diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json
index ee7d2ec..8b096ef 100644
--- a/.claude-plugin/marketplace.json
+++ b/.claude-plugin/marketplace.json
@@ -10,7 +10,7 @@
       "name": "codebase-index",
       "description": "Semantic code search and codebase graph tools for Claude Code",
       "source": "./",
-      "version": "0.32.2"
+      "version": "0.33.0"
     }
   ]
 }
diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json
index 7f2116e..192df20 100644
--- a/.claude-plugin/plugin.json
+++ b/.claude-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "codebase-index",
-  "version": "0.32.2",
+  "version": "0.33.0",
   "description": "Semantic code search and codebase graph tools for Claude Code",
   "displayName": "Codebase Index",
   "author": {
diff --git a/.codex-plugin/plugin.json b/.codex-plugin/plugin.json
index 99c065c..2972e05 100644
--- a/.codex-plugin/plugin.json
+++ b/.codex-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "codebase-index",
-  "version": "0.32.2",
+  "version": "0.33.0",
   "description": "Semantic code search and codebase graph tools for Codex",
   "author": {
     "name": "Kenneth",
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 31b258f..7e937cd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,14 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.33.0] - 2026-09-29
+
 ### Added
 
 - **Selective ignored-path indexing**: Added `indexing.includeIgnored` to opt specific `.gitignore`-ignored project source paths into initial indexing and file watching while retaining normal include rules, explicit excludes, and built-in hidden, build, dependency, output, and restricted-path safety filters.
 
-## [0.32.2] - 2026-09-28
-
 ### Fixed
 
+- **Dependency security**: Updated transitive `fast-uri` to 3.1.7 and `ip-address` to 10.5.1 to resolve four GitHub Dependabot advisories affecting the runtime dependency tree.
+
 - **Conceptual evidence locations**: Render complete repository-relative source paths for configured project and knowledge-base hits, including knowledge bases configured through symlinks, instead of machine-specific absolute paths clipped to 120 characters. Keep origin labels for multi-repository results, escape control characters in evidence paths and labels without altering normal bracketed paths, and preserve exact-symbol ordering.
 
 - **OpenCode answer-guidance lifetime**: Retain source-verification guidance for the current turn after a discovery tool consumes the one-shot routing hint. A new user message clears or replaces it. Small exploratory studies found better supporting citations but did not establish improved factual accuracy.
diff --git a/package-lock.json b/package-lock.json
index 7b2bea6..3e041e3 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "opencode-codebase-index",
-  "version": "0.32.2",
+  "version": "0.33.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "opencode-codebase-index",
-      "version": "0.32.2",
+      "version": "0.33.0",
       "license": "MIT",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.29.0",
diff --git a/package.json b/package.json
index db5857d..e9e76c1 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "opencode-codebase-index",
-  "version": "0.32.2",
+  "version": "0.33.0",
   "description": "Host-neutral semantic codebase search with embeddings, symbol discovery, and call-graph tooling",
   "type": "module",
   "main": "dist/index.js",
diff --git a/tests/multiprocess-indexing.test.ts b/tests/multiprocess-indexing.test.ts
index c8fd27e..8a66a45 100644
--- a/tests/multiprocess-indexing.test.ts
+++ b/tests/multiprocess-indexing.test.ts
@@ -1791,11 +1791,14 @@ describe("multiprocess indexing", () => {
     const owner = JSON.parse(fs.readFileSync(path.join(leasePath, "owner.json"), "utf-8")) as { pid: number };
     const follower = first.transport.pid === owner.pid ? second : first;
 
+    embeddingServer.block();
     fs.writeFileSync(sourcePath, "export function alpha() { return 'follower-refresh'; }\nexport function gamma() { return alpha(); }\n");
-    const search = await follower.client.callTool({
+    const pendingSearch = follower.client.callTool({
       name: "codebase_search",
       arguments: { query: "beta" },
     });
+    await embeddingServer.waitForRequestCount(1, 12_000);
+    const search = await pendingSearch;
     const searchText = (search.content as Array<{ text?: string }>).map(({ text }) => text ?? "").join("\n");
     expect(search.isError).toBe(true);
     expect(searchText).toContain("INDEX_UNAVAILABLE");
@@ -1807,6 +1810,7 @@ describe("multiprocess indexing", () => {
       },
     });
     expect(searchText).not.toContain("INDEX_BUSY");
+    embeddingServer.release();
     await waitForCondition(
       () => embeddingServer.inputs.some((input) => input.includes("follower-refresh")),
       "leader refresh requested by follower",