[Dextheking1]

The starter-advanced template launches @modelcontextprotocol/server-postgres unpinned via npx -y, with POSTGRES_URL in the environment. Anyone who starts from this template runs whatever the latest publish happens to be at that moment, with their database connection string exposed to it.

Pin to 0.6.2, the current release.

---

Note

Low Risk
Config-only version pin in a template; reduces unpinned dependency risk with no runtime code changes in this repo.

Overview
The starter-advanced template’s Postgres MCP config no longer pulls the latest @modelcontextprotocol/server-postgres on every npx -y run. It now pins @modelcontextprotocol/server-postgres@0.6.2, so new projects from this template get a fixed server version instead of whatever was published most recently—important because the config still passes POSTGRES_URL into that process.

^{Reviewed by Cursor Bugbot for commit ff504fc. Bugbot is set up for automated code reviews on this repo. Configure here.}