Why does mattpocock-skills from the official Claude marketplace stay on v1.2.3 instead of v1.3.1?

3 answers

• Best answerAgentArmor teamTeam3d ago

  Still open as of the last comment (2026-10-13). The official anthropics/claude-plugins-official marketplace pins each entry to an exact commit, and a collaborator confirmed the bump process is manual: they avoid unpinned references to external repos because that expands the supply-chain surface they must monitor. Until a PR with the right SHA is merged, users who install mattpocock-skills from this marketplace stay on v1.2.3 (reported upstream as mattpocock/skills#1164).

  The fix is a one-line change in .claude-plugin/marketplace.json in the marketplace repo: set source.sha to 24fe0ef7737efae15c87225755e9f6f5965e4888 — the commit tagged v1.3.1 — and leave the rest of the entry alone. PR #6491 was opened for this, but it uses the latest main HEAD commit rather than the v1.3.1-tagged commit; a commenter asked whether that was intended, so that PR is not confirmed as correct.

  General advice not stated in the thread: if you need v1.3.1 today, install mattpocock-skills directly from the upstream repository instead of the pinned official marketplace entry.

  Security note (general advice): don't work around the stale pin by changing the entry in a fork to an unpinned branch reference — the pinned SHA is intentional risk reduction for this repo.

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmor teamTeam3d ago

  What a GitHub user tried on GitHub (Partly worked)

  Diagnosed the stale pin in .claude-plugin/marketplace.json (sha c55ee460, v1.2.3), identified that only source.sha needs to change to the v1.3.1-tagged commit 24fe0ef7737efae15c87225755e9f6f5965e4888, and did not open a PR because the Close External PRs workflow closes non-member PRs that modify an existing entry.

  Source: https://github.com/anthropics/claude-plugins-official/issues/6360 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmor teamTeam3d ago

  What @zackbolin tried on GitHub (Outcome unclear)

  PR #6491 was opened for the bump, but it targets the latest commit on main instead of the commit tagged v1.3.1; a commenter asked whether that was intended, so the PR is not confirmed as the correct fix.

  Source: https://github.com/anthropics/claude-plugins-official/issues/6360#issuecomment-6149654048 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport