Since this package is in pre-1.0 development, only the latest version receives security updates.

To report a security vulnerability, please email spencer@savvyweb.systems.

Please include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Any suggested fixes (optional)

Response Timeline:

• We will acknowledge receipt within 72 hours
• We will provide a status update within 7 days
• Critical vulnerabilities will be prioritized for immediate patching

We appreciate responsible disclosure and will credit reporters in release notes unless anonymity is requested.

This package is a pnpm config dependency that:

• Has zero runtime dependencies (all code is bundled)
• Is loaded during pnpm install to merge catalog definitions
• Does not execute arbitrary code or access network resources
• Does not perform file system reads or writes

The primary security consideration is ensuring that catalog version definitions are accurate and do not inadvertently introduce vulnerable dependency versions.