chore(main): release 0.6.1 (#253)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Author: williamzujkowski

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.6.0"
+  ".": "0.6.1"
 }

CHANGELOG.md

@@ -67,6 +67,36 @@
 * **web:** replace regex HTML sanitization with sanitize-html ([#171](https://github.com/civic-source/us-code-tracker/issues/171)) ([23297e9](https://github.com/civic-source/us-code-tracker/commit/23297e9446d04adf0b7c3da913fb8f0562759c37))
 * **web:** resolve 404s on Recently Changed Sections links ([#108](https://github.com/civic-source/us-code-tracker/issues/108)) ([ba8451e](https://github.com/civic-source/us-code-tracker/commit/ba8451ea123dbc34cf91d8f7e5488b4195502073))
 
+## [0.6.1](https://github.com/civic-source/us-code-tracker/compare/v0.6.0...v0.6.1) (2026-06-30)
+
+
+### Bug Fixes
+
+* **annotator,types:** bound untrusted strings flowing into the YAML sidecar ([#232](https://github.com/civic-source/us-code-tracker/issues/232)) ([#243](https://github.com/civic-source/us-code-tracker/issues/243)) ([66b7e3b](https://github.com/civic-source/us-code-tracker/commit/66b7e3b13a268015ead01da577d24a723c93dbdb))
+* **annotator:** correct rate-limiter to 5000/hr and drop redundant bucket ([#230](https://github.com/civic-source/us-code-tracker/issues/230)) ([#248](https://github.com/civic-source/us-code-tracker/issues/248)) ([8d21c41](https://github.com/civic-source/us-code-tracker/commit/8d21c412d4c53d8553a3715b22c698b84ff53226))
+* **annotator:** escape all string fields in sidecar YAML serialization ([#224](https://github.com/civic-source/us-code-tracker/issues/224)) ([765340c](https://github.com/civic-source/us-code-tracker/commit/765340c4e1760c3ee159bc539455adf6477c30a1))
+* **annotator:** pin sourceUrl to CourtListener origin ([#223](https://github.com/civic-source/us-code-tracker/issues/223), finding 1) ([#225](https://github.com/civic-source/us-code-tracker/issues/225)) ([1b99e32](https://github.com/civic-source/us-code-tracker/commit/1b99e32760cb399f1f5c5e414c573496a1161039))
+* **annotator:** validate CourtListener result elements before use ([#237](https://github.com/civic-source/us-code-tracker/issues/237)) ([#244](https://github.com/civic-source/us-code-tracker/issues/244)) ([b9dbaa2](https://github.com/civic-source/us-code-tracker/commit/b9dbaa2558841d4f5b7b0a8b4fc3cbb9ca8976b7))
+* **ci:** decode+unzip OLRC archive before transforming in sync ([#204](https://github.com/civic-source/us-code-tracker/issues/204)) ([e7712cd](https://github.com/civic-source/us-code-tracker/commit/e7712cdde5bced13e205c66b0d4d916be730b095)), closes [#199](https://github.com/civic-source/us-code-tracker/issues/199)
+* **ci:** make @civic-source/* resolvable for sync-law.yml inline scripts ([#198](https://github.com/civic-source/us-code-tracker/issues/198)) ([c3e1938](https://github.com/civic-source/us-code-tracker/commit/c3e1938003ead365fc77043e31e5e765fc340027)), closes [#194](https://github.com/civic-source/us-code-tracker/issues/194)
+* **ci:** pass OLRC-derived values via env to prevent shell injection in sync-law ([#229](https://github.com/civic-source/us-code-tracker/issues/229)) ([#240](https://github.com/civic-source/us-code-tracker/issues/240)) ([bfe2a25](https://github.com/civic-source/us-code-tracker/commit/bfe2a25090bafb0a50eb9a28f70e13c4969fa661))
+* **fetcher:** decouple decompressed-size cap from download cap ([#226](https://github.com/civic-source/us-code-tracker/issues/226)) ([#227](https://github.com/civic-source/us-code-tracker/issues/227)) ([1d21fb3](https://github.com/civic-source/us-code-tracker/commit/1d21fb3385ee9304553b2fff5a0356ee16fc7fbc))
+* **fetcher:** guard HashStore.load against non-object stores ([#238](https://github.com/civic-source/us-code-tracker/issues/238)) ([#247](https://github.com/civic-source/us-code-tracker/issues/247)) ([75c727d](https://github.com/civic-source/us-code-tracker/commit/75c727d2c6544b6ac78a10eb41be98c22a535093))
+* **fetcher:** harden against SSRF and oversized downloads ([#205](https://github.com/civic-source/us-code-tracker/issues/205)) ([f4fbd50](https://github.com/civic-source/us-code-tracker/commit/f4fbd50018c97f3b0317ce988d124b3cdaf5975c)), closes [#201](https://github.com/civic-source/us-code-tracker/issues/201)
+* **fetcher:** harden ZIP extraction, title padding, and HTML body cap ([#220](https://github.com/civic-source/us-code-tracker/issues/220)) ([cea57b7](https://github.com/civic-source/us-code-tracker/commit/cea57b724b348a11c99dfed0ba677de040bf3a68))
+* **fetcher:** parse redesigned OLRC page (relative releasepoints hrefs) ([#217](https://github.com/civic-source/us-code-tracker/issues/217)) ([c0f523f](https://github.com/civic-source/us-code-tracker/commit/c0f523ff9f702f12479a81f49c787cadcfed9b04)), closes [#216](https://github.com/civic-source/us-code-tracker/issues/216)
+* **fetcher:** stream-cap fetchXml body instead of buffering the whole ZIP ([#231](https://github.com/civic-source/us-code-tracker/issues/231)) ([#245](https://github.com/civic-source/us-code-tracker/issues/245)) ([c450e50](https://github.com/civic-source/us-code-tracker/commit/c450e5087be06fc7fbbafcf3cecf7e1a6c89fb9e))
+* **scripts:** distinguish absent vs failed title fetches; gate resume cursor ([#236](https://github.com/civic-source/us-code-tracker/issues/236)) ([#246](https://github.com/civic-source/us-code-tracker/issues/246)) ([73c87c9](https://github.com/civic-source/us-code-tracker/commit/73c87c93a829d704cf0d97fbbc9a7f5be7d59133))
+* **scripts:** drop shell from generate-diffs git calls + anchor tag validation ([#235](https://github.com/civic-source/us-code-tracker/issues/235)) ([#241](https://github.com/civic-source/us-code-tracker/issues/241)) ([6d30b77](https://github.com/civic-source/us-code-tracker/commit/6d30b7718d405cc317107b7d3960f678ce1473de))
+* **shared:** harden fetchWithRetry (backoff cap, 429, Retry-After, aborts) ([#212](https://github.com/civic-source/us-code-tracker/issues/212)) ([6e632a1](https://github.com/civic-source/us-code-tracker/commit/6e632a1a87b9c8c6fc8ddf75d1fee324f792ab6c))
+* **shared:** serialize TokenBucket.waitAndConsume to prevent over-issue ([#213](https://github.com/civic-source/us-code-tracker/issues/213)) ([7f92425](https://github.com/civic-source/us-code-tracker/commit/7f924251c8e999d56cc4d58e9c90bb9f0421af2e)), closes [#209](https://github.com/civic-source/us-code-tracker/issues/209)
+* **transformer:** escape < and > in extracted text (XSS defense-in-depth) ([#207](https://github.com/civic-source/us-code-tracker/issues/207)) ([301e598](https://github.com/civic-source/us-code-tracker/commit/301e5983ca821fe5a5c0fa2c2ecc52983c5af5a6))
+* **transformer:** escape YAML frontmatter strings (closes [#221](https://github.com/civic-source/us-code-tracker/issues/221)) ([#222](https://github.com/civic-source/us-code-tracker/issues/222)) ([e1f7d40](https://github.com/civic-source/us-code-tracker/commit/e1f7d402ab18ef32d810738370d16e2b224a0bdd))
+* **types:** constrain rendered/fetched URLs to http(s) scheme ([#211](https://github.com/civic-source/us-code-tracker/issues/211)) ([63d4375](https://github.com/civic-source/us-code-tracker/commit/63d4375c7f6941650e28df615745b46330284a16)), closes [#210](https://github.com/civic-source/us-code-tracker/issues/210)
+* uncited-case dedupe collapse and appendix-title path collision ([#206](https://github.com/civic-source/us-code-tracker/issues/206)) ([c7193dd](https://github.com/civic-source/us-code-tracker/commit/c7193dd14e82f21ea986f2ff5872956fcc009628)), closes [#202](https://github.com/civic-source/us-code-tracker/issues/202)
+* **web:** escape JSON-LD to prevent </script> breakout XSS ([#203](https://github.com/civic-source/us-code-tracker/issues/203)) ([0af8e74](https://github.com/civic-source/us-code-tracker/commit/0af8e74c7427ca48bbb694228478195950e0888c))
+* **web:** sanitize rendered statute Markdown with rehype-sanitize ([#200](https://github.com/civic-source/us-code-tracker/issues/200)) ([#215](https://github.com/civic-source/us-code-tracker/issues/215)) ([2fb5ef8](https://github.com/civic-source/us-code-tracker/commit/2fb5ef8472f6eb1361a4429e1de346d040c492dc))
+
 ## [0.5.7](https://github.com/civic-source/us-code-tracker/compare/v0.5.6...v0.5.7) (2026-03-29)
 
 ### Features

package.json

@@ -1,6 +1,6 @@
 {
   "name": "openlaw-git-pipeline",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "private": true,
   "type": "module",
   "packageManager": "pnpm@11.1.1",