Release 1.6.2

[heskew]

1.x patch cutting the login-CSRF browser-binding backport (#215, GHSA-xf67-jxfx-jf88) and the Harper 4 peer-range pin (#214). This PR is version bump + CHANGELOG + lockfile only — both fixes are already merged into v1.x.

Changes

• CHANGELOG.md: new [1.6.2] section documenting the browser-cookie CSRF fix and peer-range change
• package.json: 1.6.1 → 1.6.2
• package-lock.json: version metadata only (root version + package entry + the >=4.6.0 <5.0.0 peer range from chore: pin the harperdb peer range to Harper 4 (<5.0.0) #214)

Publish

Publishing the GitHub Release v1.6.2 triggers the npm publish workflow to the v1-lts dist-tag. Do not merge before the release cut is confirmed.

[gemini-code-assist]

Code Review

This pull request updates the package version to 1.6.2, updates the changelog to document security improvements and dependency changes, and pins the harperdb peer dependency range to >=4.6.0 <5.0.0. As there are no review comments, we have no feedback to provide.

[github-actions]

Reviewed; no blockers found.

Suggestions (non-blocking)

• src/lib/handlers.ts:358 — use JSON.stringify(hookData.status) when logging unrecognized hook status (robustness against CRLF if hook returns unsanitized data).
• package.json:62 — consider capping devDependencies.harperdb to <5.0.0 to match the peer dependency range and ensure test parity (consistency).

[claude]

Reviewed; no blockers found. This PR is a mechanical version bump (1.6.1 → 1.6.2) plus CHANGELOG and lockfile sync — the CSRF fix (#215) and Harper 4 peer-range pin (#214) it documents are already merged into v1.x. No reviewable code surface.