diff --git a/CHANGELOG.md b/CHANGELOG.md
index f4ba8a0..a7fb57c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,8 +1,10 @@
-## [Unreleased]
+## [1.1.1](https://github.com/WYRE-AI/node-halopsa/compare/v1.1.0...v1.1.1) (2026-09-15)
+
+
+### Bug Fixes
 
-### Security
+* **deps:** resolve js-yaml CVE-2026-84375 ([#83](https://github.com/WYRE-AI/node-halopsa/issues/83)) ([8e7a7b1](https://github.com/WYRE-AI/node-halopsa/commit/8e7a7b191407c20a04176d2fb6d0accee744efbf))
 
-- **Resolved js-yaml high-severity advisory CVE-2026-84375** (fixed in js-yaml >= 4.3.2). js-yaml is only a transitive devDependency, pulled on the 4.x line via `cosmiconfig`. Added a scoped npm `override` (`cosmiconfig` → `js-yaml ^4.3.2`) to force the patched line. `npm audit` reports 0 vulnerabilities.
 
 # [1.1.0](https://github.com/WYRE-AI/node-halopsa/compare/v1.0.13...v1.1.0) (2026-09-04)
 
diff --git a/package-lock.json b/package-lock.json
index 839f170..f2cc446 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@wyre-ai/node-halopsa",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@wyre-ai/node-halopsa",
-      "version": "1.1.0",
+      "version": "1.1.1",
       "license": "Apache-2.0",
       "devDependencies": {
         "@eslint/js": "^10.0.1",
diff --git a/package.json b/package.json
index 386ae41..4ac3660 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@wyre-ai/node-halopsa",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "publishConfig": {
     "registry": "https://npm.pkg.github.com"
   },