dmux · Sep 29, 2026 · Sep 29, 2026 · Sep 29, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -8,6 +8,22 @@ project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 Per-feature design rationale and known limitations live in [FEATURES.md](FEATURES.md);
 this file records what changed between releases.
 
+## [1.8.0] — 2026-09-29
+
+Clears every open Dependabot alert. The change is only in `ui/pnpm-lock.yaml`: each
+patched version fits the range its parent already declares, so `ui/package.json` is
+unchanged and no `overrides` are needed.
+
+### Security
+
+- **Transitive UI dependencies bumped** within their existing semver ranges:
+  `fast-uri` 3.1.5 → 3.1.8 (4 high-severity host-confusion / SSRF advisories),
+  `js-yaml` 4.3.1 → 4.3.2, `hono` 4.13.3 → 4.13.11, `qs` 6.15.3 → 6.16.0, plus
+  `undici` 7.29.0 → 7.30.0 and `ip-address` 10.5.0 → 10.7.2, which `pnpm audit`
+  flagged before Dependabot did. All of these come in through `shadcn` (its MCP SDK,
+  express and ajv) or eslint, not the exported UI bundle, so actual exposure was low.
+  `pnpm audit` now reports no known vulnerabilities.
+
 ## [1.7.8] — 2026-09-15
 
 Makes the Terraform claim testable, then acts on what the test found.
@@ -398,6 +414,7 @@ server — all working and tested, with `MINILAKE_PERSIST` wired in.
 
 See [FEATURES.md](FEATURES.md) for the full per-feature status of this release.
 
+[1.8.0]: https://github.com/dmux/minilake/compare/v1.7.8...v1.8.0
 [1.7.8]: https://github.com/dmux/minilake/compare/v1.7.7...v1.7.8
 [1.7.7]: https://github.com/dmux/minilake/compare/v1.7.6...v1.7.7
 [1.7.6]: https://github.com/dmux/minilake/compare/v1.7.4...v1.7.6

diff --git a/FEATURES.md b/FEATURES.md
@@ -10,7 +10,7 @@ the *reachable* surface, once the blocks this project deliberately skips are exc
 [docs/EMULATION_ROADMAP.md](docs/EMULATION_ROADMAP.md) for what to build next.
 
 **Latest Update:** 2026-09-15
-**Version:** 1.7.8 — see [CHANGELOG.md](CHANGELOG.md) for what changed between releases
+**Version:** 1.8.0 — see [CHANGELOG.md](CHANGELOG.md) for what changed between releases
 **Project Status:** Core SQL + UC (per-catalog isolation) + Jobs (real DAG scheduling) + Workspace + DBFS + Files + Secrets + Clusters + Permissions + real Spark/Delta execution all working and tested; `MINILAKE_PERSIST` is now actually wired in. See [Known Limitations](#known-limitations) for what's intentionally not built (this is a single-dev local tool, not a multi-tenant server)
 
 ---

diff --git a/pyproject.toml b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "minilake"
-version = "1.7.8"
+version = "1.8.0"
 description = "A local Databricks API emulator backed by DuckDB."
 readme = "README.md"
 requires-python = ">=3.11"

diff --git a/site/index.html b/site/index.html
@@ -484,7 +484,7 @@
 
 <header class="hdr" id="hdr">
   <div class="wrap nav">
-    <a class="brand" href="#top"><img src="assets/minilake-logo.png" alt="" width="32" height="32" />MiniLake <span class="v">v1.7.8</span></a>
+    <a class="brand" href="#top"><img src="assets/minilake-logo.png" alt="" width="32" height="32" />MiniLake <span class="v">v1.8.0</span></a>
     <nav class="nav-links" id="navlinks">
       <a href="#features">Features</a>
       <a href="#code">Examples</a>