# v3.1.3 - Security Fixes for Docker Scout CVEs

**Release Date:** January 11, 2026

## Security Fixes

### Docker Image CVE Remediation

This release actively fixes several CVEs that Docker Scout flagged:

#### npm Global Upgrade

- **CVE-2025-64756** (glob, HIGH) — Fixed by upgrading npm globally in Docker build
- **CVE-2025-64118** (tar, MEDIUM) — Fixed by upgrading npm globally in Docker build

#### Alpine Edge Repository

- **CVE-2025-14524** (curl, MEDIUM) — Fixed via Alpine edge: curl 8.18.0-r0
- **CVE-2025-14819** (curl, MEDIUM) — Fixed via Alpine edge: curl 8.18.0-r0
- **CVE-2025-14017** (curl, N/A) — Fixed via Alpine edge: curl 8.18.0-r0

#### protobufjs CLI Cleanup

- **CVE-2025-54798** (tmp, LOW) — Fixed by removing bundled protobufjs/cli deps and applying npm overrides
- **CVE-2025-5889** (brace-expansion, LOW) — Fixed by removing bundled protobufjs/cli deps and applying npm overrides

### Remaining Allowlisted CVEs (No Upstream Fix)

These CVEs have **no fix available** from upstream:

- **CVE-2026-22184** (zlib, CRITICAL) — Alpine has not released a fix version
- **CVE-2019-10790** (taffydb, HIGH) — Package is 6+ years unmaintained/abandoned

---

## Dockerfile Changes

- Added `npm install -g npm@latest` to upgrade bundled npm
- Added Alpine edge repository for curl security patches
- Added protobufjs cli cleanup to force npm overrides
- Copying `.npmrc` into build for consistent dependency resolution

---

## Installation

**npm:**

```bash
npm install -g memory-journal-mcp@3.1.3
```

**Docker:**

```bash
docker pull writenotenow/memory-journal-mcp:3.1.3
```

---

## Links

- [Full Changelog](https://github.com/neverinfamous/memory-journal-mcp/wiki/CHANGELOG)
- [v3.1.0 Release Notes](https://github.com/neverinfamous/memory-journal-mcp/releases/tag/v3.1.0)
