diff --git a/CHANGELOG.md b/CHANGELOG.md
index a0253e1..f18cc98 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,16 @@ All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+## [2.0.2] - 2026-08-20
+
+### Fixed
+
+- **Reactive proxy could be used to pollute `Object.prototype`** — reading, writing, or deleting `__proto__`, `constructor`, or `prototype` through `data` behaved like any other property, so `data.__proto__ = { isAdmin: true }` (or an unguarded `Object.assign(data, JSON.parse(untrustedInput))`) could reach the shared `Object.prototype` and affect every object in the app. These keys are now blocked at the proxy itself, matching the guard already used for path-based updates and merges.
+
+### Demo
+
+- Widened a couple of validators and reactive stores shown in the demo pages, and refreshed the built demo site.
+
## [2.0.1] - 2026-08-20
### Changed
diff --git a/demo/src/pages/ActionDemo.svelte b/demo/src/pages/ActionDemo.svelte
index 47fbe11..054b858 100644
--- a/demo/src/pages/ActionDemo.svelte
+++ b/demo/src/pages/ActionDemo.svelte
@@ -65,7 +65,7 @@
createSvState(sourceData, {
validator: (source) => ({
title: stringValidator(source.title).prepare('trim').required().minLength(3).maxLength(50).getError(),
- description: stringValidator(source.description).prepare('trim').required().minLength(10).getError()
+ description: stringValidator(source.description).prepare('trim').required().minLength(10).maxLength(200).getError()
}),
action: async () => {
// Simulate API call with 100-1000ms delay
diff --git a/demo/src/pages/ArrayProperty.svelte b/demo/src/pages/ArrayProperty.svelte
index bd7fff5..adaae50 100644
--- a/demo/src/pages/ArrayProperty.svelte
+++ b/demo/src/pages/ArrayProperty.svelte
@@ -96,10 +96,10 @@ type ItemErrors = Record Reset isDirty after successful action Try 500ms and type quickly Keep errors until next action A Svelte 5 library that provides a supercharged $state() with deep reactive proxies, validation, snapshot/undo,
- and side effects — built for complex, real-world applications.0){var ee=i&4&&s===0?n:null;if(o){for(v=0;v
`),xa=U(`
Dirty Fields
State Object
State Info
Errors
Action State
`),xa=U(`
Dirty Fields
State Object
State Info
Errors
Action State
Quick Fill
Async Validation State
Async Errors
Quick Fill
Async Validation State
Async Errors
Options
Current Options
svstate