docs(changelog): add security glob override note under Unreleased

Author: dkattan

CHANGELOG.md

@@ -7,6 +7,7 @@ Check [Keep a Changelog](http://keepachangelog.com/) for recommendations on how
 ## [Unreleased]
 
 - Initial release
+- Security: Override transitive `glob` to 10.5.0 (fixes GHSA-5j98-mcp5-4vw2) via root `overrides` after audit flagged vulnerable range (<10.5.0). Lockfile committed for reproducible remediation.
 
 ## [0.0.15] - 2025-11-20