From 1a8bef36357eef28ed207ffb5b42e93a4c352eb0 Mon Sep 17 00:00:00 2001
From: wfostersbp <70692712+wfostersbp@users.noreply.github.com>
Date: Thu, 22 Oct 2026 11:23:34 +0200
Subject: [PATCH] chore(release): v1.4.1

Patch release carrying only the bundled Node runtime bump to 22.23.4 (#103),
the Node.js security release of 2026-10-21 (CVE-2026-111497 Brotli decoder
RCE and the TLS/DNS fixes). Nothing else changed since 1.4.0. Tracked in
LABS-1035.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 CHANGELOG.md      | 10 ++++++++++
 package-lock.json |  4 ++--
 package.json      |  2 +-
 3 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6b4ce8a..1ffb99c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.4.1] - 2026-10-22
+
+### Security
+
+- **Bundled Node runtime 22.20.0 to 22.23.4** (#103). Picks up the Node.js security release of
+  2026-10-21: CVE-2026-111497 (High, Brotli decoder out-of-bounds write permitting remote code
+  execution), CVE-2026-105482 (`dns.resolve` NUL truncation), CVE-2026-106069 (TLS hostname
+  bypass) and the medium and low fixes alongside them. Same 22.x line, so the `serialport`
+  native binding is unchanged. Tracked in LABS-1035.
+
 ## [1.4.0] - 2026-09-14
 
 ### Added
diff --git a/package-lock.json b/package-lock.json
index 8cd1962..d399e48 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "penplotter271",
-  "version": "1.4.0",
+  "version": "1.4.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "penplotter271",
-      "version": "1.4.0",
+      "version": "1.4.1",
       "dependencies": {
         "@types/ws": "^8.18.1",
         "konva": "^10.3.2",
diff --git a/package.json b/package.json
index 11763b8..1bab032 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "penplotter271",
   "private": true,
-  "version": "1.4.0",
+  "version": "1.4.1",
   "type": "module",
   "scripts": {
     "dev": "vite",