diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index c1f4ea28..352282f7 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,4 +1,4 @@
 {
-  ".": "0.42.5",
+  ".": "0.42.6",
   "mcp-package": "0.1.2"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index b2522e45..4a24d841 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,17 @@
 # Changelog
 
+## [0.42.6](https://github.com/grafana/plugin-validator/compare/plugin-validator/v0.42.5...plugin-validator/v0.42.6) (2026-05-28)
+
+
+### 🐛 Bug Fixes
+
+* **security/medium:** update module github.com/go-git/go-git/v5 to v5.19.1 [security] ([#597](https://github.com/grafana/plugin-validator/issues/597)) ([70c4c80](https://github.com/grafana/plugin-validator/commit/70c4c8038433a056ecfb06a544e8a5154faef29a))
+
+
+### 🔧 Chores
+
+* **deps:** bump step-security/harden-runner to v2.16.0 ([#595](https://github.com/grafana/plugin-validator/issues/595)) ([a7f5763](https://github.com/grafana/plugin-validator/commit/a7f57637d6e8c9b38efaa71c471bb05a91fafbb7))
+
 ## [0.42.5](https://github.com/grafana/plugin-validator/compare/plugin-validator/v0.42.4...plugin-validator/v0.42.5) (2026-05-28)
 
 
diff --git a/package-lock.json b/package-lock.json
index fa6c32c6..3d186f62 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@grafana/plugin-validator",
-  "version": "0.42.5",
+  "version": "0.42.6",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "@grafana/plugin-validator",
-      "version": "0.42.5",
+      "version": "0.42.6",
       "license": "Apache-2.0",
       "dependencies": {
         "tar": "7.5.11"
diff --git a/package.json b/package.json
index 0c2a17e6..130e902f 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@grafana/plugin-validator",
-  "version": "0.42.5",
+  "version": "0.42.6",
   "description": "Grafana Plugin Validator",
   "main": "index.js",
   "repository": {