diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0a41f75..b528831 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @offckb/cli
 
+## 0.4.8
+
+### Patch Changes
+
+- Override `form-data@>=4.0.0 <4.0.6` to `4.0.6` to fix CRLF injection (GHSA).
+- Override `hono@<4.12.25` to `4.12.25` to fix CORS origin reflection with credentials.
+
 ## 0.4.7
 
 ### Patch Changes
diff --git a/package.json b/package.json
index eb00728..d54f616 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@offckb/cli",
-  "version": "0.4.7",
+  "version": "0.4.8",
   "description": "ckb development network for your first try",
   "author": "CKB EcoFund",
   "license": "MIT",