# v5.0.1 — Security Patch

**Release Date:** March 6, 2026

Patches a HIGH severity path traversal vulnerability in npm's bundled `tar` package discovered by Docker Scout during the v5.0.0 deployment pipeline.

## 🔒 Security

- **GHSA-qffp-2rhf-9h96 (tar)** — Manually patched npm's bundled `tar` → `7.5.10` in Dockerfile (builder + production stages) to fix HIGH severity path traversal vulnerability (CVSS 8.2). Also updated npm override in `package.json`.

## 🔄 Changed

- `tar` override: 7.5.9 → 7.5.10 (patch) — npm + Docker layers

---

**Full Changelog:** [v5.0.0...v5.0.1](https://github.com/neverinfamous/memory-journal-mcp/compare/v5.0.0...v5.0.1)

**Install/Update:**

```bash
npm install -g memory-journal-mcp@5.0.1
# or
docker pull writenotenow/memory-journal-mcp:v5.0.1
```
