diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0bb5f1e..367ac84 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,7 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.4.5] - 2026-02-20
+
 ### Fixed
+- Regenerate Node.js `package-lock.json` to fix npm release CI failures (#67)
+- Add CodeQL security scanning workflow
 - Make entity resolution bozo-tolerant: `resolve_entity` preserves malformed entities as-is instead of failing (#64)
 - Propagate bozo flag from `read_text` when encountering unresolvable entities in feed-level fields (#64)
 
@@ -214,7 +218,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Comprehensive test coverage
 - Documentation with examples
 
-[Unreleased]: https://github.com/bug-ops/feedparser-rs/compare/v0.4.4...HEAD
+[Unreleased]: https://github.com/bug-ops/feedparser-rs/compare/v0.4.5...HEAD
+[0.4.5]: https://github.com/bug-ops/feedparser-rs/compare/v0.4.4...v0.4.5
 [0.4.4]: https://github.com/bug-ops/feedparser-rs/compare/v0.4.3...v0.4.4
 [0.4.3]: https://github.com/bug-ops/feedparser-rs/compare/v0.4.2...v0.4.3
 [0.4.2]: https://github.com/bug-ops/feedparser-rs/compare/v0.4.1...v0.4.2
diff --git a/Cargo.lock b/Cargo.lock
index d3c064b..bae2136 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -600,7 +600,7 @@ checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
 
 [[package]]
 name = "feedparser-rs"
-version = "0.4.4"
+version = "0.4.5"
 dependencies = [
  "ammonia",
  "chrono",
@@ -623,7 +623,7 @@ dependencies = [
 
 [[package]]
 name = "feedparser-rs-node"
-version = "0.4.4"
+version = "0.4.5"
 dependencies = [
  "feedparser-rs",
  "napi",
@@ -633,7 +633,7 @@ dependencies = [
 
 [[package]]
 name = "feedparser-rs-py"
-version = "0.4.4"
+version = "0.4.5"
 dependencies = [
  "chrono",
  "feedparser-rs",
diff --git a/Cargo.toml b/Cargo.toml
index fb613b6..843d702 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -7,7 +7,7 @@ members = [
 resolver = "2"
 
 [workspace.package]
-version = "0.4.4"
+version = "0.4.5"
 edition = "2024"
 rust-version = "1.88.0"
 authors = ["bug-ops"]
diff --git a/crates/feedparser-rs-node/README.md b/crates/feedparser-rs-node/README.md
index b127f4f..29734c8 100644
--- a/crates/feedparser-rs-node/README.md
+++ b/crates/feedparser-rs-node/README.md
@@ -27,8 +27,7 @@ yarn add feedparser-rs
 pnpm add feedparser-rs
 ```
 
-> [!IMPORTANT]
-> Requires Node.js 18 or later.
+> **Important:** Requires Node.js 18 or later.
 
 ## Quick Start
 
@@ -65,8 +64,7 @@ console.log(feed.feed.title);
 console.log(`Fetched ${feed.entries.length} entries`);
 ```
 
-> [!TIP]
-> `fetchAndParse` automatically handles compression (gzip, deflate, brotli) and follows redirects.
+> **Tip:** `fetchAndParse` automatically handles compression (gzip, deflate, brotli) and follows redirects.
 
 ### Parsing from Buffer
 
@@ -170,8 +168,7 @@ interface Entry {
 }
 ```
 
-> [!NOTE]
-> See `index.d.ts` for complete type definitions including `Link`, `Person`, `Tag`, `Image`, `Enclosure`, and more.
+> **Note:** See `index.d.ts` for complete type definitions including `Link`, `Person`, `Tag`, `Image`, `Enclosure`, and more.
 
 ## Error Handling
 
@@ -217,8 +214,7 @@ Benchmarks on Apple M1 Pro:
 | Parse 20 KB RSS | 0.09 ms | 8.5 ms | **94x** |
 | Parse 200 KB RSS | 0.94 ms | 85 ms | **90x** |
 
-> [!TIP]
-> For best performance, pass `Buffer` instead of `string` to avoid UTF-8 conversion overhead.
+> **Tip:** For best performance, pass `Buffer` instead of `string` to avoid UTF-8 conversion overhead.
 
 ## Platform Support
 
diff --git a/crates/feedparser-rs-node/package-lock.json b/crates/feedparser-rs-node/package-lock.json
index 76d57e9..187a6f9 100644
--- a/crates/feedparser-rs-node/package-lock.json
+++ b/crates/feedparser-rs-node/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "feedparser-rs",
-  "version": "0.4.4",
+  "version": "0.4.5",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "feedparser-rs",
-      "version": "0.4.4",
+      "version": "0.4.5",
       "license": "MIT OR Apache-2.0",
       "devDependencies": {
         "@biomejs/biome": "^2.4.0",
diff --git a/crates/feedparser-rs-node/package.json b/crates/feedparser-rs-node/package.json
index e935023..05c6d08 100644
--- a/crates/feedparser-rs-node/package.json
+++ b/crates/feedparser-rs-node/package.json
@@ -1,6 +1,6 @@
 {
   "name": "feedparser-rs",
-  "version": "0.4.4",
+  "version": "0.4.5",
   "description": "High-performance RSS/Atom/JSON Feed parser for Node.js",
   "main": "index.js",
   "types": "index.d.ts",
diff --git a/crates/feedparser-rs-py/README.md b/crates/feedparser-rs-py/README.md
index cd901ab..2c7d443 100644
--- a/crates/feedparser-rs-py/README.md
+++ b/crates/feedparser-rs-py/README.md
@@ -23,8 +23,7 @@ High-performance RSS/Atom/JSON Feed parser for Python with feedparser-compatible
 pip install feedparser-rs
 ```
 
-> [!IMPORTANT]
-> Requires Python 3.10 or later.
+> **Important:** Requires Python 3.10 or later.
 
 ## Usage
 
@@ -52,8 +51,7 @@ for entry in d.entries:
     print(entry.published_parsed)  # time.struct_time
 ```
 
-> [!NOTE]
-> Date fields like `published_parsed` return `time.struct_time` for feedparser compatibility.
+> **Note:** Date fields like `published_parsed` return `time.struct_time` for feedparser compatibility.
 
 ### Fetching from URL
 
@@ -80,8 +78,7 @@ limits = feedparser_rs.ParserLimits(max_entries=100)
 d = feedparser_rs.parse_with_limits('https://example.com/feed.xml', limits=limits)
 ```
 
-> [!TIP]
-> URL fetching supports automatic compression (gzip, deflate, brotli) and follows redirects.
+> **Tip:** URL fetching supports automatic compression (gzip, deflate, brotli) and follows redirects.
 
 ## Migration from feedparser
 
@@ -195,8 +192,7 @@ Benchmarks vs Python feedparser on Apple M1 Pro:
 | Parse 20 KB RSS | 0.09 ms | 8.5 ms | **94x** |
 | Parse 200 KB RSS | 0.94 ms | 85 ms | **90x** |
 
-> [!TIP]
-> For maximum performance, pass `bytes` instead of `str` to avoid UTF-8 re-encoding.
+> **Tip:** For maximum performance, pass `bytes` instead of `str` to avoid UTF-8 re-encoding.
 
 ## Platform Support