skilldrop 0.16.39

Released 2026-10-20 · npx skilldrop-cli@0.16.39

Eval fixtures no longer raise Dependabot alerts. A fixture's fake package.json, go.mod, pyproject.toml or CI workflow is now stored as <name>.fixture. GitHub no longer reads its pins as the repo's own dependencies, which had produced 33 alerts and six security PRs against code nothing installs or runs. run_bench.py gives each file its real name in the run's workspace, and validate.py fails on a fixture dependency file that keeps its real name (RFC-0058).