cameri · Oct 16, 2026 · Oct 16, 2026
diff --git a/.changeset/dependabot-security-alerts.md b/.changeset/dependabot-security-alerts.md
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,13 @@
 # nostream
 
+## 3.5.1
+
+### Patch Changes
+
+- [#838](https://github.com/cameri/nostream/pull/838) [`50ffe33`](https://github.com/cameri/nostream/commit/50ffe335780b8144350bd91fbf455e3b911ba808) Thanks [@chappie-daemon](https://github.com/chappie-daemon)! - fix(deps): resolve open dependabot security alerts
+
+  Bumps axios to ^1.20.0, stream-json to ^3.7.0 (with the v3 ESM import-shape fix in the event import service) and js-yaml to 4.3.2, and adds pnpm overrides forcing proxy-addr >= 2.0.8, fast-uri >= 3.1.7, brace-expansion >= 1.1.21 <2 / >= 2.1.7 <3 and js-yaml 3.x >= 3.15.2 <4. The hero-animation package stubs its unfixable transitive ip <= 2.0.1 (werift chain, unused at runtime) with @stdlib/utils-noop.
+
 ## 3.5.0
 
 ### Minor Changes

diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "nostream",
-  "version": "3.5.0",
+  "version": "3.5.1",
   "packageManager": "pnpm@10.33.0",
   "private": true,
   "description": "A Nostr relay written in Typescript.",