# magi-code 0.98.0
## Fixes
- Upgrade ZIP handling to address extraction-permission and symbolic-link security advisories RUSTSEC-2026-0367, RUSTSEC-2026-0368, and RUSTSEC-2026-0369. Session exports retain Deflate compression and private permissions.
## Other changes
- Replace local Codex token counting with `magi-tokenizer`, using embedded `o200k_base` tables without runtime initialization or downloads. Applies automatically; no setup required.
- Models requiring unsupported encodings, including `cl100k_base`, now use character-based estimates. Offline tool-output measurement rejects these models, including `gpt-4` and `gpt-3.5-turbo`. Use a supported model, for example: `magi-code sessions measure-compression --model gpt-4o`. Counts remain local estimates, not provider billing counts.