Binary Was The Gate

A package distributes both a library and a CLI entrypoint that consumes it. A security check that closes a CVE is added at the CLI's startup path; the library's exported class continues to accept the unsafe default. Library consumers that instantiate the class directly bypass the guard. The published advisory and CHANGELOG describe the bug as fixed; the package's library surface still ships the unfixed primitive.