[mhegazy]

Manual SHA bump for security-guidance, from 2.0.16 to 2.0.17.

Old SHA	New SHA
af59ee3a1051	41f619d61b99

The new SHA is the commit on claude-plugins-official main that merged the 2.0.17 version bump (anthropics/claude-plugins-official#6908).

Upstream changes in this range

Reviews

• In-flight review markers now hold on native Windows, so a push no longer reviews a commit still under review (security-guidance: hold in-flight review markers on native Windows too claude-plugins-official#6875).

Telemetry only

• Network failure class (security-guidance: report why a review call got no HTTP response claude-plugins-official#6839).
• Slow prompt hook timing (security-guidance: report where a slow prompt's time goes claude-plugins-official#6858).
• Failed intent-to-add (security-guidance: count failed git add -N calls in the Stop review claude-plugins-official#6861).
• Repeat reviews of the same diff (security-guidance: count reviews of a diff that was already reviewed claude-plugins-official#6836).
• Turns and model time of a commit review (security-guidance: report turns and model time of a commit review (measure only) claude-plugins-official#6903).

Test plan

• .claude-plugin/marketplace.json parses, and only the security-guidance source.sha line changes.
• plugins/security-guidance/.claude-plugin/plugin.json at the new SHA reads 2.0.17.

---

Generated by Claude Code

[mhegazy]

check (Check MCP URLs) fails on an unrelated data plugin server, https://api.definite.app/v3/mcp/http (404). The same check fails on main's daily runs, and this PR only changes the security-guidance SHA. It is not a required check, and no fix exists yet, so nothing was ported here.

---

Generated by Claude Code