v3.0.1 — patch release based on external audit
v3.0.1 - patch release based on external audit
Fixes:
- requirements.txt missing openpyxl (clean install reproducibility)
- export_deliverables path traversal vulnerability
- v45_merge hardcoded statistics
Doc alignment (R10 honesty):
- .reviewed gate hash check limitation explicitly noted
- B mode current implementation extracts text only (format preservation deferred to V4)
Source: external code audit by Codex (2026-05-08)