What upstream-version-tested actually promises

It is a provenance claim, not a version number: it says this is the release we read and verified the body against. That makes a pin-only bump a way of asserting something nobody checked. Switch modes to see what each strategy does to the drift linter, and what it misses even when green.

Bump strategy

skillpackagepinbody sayslinter
0 passed
0 failed
2 invisible to the linter in every mode

What reading the changelogs turned up

Neither of these is a version-string problem. Both would have survived any number of pin-only bumps.

emulate-seed documented a verifier that is now wrong for Stripe

Since emulate 0.10.0, Stripe deliveries carry Stripe-Signature: t=<ts>,v1=<hmac> signed over <ts>.<raw body>. The skill showed one generic helper: 'sha256=' + hmac(body) // correct for GitHub, wrong for Stripe Anyone following it for Stripe writes a verifier that fails on both the header shape and the signed payload.

browser-tools credited 0.34.0 with features from four other releases

pushstate, removeinitscript, react-devtools, profiler, plugin, confirm/deny, --webgpu, MCP --tools Against the upstream changelog: pushstate landed in 0.27.0, the plugin system and --tools in 0.28.0, --webgpu in 0.31.2, and removeinitscript and confirm/deny appear nowhere in it. Only --pin-tab was 0.34.0. The file already dated pushstate to v0.27 in two other places, so it contradicted itself.