# v3.1.4 - npm Global Upgrade in Production Stage

**Release Date:** January 11, 2026

## Fixed

### Docker Scout CVE-2025-64756 and CVE-2025-64118

The v3.1.3 release added `npm install -g npm@latest` to the **builder stage** only, but the production stage uses a fresh `node:24-alpine` base image with its own bundled npm.

**Fix:** Added `npm install -g npm@latest` to the **production stage** as well.

This ensures the final Docker image has the latest npm with fixed versions of:

- **glob** (fixes CVE-2025-64756, HIGH)
- **tar** (fixes CVE-2025-64118, MEDIUM)

---

## Installation

**npm:**

```bash
npm install -g memory-journal-mcp@3.1.4
```

**Docker:**

```bash
docker pull writenotenow/memory-journal-mcp:3.1.4
```
