Madraka · Nov 10, 2026 · Nov 10, 2026
diff --git a/.changeset/codeql-backlog-security.md b/.changeset/codeql-backlog-security.md
diff --git a/packages/agent-runtime/CHANGELOG.md b/packages/agent-runtime/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @cloudhal/agent-runtime
 
+## 0.7.1
+
+### Patch Changes
+
+- @cloudhal/[email protected]
+  - @cloudhal/[email protected]
+
 ## 0.7.0
 
 ### Patch Changes

diff --git a/packages/agent-runtime/package.json b/packages/agent-runtime/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cloudhal/agent-runtime",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Cloudhal agent runtime: policy engine (actors, scopes, approvals), skill loader, audit log",
   "license": "Apache-2.0",
   "homepage": "https://cloudhal.dev",

diff --git a/packages/analytics/CHANGELOG.md b/packages/analytics/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @cloudhal/analytics
 
+## 0.7.1
+
+### Patch Changes
+
+- @cloudhal/[email protected]
+  - @cloudhal/[email protected]
+
 ## 0.7.0
 
 ### Patch Changes

diff --git a/packages/analytics/package.json b/packages/analytics/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cloudhal/analytics",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Cloudhal site analytics (RFC-0006): query model, classifiers, beacon handler, SQLite/D1 store, daily rollups and Workers Analytics Engine adapters. Worker-safe.",
   "license": "Apache-2.0",
   "homepage": "https://cloudhal.dev",

diff --git a/packages/api/CHANGELOG.md b/packages/api/CHANGELOG.md
@@ -1,5 +1,25 @@
 # @cloudhal/api
 
+## 0.7.1
+
+### Patch Changes
+
+- 24fe76b: Security fixes from the CodeQL backlog on `main`.
+
+  - **Prototype pollution.** A2UI `updateDataModel` paths (`@cloudhal/core-ts/interop`) that name `__proto__`, `constructor` or `prototype` at any depth are now refused with an `InteropError` instead of being skipped, step into arrays by index only, and write own properties only; an input whose component id is one of those keys gets the data key `<id>-value`. Surface pointers the page writes through (an input's `value`/`checked`, a Scrolly's `step`, a Button action's `path`) may not name those keys (a `checkSurface` issue); read bindings still may. The Build eval's sample inputs never write through them, and `set_chrome` and `update_entry`'s `fields` merge patch refuse them as keys. `RESERVED_KEYS` and `isReservedKey` are new in `@cloudhal/core-ts/names`.
+  - **Plain text from HTML.** `htmlText` (meta and feed descriptions, JSON-LD, table-of-contents labels) is plain text: `&lt;script&gt;` in markdown is the text `<script>`, as before, and every place it goes escapes it (now tested sink by sink). Tags are dropped with a linear scan, and entities are decoded once (`&amp;#60;` is the text `&#60;`, no longer `<`).
+  - **Linear scans (AGENTS.md rule 13).** The svg sniff of uploads (exponential on `<!--` followed by many `--><!--`), the code-fence opener of surface bodies, the rich-text-to-text and text-to-rich-text field conversions, hostname normalization, the leading-H1 check of articles, the table of contents, the `::embed` check, the sender-address check (`isMailAddress`, new in `@cloudhal/api`; `MAIL_ADDRESS` in `@cloudhal/cloudflare/mail` is deprecated) and Studio's origin trim no longer backtrack. Each gives the old regex's answers; one intended difference: an svg comment ends at its first `-->`.
+- Updated dependencies [24fe76b]
+  - @cloudhal/[email protected]
+  - @cloudhal/[email protected]
+  - @cloudhal/[email protected]
+  - @cloudhal/[email protected]
+  - @cloudhal/[email protected]
+  - @cloudhal/[email protected]
+  - @cloudhal/[email protected]
+  - @cloudhal/[email protected]
+  - @cloudhal/[email protected]
+
 ## 0.7.0
 
 ### Minor Changes

diff --git a/packages/api/package.json b/packages/api/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cloudhal/api",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Cloudhal HTTP API (Hono): sites, pages, entries, snapshots, auth — runs on Node and Cloudflare Workers",
   "license": "Apache-2.0",
   "homepage": "https://cloudhal.dev",

diff --git a/packages/astro-renderer/CHANGELOG.md b/packages/astro-renderer/CHANGELOG.md
@@ -1,5 +1,21 @@
 # @cloudhal/astro-renderer
 
+## 0.7.1
+
+### Patch Changes
+
+- 24fe76b: Security fixes from the CodeQL backlog on `main`.
+
+  - **Prototype pollution.** A2UI `updateDataModel` paths (`@cloudhal/core-ts/interop`) that name `__proto__`, `constructor` or `prototype` at any depth are now refused with an `InteropError` instead of being skipped, step into arrays by index only, and write own properties only; an input whose component id is one of those keys gets the data key `<id>-value`. Surface pointers the page writes through (an input's `value`/`checked`, a Scrolly's `step`, a Button action's `path`) may not name those keys (a `checkSurface` issue); read bindings still may. The Build eval's sample inputs never write through them, and `set_chrome` and `update_entry`'s `fields` merge patch refuse them as keys. `RESERVED_KEYS` and `isReservedKey` are new in `@cloudhal/core-ts/names`.
+  - **Plain text from HTML.** `htmlText` (meta and feed descriptions, JSON-LD, table-of-contents labels) is plain text: `&lt;script&gt;` in markdown is the text `<script>`, as before, and every place it goes escapes it (now tested sink by sink). Tags are dropped with a linear scan, and entities are decoded once (`&amp;#60;` is the text `&#60;`, no longer `<`).
+  - **Linear scans (AGENTS.md rule 13).** The svg sniff of uploads (exponential on `<!--` followed by many `--><!--`), the code-fence opener of surface bodies, the rich-text-to-text and text-to-rich-text field conversions, hostname normalization, the leading-H1 check of articles, the table of contents, the `::embed` check, the sender-address check (`isMailAddress`, new in `@cloudhal/api`; `MAIL_ADDRESS` in `@cloudhal/cloudflare/mail` is deprecated) and Studio's origin trim no longer backtrack. Each gives the old regex's answers; one intended difference: an svg comment ends at its first `-->`.
+- Updated dependencies [24fe76b]
+  - @cloudhal/[email protected]
+  - @cloudhal/[email protected]
+  - @cloudhal/[email protected]
+  - @cloudhal/[email protected]
+  - @cloudhal/[email protected]
+
 ## 0.7.0
 
 ### Patch Changes

diff --git a/packages/astro-renderer/package.json b/packages/astro-renderer/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cloudhal/astro-renderer",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Render a Cloudhal Site Graph with Astro: data sources (live/snapshot), section components and the cloudhal() integration",
   "license": "Apache-2.0",
   "homepage": "https://cloudhal.dev",

diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md
@@ -1,5 +1,26 @@
 # @cloudhal/cli
 
+## 0.7.1
+
+### Patch Changes
+
+- 24fe76b: Security fixes from the CodeQL backlog on `main`.
+
+  - **Prototype pollution.** A2UI `updateDataModel` paths (`@cloudhal/core-ts/interop`) that name `__proto__`, `constructor` or `prototype` at any depth are now refused with an `InteropError` instead of being skipped, step into arrays by index only, and write own properties only; an input whose component id is one of those keys gets the data key `<id>-value`. Surface pointers the page writes through (an input's `value`/`checked`, a Scrolly's `step`, a Button action's `path`) may not name those keys (a `checkSurface` issue); read bindings still may. The Build eval's sample inputs never write through them, and `set_chrome` and `update_entry`'s `fields` merge patch refuse them as keys. `RESERVED_KEYS` and `isReservedKey` are new in `@cloudhal/core-ts/names`.
+  - **Plain text from HTML.** `htmlText` (meta and feed descriptions, JSON-LD, table-of-contents labels) is plain text: `&lt;script&gt;` in markdown is the text `<script>`, as before, and every place it goes escapes it (now tested sink by sink). Tags are dropped with a linear scan, and entities are decoded once (`&amp;#60;` is the text `&#60;`, no longer `<`).
+  - **Linear scans (AGENTS.md rule 13).** The svg sniff of uploads (exponential on `<!--` followed by many `--><!--`), the code-fence opener of surface bodies, the rich-text-to-text and text-to-rich-text field conversions, hostname normalization, the leading-H1 check of articles, the table of contents, the `::embed` check, the sender-address check (`isMailAddress`, new in `@cloudhal/api`; `MAIL_ADDRESS` in `@cloudhal/cloudflare/mail` is deprecated) and Studio's origin trim no longer backtrack. Each gives the old regex's answers; one intended difference: an svg comment ends at its first `-->`.
+- Updated dependencies [24fe76b]
+  - @cloudhal/[email protected]
+  - @cloudhal/[email protected]
+  - @cloudhal/[email protected]
+  - @cloudhal/[email protected]
+  - @cloudhal/[email protected]
+  - @cloudhal/[email protected]
+  - @cloudhal/[email protected]
+  - @cloudhal/[email protected]
+  - @cloudhal/[email protected]
+  - @cloudhal/[email protected]
+
 ## 0.7.0
 
 ### Minor Changes

diff --git a/packages/cli/package.json b/packages/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cloudhal/cli",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "cloudhal — create, run and build Cloudhal sites locally",
   "license": "Apache-2.0",
   "homepage": "https://cloudhal.dev",

diff --git a/packages/cloudflare/CHANGELOG.md b/packages/cloudflare/CHANGELOG.md
@@ -1,5 +1,24 @@
 # @cloudhal/cloudflare
 
+## 0.7.1
+
+### Patch Changes
+
+- 24fe76b: Security fixes from the CodeQL backlog on `main`.
+
+  - **Prototype pollution.** A2UI `updateDataModel` paths (`@cloudhal/core-ts/interop`) that name `__proto__`, `constructor` or `prototype` at any depth are now refused with an `InteropError` instead of being skipped, step into arrays by index only, and write own properties only; an input whose component id is one of those keys gets the data key `<id>-value`. Surface pointers the page writes through (an input's `value`/`checked`, a Scrolly's `step`, a Button action's `path`) may not name those keys (a `checkSurface` issue); read bindings still may. The Build eval's sample inputs never write through them, and `set_chrome` and `update_entry`'s `fields` merge patch refuse them as keys. `RESERVED_KEYS` and `isReservedKey` are new in `@cloudhal/core-ts/names`.
+  - **Plain text from HTML.** `htmlText` (meta and feed descriptions, JSON-LD, table-of-contents labels) is plain text: `&lt;script&gt;` in markdown is the text `<script>`, as before, and every place it goes escapes it (now tested sink by sink). Tags are dropped with a linear scan, and entities are decoded once (`&amp;#60;` is the text `&#60;`, no longer `<`).
+  - **Linear scans (AGENTS.md rule 13).** The svg sniff of uploads (exponential on `<!--` followed by many `--><!--`), the code-fence opener of surface bodies, the rich-text-to-text and text-to-rich-text field conversions, hostname normalization, the leading-H1 check of articles, the table of contents, the `::embed` check, the sender-address check (`isMailAddress`, new in `@cloudhal/api`; `MAIL_ADDRESS` in `@cloudhal/cloudflare/mail` is deprecated) and Studio's origin trim no longer backtrack. Each gives the old regex's answers; one intended difference: an svg comment ends at its first `-->`.
+- Updated dependencies [24fe76b]
+  - @cloudhal/[email protected]
+  - @cloudhal/[email protected]
+  - @cloudhal/[email protected]
+  - @cloudhal/[email protected]
+  - @cloudhal/[email protected]
+  - @cloudhal/[email protected]
+  - @cloudhal/[email protected]
+  - @cloudhal/[email protected]
+
 ## 0.7.0
 
 ### Minor Changes

diff --git a/packages/cloudflare/package.json b/packages/cloudflare/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cloudhal/cloudflare",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Cloudhal on Cloudflare: the admin Worker (API, auth, MCP, Studio) over D1 + R2",
   "license": "Apache-2.0",
   "homepage": "https://cloudhal.dev",

diff --git a/packages/comments/CHANGELOG.md b/packages/comments/CHANGELOG.md
@@ -1,5 +1,14 @@
 # @cloudhal/comments
 
+## 0.7.1
+
+### Patch Changes
+
+- Updated dependencies [24fe76b]
+  - @cloudhal/[email protected]
+  - @cloudhal/[email protected]
+  - @cloudhal/[email protected]
+
 ## 0.7.0
 
 ### Patch Changes

diff --git a/packages/comments/package.json b/packages/comments/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cloudhal/comments",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Cloudhal reader comments (RFC-0007): settings and thread state, text normalising and content rules, linkify, first-party proof of work, the submission pipeline, purge planner, retention plan and the SQLite/D1 store. Worker-safe.",
   "license": "Apache-2.0",
   "homepage": "https://cloudhal.dev",

diff --git a/packages/core-contracts/CHANGELOG.md b/packages/core-contracts/CHANGELOG.md
@@ -1,5 +1,9 @@
 # @cloudhal/core-contracts
 
+## 0.7.1
+
+No changes in this release.
+
 ## 0.7.0
 
 No changes in this release.

diff --git a/packages/core-contracts/package.json b/packages/core-contracts/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cloudhal/core-contracts",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Cloudhal domain contracts: JSON Schema source of truth plus generated TypeScript types",
   "license": "Apache-2.0",
   "homepage": "https://cloudhal.dev",

diff --git a/packages/core-ts/CHANGELOG.md b/packages/core-ts/CHANGELOG.md
@@ -1,5 +1,18 @@
 # @cloudhal/core-ts
 
+## 0.7.1
+
+### Patch Changes
+
+- 24fe76b: Security fixes from the CodeQL backlog on `main`.
+
+  - **Prototype pollution.** A2UI `updateDataModel` paths (`@cloudhal/core-ts/interop`) that name `__proto__`, `constructor` or `prototype` at any depth are now refused with an `InteropError` instead of being skipped, step into arrays by index only, and write own properties only; an input whose component id is one of those keys gets the data key `<id>-value`. Surface pointers the page writes through (an input's `value`/`checked`, a Scrolly's `step`, a Button action's `path`) may not name those keys (a `checkSurface` issue); read bindings still may. The Build eval's sample inputs never write through them, and `set_chrome` and `update_entry`'s `fields` merge patch refuse them as keys. `RESERVED_KEYS` and `isReservedKey` are new in `@cloudhal/core-ts/names`.
+  - **Plain text from HTML.** `htmlText` (meta and feed descriptions, JSON-LD, table-of-contents labels) is plain text: `&lt;script&gt;` in markdown is the text `<script>`, as before, and every place it goes escapes it (now tested sink by sink). Tags are dropped with a linear scan, and entities are decoded once (`&amp;#60;` is the text `&#60;`, no longer `<`).
+  - **Linear scans (AGENTS.md rule 13).** The svg sniff of uploads (exponential on `<!--` followed by many `--><!--`), the code-fence opener of surface bodies, the rich-text-to-text and text-to-rich-text field conversions, hostname normalization, the leading-H1 check of articles, the table of contents, the `::embed` check, the sender-address check (`isMailAddress`, new in `@cloudhal/api`; `MAIL_ADDRESS` in `@cloudhal/cloudflare/mail` is deprecated) and Studio's origin trim no longer backtrack. Each gives the old regex's answers; one intended difference: an svg comment ends at its first `-->`.
+- @cloudhal/[email protected]
+  - @cloudhal/[email protected]
+  - @cloudhal/[email protected]
+
 ## 0.7.0
 
 ### Patch Changes

diff --git a/packages/core-ts/package.json b/packages/core-ts/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cloudhal/core-ts",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Cloudhal Site Graph core (TypeScript): load/save nodes with optimistic locking, snapshots, diff, publish and rollback; taxonomies, terms, redirects and menus",
   "license": "Apache-2.0",
   "homepage": "https://cloudhal.dev",

diff --git a/packages/create-cloudhal/CHANGELOG.md b/packages/create-cloudhal/CHANGELOG.md
@@ -1,5 +1,12 @@
 # create-cloudhal
 
+## 0.7.1
+
+### Patch Changes
+
+- Updated dependencies [24fe76b]
+  - @cloudhal/[email protected]
+
 ## 0.7.0
 
 ### Patch Changes

diff --git a/packages/create-cloudhal/package.json b/packages/create-cloudhal/package.json
@@ -1,6 +1,6 @@
 {
   "name": "create-cloudhal",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Create a Cloudhal site: npm create cloudhal@latest",
   "license": "Apache-2.0",
   "homepage": "https://cloudhal.dev",

diff --git a/packages/mcp-server/CHANGELOG.md b/packages/mcp-server/CHANGELOG.md
@@ -1,5 +1,24 @@
 # @cloudhal/mcp-server
 
+## 0.7.1
+
+### Patch Changes
+
+- 24fe76b: Security fixes from the CodeQL backlog on `main`.
+
+  - **Prototype pollution.** A2UI `updateDataModel` paths (`@cloudhal/core-ts/interop`) that name `__proto__`, `constructor` or `prototype` at any depth are now refused with an `InteropError` instead of being skipped, step into arrays by index only, and write own properties only; an input whose component id is one of those keys gets the data key `<id>-value`. Surface pointers the page writes through (an input's `value`/`checked`, a Scrolly's `step`, a Button action's `path`) may not name those keys (a `checkSurface` issue); read bindings still may. The Build eval's sample inputs never write through them, and `set_chrome` and `update_entry`'s `fields` merge patch refuse them as keys. `RESERVED_KEYS` and `isReservedKey` are new in `@cloudhal/core-ts/names`.
+  - **Plain text from HTML.** `htmlText` (meta and feed descriptions, JSON-LD, table-of-contents labels) is plain text: `&lt;script&gt;` in markdown is the text `<script>`, as before, and every place it goes escapes it (now tested sink by sink). Tags are dropped with a linear scan, and entities are decoded once (`&amp;#60;` is the text `&#60;`, no longer `<`).
+  - **Linear scans (AGENTS.md rule 13).** The svg sniff of uploads (exponential on `<!--` followed by many `--><!--`), the code-fence opener of surface bodies, the rich-text-to-text and text-to-rich-text field conversions, hostname normalization, the leading-H1 check of articles, the table of contents, the `::embed` check, the sender-address check (`isMailAddress`, new in `@cloudhal/api`; `MAIL_ADDRESS` in `@cloudhal/cloudflare/mail` is deprecated) and Studio's origin trim no longer backtrack. Each gives the old regex's answers; one intended difference: an svg comment ends at its first `-->`.
+- Updated dependencies [24fe76b]
+  - @cloudhal/[email protected]
+  - @cloudhal/[email protected]
+  - @cloudhal/[email protected]
+  - @cloudhal/[email protected]
+  - @cloudhal/[email protected]
+  - @cloudhal/[email protected]
+  - @cloudhal/[email protected]
+  - @cloudhal/[email protected]
+
 ## 0.7.0
 
 ### Patch Changes

diff --git a/packages/mcp-server/package.json b/packages/mcp-server/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cloudhal/mcp-server",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Cloudhal MCP server: semantic site tools (pages, articles, snapshots, preview, publish) governed by the policy engine",
   "license": "Apache-2.0",
   "homepage": "https://cloudhal.dev",

diff --git a/packages/schedules/CHANGELOG.md b/packages/schedules/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @cloudhal/schedules
 
+## 0.7.1
+
+### Patch Changes
+
+- @cloudhal/[email protected]
+  - @cloudhal/[email protected]
+
 ## 0.7.0
 
 ### Patch Changes

diff --git a/packages/schedules/package.json b/packages/schedules/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cloudhal/schedules",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Cloudhal schedules (RFC-0008): the time model, the RRULE subset and its sentences, releases (pin, closure, rl1: hash, compose, conflicts, state machine), automation and run state, taint and budget accounting, the Scheduler and runDue, and the SQLite/D1 store. Worker-safe.",
   "license": "Apache-2.0",
   "homepage": "https://cloudhal.dev",

diff --git a/packages/storage/CHANGELOG.md b/packages/storage/CHANGELOG.md
@@ -1,5 +1,11 @@
 # @cloudhal/storage
 
+## 0.7.1
+
+### Patch Changes
+
+- @cloudhal/[email protected]
+
 ## 0.7.0
 
 ### Minor Changes

diff --git a/packages/storage/package.json b/packages/storage/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cloudhal/storage",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Cloudhal storage interfaces (SQL driver, blob store) with Cloudflare D1/R2/Durable Object SQLite and local SQLite/filesystem adapters",
   "license": "Apache-2.0",
   "homepage": "https://cloudhal.dev",