From 46312d0f3c6458f889a59f7b16c6e0d6449fe60f Mon Sep 17 00:00:00 2001
From: x <x@x>
Date: Wed, 7 Oct 2026 08:12:42 -0500
Subject: [PATCH] release: cut v0.45.1

Patch release: the heap use-after-free on under-arity calls (#1661, #1664). v0.44.0 and v0.45.0 were also affected.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KC99CmwatKssQYggkBCgwF
---
 CHANGELOG.md                                     | 16 ++++++++++++++++
 VERSION                                          |  2 +-
 changes/fixed/1661-underarity-param-null-fill.md | 11 -----------
 3 files changed, 17 insertions(+), 12 deletions(-)
 delete mode 100644 changes/fixed/1661-underarity-param-null-fill.md

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6ca4d150..89909886 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,22 @@ All notable changes to EigenScript are documented here.
 
 ## [Unreleased]
 
+## [0.45.1] - 2026-10-07
+
+### Fixed
+
+- **An unsent parameter is null-filled at every call entry, with or without
+  defaults (#1661).** A 2+-parameter callee without defaults, called with
+  fewer arguments than it takes, left the unsent parameters unbound. Once the
+  JIT compiled the callee, reading one read a stale slot of a recycled call
+  env: a heap-use-after-free that aborted release builds in `malloc` (seen in
+  recursion around depth 1000 or more), or a stale non-null value. Even
+  without the JIT, a closure over an unsent parameter resolved the name in an
+  outer scope instead of reading `null`. Direct calls, JIT-to-JIT calls,
+  `dispatch` (both forms) and `task_spawn` now bind every unsent parameter to
+  `null`, as SPEC.md and `docs/llms.txt` already promised. The bug was also
+  present in v0.44.0.
+
 ## [0.45.0] - 2026-10-07
 
 ### Breaking changes
diff --git a/VERSION b/VERSION
index bcce5d06..ff12df2f 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-0.45.0
+0.45.1
diff --git a/changes/fixed/1661-underarity-param-null-fill.md b/changes/fixed/1661-underarity-param-null-fill.md
deleted file mode 100644
index 3dbf3daa..00000000
--- a/changes/fixed/1661-underarity-param-null-fill.md
+++ /dev/null
@@ -1,11 +0,0 @@
-- **An unsent parameter is null-filled at every call entry, with or without
-  defaults (#1661).** A 2+-parameter callee without defaults, called with
-  fewer arguments than it takes, left the unsent parameters unbound. Once the
-  JIT compiled the callee, reading one read a stale slot of a recycled call
-  env: a heap-use-after-free that aborted release builds in `malloc` (seen in
-  recursion around depth 1000 or more), or a stale non-null value. Even
-  without the JIT, a closure over an unsent parameter resolved the name in an
-  outer scope instead of reading `null`. Direct calls, JIT-to-JIT calls,
-  `dispatch` (both forms) and `task_spawn` now bind every unsent parameter to
-  `null`, as SPEC.md and `docs/llms.txt` already promised. The bug was also
-  present in v0.44.0.