release: bump 0.8.9 -> 0.9.0 (#289)

All nine Dependabot ecosystems now batch their updates into one grouped PR each
(`groups: { <name>: { patterns: ["*"] } }`) instead of one PR per dependency.

A routine refresh previously fanned out into a dozen-plus PRs (the Maven batch
alone opened 12), each running the full nine-language CI matrix (~55 checks) and
clogging the runner queue ahead of release and feature runs. Grouping collapses
that to one PR per ecosystem.

Trade-off: a single broken update blocks its whole group until excluded — fine
for routine maintenance bumps. Security updates are unaffected (they are not
grouped and continue to arrive individually).

.github/dependabot.yml

@@ -10,6 +10,9 @@ updates:
       default-days: 7
     commit-message:
       prefix: "deps(cargo)"
+    groups:
+      cargo:
+        patterns: ["*"]
 
   # Node binding npm dependencies.
   - package-ecosystem: npm
@@ -21,6 +24,9 @@ updates:
       default-days: 7
     commit-message:
       prefix: "deps(npm)"
+    groups:
+      node-binding:
+        patterns: ["*"]
 
   # Python binding pip dependencies.
   - package-ecosystem: pip
@@ -32,6 +38,9 @@ updates:
       default-days: 7
     commit-message:
       prefix: "deps(pip)"
+    groups:
+      python-binding:
+        patterns: ["*"]
 
   # Hash-pinned CI/bench Python tooling under .github/requirements/. Each
   # <name>.in is the loose source; the matching hash-locked <name>.txt is the
@@ -47,6 +56,9 @@ updates:
       default-days: 7
     commit-message:
       prefix: "deps(ci-pip)"
+    groups:
+      ci-pip:
+        patterns: ["*"]
 
   # GitHub Actions — keeps the SHA-pinned actions current (Dependabot reads
   # the version comment after each pinned SHA and bumps both together).
@@ -59,3 +71,73 @@ updates:
       default-days: 7
     commit-message:
       prefix: "deps(actions)"
+    groups:
+      github-actions:
+        patterns: ["*"]
+
+  # Java binding + examples (Maven). Tracks the C-ABI binding's build plugins
+  # (e.g. central-publishing-maven-plugin) and the examples' jackson dependency,
+  # which had no Dependabot coverage before — a stale publishing plugin slipped
+  # through unnoticed until an OSV scan flagged it.
+  - package-ecosystem: maven
+    directories:
+      - "/bindings/java"
+      - "/bindings/java/benchmarks"
+      - "/examples/java"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    cooldown:
+      default-days: 7
+    commit-message:
+      prefix: "deps(maven)"
+    groups:
+      maven:
+        patterns: ["*"]
+
+  # C# binding (NuGet). The published Wickra.csproj is a thin C-ABI wrapper with
+  # no external packages, but the test and benchmark projects pull xunit,
+  # Microsoft.NET.Test.Sdk and BenchmarkDotNet.
+  - package-ecosystem: nuget
+    directories:
+      - "/bindings/csharp/Wickra.Tests"
+      - "/bindings/csharp/benchmarks"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    cooldown:
+      default-days: 7
+    commit-message:
+      prefix: "deps(nuget)"
+    groups:
+      nuget:
+        patterns: ["*"]
+
+  # Node examples (npm) — separate from the binding's own package.json.
+  - package-ecosystem: npm
+    directory: "/examples/node"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    cooldown:
+      default-days: 7
+    commit-message:
+      prefix: "deps(npm)"
+    groups:
+      node-examples:
+        patterns: ["*"]
+
+  # Go examples (Go modules). The binding's own go.mod has no external deps;
+  # the examples pull coder/websocket.
+  - package-ecosystem: gomod
+    directory: "/examples/go"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    cooldown:
+      default-days: 7
+    commit-message:
+      prefix: "deps(gomod)"
+    groups:
+      go-examples:
+        patterns: ["*"]

.github/workflows/bench.yml

@@ -48,7 +48,7 @@ jobs:
     name: Cross-library benchmark report
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -122,7 +122,7 @@ jobs:
     name: Rust cross-library benchmark report
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 

.github/workflows/ci.yml

@@ -40,7 +40,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -107,7 +107,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20 # backstop: cap a wedged job instead of GitHub's 6h default (slowest real job ~5 min)
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -197,7 +197,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20 # backstop: cap a wedged job instead of GitHub's 6h default (slowest real job ~5 min)
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -291,7 +291,7 @@ jobs:
             toolchain: "1.88"
             packages: "-p wickra-node"
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -330,7 +330,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20 # backstop: cap a wedged job instead of GitHub's 6h default (slowest real job ~5 min)
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -345,7 +345,7 @@ jobs:
         timeout-minutes: 6
 
       - name: Install cargo-llvm-cov
-        uses: taiki-e/install-action@0fd46367812ee04360509b4169d9f659d6892bb2 # v2.79.15
+        uses: taiki-e/install-action@59012be0884e296ca2da49b530610e72c49039ad # v2.81.6
         timeout-minutes: 10 # fail fast on a stuck download instead of hanging the job
         with:
           tool: cargo-llvm-cov
@@ -372,7 +372,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20 # backstop: cap a wedged job instead of GitHub's 6h default (slowest real job ~5 min)
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -391,7 +391,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20 # backstop: cap a wedged job instead of GitHub's 6h default (slowest real job ~5 min)
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -415,7 +415,7 @@ jobs:
         # attributes the modern nightly compiler rejects, so the install
         # never gets off the ground. The prebuilt binary avoids the entire
         # transitive-dep compile.
-        uses: taiki-e/install-action@0fd46367812ee04360509b4169d9f659d6892bb2 # v2.79.15
+        uses: taiki-e/install-action@59012be0884e296ca2da49b530610e72c49039ad # v2.81.6
         timeout-minutes: 10 # fail fast on a stuck download instead of hanging the job
         with:
           tool: cargo-fuzz
@@ -450,7 +450,7 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
         python-version: ["3.9", "3.11", "3.12", "3.13"]
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -527,7 +527,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20 # backstop: cap a wedged job instead of GitHub's 6h default (slowest real job ~5 min)
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -549,7 +549,7 @@ jobs:
         # same taiki-e prebuilt-binary installer we already use for
         # cargo-llvm-cov and cargo-fuzz; it tracks the latest wasm-pack
         # release, which has `--features` as a top-level flag (since 0.12).
-        uses: taiki-e/install-action@0fd46367812ee04360509b4169d9f659d6892bb2 # v2.79.15
+        uses: taiki-e/install-action@59012be0884e296ca2da49b530610e72c49039ad # v2.81.6
         timeout-minutes: 10 # fail fast on a stuck download instead of hanging the job
         with:
           tool: wasm-pack
@@ -576,7 +576,7 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
         node-version: ["18", "20"]
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -649,7 +649,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -662,7 +662,7 @@ jobs:
         timeout-minutes: 6
 
       - name: Install cbindgen
-        uses: taiki-e/install-action@0fd46367812ee04360509b4169d9f659d6892bb2 # v2.79.15
+        uses: taiki-e/install-action@59012be0884e296ca2da49b530610e72c49039ad # v2.81.6
         timeout-minutes: 10 # fail fast on a stuck download instead of hanging the job
         with:
           tool: cbindgen
@@ -705,7 +705,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -756,7 +756,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -766,7 +766,7 @@ jobs:
       - name: Set up Go
         id: setup-go
         continue-on-error: true
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version: "stable"
           cache: false
@@ -780,7 +780,7 @@ jobs:
 
       - name: Set up Go (retry)
         if: steps.setup-go.outcome == 'failure'
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version: "stable"
           cache: false
@@ -882,7 +882,7 @@ jobs:
       WICKRA_INCLUDE_DIR: ${{ github.workspace }}/bindings/c/include
       WICKRA_LIB_DIR: ${{ github.workspace }}/target/release
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -926,6 +926,16 @@ jobs:
           R CMD INSTALL bindings/r
           Rscript -e 'library(testthat); library(wickra); test_dir("bindings/r/tests/testthat", stop_on_failure = TRUE)'
 
+      - name: Build the vignette code
+        shell: bash
+        # The getting-started vignette runs at R CMD check time on r-universe /
+        # CRAN (with pandoc); this job only INSTALLs, so execute the vignette's R
+        # chunks here (knit, no pandoc needed) to catch a broken example before it
+        # reaches the published build.
+        run: |
+          Rscript -e 'install.packages("knitr", repos = Sys.getenv("RSPM", unset = "https://cloud.r-project.org"))'
+          Rscript -e 'knitr::knit("bindings/r/vignettes/getting-started.Rmd", output = tempfile(fileext = ".md"), quiet = TRUE); cat("vignette code OK\n")'
+
       - name: Run the offline R examples
         shell: bash
         # No loader-path exports: the installed package is self-contained (bundled
@@ -951,7 +961,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -973,7 +983,7 @@ jobs:
       - name: Set up JDK 22
         id: setup-java
         continue-on-error: true
-        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: temurin
           java-version: "22"
@@ -988,7 +998,7 @@ jobs:
 
       - name: Set up JDK 22 (retry)
         if: steps.setup-java.outcome == 'failure'
-        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: temurin
           java-version: "22"

.github/workflows/codeql.yml

@@ -40,17 +40,17 @@ jobs:
             build-mode: none
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@03e4368ac7daa2bd82b3e85262f3bf87ee112f57 # v3.36.0
+        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@03e4368ac7daa2bd82b3e85262f3bf87ee112f57 # v3.36.0
+        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/release.yml

@@ -45,7 +45,7 @@ jobs:
     # Settings -> Environments.
     environment: release
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
       - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable branch, 2026-03-27
@@ -110,7 +110,7 @@ jobs:
       # consumers can audit the published dependency tree without
       # re-resolving Cargo.lock.
       - name: Install cargo-cyclonedx
-        uses: taiki-e/install-action@0fd46367812ee04360509b4169d9f659d6892bb2 # v2.79.15
+        uses: taiki-e/install-action@59012be0884e296ca2da49b530610e72c49039ad # v2.81.6
         timeout-minutes: 10 # fail fast on a stuck download instead of hanging the job
         with:
           tool: cargo-cyclonedx
@@ -157,7 +157,7 @@ jobs:
           - { os: windows-11-arm, target: aarch64, manylinux: auto }
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
       - name: Set up Python
@@ -197,7 +197,7 @@ jobs:
     name: Build Python sdist
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
       - name: Sync root README into bindings/python so it ships in the sdist
@@ -249,7 +249,7 @@ jobs:
           - { host: windows-11-arm, target: aarch64-pc-windows-msvc }
     runs-on: ${{ matrix.host }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -310,7 +310,7 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -479,7 +479,7 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -512,7 +512,7 @@ jobs:
       - name: Install wasm-pack (latest, via prebuilt binary)
         # See the matching note in ci.yml: jetli's default installs an old
         # 0.10.x wasm-pack whose build subcommand rejects --features.
-        uses: taiki-e/install-action@0fd46367812ee04360509b4169d9f659d6892bb2 # v2.79.15
+        uses: taiki-e/install-action@59012be0884e296ca2da49b530610e72c49039ad # v2.81.6
         timeout-minutes: 10 # fail fast on a stuck download instead of hanging the job
         with:
           tool: wasm-pack
@@ -588,7 +588,7 @@ jobs:
           - { host: windows-11-arm, target: aarch64-pc-windows-msvc }
     runs-on: ${{ matrix.host }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -638,7 +638,7 @@ jobs:
       contents: read
       id-token: write # request the GitHub OIDC token for trusted publishing
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -718,7 +718,7 @@ jobs:
     runs-on: ubuntu-latest
     environment: release
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -758,7 +758,7 @@ jobs:
       # setup-java writes a settings.xml with the 'central' server credentials
       # (mapped from the env vars below) and imports the GPG signing key.
       - name: Set up JDK 22 + Maven Central credentials + GPG
-        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: temurin
           java-version: "22"
@@ -788,7 +788,7 @@ jobs:
     needs: c-abi-build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -877,7 +877,7 @@ jobs:
     outputs:
       tag: ${{ steps.tag.outputs.tag }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           fetch-depth: 0

.github/workflows/scorecard.yml

@@ -24,7 +24,7 @@ jobs:
       id-token: write # OIDC token to publish results to the OpenSSF API
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -51,6 +51,6 @@ jobs:
           retention-days: 5
 
       - name: Upload SARIF to code-scanning
-        uses: github/codeql-action/upload-sarif@03e4368ac7daa2bd82b3e85262f3bf87ee112f57 # v3.36.0
+        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           sarif_file: results.sarif

.github/workflows/sync-about.yml

@@ -93,7 +93,7 @@ jobs:
       # Fetching the now-gone `refs/heads/<branch>` then fails the run (exit 1).
       # The head SHA stays reachable via `refs/pull/N/head` after the branch is
       # gone, so the checkout — and the run — survives an instant merge.
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 1
           ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.ref }}

.github/workflows/sync-metadata.yml

@@ -14,7 +14,7 @@ jobs:
     name: metadata audit
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0

.github/workflows/zizmor.yml

@@ -32,7 +32,7 @@ jobs:
       actions: read # online audits resolve referenced actions
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 

CHANGELOG.md

@@ -7,6 +7,71 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.9.0] - 2026-06-13
+
+Maintenance release: Java build-dependency updates and CI/Dependabot
+housekeeping only. No library code or public API changes.
+
+### Changed
+- Java binding: upgraded the test framework to JUnit Jupiter 6.1.0 (from
+  5.10.2) and bumped the Maven build plugins — `maven-compiler-plugin`
+  3.13.0 → 3.15.0, `maven-surefire-plugin` 3.2.5 → 3.5.6, `maven-jar-plugin`
+  3.4.1 → 3.5.0, `maven-source-plugin` 3.3.1 → 3.4.0, `maven-javadoc-plugin`
+  3.7.0 → 3.12.0, and `maven-gpg-plugin` 3.2.4 → 3.2.8.
+- Java benchmarks and examples: bumped `maven-compiler-plugin` to 3.15.0 and
+  `exec-maven-plugin` to 3.6.3; examples bumped `jackson-databind` 2.17.1 →
+  2.22.0.
+- Grouped Dependabot updates per ecosystem into a single pull request and
+  extended tracking to the NuGet (C#) binding and the Node/Go examples.
+
+
+## [0.8.9] - 2026-06-12
+
+Maintenance release: supply-chain and CI housekeeping only. No library code or
+public API changes.
+
+### Security
+- Triaged the pyo3 advisories RUSTSEC-2026-0176 (out-of-bounds read in
+  `PyList`/`PyTuple` `nth`/`nth_back`) and RUSTSEC-2026-0177 (missing `Sync`
+  bound on `PyCFunction::new_closure`) as **not affecting Wickra**: neither
+  vulnerable API is reachable from the Python binding. Both are fixed in pyo3
+  0.29, but rust-numpy 0.28 pins pyo3 `^0.28`, so the upgrade is blocked
+  upstream; the advisories are recorded with their not-affected rationale in
+  `deny.toml` and `osv-scanner.toml` and will be cleared once rust-numpy 0.29
+  ships.
+
+### Changed
+- Java binding: bumped `central-publishing-maven-plugin` 0.5.0 → 0.10.0 (the
+  Maven Central publishing plugin used at release time).
+- Bumped the SHA-pinned GitHub Actions used in CI (`actions/checkout`,
+  `actions/setup-go`, `actions/setup-java`, `github/codeql-action`,
+  `taiki-e/install-action`) to their latest releases.
+- Added a Maven ecosystem to Dependabot so the Java binding's build plugins and
+  dependencies are tracked going forward.
+
+
+## [0.8.8] - 2026-06-11
+### Fixed
+- R binding: declare `Depends: R (>= 2.10)`, clearing the `R CMD check` warning
+  ("package needs dependence on R (>= 2.10)") that the bundled, lazy-loaded
+  `sample_ohlcv` dataset triggers on r-universe / CRAN.
+
+## [0.8.7] - 2026-06-11
+### Added
+- R binding: a *Getting started* vignette and a synthetic `sample_ohlcv` example
+  dataset, giving new users a runnable, self-contained walkthrough and populating
+  the R-universe Articles and Datasets tabs. The vignette's code is exercised in
+  CI so a broken example is caught before the published build.
+
+## [0.8.6] - 2026-06-11
+### Changed
+- Package registry metadata for better discoverability:
+  - R (R-universe): added the R-universe URL and `X-schema.org-keywords` to the
+    R `DESCRIPTION`, plus a package logo at `bindings/r/man/figures/logo.png`
+    (pkgdown convention).
+  - Python (PyPI): added a `Documentation` project URL.
+  - C# (NuGet): added a package icon via `PackageIcon`.
+
 ## [0.8.5] - 2026-06-11
 ### Fixed
 - The R binding's golden-fixture parity test now skips gracefully when the shared
@@ -1550,7 +1615,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   optional Binance live feed.
 - Bindings for Python, Node.js, and WebAssembly.
 
-[Unreleased]: https://github.com/wickra-lib/wickra/compare/v0.8.5...HEAD
+[Unreleased]: https://github.com/wickra-lib/wickra/compare/v0.9.0...HEAD
+[0.9.0]: https://github.com/wickra-lib/wickra/compare/v0.8.9...v0.9.0
+[0.8.9]: https://github.com/wickra-lib/wickra/compare/v0.8.8...v0.8.9
+[0.8.8]: https://github.com/wickra-lib/wickra/compare/v0.8.7...v0.8.8
+[0.8.7]: https://github.com/wickra-lib/wickra/compare/v0.8.6...v0.8.7
+[0.8.6]: https://github.com/wickra-lib/wickra/compare/v0.8.5...v0.8.6
 [0.8.5]: https://github.com/wickra-lib/wickra/compare/v0.8.4...v0.8.5
 [0.8.4]: https://github.com/wickra-lib/wickra/compare/v0.8.3...v0.8.4
 [0.8.3]: https://github.com/wickra-lib/wickra/compare/v0.8.2...v0.8.3

Cargo.lock

@@ -1944,7 +1944,7 @@ dependencies = [
 
 [[package]]
 name = "wickra"
-version = "0.8.5"
+version = "0.9.0"
 dependencies = [
  "approx",
  "criterion",
@@ -1955,7 +1955,7 @@ dependencies = [
 
 [[package]]
 name = "wickra-bench"
-version = "0.8.5"
+version = "0.9.0"
 dependencies = [
  "criterion",
  "kand",
@@ -1967,14 +1967,14 @@ dependencies = [
 
 [[package]]
 name = "wickra-c"
-version = "0.8.5"
+version = "0.9.0"
 dependencies = [
  "wickra-core",
 ]
 
 [[package]]
 name = "wickra-core"
-version = "0.8.5"
+version = "0.9.0"
 dependencies = [
  "approx",
  "proptest",
@@ -1984,7 +1984,7 @@ dependencies = [
 
 [[package]]
 name = "wickra-data"
-version = "0.8.5"
+version = "0.9.0"
 dependencies = [
  "approx",
  "csv",
@@ -2001,7 +2001,7 @@ dependencies = [
 
 [[package]]
 name = "wickra-examples"
-version = "0.8.5"
+version = "0.9.0"
 dependencies = [
  "serde_json",
  "tokio",
@@ -2011,7 +2011,7 @@ dependencies = [
 
 [[package]]
 name = "wickra-node"
-version = "0.8.5"
+version = "0.9.0"
 dependencies = [
  "napi",
  "napi-build",
@@ -2021,7 +2021,7 @@ dependencies = [
 
 [[package]]
 name = "wickra-python"
-version = "0.8.5"
+version = "0.9.0"
 dependencies = [
  "numpy",
  "pyo3",
@@ -2030,7 +2030,7 @@ dependencies = [
 
 [[package]]
 name = "wickra-wasm"
-version = "0.8.5"
+version = "0.9.0"
 dependencies = [
  "console_error_panic_hook",
  "js-sys",

Cargo.toml

@@ -14,7 +14,7 @@ members = [
 exclude = ["fuzz"]
 
 [workspace.package]
-version = "0.8.5"
+version = "0.9.0"
 authors = ["kingchenc <support@wickra.org>"]
 edition = "2021"
 rust-version = "1.86"
@@ -26,7 +26,7 @@ keywords = ["finance", "trading", "indicators", "technical-analysis", "ta"]
 categories = ["finance", "mathematics", "science"]
 
 [workspace.dependencies]
-wickra-core = { path = "crates/wickra-core", version = "0.8.5" }
+wickra-core = { path = "crates/wickra-core", version = "0.9.0" }
 
 thiserror = "2"
 rayon = "1.10"

README.md

@@ -419,13 +419,13 @@ The library is provided **as is**, without warranty of any kind; see
 
 <p align="center">
   <a href="https://github.com/wickra-lib/wickra/stargazers">
-    <img alt="GitHub stars" src="https://img.shields.io/github/stars/wickra-lib/wickra?style=for-the-badge&logo=github&logoColor=white&color=ffd866">
+    <img alt="GitHub stars" src="https://raw.githubusercontent.com/wickra-lib/.github/main/profile/badges/stars.svg">
   </a>
   <a href="https://github.com/wickra-lib/wickra/network/members">
-    <img alt="GitHub forks" src="https://img.shields.io/github/forks/wickra-lib/wickra?style=for-the-badge&logo=github&logoColor=white&color=78dce8">
+    <img alt="GitHub forks" src="https://raw.githubusercontent.com/wickra-lib/.github/main/profile/badges/forks.svg">
   </a>
   <a href="https://github.com/wickra-lib/wickra/issues">
-    <img alt="GitHub issues" src="https://img.shields.io/github/issues/wickra-lib/wickra?style=for-the-badge&logo=github&logoColor=white&color=ff6188">
+    <img alt="GitHub issues" src="https://raw.githubusercontent.com/wickra-lib/.github/main/profile/badges/issues.svg">
   </a>
 </p>
 
@@ -436,6 +436,6 @@ The library is provided **as is**, without warranty of any kind; see
 <p align="center">
   <a href="https://star-history.com/#wickra-lib/wickra&Date">
     <img alt="Wickra star history" width="640"
-         src="https://api.star-history.com/svg?repos=wickra-lib/wickra&type=Date&theme=dark">
+         src="https://raw.githubusercontent.com/wickra-lib/.github/main/profile/badges/star-history.svg">
   </a>
 </p>

SECURITY.md

@@ -2,13 +2,13 @@
 
 ## Supported versions
 
-Wickra is pre-1.0. Security fixes are applied to the latest released `0.8.5`
+Wickra is pre-1.0. Security fixes are applied to the latest released `0.9.0`
 version only; please upgrade to the newest release before reporting an issue.
 
 | Version | Supported |
 | --- | --- |
-| 0.8.5 (latest) | :white_check_mark: |
-| < 0.8.5 | :x: |
+| 0.9.0 (latest) | :white_check_mark: |
+| < 0.9.0 | :x: |
 
 ## Reporting a vulnerability
 

bindings/csharp/Wickra/Wickra.csproj

@@ -11,7 +11,7 @@
 
     <!-- NuGet package metadata -->
     <PackageId>Wickra</PackageId>
-    <Version>0.8.5</Version>
+    <Version>0.9.0</Version>
     <Authors>kingchenc</Authors>
     <Description>High-performance streaming technical-analysis indicators (514 indicators) for .NET, backed by the native Rust core via the Wickra C ABI.</Description>
     <PackageLicenseExpression>MIT OR Apache-2.0</PackageLicenseExpression>
@@ -20,6 +20,7 @@
     <RepositoryType>git</RepositoryType>
     <PackageTags>technical-analysis;indicators;trading;finance;streaming;ffi;native</PackageTags>
     <PackageReadmeFile>README.md</PackageReadmeFile>
+    <PackageIcon>icon.png</PackageIcon>
     <IncludeSymbols>true</IncludeSymbols>
     <SymbolPackageFormat>snupkg</SymbolPackageFormat>
     <GenerateDocumentationFile>true</GenerateDocumentationFile>
@@ -42,6 +43,7 @@
 
   <ItemGroup>
     <None Include="..\README.md" Pack="true" PackagePath="\" />
+    <None Include="..\icon.png" Pack="true" PackagePath="\" />
   </ItemGroup>
 
   <!--

bindings/java/README.md

@@ -30,14 +30,14 @@ Maven:
 <dependency>
   <groupId>org.wickra</groupId>
   <artifactId>wickra</artifactId>
-  <version>0.8.5</version>
+  <version>0.9.0</version>
 </dependency>
 ```
 
 Gradle:
 
 ```kotlin
-implementation("org.wickra:wickra:0.8.5")
+implementation("org.wickra:wickra:0.9.0")
 ```
 
 The native library ships prebuilt per platform (Linux, macOS, Windows — x64 and

bindings/java/benchmarks/pom.xml

@@ -30,7 +30,7 @@
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-compiler-plugin</artifactId>
-        <version>3.13.0</version>
+        <version>3.15.0</version>
       </plugin>
 
       <!--
@@ -41,7 +41,7 @@
       <plugin>
         <groupId>org.codehaus.mojo</groupId>
         <artifactId>exec-maven-plugin</artifactId>
-        <version>3.2.0</version>
+        <version>3.6.3</version>
         <configuration>
           <executable>${java.home}/bin/java</executable>
           <arguments>

bindings/java/osv-scanner.toml

@@ -0,0 +1,12 @@
+# OSV-Scanner suppression for this Maven manifest. OSV-Scanner looks for an
+# osv-scanner.toml next to each manifest it scans, and the repo-root config does
+# not cover Maven sub-directory scans — so the jackson finding is suppressed
+# here as well. See the root osv-scanner.toml and the SECURITY.md VEX section.
+#
+# tools.jackson.core:jackson-core 3.x is NOT a dependency of this project. Full
+# Maven resolution (the publishing plugin tree and the project dependency tree)
+# resolves only jackson 2.16.1 / 2.17.1; tools.jackson 3.x appears nowhere.
+# OSV-Scanner's own resolver flags it as a false positive.
+[[IgnoredVulns]]
+id = "GHSA-72hv-8253-57qq"
+reason = "tools.jackson.core:jackson-core 3.x is not a dependency; only jackson 2.x resolves. Not affected."

bindings/java/pom.xml

@@ -6,7 +6,7 @@
 
   <groupId>org.wickra</groupId>
   <artifactId>wickra</artifactId>
-  <version>0.8.5</version>
+  <version>0.9.0</version>
   <packaging>jar</packaging>
 
   <name>Wickra</name>
@@ -44,7 +44,7 @@
   <properties>
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
     <maven.compiler.release>22</maven.compiler.release>
-    <junit.version>5.10.2</junit.version>
+    <junit.version>6.1.0</junit.version>
     <!-- The FFM API is restricted; grant native access to the unnamed module so
          tests and examples run without warnings. Consumers pass the same flag. -->
     <native.access.arg>--enable-native-access=ALL-UNNAMED</native.access.arg>
@@ -64,13 +64,13 @@
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-compiler-plugin</artifactId>
-        <version>3.13.0</version>
+        <version>3.15.0</version>
       </plugin>
 
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-surefire-plugin</artifactId>
-        <version>3.2.5</version>
+        <version>3.5.6</version>
         <configuration>
           <argLine>${native.access.arg}</argLine>
         </configuration>
@@ -79,7 +79,7 @@
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-jar-plugin</artifactId>
-        <version>3.4.1</version>
+        <version>3.5.0</version>
         <configuration>
           <archive>
             <manifestEntries>
@@ -107,7 +107,7 @@
           <plugin>
             <groupId>org.apache.maven.plugins</groupId>
             <artifactId>maven-source-plugin</artifactId>
-            <version>3.3.1</version>
+            <version>3.4.0</version>
             <executions>
               <execution>
                 <id>attach-sources</id>
@@ -119,7 +119,7 @@
           <plugin>
             <groupId>org.apache.maven.plugins</groupId>
             <artifactId>maven-javadoc-plugin</artifactId>
-            <version>3.7.0</version>
+            <version>3.12.0</version>
             <configuration>
               <!-- Generated members are self-descriptive; do not fail on doclint. -->
               <doclint>none</doclint>
@@ -136,7 +136,7 @@
           <plugin>
             <groupId>org.apache.maven.plugins</groupId>
             <artifactId>maven-gpg-plugin</artifactId>
-            <version>3.2.4</version>
+            <version>3.2.8</version>
             <executions>
               <execution>
                 <id>sign-artifacts</id>
@@ -157,7 +157,7 @@
           <plugin>
             <groupId>org.sonatype.central</groupId>
             <artifactId>central-publishing-maven-plugin</artifactId>
-            <version>0.5.0</version>
+            <version>0.10.0</version>
             <extensions>true</extensions>
             <configuration>
               <publishingServerId>central</publishingServerId>

bindings/node/npm/darwin-arm64/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wickra-darwin-arm64",
-  "version": "0.8.5",
+  "version": "0.9.0",
   "description": "Native binding for wickra (macOS Apple Silicon). Installed automatically as an optional dependency of wickra on matching platforms.",
   "main": "wickra.darwin-arm64.node",
   "files": [

bindings/node/npm/darwin-x64/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wickra-darwin-x64",
-  "version": "0.8.5",
+  "version": "0.9.0",
   "description": "Native binding for wickra (macOS Intel). Installed automatically as an optional dependency of wickra on matching platforms.",
   "main": "wickra.darwin-x64.node",
   "files": [

bindings/node/npm/linux-arm64-gnu/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wickra-linux-arm64-gnu",
-  "version": "0.8.5",
+  "version": "0.9.0",
   "description": "Native binding for wickra (linux arm64 GNU). Installed automatically as an optional dependency of wickra on matching platforms.",
   "main": "wickra.linux-arm64-gnu.node",
   "files": [

bindings/node/npm/linux-x64-gnu/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wickra-linux-x64-gnu",
-  "version": "0.8.5",
+  "version": "0.9.0",
   "description": "Native binding for wickra (linux x64 GNU). Installed automatically as an optional dependency of wickra on matching platforms.",
   "main": "wickra.linux-x64-gnu.node",
   "files": [

bindings/node/npm/win32-arm64-msvc/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wickra-win32-arm64-msvc",
-  "version": "0.8.5",
+  "version": "0.9.0",
   "description": "Native binding for wickra (Windows arm64 MSVC). Installed automatically as an optional dependency of wickra on matching platforms.",
   "main": "wickra.win32-arm64-msvc.node",
   "files": [

bindings/node/npm/win32-x64-msvc/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wickra-win32-x64-msvc",
-  "version": "0.8.5",
+  "version": "0.9.0",
   "description": "Native binding for wickra (Windows x64 MSVC). Installed automatically as an optional dependency of wickra on matching platforms.",
   "main": "wickra.win32-x64-msvc.node",
   "files": [

bindings/node/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "wickra",
-  "version": "0.8.5",
+  "version": "0.9.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "wickra",
-      "version": "0.8.5",
+      "version": "0.9.0",
       "license": "MIT OR Apache-2.0",
       "devDependencies": {
         "@napi-rs/cli": "^2.18.0"
@@ -15,12 +15,12 @@
         "node": ">= 18"
       },
       "optionalDependencies": {
-        "wickra-darwin-arm64": "0.8.5",
-        "wickra-darwin-x64": "0.8.5",
-        "wickra-linux-arm64-gnu": "0.8.5",
-        "wickra-linux-x64-gnu": "0.8.5",
-        "wickra-win32-arm64-msvc": "0.8.5",
-        "wickra-win32-x64-msvc": "0.8.5"
+        "wickra-darwin-arm64": "0.9.0",
+        "wickra-darwin-x64": "0.9.0",
+        "wickra-linux-arm64-gnu": "0.9.0",
+        "wickra-linux-x64-gnu": "0.9.0",
+        "wickra-win32-arm64-msvc": "0.9.0",
+        "wickra-win32-x64-msvc": "0.9.0"
       }
     },
     "node_modules/@napi-rs/cli": {
@@ -41,8 +41,8 @@
       }
     },
     "node_modules/wickra-darwin-arm64": {
-      "version": "0.8.5",
-      "resolved": "https://registry.npmjs.org/wickra-darwin-arm64/-/wickra-darwin-arm64-0.8.5.tgz",
+      "version": "0.9.0",
+      "resolved": "https://registry.npmjs.org/wickra-darwin-arm64/-/wickra-darwin-arm64-0.9.0.tgz",
       "integrity": "sha512-4eZiBR/yGUdr4nzhEUFy2i69XgNx64iI2ax/LPamsThgylC0KpHOZKK19QzJ2d9KbK4C8nMjME5FLuR+4GNEwQ==",
       "cpu": [
         "arm64"
@@ -57,8 +57,8 @@
       }
     },
     "node_modules/wickra-darwin-x64": {
-      "version": "0.8.5",
-      "resolved": "https://registry.npmjs.org/wickra-darwin-x64/-/wickra-darwin-x64-0.8.5.tgz",
+      "version": "0.9.0",
+      "resolved": "https://registry.npmjs.org/wickra-darwin-x64/-/wickra-darwin-x64-0.9.0.tgz",
       "integrity": "sha512-6hf8zI3QPjTFp4zCpmgUwDvNtu6jHqNUHKD5e55POo0CgA52HkpyxSPtVm8TGTIZDI7kPjlbOdBM8CJ76mmXwA==",
       "cpu": [
         "x64"
@@ -73,8 +73,8 @@
       }
     },
     "node_modules/wickra-linux-arm64-gnu": {
-      "version": "0.8.5",
-      "resolved": "https://registry.npmjs.org/wickra-linux-arm64-gnu/-/wickra-linux-arm64-gnu-0.8.5.tgz",
+      "version": "0.9.0",
+      "resolved": "https://registry.npmjs.org/wickra-linux-arm64-gnu/-/wickra-linux-arm64-gnu-0.9.0.tgz",
       "integrity": "sha512-kSe6y0xBMSiqdPLXNjwop5WZdHtvdBNKSEBCwZ4hFq33p4apW25/wrlzv9/oDuyD4kuPabJEhCCnFOplh58CUg==",
       "cpu": [
         "arm64"
@@ -89,8 +89,8 @@
       }
     },
     "node_modules/wickra-linux-x64-gnu": {
-      "version": "0.8.5",
-      "resolved": "https://registry.npmjs.org/wickra-linux-x64-gnu/-/wickra-linux-x64-gnu-0.8.5.tgz",
+      "version": "0.9.0",
+      "resolved": "https://registry.npmjs.org/wickra-linux-x64-gnu/-/wickra-linux-x64-gnu-0.9.0.tgz",
       "integrity": "sha512-tWBWS4qz7hxM4xnpFb59bhf6TaLwXq0Z3jEa/2l7r8PiHA94g8r8S53NRMiT+4yiL5hSWe/nUiC/YXdRrhEZ4g==",
       "cpu": [
         "x64"
@@ -105,8 +105,8 @@
       }
     },
     "node_modules/wickra-win32-arm64-msvc": {
-      "version": "0.8.5",
-      "resolved": "https://registry.npmjs.org/wickra-win32-arm64-msvc/-/wickra-win32-arm64-msvc-0.8.5.tgz",
+      "version": "0.9.0",
+      "resolved": "https://registry.npmjs.org/wickra-win32-arm64-msvc/-/wickra-win32-arm64-msvc-0.9.0.tgz",
       "integrity": "sha512-EXIckHxAtF75PUGDKRzXyqMe9ldP0JjSdu68WFN6iJfp+McYrGu6h40TEJlQ/oUEIoPqiZB/xhVyo/el5Lg7zw==",
       "cpu": [
         "arm64"
@@ -121,8 +121,8 @@
       }
     },
     "node_modules/wickra-win32-x64-msvc": {
-      "version": "0.8.5",
-      "resolved": "https://registry.npmjs.org/wickra-win32-x64-msvc/-/wickra-win32-x64-msvc-0.8.5.tgz",
+      "version": "0.9.0",
+      "resolved": "https://registry.npmjs.org/wickra-win32-x64-msvc/-/wickra-win32-x64-msvc-0.9.0.tgz",
       "integrity": "sha512-Yfsqq1Xwp6hdxMyLze411vNdo7BDwI6+lPSe7A9XdqyPecNDbtKwYLpsal2r8EHbNzqM+R8XnuRtUaEQS5VlUQ==",
       "cpu": [
         "x64"

bindings/node/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wickra",
-  "version": "0.8.5",
+  "version": "0.9.0",
   "description": "Streaming-first technical indicators: incremental, fast, install-free. Node bindings powered by Rust.",
   "author": "kingchenc <support@wickra.org>",
   "main": "index.js",
@@ -47,12 +47,12 @@
     "node": ">= 18"
   },
   "optionalDependencies": {
-    "wickra-linux-x64-gnu": "0.8.5",
-    "wickra-linux-arm64-gnu": "0.8.5",
-    "wickra-darwin-x64": "0.8.5",
-    "wickra-darwin-arm64": "0.8.5",
-    "wickra-win32-x64-msvc": "0.8.5",
-    "wickra-win32-arm64-msvc": "0.8.5"
+    "wickra-linux-x64-gnu": "0.9.0",
+    "wickra-linux-arm64-gnu": "0.9.0",
+    "wickra-darwin-x64": "0.9.0",
+    "wickra-darwin-arm64": "0.9.0",
+    "wickra-win32-x64-msvc": "0.9.0",
+    "wickra-win32-arm64-msvc": "0.9.0"
   },
   "scripts": {
     "build": "napi build --platform --release",

bindings/python/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "maturin"
 
 [project]
 name = "wickra"
-version = "0.8.5"
+version = "0.9.0"
 description = "Streaming-first technical indicators: incremental, fast, install-free."
 readme = "README.md"
 license = "MIT OR Apache-2.0"
@@ -48,6 +48,7 @@ bench = [
 
 [project.urls]
 Homepage = "https://github.com/wickra-lib/wickra"
+Documentation = "https://docs.wickra.org"
 Repository = "https://github.com/wickra-lib/wickra"
 Issues = "https://github.com/wickra-lib/wickra/issues"
 

bindings/r/.Rbuildignore

@@ -11,3 +11,4 @@
 ^src/wickra-c$
 ^src/Makevars$
 ^\.gitignore$
+^data-raw$

bindings/r/DESCRIPTION

@@ -1,15 +1,19 @@
 Package: wickra
 Type: Package
 Title: Streaming-First Technical Indicators
-Version: 0.8.5
+Version: 0.9.0
 Authors@R: person("Wickra contributors", role = c("aut", "cre"), email = "support@wickra.org")
 Description: R bindings for the Wickra technical-analysis library over its C ABI
     hub. Exposes 514 indicators, each an O(1) streaming state machine shared with
     the Rust core and the other language bindings, so that live and historical
     evaluation use the exact same implementation.
 License: MIT + file LICENSE | Apache License 2.0
-URL: https://github.com/wickra-lib/wickra, https://docs.wickra.org
+URL: https://github.com/wickra-lib/wickra, https://docs.wickra.org,
+    https://wickra-lib.r-universe.dev
 BugReports: https://github.com/wickra-lib/wickra/issues
+X-schema.org-keywords: technical-analysis, indicators, streaming, trading,
+    finance, quant, algorithmic-trading, backtesting, time-series, ta-lib,
+    candlestick, market-data
 Encoding: UTF-8
 NeedsCompilation: yes
 SystemRequirements: the Wickra C ABI shared library, downloaded automatically at
@@ -17,6 +21,9 @@ SystemRequirements: the Wickra C ABI shared library, downloaded automatically at
     Set WICKRA_INCLUDE_DIR and WICKRA_LIB_DIR to build against a locally built C
     ABI instead (e.g. after `cargo build -p wickra-c --release`).
 Roxygen: list(markdown = TRUE)
-Suggests: testthat (>= 3.0.0)
+Depends: R (>= 2.10)
+Suggests: testthat (>= 3.0.0), knitr, rmarkdown
+VignetteBuilder: knitr
+LazyData: true
 Config/testthat/edition: 3
 Config/roxygen2/version: 8.0.0

bindings/r/R/data.R

@@ -0,0 +1,17 @@
+#' Synthetic daily OHLCV sample series
+#'
+#' A deterministic, synthetic daily OHLCV (open / high / low / close / volume)
+#' price series for use in the examples, the *Getting started* vignette, and
+#' tests. It is a seeded random walk, **not** real market data. Regenerate with
+#' `data-raw/sample_ohlcv.R`.
+#'
+#' @format A data frame with 250 rows and 6 columns:
+#' \describe{
+#'   \item{date}{Trading date (`Date`).}
+#'   \item{open}{Opening price.}
+#'   \item{high}{Session high.}
+#'   \item{low}{Session low.}
+#'   \item{close}{Closing price.}
+#'   \item{volume}{Traded volume.}
+#' }
+"sample_ohlcv"

bindings/r/README.md

@@ -1,4 +1,4 @@
-# Wickra — R
+# Wickra — R <img src="man/figures/logo.png" align="right" height="120" alt="Wickra logo" />
 
 [![CI](https://github.com/wickra-lib/wickra/actions/workflows/ci.yml/badge.svg)](https://github.com/wickra-lib/wickra/actions/workflows/ci.yml)
 [![codecov](https://codecov.io/gh/wickra-lib/wickra/branch/main/graph/badge.svg)](https://codecov.io/gh/wickra-lib/wickra)

bindings/r/data-raw/sample_ohlcv.R

@@ -0,0 +1,31 @@
+# Generates data/sample_ohlcv.rda — a deterministic, synthetic daily OHLCV
+# series used by the examples, the getting-started vignette, and tests. It is a
+# seeded random walk, NOT real market data.
+#
+# Regenerate (run from the R package root, bindings/r):
+#   Rscript data-raw/sample_ohlcv.R
+
+set.seed(42)
+n <- 250L
+dates <- seq(as.Date("2023-01-02"), by = "day", length.out = n)
+
+# Random-walk close with a mild upward drift; derive OHLC around it.
+returns <- rnorm(n, mean = 0.0004, sd = 0.012)
+close <- round(100 * cumprod(1 + returns), 2)
+open <- round(c(100, head(close, -1)) * (1 + rnorm(n, 0, 0.003)), 2)
+high <- round(pmax(open, close) * (1 + abs(rnorm(n, 0, 0.004))), 2)
+low <- round(pmin(open, close) * (1 - abs(rnorm(n, 0, 0.004))), 2)
+volume <- round(1e6 * exp(rnorm(n, 0, 0.3)))
+
+sample_ohlcv <- data.frame(
+  date = dates,
+  open = open,
+  high = high,
+  low = low,
+  close = close,
+  volume = volume
+)
+
+save(sample_ohlcv, file = "data/sample_ohlcv.rda", compress = "xz", version = 2)
+cat(sprintf("wrote data/sample_ohlcv.rda: %d rows x %d cols\n",
+            nrow(sample_ohlcv), ncol(sample_ohlcv)))

bindings/r/man/sample_ohlcv.Rd

@@ -0,0 +1,27 @@
+% Generated by roxygen2: do not edit by hand
+% Please edit documentation in R/data.R
+\docType{data}
+\name{sample_ohlcv}
+\alias{sample_ohlcv}
+\title{Synthetic daily OHLCV sample series}
+\format{
+A data frame with 250 rows and 6 columns:
+\describe{
+  \item{date}{Trading date (\code{Date}).}
+  \item{open}{Opening price.}
+  \item{high}{Session high.}
+  \item{low}{Session low.}
+  \item{close}{Closing price.}
+  \item{volume}{Traded volume.}
+}
+}
+\usage{
+sample_ohlcv
+}
+\description{
+A deterministic, synthetic daily OHLCV (open / high / low / close / volume)
+price series for use in the examples, the \emph{Getting started} vignette, and
+tests. It is a seeded random walk, \strong{not} real market data. Regenerate with
+\code{data-raw/sample_ohlcv.R}.
+}
+\keyword{datasets}

bindings/r/vignettes/getting-started.Rmd

@@ -0,0 +1,113 @@
+---
+title: "Getting started with wickra"
+output: rmarkdown::html_vignette
+vignette: >
+  %\VignetteIndexEntry{Getting started with wickra}
+  %\VignetteEngine{knitr::rmarkdown}
+  %\VignetteEncoding{UTF-8}
+---
+
+```{r setup, include = FALSE}
+knitr::opts_chunk$set(collapse = TRUE, comment = "#>")
+```
+
+`wickra` exposes the Wickra technical-analysis library in R over its C ABI hub.
+Every indicator is a constructor returning a `wickra_indicator`; you feed it data
+one observation at a time with `update()` (an O(1) streaming step) or run a whole
+series at once with `batch()`. Both paths share the exact same Rust core, so a
+live feed and a historical backtest compute identical values.
+
+```{r}
+library(wickra)
+```
+
+## A sample series
+
+The package ships a small synthetic OHLCV series, `sample_ohlcv`, for examples
+(a seeded random walk — not real market data).
+
+```{r}
+head(sample_ohlcv)
+```
+
+## Batch: a whole series at once
+
+Scalar indicators run over a vector with `batch()`. Warmup positions are `NA`.
+
+```{r}
+sma <- Sma(20)
+sma_values <- batch(sma, sample_ohlcv$close)
+tail(sma_values)
+```
+
+## Streaming: one observation at a time
+
+The same indicator fed tick-by-tick with `update()` returns the identical
+values — an equivalence the test suite enforces for every indicator.
+
+```{r}
+sma_stream <- Sma(20)
+streamed <- vapply(sample_ohlcv$close, function(p) update(sma_stream, p), numeric(1))
+
+same_warmup <- all(is.na(streamed) == is.na(sma_values))
+same_values <- all(streamed == sma_values, na.rm = TRUE)
+c(batch_equals_streaming = same_warmup && same_values)
+```
+
+A typical streaming loop reacts to each value as it arrives:
+
+```{r}
+rsi <- Rsi(14)
+overbought_days <- 0L
+for (price in sample_ohlcv$close) {
+  v <- update(rsi, price)            # NA during warmup
+  if (!is.na(v) && v > 70) overbought_days <- overbought_days + 1L
+}
+overbought_days
+```
+
+## Multi-output indicators
+
+Indicators with several outputs return a *named* numeric vector (`NA` while
+warming up). MACD is the classic example — line, signal, and histogram:
+
+```{r}
+macd <- MacdIndicator(12, 26, 9)
+last_macd <- c(macd = NA, signal = NA, histogram = NA)
+for (price in sample_ohlcv$close) last_macd <- update(macd, price)
+last_macd
+```
+
+## Candle indicators
+
+Indicators that need the whole bar take the OHLCV fields plus a timestamp:
+
+```{r}
+atr <- Atr(14)
+last_atr <- NA_real_
+for (i in seq_len(nrow(sample_ohlcv))) {
+  last_atr <- update(
+    atr,
+    sample_ohlcv$open[i], sample_ohlcv$high[i], sample_ohlcv$low[i],
+    sample_ohlcv$close[i], sample_ohlcv$volume[i], i - 1
+  )
+}
+last_atr
+```
+
+## Resetting state
+
+`reset()` returns an indicator to its warmup state so the same object can be
+reused on a fresh series:
+
+```{r}
+reset(sma)
+update(sma, 100)   # NaN — warming up again
+```
+
+## Next steps
+
+- Full indicator catalogue, guides, and per-indicator reference:
+  <https://docs.wickra.org>.
+- Every constructor (`Sma()`, `Rsi()`, `MacdIndicator()`, `Atr()`, …) is listed
+  in this package's help index.

deny.toml

@@ -9,6 +9,18 @@ all-features = true
 # Fail on any security advisory or unmaintained/unsound crate in the tree.
 version = 2
 yanked = "deny"
+# Temporary, upstream-blocked exception. Both advisories are fixed in pyo3
+# 0.29.0, but rust-numpy 0.28 (latest release) hard-pins `pyo3 ^0.28.0`, so the
+# resolver cannot select 0.29 until rust-numpy ships a 0.29-compatible release
+# (PyO3/rust-numpy "Updated to PyO3 version 0.29.0" is open, not yet published).
+# Neither vulnerable code path is reachable from our binding: it never calls
+# `BoundListIterator::nth`/`nth_back` or the `PyTuple` equivalents (0176), nor
+# `PyCFunction::new_closure` (0177) — verified by grep over bindings/python/src.
+# Remove both once rust-numpy 0.29 lands and the pyo3 0.29 bump goes in.
+ignore = [
+    "RUSTSEC-2026-0176",
+    "RUSTSEC-2026-0177",
+]
 
 [bans]
 # Catch accidental duplicate versions and wildcard ("*") version requirements.

examples/java/osv-scanner.toml

@@ -0,0 +1,12 @@
+# OSV-Scanner suppression for this Maven manifest. OSV-Scanner looks for an
+# osv-scanner.toml next to each manifest it scans, and the repo-root config does
+# not cover Maven sub-directory scans — so the jackson finding is suppressed
+# here as well. See the root osv-scanner.toml and the SECURITY.md VEX section.
+#
+# tools.jackson.core:jackson-core 3.x is NOT a dependency of this project. This
+# example resolves only com.fasterxml.jackson.core:jackson-databind 2.17.1 (and
+# its 2.x jackson-core); tools.jackson 3.x appears nowhere. OSV-Scanner's own
+# resolver flags it as a false positive.
+[[IgnoredVulns]]
+id = "GHSA-72hv-8253-57qq"
+reason = "tools.jackson.core:jackson-core 3.x is not a dependency; only jackson 2.x resolves. Not affected."

examples/java/pom.xml

@@ -6,7 +6,7 @@
 
   <groupId>org.wickra.examples</groupId>
   <artifactId>wickra-examples</artifactId>
-  <version>0.8.5</version>
+  <version>0.9.0</version>
   <packaging>jar</packaging>
 
   <name>Wickra Java examples</name>
@@ -21,13 +21,13 @@
     <dependency>
       <groupId>org.wickra</groupId>
       <artifactId>wickra</artifactId>
-      <version>0.8.5</version>
+      <version>0.9.0</version>
     </dependency>
     <!-- Only the network examples (fetch_btcusdt) parse JSON. -->
     <dependency>
       <groupId>com.fasterxml.jackson.core</groupId>
       <artifactId>jackson-databind</artifactId>
-      <version>2.17.1</version>
+      <version>2.22.0</version>
     </dependency>
   </dependencies>
 
@@ -36,7 +36,7 @@
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-compiler-plugin</artifactId>
-        <version>3.13.0</version>
+        <version>3.15.0</version>
       </plugin>
 
       <!--
@@ -46,7 +46,7 @@
       <plugin>
         <groupId>org.codehaus.mojo</groupId>
         <artifactId>exec-maven-plugin</artifactId>
-        <version>3.2.0</version>
+        <version>3.6.3</version>
         <configuration>
           <executable>${java.home}/bin/java</executable>
           <arguments>

examples/node/package-lock.json

@@ -17,7 +17,7 @@
     },
     "../../bindings/node": {
       "name": "wickra",
-      "version": "0.8.5",
+      "version": "0.9.0",
       "license": "MIT OR Apache-2.0",
       "devDependencies": {
         "@napi-rs/cli": "^2.18.0"
@@ -26,12 +26,12 @@
         "node": ">= 18"
       },
       "optionalDependencies": {
-        "wickra-darwin-arm64": "0.8.5",
-        "wickra-darwin-x64": "0.8.5",
-        "wickra-linux-arm64-gnu": "0.8.5",
-        "wickra-linux-x64-gnu": "0.8.5",
-        "wickra-win32-arm64-msvc": "0.8.5",
-        "wickra-win32-x64-msvc": "0.8.5"
+        "wickra-darwin-arm64": "0.9.0",
+        "wickra-darwin-x64": "0.9.0",
+        "wickra-linux-arm64-gnu": "0.9.0",
+        "wickra-linux-x64-gnu": "0.9.0",
+        "wickra-win32-arm64-msvc": "0.9.0",
+        "wickra-win32-x64-msvc": "0.9.0"
       }
     },
     "node_modules/wickra": {

osv-scanner.toml

@@ -0,0 +1,35 @@
+# OSV-Scanner suppressions (VEX record). Consumed by the OpenSSF Scorecard
+# Vulnerabilities check, which runs OSV-Scanner over this repository. Each entry
+# is an advisory assessed as not affecting Wickra; this mirrors the cargo-deny
+# `ignore` list in deny.toml at the OSV layer. See the "Vulnerability
+# exploitability (VEX)" section of SECURITY.md.
+
+# pyo3 — both advisories are fixed in pyo3 0.29.0, but rust-numpy 0.28 (latest
+# release) hard-pins pyo3 ^0.28.0, so the bump is upstream-blocked. Neither
+# vulnerable code path is reachable from the binding: it never calls
+# BoundListIterator nth/nth_back, the PyTuple equivalents, or
+# PyCFunction::new_closure (verified by grep over bindings/python/src). Also
+# tracked in deny.toml; remove once rust-numpy 0.29 ships and pyo3 is bumped.
+[[IgnoredVulns]]
+id = "RUSTSEC-2026-0176"
+reason = "pyo3 OOB read in PyList/PyTuple nth/nth_back; vulnerable API unused; fix blocked upstream by rust-numpy. Tracked in deny.toml."
+
+[[IgnoredVulns]]
+id = "GHSA-36hh-v3qg-5jq4"
+reason = "Alias of RUSTSEC-2026-0176."
+
+[[IgnoredVulns]]
+id = "RUSTSEC-2026-0177"
+reason = "pyo3 missing Sync on PyCFunction::new_closure; vulnerable API unused; fix blocked upstream by rust-numpy. Tracked in deny.toml."
+
+[[IgnoredVulns]]
+id = "GHSA-chgr-c6px-7xpp"
+reason = "Alias of RUSTSEC-2026-0177."
+
+# jackson-core 3.x async-parser DoS — tools.jackson.core:jackson-core 3.x is not
+# a dependency of this project. No manifest, Maven plugin, or the GitHub
+# dependency-graph SBOM references jackson 3.x; the only jackson present is
+# com.fasterxml.jackson.core:jackson-databind 2.17.1 (examples only). Not affected.
+[[IgnoredVulns]]
+id = "GHSA-72hv-8253-57qq"
+reason = "tools.jackson.core:jackson-core 3.x is not a dependency of this project; only jackson-databind 2.17.1 is present. Not affected."