diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 148286d..48dde3a 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "6.0.3"
+  ".": "6.0.4"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index c9c87b3..d17632b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -20,6 +20,12 @@ Also other errors i.e. ENOENT attach a path attribute.
 
 
 <a name="3.0.1"></a>
+## [6.0.4](https://github.com/npm/read-package-json/compare/v6.0.3...v6.0.4) (2023-05-04)
+
+### Bug Fixes
+
+* [`d8eca92`](https://github.com/npm/read-package-json/commit/d8eca922bb6a99fc84c4d5585ea4d3de7137f911) [#177](https://github.com/npm/read-package-json/pull/177) prevent directory.bin referencing outside the package root (#177) (@antongolub)
+
 ## [6.0.3](https://github.com/npm/read-package-json/compare/v6.0.2...v6.0.3) (2023-05-03)
 
 ### Bug Fixes
diff --git a/package.json b/package.json
index 9c879e5..2996e0e 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "read-package-json",
-  "version": "6.0.3",
+  "version": "6.0.4",
   "author": "GitHub Inc.",
   "description": "The thing npm uses to read package.json files with semantics and defaults and validation",
   "repository": {