ebb17 [fix] fix(copilot): generate .prompt.md file for VS Code Copilot slash commands (#328)
• 14ddef5 [feat] feat(gallery): add Style Detail Modal with phone UI controls preview (#155)
• 4d140cf [feat] feat(cli): add --global flag to uipro update and support --ai universal target (#435, #436) (#437)

superpowers

• New release: v6.3.0 (was v6.2.0)
• Release notes:

### Harness Support

- **Devin CLI**: `devin plugins install obra/superpowers` now works, and skills auto-trigger at session start. (#1995)
- **Hermes Agent**: install from a git clone; skills register with Hermes' native loader and the bootstrap loads on the first turn. (#1922, #2025)
- **Grok Build CLI** added to the install docs. (#1919)

### Brainstorming

- **Ceremony now scales to the task.** Requests are classified as spike, bounded, or architectural; small tasks skip the two-document ritual. Every path still stops for your approval before implementation. (#2063)

### Subagent-Driven Development

- **Controllers no longer stall on plan conflicts.** Non-catastrophic conflicts and ambiguities get a recorded ruling and work continues; only destructive or irreversible actions still stop for a human. One donated session had sat blocked for almost nine hours on a question the controller could have decided. (#2077)
- **The pre-dispatch conflict scan records its checks in the ledger** instead of just asserting the plan is clean. (#2080)
- **Small same-shape tasks batch into one dispatch**, cutting subagent cost sharply on micro-task plans; batch reviews verify every file in the brief made it into the diff. (#2078)
- **Implementers and reviewers may not spawn their own subagents**, which was producing duplicate reviews. (#2059)
- **Plans carry a `Spec:` pointer** and SDD reads the spec at setup, so plan conflicts get resolved against the design instead of guessed at. (#2086)
- Reviewers re-read evidence they find illegible instead of re-running the test suite (#2089), and circuit-breaker rulings now show up in the Finish report.

• Impact: 🟡 review (code touched)
• Commit mix: 1 docs · 1 other
• Files touched: code=0 docs=18 ci=1 test=7 other=14
• 2 new commit(s) since last check
• Latest: b36e082 — Release v6.3.0: Devin CLI and Hermes Agent support, brainstorming three-path router, SDD/Codex efficiency fixes (#2125)
• Recent commits:
• 44c9b2d [docs] docs: remove the "We're Hiring" section from the README
• b36e082 [other] Release v6.3.0: Devin CLI and Hermes Agent support, brainstorming three-path router, SDD/Codex efficiency fixes (#2125)

anthropic-skills

• Impact: 🟢 skim (docs/ci/test only)
• Commit mix: 2 other
• Files touched: code=0 docs=20 ci=0 test=0 other=0
• 2 new commit(s) since last check
• Latest: f6656c1 — Update claude-api skill: prompt-audit subcommand (#1557)
• Recent commits:
• f17010c [other] Update claude-api skill: Managed Agents August launch wave (#1532)
• f6656c1 [other] Update claude-api skill: prompt-audit subcommand (#1557)

knowledge-work-plugins

• Impact: 🟡 review (code touched)
• Commit mix: 204 other
• Files touched: code=0 docs=0 ci=0 test=0 other=4
• 204 new commit(s) since last check
• Latest: 2374e85 — bump(carta-investors): dd0c286b → e9bb21cb (#927)
• Recent commits:
• d10c2c9 [other] bump(wix): 87c6b285 → 6f402cef (#709)
• 7f1ce6b [other] bump(wix): 6f402cef → dd567862 (#710)
• 372e3b2 [other] bump(langfuse): 13a79944 → 93d82827 (#713)
• 9d92c5e [other] bump(wix): dd567862 → 9e3b2d55 (#711)
• 37820dc [other] bump(carta-cap-table): 0ee76454 → 35c25847 (#712)

n8n-mcp

• New release: v2.69.2 (was v2.66.1)
• Release notes:

# Release v2.69.2

Generating release notes from v2.69.1 to HEAD
### 🔧 Maintenance

- Upgrade @modelcontextprotocol/sdk to 1.30.0 (v2.69.2) (#996) (8ec71c8)

---

**Release Statistics:**
- 1 commit
- 1 contributor
- Contributors: Romuald Członkowski

---

## Installation

### NPM Package
```bash

• Impact: 🟡 review (code touched)
• Commit mix: 3 chore · 4 docs · 2 feat · 6 fix · 1 other
• Files touched: code=39 docs=16 ci=5 test=34 other=14
• 16 new commit(s) since last check
• Latest: 8ec71c8 — chore: upgrade @modelcontextprotocol/sdk to 1.30.0 (v2.69.2) (#996)
• Recent commits:
• b14f3c1 [docs] docs: sync skills pack v1.26.0 — canvas groups (nodeGroups) (#951)
• 1d15fc2 [fix] fix: AI-tool validation follow-ups from the 2.31.3 update review (#953–#956) (#962)
• 268f577 [fix] fix: bracket-index path updates and fabricated community node types (#950, #949) (#964)
• 3293e61 [feat] feat: add run and cancel actions to n8n_evaluations (#936) (#963)
• 8265427 [docs] docs: sync skills pack to n8n-skills v1.27.0 (evaluations run/cancel) (#966)

skillspector

• New release: v2.9.5 (was none)
• Release notes:

# SkillSpector v2.9.5

Released: 2026-08-14

## Summary

SkillSpector 2.9.5 expands provider support, adds opt-in author-shipped baselines, and strengthens static detection for insecure deserialization. It also improves analyzer accuracy and compatibility across safety-pattern, MCP dependency, and YARA scanning paths.

## Highlights

- Add Ollama, Azure OpenAI, and generic OpenAI-compatible providers.
- Add static detection coverage for insecure deserialization patterns.
- Improve scan accuracy with opt-in shipped baselines, lower false positives, and more precise YARA source locations.

## Added

- Add Ollama support for local OpenAI-compatible inference, Azure OpenAI deployment routing, and a configurable provider for other OpenAI-compatible endpoints.
- Add opt-in discovery of a top-level `.skillspector-baseline.yaml` while keeping explicitly supplied baselines authoritative.
- Add analyzer coverage for insecure deserialization patterns represented by AST10, TT6, and DS1–DS4 findings.

• Impact: 🟡 review (code touched)
• Commit mix: 8 chore · 1 docs · 6 feat · 14 fix · 11 other · 1 test
• Files touched: code=63 docs=24 ci=3 test=58 other=11
• 41 new commit(s) since last check
• Latest: 27fd962 — release: SkillSpector 2.9.5 (#378)
• Recent commits:
• 34f6030 [feat] feat: publish 2.5.0 execution accounting (#308)
• da5cb13 [feat] feat(llm): make analyzer fan-out concurrency configurable via env (#305)
• 3f11bfa [other] release: publish OSS snapshot 2.5.1 (#320)
• e48fc1a [fix] fix(input-handler): bound URL, zip, and git ingest paths (#164)
• 1df69ad [fix] fix(analyzer): reduce instructional-prose false positives in static scans (#103) (#232)

transitions

• Impact: 🟡 review (code touched)
• Commit mix: 3 feat · 8 fix · 1 perf
• Files touched: code=0 docs=0 ci=0 test=0 other=11
• 12 new commit(s) since last check
• Latest: 45d02c7 — feat(pro): pass ?code= from the pricing page into checkout
• Recent commits:
• 0ec87b1 [fix] fix: sidebar edge fade, footer alignment, and mobile layout issues
• 1eea31f [feat] feat(pro): add gooey plus menu, drag & drop physics, spinner→check morph
• 9ab8174 [fix] fix(pro): drag no longer opens the detail page; use the stack's middle photo
• c10106d [fix] fix(pro): make the gooey merge readable in dark mode; woman photo for drag & drop
• 67d5c67 [fix] fix(pro): restore smoky dissolve + image open tilt to their original photo

claude-mem

• New release: v13.15.0 (was v13.12.4)
• Release notes:

## 7-day Pro trial in the installer

The npx installer can now start a free week of CMEM Pro end to end:

- **Trial funnel in `npx claude-mem install`** — pitch → email entry → magic-link → Stripe checkout, with the installer polling the pairing API and finishing setup automatically once the trial starts (#3524)
- **Device-code approval** — the terminal shows a short code (XXXX-XXXX) that you confirm in the browser before credentials are delivered, closing a pairing-secret disclosure vector (#3524)
- **Live model pricing** — the installer now fetches model pricing from the API instead of shipping hardcoded numbers (#3515)

Requires the cmem.ai backend released today (trial routes + `cli_pairings` device-authorization grant).

• Impact: 🟡 review (code touched)
• Commit mix: 4 chore · 4 docs · 3 feat · 2 fix · 1 other
• Files touched: code=12 docs=6 ci=0 test=7 other=20
• 14 new commit(s) since last check
• Latest: d768ba3 — docs: update changelog for v13.15.0
• Recent commits:
• a90066f [fix] fix(chroma): prevent concurrent write storms (#3462)
• dd68d21 [feat] feat(observations): add "sensitive" type with Telegram notification (#3468)
• ce92132 [chore] chore: bump version to 13.13.0
• b368aba [docs] docs: update changelog for v13.13.0
• 9326fae [feat] feat: add custom mode creator skill (#3487)

caveman

• New release: v2.0.0 (was v1.9.1)
• Release notes:

**Caveman 2 — the engine ships.** v1 shrank the model's mouth (output). v2 adds the ears: a real compression engine that squeezes what the model *reads* — tool outputs, logs, code, JSON — before it ever hits the model. One line in front of any LLM app. Free, local, BYOK.

**The skill is untouched and still MIT.** Nothing about your `/caveman` install changed.

Real run: a 40-record JSON went `16,098 → 1,091 tokens` (93% smaller), byte-safe, fully recoverable via CCR. Savings are **inferred** — measured on your machine, not projected, not "verified."

**Licensing:** MIT for the skill, CLI, SDKs, kit, evals, contracts, catalog, and extension shell. BSL-1.1 for the engine/proxy/mcp/shrink/cavemem-core/platform — self-host your own traffic (incl. production) free; only reselling Caveman-as-a-service needs a commercial license. Sunsets to Apache-2.0 in ~4 years.

**Ships now:** engine, proxy, CLI, SDKs (as the packages resolve). **Coming soon:** browser extension. Install commands and pip/npm/docker badges go live when the packages publish.

Want to help? New content-type compressors are the highest-leverage contribution — check `good first issue`.

• Impact: 🟡 review (code touched)
• Commit mix: 6 chore · 1 ci · 8 docs · 3 feat · 10 fix · 7 other · 2 test
• Files touched: code=0 docs=40 ci=8 test=73 other=179
• 37 new commit(s) since last check
• Latest: 12aa8cc — Revise README installation instructions
• Recent commits:
• 710173f [fix] fix(skill): negation safety, tool-call silence, language-drift hardening
• 7693a04 [fix] fix(hooks): shared parser, envelope unwrap, resume-safe SessionStart
• d833f4a [feat] feat(stats): surface net savings, not just gross (#145, #677)
• dcd51f1 [fix] fix(compress): stop Windows data loss — UTF-8 + atomic writes (#652, #655, #686)
• ed1fbb7 [fix] fix(install): rename bin/ to cli/, harden Windows quoting, clean uninstall

playwright-mcp

• New release: v0.0.79 (was v0.0.78)
• Release notes:

## What's New

### Tool Improvements

- **`browser_take_screenshot` — WebP format** — New `type` option to pick the image format (`png`, `jpeg` or `webp`); when unset, the format is inferred from the filename extension ([#41152](https://github.com/microsoft/playwright/pull/41152))
- **`--codegen` — more languages** — Code generation now supports `python`, `java` and `csharp` in addition to `typescript` ([#42106](https://github.com/microsoft/playwright/pull/42106))
- **Configurable settle delay** — New `--timeout-settle` flag (and `timeouts.settle` config option) to control how long to wait after each action for triggered work (navigations, requests) to settle, defaults to 500ms ([#41924](https://github.com/microsoft/playwright/pull/41924))

## Fixes

- Aria snapshot capture is skipped when the response discards it ([#41923](https://github.com/microsoft/playwright/pull/41923))
- New `--snapshot-boxes` flag (and `snapshot.boxes` config option) to enable bounding boxes in snapshots globally — previously this was only available per command ([#42102](https://github.com/microsoft/playwright/pull/42102))
- Reconnect to the browser after a disconnect ([#41966](https://github.com/microsoft/playwright/pull/41966))
- Report malformed JSON config instead of silently falling back to INI parsing ([#41909](https://github.com/microsoft/playwright/pull/41909))
- Clear the dialog modal state when a dialog is closed out of band ([#42032](https://github.com/microsoft/playwright/pull/42032))
- Detect downloads via the download event instead of guessing from `net::ERR_ABORTED` navigation errors ([#41933](https://github.com/microsoft/playwright/pull/41933))
- Surface the missing executable path when a browser isn't installed ([#41941](https://github.com/microsoft/playwright/pull/41941))
- Escape user input in codegen output ([#41962](https://github.com/microsoft/playwright/pull/41962))
- Removed the stale `--output-mode` CLI option ([#41833](https://github.com/microsoft/playwright/pull/41833))

• Impact: 🟡 review (code touched)
• Commit mix: 6 chore · 1 other
• Files touched: code=0 docs=1 ci=0 test=0 other=5
• 7 new commit(s) since last check
• Latest: 7e0457a — devops: add ESRP pipeline for publishing npm alpha versions (#1709)
• Recent commits:
• 30710c8 [chore] chore(deps-dev): bump fast-uri from 3.1.2 to 3.1.4 (#1692)
• 42e792a [chore] chore(deps-dev): bump hono from 4.12.26 to 4.12.31 (#1687)
• f2db2c2 [chore] chore(deps-dev): bump ip-address from 10.2.0 to 10.4.0 (#1703)
• 8414d57 [chore] chore(deps): bump @hono/node-server and @modelcontextprotocol/sdk (#1702)
• 4ed35bf [chore] chore: roll Playwright to 1.63.0-alpha-2026-08-05 (#1706)

Updated by the upstream tracker workflow.

[github-actions]

New upstream changes detected (2026-08-17)

social-media-skills

• Impact: 🟡 review (code touched)
• Commit mix: 3 other
• Files touched: code=0 docs=1 ci=0 test=0 other=1
• 3 new commit(s) since last check
• Latest: 69d9488 — Correct follower count to 415k+ and skill count to 17
• Recent commits:
• b232b9b [other] Add exposure-audit skill (18 skills, v1.1.0)
• 43d6fc4 [other] Revert "Add exposure-audit skill (18 skills, v1.1.0)"
• 69d9488 [other] Correct follower count to 415k+ and skill count to 17

context7

• New release: @upstash/context7-mcp@4.0.2 (was @upstash/context7-mcp@3.2.5)
• Release notes:

### Patch Changes

- 67528f2: Add a 60s `AbortSignal.timeout()` to both Context7 API calls in `lib/api.ts`. Without a signal a stalled backend call rides undici's ~300s default before failing. 60s is generous: these are vector queries with p99.9 ~3.2s, and no request exceeded 30s across a full day of production traffic.
- c68104e: Disable SSE keepalive heartbeats on the HTTP handler (`keepAliveMs: 0`). Every tool is a millisecond vector query, so no legitimate exchange needs a heartbeat — but a hung exchange kept alive by heartbeats can never be reaped by a proxy's stream idle timeout. One such hang is deterministic: a 2025-era JSON-RPC batch carrying a request plus its own `notifications/cancelled` gets no response for the cancelled request (per spec), the SDK transport then never closes the stream, and heartbeats kept it alive until the gateway's 1200s hard cap — the dominant source of leaked upstream connections in the 2026-08-11 mcp.context7.com outage. With heartbeats off, silent hangs go idle and the proxy reaps them at its idle timeout.

• Impact: 🟡 review (code touched)
• Commit mix: 4 chore · 2 ci · 9 docs · 2 feat · 2 fix · 5 other
• Files touched: code=26 docs=47 ci=2 test=8 other=8
• 24 new commit(s) since last check
• Latest: d27c0f1 — docs: add eve integration guide (#3038)
• Recent commits:
• 6c343ae [docs] docs(enterprise): changelog for v1.2.4 through v1.3.0 (#2953)
• 80f9d6c [docs] docs(enterprise): add library access control page (#2928)
• b89a04e [fix] fix(cli): write the API key as an Authorization header (#2957)
• 38422b1 [chore] chore(release): version packages (#2960)
• 6153deb [docs] docs(enterprise): document external Postgres with the embedded vector index (#2954)

lightrag

• New release: v1.5.6 (was v1.5.5rc1)
• Release notes:

## Important Notes

Introducing **PGTableGraphStorage**, a new graph storage backend built on native PostgreSQL tables. By eliminating the dependency on Apache AGE, it not only simplifies deployment but also delivers significantly higher graph storage performance with reduced storage footprint. It will replace the AGE-based `PGGraphStorage` as the preferred graph storage solution for PostgreSQL. This makes **PostgreSQL** the go-to **all-in-one backend database** for LightRAG, enabling a single database to cover all four storage types.

## What's New

* feat(kg): add PGTableGraphStorage — PostgreSQL-native graph backend (no AGE dependency) by @ysys143 in https://github.com/HKUDS/LightRAG/pull/3103
* docs(pipeline): rewrite the dedup and concurrency chapters from a user's view by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3583

## What's Changed

* Implement fail-closed recovery proof for whole-document purge by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3535
* docs: fix broken links and correct VLM gating semantics by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3539
* docs: extract parser service deployment runbooks by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3540
* docs: restructure FileProcessingPipeline into a usable guide by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3541
* docs: fix documentation typos, grammar errors, and incorrect warning messages by @Rythamo8055 in https://github.com/HKUDS/LightRAG/pull/3538
* feat(utils): bound thread-pool submission and pin the tokenizer contract by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3543
* fix(deps): sync uv.lock with the tiktoken floor and correct the restore rationale by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3546
* fix(api): bound request bodies and take token counting off the event loop by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3544
* fix(pipeline): take chunking off the event loop and bound the separator cascade by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3547

• Impact: 🟡 review (code touched)
• Commit mix: 6 build · 1 chore · 18 docs · 4 feat · 107 fix · 92 other · 3 perf · 8 refactor · 1 revert · 2 style · 8 test
• Files touched: code=0 docs=32 ci=12 test=134 other=122
• 697 new commit(s) since last check
• Latest: d692105 — Merge pull request #3650 from Marc-oss-hub/docs/add-orcarouter-config
• Recent commits:
• 7a91859 [fix] fix(kg): break BFS same-depth degree ties by label in get_knowledge_graph
• 1da68c8 [fix] fix(kg): hydrate track docs via _doc_processing_status_from_row and catch TypeError
• d7b5480 [fix] fix: disable thinking for Ollama extract/keyword roles by default
• 5ab250e [other] Merge pull request #3588 from santhreal/fix/networkx-get-node-edge-copy-on-read
• c84eb95 [other] Fix lintings

vercel-agent-skills

• Impact: 🟢 skim (docs/ci/test only)
• Commit mix: 3 other
• Files touched: code=0 docs=3 ci=0 test=0 other=0
• 3 new commit(s) since last check
• Latest: b8caa26 — Merge pull request #318 from vercel-labs/codex/update-view-transitions-skill
• Recent commits:
• 9542f4e [other] Document prefetched route transitions
• 3798a79 [other] Scope content readiness guidance
• b8caa26 [other] Merge pull request #318 from vercel-labs/codex/update-view-transitions-skill

everything-claude-code

• New release: v2.1.0 (was v2.0.0)
• Release notes:

# ECC 2.1.0: Plan Canvas, Kimi Harness, and Self-Hosted Compute

ECC 2.1 turns plan review into a visual loop and opens the harness to self-hosted models. Plan Canvas lets you review agent plans in the browser. Point at the part you mean instead of retyping it in chat. A new Kimi Code install target and a verified Itô GPU path make ECC + open-source models a first-class setup, backed by our public sponsors: Moonshot AI (Kimi), Itô, and Atlas Cloud.

## Plan Canvas: review plans by pointing, not retyping

![Plan Canvas demo: reviewing an ECC plan, attaching an annotation, chatting with the agent, and approving the plan](https://raw.githubusercontent.com/affaan-m/ECC/main/docs/releases/2.1.0/assets/ecc-plan-canvas-demo.gif)

[Download the MP4 demo](https://raw.githubusercontent.com/affaan-m/ECC/main/docs/releases/2.1.0/assets/ecc-plan-canvas-demo.mp4)

`/plan` ends with a confirm gate, and until now that review was a wall of markdown in the terminal. Now the agent opens the plan in a loopback-only browser canvas:

- Click elements or select text to attach numbered annotations
- Chat with the agent from a side rail while it works in the terminal
- **Approve plan** / **Request changes** buttons map directly onto `/plan`'s CONFIRM gate
- Mermaid diagrams, tables, and task lists render natively; file edits live-reload the page
- Model- and harness-agnostic: a plain CLI + JSON protocol (`ecc-plan-canvas`), no Claude-only dependency

## Kimi harness: Moonshot AI partnership

• Impact: 🟡 review (code touched)
• Commit mix: 11 chore · 1 ci · 11 docs · 11 feat · 51 fix · 15 other · 9 test
• Files touched: code=0 docs=164 ci=15 test=0 other=121
• 109 new commit(s) since last check
• Latest: 06c5e11 — test(release): verify packed Ito distribution (#2803)
• Recent commits:
• b06c78c [docs] docs: add 2.1.0 release notes and Plan Canvas demo assets
• 1ffaa75 [fix] fix(release): match the ECC banner name when bumping versions
• 4099794 [fix] fix(release): bump the claude marketplace and zh-CN heading on macOS
• 6f452d4 [chore] chore: bump plugin version to 2.1.0
• edaf6fe [fix] fix(release): drop the dead OMP adapter verification step

marketing-skills

• New release: v2.10.0 (was v2.9.0)
• Release notes:

**attribution** (new, 1.1.0): a dedicated skill for the hardest question in marketing — which efforts actually drive conversions and revenue. Fills a real gap: attribution was scattered across analytics (UTM setup), ads (platform pixels), revops (pipeline), and ai-seo (the AI blind spot), but no skill owned the *models* or the *reconciliation problem*. Two pillars. **(A) Interpretation** — the six attribution models and when each lies; MTA vs. MMM vs. incrementality and how to choose; self-reported attribution; reconciling the platform-vs-GA-vs-CRM-vs-survey disagreement (never sum across platforms; pick one source of truth; read directional trends); and the direct / branded-search / dark-social / AI blind spots. **(B) Own your attribution (first-party)** — a build runbook for instrumenting attribution yourself when you control the site/app: the identity graph, closing the `identify()` gap (adapted from Tessa Kriesel's PostHog approach), stitching conversions on third-party domains you don't own (SavvyCal/Calendly/Stripe) via metadata passthrough + webhook identity-merge, fail-closed anonymity guards, and first-touch data-quality cleanup — distilled from real production builds (Conversion Factory + Truelist). Four references (`attribution-models.md`, `measurement-paradigms.md`, `by-business-type.md` with B2B/DTC playbooks, `first-party-tracking.md`) and 7 evals covering reconciliation, model choice, the third-party stitch, ROAS incrementality, the direct/branded blind spot, the analytics boundary, and the DTC measurement stack. Pillar B also folds in **production feedback from Tessa Kriesel** (credited): the CRM last mile (sync a `source` field with confidence + basis and a paid-vs-non-paid read onto the account → revops), storing the full ordered touch path so the build track can run Pillar A's multi-touch models on real data, the "expect ~zero until the cross-subdomain stitch is verified in prod" window with a narrowly-scoped campaign-window fallback + pre-stitch backfill, and account-level rollup (excluding free-mail domains) for B2B.
**analytics** (2.0.0 → 2.0.1): description now hands off attribution modeling and reconciliation to the new attribution skill, keeping analytics scoped to tracking setup, event taxonomy, and UTMs.

• Impact: 🟡 review (code touched)
• Commit mix: 1 chore · 2 feat · 5 other
• Files touched: code=0 docs=10 ci=0 test=0 other=4
• 8 new commit(s) since last check
• Latest: 7868cb9 — chore: sync skills with marketplace.json, plugin.json, and README
• Recent commits:
• 804c512 [feat] feat(attribution): new skill — models, reconciliation, and first-party attribution (2.10.0) (#473)
• 789ef02 [feat] feat(attribution): Tessa Kriesel production feedback → first-party runbook (1.1.0, part of 2.10.0) (#483)
• 3c51add [other] release(2.9.1): pricing-page teardown with AI-agent-readiness axis (#487)
• 2c13acc [other] Merge pull request #492 from coreyhaines31/hotfix/487-pricing-2.9.1
• fc2f33b [other] sync: main -> development after 2.9.1 pricing release

ui-ux-pro-max

• New release: v2.15.0 (was v2.11.2)
• Release notes:

## UI UX Pro Max v2.15.0

This release is a broad search, data-quality, and agent-guidance upgrade. It keeps the existing CLI/install contract while improving how agents retrieve, reason about, and apply UI/UX guidance.

### Search and reasoning

- Reworked BM25 routing, query rewriting, abstention, typo recovery, suggestions, and cache safety.
- Added a 90-case graded relevance corpus covering 12 domains, 22 stacks, hard negatives, routing, and design-system coherence.
- Added deterministic current-versus-legacy framework routing so old-version queries return labeled legacy guidance or abstain instead of mixing generations.
- Strengthened exact style, landing-pattern, palette, and product-reasoning identity resolution.
- Completed exact reasoning coverage for all 192 product types and made generated source identities traceable.

### Curated UI/UX data

- Refreshed the style taxonomy: 79 searchable styles, including 50 active and 29 supplemental styles; 9 legacy entries remain deprecated and redirect to supported replacements.
- Expanded the catalog to 119 UX guidelines and 1,260 stack-specific guidelines across 22 stacks.
- Updated accessibility guidance for contrast roles, focus indicators, icons, charts, error summaries, reduced motion, loading states, and interaction feedback.
- Added resilient text-layout guidance for heading balance, long tokens, reflow, text scaling, essential text, chips, tags, badges, live counts, and cancellable micro-interactions.
- Refreshed current and legacy guidance for React, Next.js, Vue, Nuxt, Nuxt UI, Svelte, Astro, Tailwind CSS, shadcn/ui, Flutter, React Native, SwiftUI, Three.js, Laravel, JavaFX, WPF, WinUI, UWP, Avalonia, and Uno Platform.

• Impact: 🟡 review (code touched)
• Commit mix: 2 docs · 4 feat · 5 fix
• Files touched: code=70 docs=15 ci=7 test=5 other=205
• 11 new commit(s) since last check
• Latest: a38d04c — feat(search): overhaul relevance and curated design data
• Recent commits:
• 4857a2c [fix] fix(cli): sync shadcn test asset (#433)
• ec1f2a9 [fix] fix(design-system): resolve palette and anti-patterns against the style's mode (#428) (#434)
• b0ebb17 [fix] fix(copilot): generate .prompt.md file for VS Code Copilot slash commands (#328)
• 14ddef5 [feat] feat(gallery): add Style Detail Modal with phone UI controls preview (#155)
• 4d140cf [feat] feat(cli): add --global flag to uipro update and support --ai universal target (#435, #436) (#437)

superpowers

• New release: v6.3.0 (was v6.2.0)
• Release notes:

### Harness Support

- **Devin CLI**: `devin plugins install obra/superpowers` now works, and skills auto-trigger at session start. (#1995)
- **Hermes Agent**: install from a git clone; skills register with Hermes' native loader and the bootstrap loads on the first turn. (#1922, #2025)
- **Grok Build CLI** added to the install docs. (#1919)

### Brainstorming

- **Ceremony now scales to the task.** Requests are classified as spike, bounded, or architectural; small tasks skip the two-document ritual. Every path still stops for your approval before implementation. (#2063)

### Subagent-Driven Development

- **Controllers no longer stall on plan conflicts.** Non-catastrophic conflicts and ambiguities get a recorded ruling and work continues; only destructive or irreversible actions still stop for a human. One donated session had sat blocked for almost nine hours on a question the controller could have decided. (#2077)
- **The pre-dispatch conflict scan records its checks in the ledger** instead of just asserting the plan is clean. (#2080)
- **Small same-shape tasks batch into one dispatch**, cutting subagent cost sharply on micro-task plans; batch reviews verify every file in the brief made it into the diff. (#2078)
- **Implementers and reviewers may not spawn their own subagents**, which was producing duplicate reviews. (#2059)
- **Plans carry a `Spec:` pointer** and SDD reads the spec at setup, so plan conflicts get resolved against the design instead of guessed at. (#2086)
- Reviewers re-read evidence they find illegible instead of re-running the test suite (#2089), and circuit-breaker rulings now show up in the Finish report.

• Impact: 🟡 review (code touched)
• Commit mix: 1 docs · 1 other
• Files touched: code=0 docs=18 ci=1 test=7 other=14
• 2 new commit(s) since last check
• Latest: b36e082 — Release v6.3.0: Devin CLI and Hermes Agent support, brainstorming three-path router, SDD/Codex efficiency fixes (#2125)
• Recent commits:
• 44c9b2d [docs] docs: remove the "We're Hiring" section from the README
• b36e082 [other] Release v6.3.0: Devin CLI and Hermes Agent support, brainstorming three-path router, SDD/Codex efficiency fixes (#2125)

anthropic-skills

• Impact: 🟢 skim (docs/ci/test only)
• Commit mix: 2 other
• Files touched: code=0 docs=20 ci=0 test=0 other=0
• 2 new commit(s) since last check
• Latest: f6656c1 — Update claude-api skill: prompt-audit subcommand (#1557)
• Recent commits:
• f17010c [other] Update claude-api skill: Managed Agents August launch wave (#1532)
• f6656c1 [other] Update claude-api skill: prompt-audit subcommand (#1557)

knowledge-work-plugins

• Impact: 🟡 review (code touched)
• Commit mix: 208 other
• Files touched: code=0 docs=0 ci=0 test=0 other=4
• 208 new commit(s) since last check
• Latest: bd1fb11 — bump(wix): fa0280d1 → 3973a100 (#931)
• Recent commits:
• d10c2c9 [other] bump(wix): 87c6b285 → 6f402cef (#709)
• 7f1ce6b [other] bump(wix): 6f402cef → dd567862 (#710)
• 372e3b2 [other] bump(langfuse): 13a79944 → 93d82827 (#713)
• 9d92c5e [other] bump(wix): dd567862 → 9e3b2d55 (#711)
• 37820dc [other] bump(carta-cap-table): 0ee76454 → 35c25847 (#712)

n8n-mcp

• New release: v2.69.2 (was v2.66.1)
• Release notes:

# Release v2.69.2

Generating release notes from v2.69.1 to HEAD
### 🔧 Maintenance

- Upgrade @modelcontextprotocol/sdk to 1.30.0 (v2.69.2) (#996) (8ec71c8)

---

**Release Statistics:**
- 1 commit
- 1 contributor
- Contributors: Romuald Członkowski

---

## Installation

### NPM Package
```bash

• Impact: 🟡 review (code touched)
• Commit mix: 3 chore · 4 docs · 2 feat · 6 fix · 1 other
• Files touched: code=39 docs=16 ci=5 test=34 other=14
• 16 new commit(s) since last check
• Latest: 8ec71c8 — chore: upgrade @modelcontextprotocol/sdk to 1.30.0 (v2.69.2) (#996)
• Recent commits:
• b14f3c1 [docs] docs: sync skills pack v1.26.0 — canvas groups (nodeGroups) (#951)
• 1d15fc2 [fix] fix: AI-tool validation follow-ups from the 2.31.3 update review (#953–#956) (#962)
• 268f577 [fix] fix: bracket-index path updates and fabricated community node types (#950, #949) (#964)
• 3293e61 [feat] feat: add run and cancel actions to n8n_evaluations (#936) (#963)
• 8265427 [docs] docs: sync skills pack to n8n-skills v1.27.0 (evaluations run/cancel) (#966)

skillspector

• New release: v2.9.5 (was none)
• Release notes:

# SkillSpector v2.9.5

Released: 2026-08-14

## Summary

SkillSpector 2.9.5 expands provider support, adds opt-in author-shipped baselines, and strengthens static detection for insecure deserialization. It also improves analyzer accuracy and compatibility across safety-pattern, MCP dependency, and YARA scanning paths.

## Highlights

- Add Ollama, Azure OpenAI, and generic OpenAI-compatible providers.
- Add static detection coverage for insecure deserialization patterns.
- Improve scan accuracy with opt-in shipped baselines, lower false positives, and more precise YARA source locations.

## Added

- Add Ollama support for local OpenAI-compatible inference, Azure OpenAI deployment routing, and a configurable provider for other OpenAI-compatible endpoints.
- Add opt-in discovery of a top-level `.skillspector-baseline.yaml` while keeping explicitly supplied baselines authoritative.
- Add analyzer coverage for insecure deserialization patterns represented by AST10, TT6, and DS1–DS4 findings.

• Impact: 🟡 review (code touched)
• Commit mix: 8 chore · 1 docs · 6 feat · 14 fix · 11 other · 1 test
• Files touched: code=63 docs=24 ci=3 test=58 other=11
• 41 new commit(s) since last check
• Latest: 27fd962 — release: SkillSpector 2.9.5 (#378)
• Recent commits:
• 34f6030 [feat] feat: publish 2.5.0 execution accounting (#308)
• da5cb13 [feat] feat(llm): make analyzer fan-out concurrency configurable via env (#305)
• 3f11bfa [other] release: publish OSS snapshot 2.5.1 (#320)
• e48fc1a [fix] fix(input-handler): bound URL, zip, and git ingest paths (#164)
• 1df69ad [fix] fix(analyzer): reduce instructional-prose false positives in static scans (#103) (#232)

transitions

• Impact: 🟡 review (code touched)
• Commit mix: 4 feat · 9 fix · 1 perf
• Files touched: code=0 docs=0 ci=0 test=0 other=12
• 14 new commit(s) since last check
• Latest: 4eb4614 — fix(nav): no "Get Pro" flash before /me answers
• Recent commits:
• 0ec87b1 [fix] fix: sidebar edge fade, footer alignment, and mobile layout issues
• 1eea31f [feat] feat(pro): add gooey plus menu, drag & drop physics, spinner→check morph
• 9ab8174 [fix] fix(pro): drag no longer opens the detail page; use the stack's middle photo
• c10106d [fix] fix(pro): make the gooey merge readable in dark mode; woman photo for drag & drop
• 67d5c67 [fix] fix(pro): restore smoky dissolve + image open tilt to their original photo

claude-mem

• New release: v13.15.2 (was v13.12.4)
• Release notes:

## Observer errors now tell you what happened and what to do

When the memory observer stops working — most commonly a CMEM Pro allowance that's been used up — claude-mem now says so in plain words, once, with the one thing to do about it. No more silent `OpenRouter upstream error (status 502)` retry loops.

### Fixes
- **Worker carries the gateway's error envelope** (#3601): the OpenRouter classifier now understands the cmem.ai gateway's `{code, message, action, url, request_id}` errors and, for plain OpenRouter, keeps the upstream body (e.g. `Key limit exceeded … Manage it using <url>`) instead of discarding it. 402 and "key limit exceeded" bodies are classified as quota exhausted and are **not retried**.
- **One log line per failure**: `Observer failed {kind, code, requestId} <message — action url (req id)>` replaces the five-line fan-out.
- **Session-start warning says the right thing** (#3601, #3612): the observer-health warning now shows the message, a `What to do:` line, the link, and the request id — and no longer tells Pro users to edit `~/.claude-mem/settings.json`. It also appears for projects that have no memories yet (previously the welcome hint hid it).
- **Observer-health alerting** (#3538): claude-mem alerts you at session start when observations stop flowing.

### Pro trial
- **7-day Pro trial surfaced everywhere the viewer URL is shown** (#3613): session-start banner, per-message banner, first-session welcome hint, installer "Next Steps", viewer header, and cursor-hooks docs — one source of truth (`src/shared/pro-promo.ts`) with per-surface `?from=` attribution links to https://cmem.ai/pro.

Pairs with the cmem.ai gateway change (claude-mem-pro #106): honest status codes (402/401/429/503, never 502), a 6-code error taxonomy, and an `x-request-id` on every error.

_Note: v13.15.1 was tagged but never released or published; 13.15.2 supersedes it._

• Impact: 🟡 review (code touched)
• Commit mix: 6 chore · 5 docs · 5 feat · 4 fix · 1 other
• Files touched: code=27 docs=10 ci=0 test=13 other=21
• 21 new commit(s) since last check
• Latest: fae697a — docs: update changelog for v13.15.2
• Recent commits:
• a90066f [fix] fix(chroma): prevent concurrent write storms (#3462)
• dd68d21 [feat] feat(observations): add "sensitive" type with Telegram notification (#3468)
• ce92132 [chore] chore: bump version to 13.13.0
• b368aba [docs] docs: update changelog for v13.13.0
• 9326fae [feat] feat: add custom mode creator skill (#3487)

caveman

• New release: bin-v1.1.0 (was v1.9.1)
• Release notes:

Signed Caveman runtime companions for macOS, Linux, and Windows.

• Impact: 🟡 review (code touched)
• Commit mix: 7 chore · 1 ci · 9 docs · 6 feat · 17 fix · 12 other · 2 test
• Files touched: code=0 docs=63 ci=8 test=69 other=160
• 54 new commit(s) since last check
• Latest: 766dce6 — Merge remote-tracking branch 'origin/main' into optimized
• Recent commits:
• 710173f [fix] fix(skill): negation safety, tool-call silence, language-drift hardening
• 7693a04 [fix] fix(hooks): shared parser, envelope unwrap, resume-safe SessionStart
• d833f4a [feat] feat(stats): surface net savings, not just gross (#145, #677)
• dcd51f1 [fix] fix(compress): stop Windows data loss — UTF-8 + atomic writes (#652, #655, #686)
• ed1fbb7 [fix] fix(install): rename bin/ to cli/, harden Windows quoting, clean uninstall

playwright-mcp

• New release: v0.0.79 (was v0.0.78)
• Release notes:

## What's New

### Tool Improvements

- **`browser_take_screenshot` — WebP format** — New `type` option to pick the image format (`png`, `jpeg` or `webp`); when unset, the format is inferred from the filename extension ([#41152](https://github.com/microsoft/playwright/pull/41152))
- **`--codegen` — more languages** — Code generation now supports `python`, `java` and `csharp` in addition to `typescript` ([#42106](https://github.com/microsoft/playwright/pull/42106))
- **Configurable settle delay** — New `--timeout-settle` flag (and `timeouts.settle` config option) to control how long to wait after each action for triggered work (navigations, requests) to settle, defaults to 500ms ([#41924](https://github.com/microsoft/playwright/pull/41924))

## Fixes

- Aria snapshot capture is skipped when the response discards it ([#41923](https://github.com/microsoft/playwright/pull/41923))
- New `--snapshot-boxes` flag (and `snapshot.boxes` config option) to enable bounding boxes in snapshots globally — previously this was only available per command ([#42102](https://github.com/microsoft/playwright/pull/42102))
- Reconnect to the browser after a disconnect ([#41966](https://github.com/microsoft/playwright/pull/41966))
- Report malformed JSON config instead of silently falling back to INI parsing ([#41909](https://github.com/microsoft/playwright/pull/41909))
- Clear the dialog modal state when a dialog is closed out of band ([#42032](https://github.com/microsoft/playwright/pull/42032))
- Detect downloads via the download event instead of guessing from `net::ERR_ABORTED` navigation errors ([#41933](https://github.com/microsoft/playwright/pull/41933))
- Surface the missing executable path when a browser isn't installed ([#41941](https://github.com/microsoft/playwright/pull/41941))
- Escape user input in codegen output ([#41962](https://github.com/microsoft/playwright/pull/41962))
- Removed the stale `--output-mode` CLI option ([#41833](https://github.com/microsoft/playwright/pull/41833))

• Impact: 🟡 review (code touched)
• Commit mix: 6 chore · 1 other
• Files touched: code=0 docs=1 ci=0 test=0 other=5
• 7 new commit(s) since last check
• Latest: 7e0457a — devops: add ESRP pipeline for publishing npm alpha versions (#1709)
• Recent commits:
• 30710c8 [chore] chore(deps-dev): bump fast-uri from 3.1.2 to 3.1.4 (#1692)
• 42e792a [chore] chore(deps-dev): bump hono from 4.12.26 to 4.12.31 (#1687)
• f2db2c2 [chore] chore(deps-dev): bump ip-address from 10.2.0 to 10.4.0 (#1703)
• 8414d57 [chore] chore(deps): bump @hono/node-server and @modelcontextprotocol/sdk (#1702)
• 4ed35bf [chore] chore: roll Playwright to 1.63.0-alpha-2026-08-05 (#1706)

Updated by the upstream tracker workflow.