# [0.2.2] - 2026-10-18

### Security

- **Go 1.27.2 and `golang.org/x/net` v0.60.0.** Fixes the standard library's HTTP/2 and HTTP/1
  desync issues, the MIME header memory limit bypass, ECH validation in `crypto/tls`, two
  `html/template` escaping bugs and `os.Root` following junctions on Windows, plus the matching
  HTTP/2 fixes in x/net. golangci-lint moves to v2.14.0 and `golang.org/x/tools` to v0.50.0, the
  first releases that read 1.27.2's export data, which gqlgen needs too.
- **Next.js 16.3.8**, fixing a server-side request forgery in image optimization, with sharp 0.35.5
  for its bundled librsvg.
- **No high or critical `pnpm audit` findings in either app.** Patched floors pin the flagged
  dependencies (shell-quote, fast-uri, undici, brace-expansion, busboy, source-map-js, proxy-addr,
  the MCP SDK and two GraphQL Tools packages) within their current major lines. `braces` has no fixed
  release and only build tooling reaches it, so it's recorded as a reviewed exception.

[0.2.2]: https://github.com/skeletg/skelet/compare/v0.2.1...v0.2.2

---

From the Skelet changelog: https://skelet.dev/changelog/0.2.2/