v0.1.16

Highlights

• Updated the indirect dependency github.com/klauspost/compress from v1.18.6 to v1.18.7 to address CVE-2026-63209 / GHSA-259r-337f-4rfw.
• Included the dependency security fix from PR #17 in all release binaries.

Notes

The vulnerability affects S2 dictionary handling and can cause a process crash when processing a crafted dictionary. Update to this release to use binaries built with the patched dependency.

Validation

• ./scripts/ci-local.sh clean
• GitHub PR checks: test, Analyze Go, and CodeQL
• Release builds for macOS, Linux, and Windows on AMD64 and ARM64, with SHA-256 checksums.