# v6.1.1 — CodeQL Security & Hygiene Patch

Resolves 16 CodeQL alerts introduced with the v6.1.0 scan: 3 medium (Docker workflow), 1 warning (useless assignment), 12 notes (unused variables in tests).

## Highlights

- **Docker Workflow Hardening** — Removed explicit `ref: ${{ github.event.workflow_run.head_sha }}` from checkout steps to resolve "untrusted checkout in trusted context" alerts
- **Dead Code Removal** — Cleaned up 12 unused variables, imports, and constants across test files
- **Source Hygiene** — Removed useless initial assignment in `github-section.ts`

## Security

- Remove `ref:` from `docker-publish.yml` checkout steps (#145, #146, #147) — workflow only triggers on main via `workflow_run`, so default checkout is safe

## Fixed

- Remove dead `= 'unknown'` initializer on `status` in `github-section.ts` (#148)
- Remove 12 unused variables/imports across test and utility files (#149–#160)

---

**Compare**: [`v6.1.0...v6.1.1`](https://github.com/neverinfamous/memory-journal-mcp/compare/v6.1.0...v6.1.1)

```bash
npm install -g memory-journal-mcp@6.1.1
```

```bash
docker pull writenotenow/memory-journal-mcp:v6.1.1
```
