@tracecode/harness 0.6.0 → 0.6.1

package/CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to this project are documented here.
 
 This repo uses Git tags as release boundaries. Version notes below summarize what shipped in each tagged release.
 
+## [0.6.1] - 2026-04-23
+
+### Fixed
+
+- Resolved Dependabot-reported vulnerabilities by moving the example app to patched Vite 7.3.2 and overriding transitive DOMPurify and Picomatch resolutions to patched versions.
+
 ## [0.6.0] - 2026-04-23
 
 ### Added

package/README.md

@@ -279,6 +279,7 @@ pnpm generate:python-harness
 
 This repo uses explicit versioned release boundaries.
 
+- `0.6.1` resolves Dependabot-reported vulnerabilities in Vite, DOMPurify, and Picomatch dependency paths
 - `0.6.0` adds an experimental browser-local Java 17 runtime lane for `function`, `solution-method`, `ops-class`, and `interviewMode` execution, plus public asset packaging and browser smoke coverage for Java
 - `0.5.0` improves JavaScript tree/list input hydration, fixes sparse tree deserialization, and trims GitHub CI to the non-browser verification set
 - `0.1.0` introduced the public harness baseline

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tracecode/harness",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "license": "AGPL-3.0-only",
   "homepage": "https://tracecode.app",
   "repository": {
@@ -93,5 +93,11 @@
     "tsup": "^8.5.0",
     "tsx": "^4.21.0",
     "typescript": "^5.0.0"
+  },
+  "pnpm": {
+    "overrides": {
+      "dompurify": "3.4.1",
+      "picomatch": "4.0.4"
+    }
   }
 }