diff --git a/CHANGELOG.md b/CHANGELOG.md
index 516fe90..7e5a253 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,15 @@
 # Changelog
 
+## [1.5.1](https://github.com/mi-examples/pp-dev/compare/v1.5.0...v1.5.1) (2026-11-10)
+
+### Bug fixes
+
+- Installing `pp-dev` no longer pulls in the `glob` and `minimatch` versions that `npm audit` reports as moderate vulnerabilities. They only came in through `svgtofont`, which is now an optional dependency.
+
+### Other changes
+
+- `svgtofont` is no longer installed with `pp-dev`. If you use `pp-dev generate-icon-font`, add it to the project with `npm install --save-dev svgtofont`; without it the command exits with a message saying what to install.
+
 ## [1.5.0](https://github.com/mi-examples/pp-dev/compare/v1.4.7...v1.5.0) (2026-11-06)
 
 ### Features
diff --git a/package-lock.json b/package-lock.json
index 89960a0..86813b3 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@metricinsights/pp-dev",
-  "version": "1.5.0",
+  "version": "1.5.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@metricinsights/pp-dev",
-      "version": "1.5.0",
+      "version": "1.5.1",
       "license": "MIT",
       "dependencies": {
         "axios": "^1.20.0",
diff --git a/package.json b/package.json
index 4ed46bf..e847561 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@metricinsights/pp-dev",
   "type": "module",
-  "version": "1.5.0",
+  "version": "1.5.1",
   "description": "Portal Page dev build tool",
   "bin": {
     "pp-dev": "bin/pp-dev.js"