# v3.1.5 - Remove protobufjs CLI to Eliminate taffydb CVE

**Release Date:** January 11, 2026

## Security Fixes

### protobufjs CLI Removal

The `protobufjs` package (transitive dependency via `@xenova/transformers → onnxruntime-web → onnx-proto`) includes a `/cli/` folder for `.proto` file compilation. This CLI folder contains unmaintained dependencies with known CVEs.

**Since the CLI is not used at runtime**, we now remove it entirely from the Docker image:

```dockerfile
RUN rm -rf node_modules/protobufjs/cli
```

**CVEs Eliminated:**

- **CVE-2019-10790** (taffydb, HIGH) — 6+ year old unmaintained package
- **CVE-2025-54798** (tmp, LOW) — Symlink vulnerability
- **CVE-2025-5889** (brace-expansion, LOW) — ReDoS vulnerability

### Remaining Allowlisted CVEs (No Upstream Fix)

These CVEs still have **no fix available** from Alpine:

- **CVE-2026-22184** (zlib, CRITICAL) — Alpine hasn't packaged zlib 1.3.1.3 yet
- **CVE-2025-60876** (busybox, MEDIUM) — Patch submitted to busybox but not released

---

## Installation

**npm:**

```bash
npm install -g memory-journal-mcp@3.1.5
```

**Docker:**

```bash
docker pull writenotenow/memory-journal-mcp:3.1.5
```
