chore(master): release 3.3.1

release-please[bot] · web-flow · commit 22dabd16759d · 2026-04-07T22:03:01.000Z
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,14 @@
 # Changelog
 
+## [3.3.1](https://github.com/google/clasp/compare/v3.3.0...v3.3.1) (2026-04-07)
+
+
+### Bug Fixes
+
+* **mcp:** validate projectDir against permitted base paths (CWE-22 path traversal) ([#1141](https://github.com/google/clasp/issues/1141)) ([1e8132c](https://github.com/google/clasp/commit/1e8132ceb22c9a3d434ed0f9cc6488b20f38fedf))
+* prevent OAuth CSRF via missing state parameter in authorization flow ([#1135](https://github.com/google/clasp/issues/1135)) ([8dac6c2](https://github.com/google/clasp/commit/8dac6c23c4b37d8274fabbb9c12fbc8f662c8843))
+* **security:** prevent path traversal via srcDir in .clasp.json ([#1140](https://github.com/google/clasp/issues/1140)) ([408448e](https://github.com/google/clasp/commit/408448e72726a33b81256cea871c36beba6e4445))
+
 ## [3.3.0](https://github.com/google/clasp/compare/v3.2.0...v3.3.0) (2026-03-11)
 
 
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@google/clasp",
-  "version": "3.3.0",
+  "version": "3.3.1",
   "description": "Develop Apps Script Projects locally",
   "type": "module",
   "exports": "./build/src/index.js",

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "@google/clasp",`
`3`		`- "version": "3.3.0",`
	`3`	`+ "version": "3.3.1",`
`4`	`4`	`"description": "Develop Apps Script Projects locally",`
`5`	`5`	`"type": "module",`
`6`	`6`	`"exports": "./build/src/index.js",`