v0.17.0 — security release (GHSA-j3rv-rv99-hg74)

Security release. Upgrade from any earlier version. Requires Node.js 22.13 or newer.

Security

• SSRF bypass via IPv4-mapped IPv6 literals (GHSA-j3rv-rv99-hg74), reported privately by @avishaigonen-pluto and @yotampe-pluto. [::ffff:169.254.169.254] reached cloud metadata and [::ffff:127.0.0.1] reached loopback. The guard now parses IPv6 and re-checks the embedded IPv4 for every transition format, blocks the remaining non-global ranges, and fails closed on anything unparseable (#113).
• Headless Chromium egress pinned through a validating local proxy — closes DNS-rebinding and service-worker paths to internal hosts (#116).
• Stored XSS in brand-report.html closed; the report CSP pins its script by hash instead of allowing inline script (#119).
• Prompt injection through extracted text contained: implausible font names are rejected at the merge point; DESIGN.md and pasteable blocks carry provenance notices; fences can't be closed by backtick runs in brand data (#119).
• Brandcode Studio trust limited to Studio's own origins: credentials and production_approved apply only to brandcode.studio (extendable via BRANDCODE_STUDIO_TRUSTED_ORIGINS) (#118).
• File access contained: brand_extract_pdf stays inside the working directory with size/page/time limits; sidecar writes refuse symlinks (#118).
• Untrusted markup bounded before parsing — a 40k-deep SVG went from 14s + stack overflow to 2ms (#119).
• Installer and export configs pin @brandsystem/mcp@0.17.0 (#118, #119).
• zod 4 + MCP SDK 1.32.2 with request-size caps (#111). npm audit: 0.
• Release pipeline: publish credentials never reach dependency or test code; releases must be tagged from main (#114).

Changed

• Node.js 22.13+ required (Node 20 is end-of-life).
• production_approved states recorded before 0.17.0 no longer count — re-connect from Brandcode Studio to re-confer.
• Self-hosted/staging Studios need BRANDCODE_STUDIO_TRUSTED_ORIGINS; plain-http custom domains are refused.
• brand_extract_pdf paths must be inside the working directory.

Full details in CHANGELOG.md.