diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9b4b123..6d65658 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,7 +2,11 @@
 
 ## Unreleased
 
-### 0.22.0-evandro.1 — Evandro Fonseca Junior fork (oh-my-pi-telegram)
+- **Security overrides refreshed** — `protobufjs` `7.6.4` → `7.6.6`, `undici` `8.5.0` → `8.10.2`, and a new `brace-expansion` `5.0.9` override keep `npm audit` at 0 vulnerabilities; the `validate` gate (`typecheck` → `test` → `audit` → `pack:check`) passes again.
+- **README rewritten** to the repository audit standard: verified install/build/test commands, the real `omp install` syntax, omp agent-directory resolution, and an explicit limitations section.
+- **Release notes extraction fixed** — the `0.22.0-evandro.1` fork section promoted from `###` to `##` so `.github/workflows/release.yml` can build release notes for tag `v0.22.0-evandro.1`.
+
+## 0.22.0-evandro.1 — Evandro Fonseca Junior fork (oh-my-pi-telegram)
 
 - **Repackaged as `@evandrodevbr/oh-my-pi-telegram`** — version suffix `-evandro.1` keeps the 0.22.0 source line (SHA `afe09c5`) traceable to upstream `llblab/pi-telegram` while making the fork unambiguous in the `omp` extension registry.
 - **Oh My Pi (omp) compatibility metadata** — added an `omp` field in `package.json` (displayName, homepage, `compatibleWith: { "@oh-my-pi/pi-coding-agent": ">=16.5.2" }`) so the fork is discoverable as a first-class extension for `can1357/oh-my-pi` (`omp >= 16.5.2`).
diff --git a/package-lock.json b/package-lock.json
index 870284e..65f40e6 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -963,7 +963,6 @@
       "version": "26.1.1",
       "resolved": "https://registry.npmjs.org/@types/node/-/node-26.1.1.tgz",
       "integrity": "sha512-nxAkRSVkN1Y0JC1W8ky/fTfkGsMmcrRsbx+3XoZE+rMOX71kLYTV7fLXpqud1GpbpP5TuffXFqfX7fH2GgZREw==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "undici-types": "~8.3.0"
@@ -1363,14 +1362,16 @@
       "peer": true
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.6",
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
       "license": "MIT",
       "peer": true,
       "dependencies": {
         "balanced-match": "^4.0.2"
       },
       "engines": {
-        "node": "18 || 20 || >=22"
+        "node": "20 || >=22"
       }
     },
     "node_modules/buffer-equal-constant-time": {
@@ -1879,7 +1880,9 @@
       }
     },
     "node_modules/protobufjs": {
-      "version": "7.6.4",
+      "version": "7.6.6",
+      "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.6.6.tgz",
+      "integrity": "sha512-dYDWdjSl5RNb7SgPxGQcRU+GtvP7s2fpkrY0r432PcOIaZ0/rBcxEZnQN67iJhFuQiVw754JDoPruPCNdGsbjg==",
       "hasInstallScript": true,
       "license": "BSD-3-Clause",
       "peer": true,
@@ -1900,19 +1903,6 @@
         "node": ">=12.0.0"
       }
     },
-    "node_modules/protobufjs/node_modules/@types/node": {
-      "version": "22.19.19",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "undici-types": "~6.21.0"
-      }
-    },
-    "node_modules/protobufjs/node_modules/@types/node/node_modules/undici-types": {
-      "version": "6.21.0",
-      "license": "MIT",
-      "peer": true
-    },
     "node_modules/retry": {
       "version": "0.12.0",
       "license": "MIT",
@@ -2037,7 +2027,9 @@
       }
     },
     "node_modules/undici": {
-      "version": "8.5.0",
+      "version": "8.10.2",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-8.10.2.tgz",
+      "integrity": "sha512-/y4/bH9YNU5hi9NIrpOuvGXFcxrj3CMrV+/AYpowAYTpHn8gX/XPFjNy766FPoYY0miQhdW977JFWKGNhBdwyQ==",
       "license": "MIT",
       "peer": true,
       "engines": {
@@ -2048,7 +2040,6 @@
       "version": "8.3.0",
       "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.3.0.tgz",
       "integrity": "sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ==",
-      "dev": true,
       "license": "MIT"
     },
     "node_modules/web-streams-polyfill": {
diff --git a/package.json b/package.json
index d79e22b..806d135 100644
--- a/package.json
+++ b/package.json
@@ -81,22 +81,24 @@
     "typescript": "latest"
   },
   "overrides": {
-    "protobufjs": "7.6.4",
-    "undici": "8.5.0",
+    "protobufjs": "7.6.6",
+    "undici": "8.10.2",
+    "brace-expansion": "5.0.9",
     "ws": "8.21.0",
     "@earendil-works/pi-coding-agent": {
-      "protobufjs": "7.6.4",
-      "undici": "8.5.0",
+      "protobufjs": "7.6.6",
+      "undici": "8.10.2",
+      "brace-expansion": "5.0.9",
       "ws": "8.21.0",
       "@google/genai": {
-        "protobufjs": "7.6.4",
+        "protobufjs": "7.6.6",
         "ws": "8.21.0"
       },
       "@earendil-works/pi-ai": {
-        "protobufjs": "7.6.4",
+        "protobufjs": "7.6.6",
         "ws": "8.21.0",
         "@google/genai": {
-          "protobufjs": "7.6.4",
+          "protobufjs": "7.6.6",
           "ws": "8.21.0"
         }
       }