v1.6.3
1.6.3 (2026-07-21)
Security
- completed the brace-expansion advisory fix — pinned the remaining 1.x line (1.1.15 → 1.1.16, CVE-2026-13149) that the 1.6.2 override missed;
npm auditnow reports 0 vulnerabilities. Dev-only tooling, not shipped in the plugin; no code or runtime behavior change