---
summary: Security patch for flatted prototype pollution CVE-2026-33228, rebranded framework description, condensed agent protocol in CLAUDE.md
breaking: false
---

# 0.1.16 — 2026-03-21

Security patch and agent protocol cleanup.

## Security

- **CVE-2026-33228** — Pinned `flatted` to `3.4.2` via `overrides` to fix prototype pollution vulnerability in `flatted <= 3.4.1` (transitive dep via `@vitest/ui`).

## Changed

- **Project description** — Rebranded to "Agent-native TypeScript framework for building MCP servers." Updated `package.json` description, keywords, and README tagline.
- **CLAUDE.md** — Condensed agent protocol: removed inline code examples duplicated in skills, merged Checklist into Code Style section, shortened Context/Error/Auth sections with skill cross-references.
