bug: fix_dependencies wipes all tags except 'master' from tasks.json

[reinamora137]

Description

The fix_dependencies MCP tool (and CLI task-master fix-dependencies) can catastrophically wipe all tags except "master" from tasks.json. In our multi-tag workspace (51 tags, 13 MB tasks.json), running fix_dependencies on one tag caused data loss across all other tags.

Steps to Reproduce

1. Have a tasks.json with multiple tags (e.g., master, project-a, project-b)
2. Run fix_dependencies({tag: "project-a", projectRoot: "..."})
3. Observe that tasks.json now only contains the master tag — all other tags are deleted

Expected Behavior

fix_dependencies should only modify dependency references within the specified tag, preserving all other tags.

Actual Behavior

All tags except master are removed from tasks.json. This is catastrophic data loss in multi-tag workspaces.

Workaround

We have permanently blocked this tool via deniedTools in .claude/settings.json and use manual remove_dependency() + add_dependency() instead:

// Safe alternative
remove_dependency({id: "2.4", dependsOn: "2.3", tag: "your-tag"});
add_dependency({id: "2.4", dependsOn: "2.2", tag: "your-tag"});

Environment

• Task Master version: 0.43.0
• Node.js version: v24.13.0
• Operating system: Ubuntu 24.04 (NVIDIA DGX)
• IDE: Claude Code CLI

Additional Context

This has caused data loss multiple times in our workspace. The tool should either be fixed to be tag-scoped, or removed/deprecated with a warning. We've added it to our deniedTools list permanently.