By default Claude chooses old versions of libraries. without something that checks for CVEs you're gonna be shipping criticals like no tomorrow.

Yes, there are more CVEs discovered every day, but, if you don't patch, the hacker doesn't have to try.