chore(release): v0.5.1159 — security fix for GHSA-x55v-q459-68ch (#4992)

Security release. Bumps [workspace.package].version 0.5.1158 -> 0.5.1159
(+ Cargo.lock, CLAUDE.md version line) and prepends a v0.5.1159 CHANGELOG
entry. The only code change since v0.5.1158 is #4989, which fixes a path
traversal / arbitrary file write in perry publish (GHSA-x55v-q459-68ch).

After merge: tag v0.5.1159 + publish the GitHub release, then set the
advisory's patched version to 0.5.1159 and publish it.

Co-authored-by: Ralph Küpper <ralph@skelpo.com>

Author: proggeramlug

CHANGELOG.md

@@ -1,3 +1,14 @@
+## v0.5.1159 — security: fix path traversal / arbitrary file write in `perry publish` (GHSA-x55v-q459-68ch)
+
+Security release. `perry publish` trusted the build server's
+`ArtifactReady.artifact_name` and `download_path` verbatim when constructing
+the local destination path, allowing a malicious/compromised hub to write
+downloaded content outside the output directory (arbitrary file write) and, in
+the self-hosted-hub local-copy path, copy out arbitrary local files. All
+versions through v0.5.1158 are affected. Upgrade to v0.5.1159.
+
+- fix(publish): sanitize server-controlled artifact path (GHSA-x55v-q459-68ch) (#4989)
+
 ## v0.5.1158 — release roll-up: stub-elimination epic tail, React render walls, http/cluster/streams parity
 
 Version-bump + changelog roll-up for the 16 commits that landed after the

CLAUDE.md

@@ -8,7 +8,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 Perry is a native TypeScript compiler written in Rust that compiles TypeScript source code directly to native executables. It uses SWC for TypeScript parsing and LLVM for code generation.
 
-**Current Version:** 0.5.1158
+**Current Version:** 0.5.1159
 
 
 ## TypeScript Parity Status