From c77e2af7323e8755e08a25d8f9ed59591275f769 Mon Sep 17 00:00:00 2001
From: vvillait88 <vvillait88@yahoo.com>
Date: Sat, 24 Oct 2026 17:58:07 -0700
Subject: [PATCH] Release 2.9.4: dotenv 18.0.9, relock zod past
 GHSA-mrhx-c7xc-m3w5

---
 .claude/CLAUDE.md | 2 +-
 bun.lock          | 6 +++---
 package.json      | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md
index 85e1ca9..96aab31 100644
--- a/.claude/CLAUDE.md
+++ b/.claude/CLAUDE.md
@@ -36,7 +36,7 @@ Single-package TypeScript library published to npm.
 ## Tooling
 
 - **Bun**: package manager. Use `bun install`, `bun run <script>`.
-- **ESLint 9**: linting. `bun run lint`.
+- **ESLint 10**: linting. `bun run lint`.
 - **tsup**: builds CJS + ESM. `bun run build`.
 - **Vitest**: tests. `bun run test`.
 - **knip**: dead-code check. `bun run knip`.
diff --git a/bun.lock b/bun.lock
index e5890e5..a5bda65 100644
--- a/bun.lock
+++ b/bun.lock
@@ -8,7 +8,7 @@
         "@eslint/js": "^10.0.1",
         "@types/node": "^26.6.5",
         "@vitest/coverage-v8": "^5.0.5",
-        "dotenv": "^18.0.8",
+        "dotenv": "^18.0.9",
         "eslint": "^10.13.0",
         "eslint-plugin-import-x": "^4.17.1",
         "eslint-plugin-unused-imports": "^4.4.1",
@@ -426,7 +426,7 @@
 
     "detect-libc": ["detect-libc@2.1.2", "", {}, "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ=="],
 
-    "dotenv": ["dotenv@18.0.8", "", { "bin": { "dotenv": "dist/index.cjs" } }, "sha512-2KDeoFoK/zRtcnbunCDlLG5VWVMcyqeQc6iK65o231nfNAcuGrKoqUQfJFUtBI+QlShk5HKIHxwebBtUl3rEfA=="],
+    "dotenv": ["dotenv@18.0.9", "", { "bin": { "dotenv": "dist/index.cjs" } }, "sha512-3fVOW4cB02R066PUSwn8O4TJyz9NckQl7F81blIbaq9jKBm2tSmOKky7ZHIXzGvkVPXCSn6jkpziBPZdGFs8Tw=="],
 
     "es-module-lexer": ["es-module-lexer@2.3.2", "", {}, "sha512-poHGpORABojJJucnV9KbOavETW8lBVnphkW77ER5/BQ5Fz7oXSoCNek7IH3vR5nRjdsEz926ibFYX8KtLQmdyw=="],
 
@@ -714,7 +714,7 @@
 
     "yocto-queue": ["yocto-queue@0.1.0", "", {}, "sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q=="],
 
-    "zod": ["zod@4.6.5", "", {}, "sha512-v5l/aFXZQeai4awLbOpSoHecE9UiMrnfx75tEXLjNonXVARxQ5mOeipTjROUchszUNCqnE+hqAMujRsRHsut2Q=="],
+    "zod": ["zod@4.6.7", "", {}, "sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg=="],
 
     "@eslint-community/eslint-utils/eslint-visitor-keys": ["eslint-visitor-keys@3.4.3", "", {}, "sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag=="],
 
diff --git a/package.json b/package.json
index ba7c8f9..1581537 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@agent-score/sdk",
-  "version": "2.9.3",
+  "version": "2.9.4",
   "description": "TypeScript client for the AgentScore APIs",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
@@ -54,7 +54,7 @@
     "@eslint/js": "^10.0.1",
     "@types/node": "^26.6.5",
     "@vitest/coverage-v8": "^5.0.5",
-    "dotenv": "^18.0.8",
+    "dotenv": "^18.0.9",
     "eslint": "^10.13.0",
     "eslint-plugin-import-x": "^4.17.1",
     "eslint-plugin-unused-imports": "^4.4.1",