From 10f17e71e329dc99b97006333e61f0653d276ef7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= <mbombeck@gmail.com>
Date: Thu, 8 Oct 2026 23:19:32 +0200
Subject: [PATCH] docs(changelog): note the toolchain advisories closed in
 v1.42.0

---
 CHANGELOG.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 169ba9bcd..185f69561 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -148,6 +148,9 @@ an earlier fold computed from part of a day.
   first cycle of each local day a full day (#1023).
 - The capture sheet opens from the dashboard's add button on phones; the
   installed app follows its own theme in the status bar and toasts.
+- `source-map-js` 1.2.2, `postcss-selector-parser` 7.1.6 and `smol-toml`
+  1.9.0 close CVE-2026-93749, CVE-2026-104844 and GHSA-r4xh-jqrq-34v2 in the
+  build and development toolchain.
 
 ### Removed