diff --git a/CHANGELOG.md b/CHANGELOG.md
index a16dbf76..9d19ac7f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,14 @@ All notable changes to CVE Lite CLI will be documented in this file.
 
 ## [Unreleased]
 
+## [1.41.4] - 2026-11-13
+
+> **Upgrade note.** This release contains one security fix and nothing else.
+
+### Security
+
+- A package name that looks like a command-line option, such as an npm alias named `--registry=https://...` or `--ignore-scripts=false`, is no longer put into a printed fix command or run by `--fix`. Since 1.41.0 such an alias is scanned under the real package it points at, so it could produce a finding whose fix command the package manager read as a setting, for example pointing `npm install` at another registry. The finding is now listed as skipped with the reason (GHSA-5583-5qpr-q69x). Reported and fixed by @S3DFX-CYBER.
+
 ## [1.41.3] - 2026-11-13
 
 > **Upgrade note.** This release contains one security fix and nothing else.
diff --git a/package-lock.json b/package-lock.json
index fdd82b28..64534de8 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "cve-lite-cli",
-  "version": "1.41.3",
+  "version": "1.41.4",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "cve-lite-cli",
-      "version": "1.41.3",
+      "version": "1.41.4",
       "license": "MIT",
       "dependencies": {
         "better-sqlite3": "^12.8.0",
diff --git a/package.json b/package.json
index 2bf8b834..4e8ab0da 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "cve-lite-cli",
-  "version": "1.41.3",
+  "version": "1.41.4",
   "description": "Developer-friendly CLI for scanning JS/TS projects for dependency vulnerabilities using local lockfiles and OSV",
   "type": "module",
   "bin": {
diff --git a/website/docusaurus.config.ts b/website/docusaurus.config.ts
index 2eb028a2..f9835274 100644
--- a/website/docusaurus.config.ts
+++ b/website/docusaurus.config.ts
@@ -2,7 +2,7 @@ import {themes as prismThemes} from 'prism-react-renderer';
 import type {Config} from '@docusaurus/types';
 import type * as Preset from '@docusaurus/preset-classic';
 
-const latestVersion = 'v1.41.3';
+const latestVersion = 'v1.41.4';
 
 const config: Config = {
   title: 'CVE Lite CLI',