release: bump 0.8.9 -> 0.9.0 (#289)

All nine Dependabot ecosystems now batch their updates into one grouped PR each
(`groups: { <name>: { patterns: ["*"] } }`) instead of one PR per dependency.

A routine refresh previously fanned out into a dozen-plus PRs (the Maven batch
alone opened 12), each running the full nine-language CI matrix (~55 checks) and
clogging the runner queue ahead of release and feature runs. Grouping collapses
that to one PR per ecosystem.

Trade-off: a single broken update blocks its whole group until excluded — fine
for routine maintenance bumps. Security updates are unaffected (they are not
grouped and continue to arrive individually).

.github/dependabot.yml

@@ -10,6 +10,9 @@ updates:
       default-days: 7
     commit-message:
       prefix: "deps(cargo)"
+    groups:
+      cargo:
+        patterns: ["*"]
 
   # Node binding npm dependencies.
   - package-ecosystem: npm
@@ -21,6 +24,9 @@ updates:
       default-days: 7
     commit-message:
       prefix: "deps(npm)"
+    groups:
+      node-binding:
+        patterns: ["*"]
 
   # Python binding pip dependencies.
   - package-ecosystem: pip
@@ -32,6 +38,9 @@ updates:
       default-days: 7
     commit-message:
       prefix: "deps(pip)"
+    groups:
+      python-binding:
+        patterns: ["*"]
 
   # Hash-pinned CI/bench Python tooling under .github/requirements/. Each
   # <name>.in is the loose source; the matching hash-locked <name>.txt is the
@@ -47,6 +56,9 @@ updates:
       default-days: 7
     commit-message:
       prefix: "deps(ci-pip)"
+    groups:
+      ci-pip:
+        patterns: ["*"]
 
   # GitHub Actions — keeps the SHA-pinned actions current (Dependabot reads
   # the version comment after each pinned SHA and bumps both together).
@@ -59,3 +71,73 @@ updates:
       default-days: 7
     commit-message:
       prefix: "deps(actions)"
+    groups:
+      github-actions:
+        patterns: ["*"]
+
+  # Java binding + examples (Maven). Tracks the C-ABI binding's build plugins
+  # (e.g. central-publishing-maven-plugin) and the examples' jackson dependency,
+  # which had no Dependabot coverage before — a stale publishing plugin slipped
+  # through unnoticed until an OSV scan flagged it.
+  - package-ecosystem: maven
+    directories:
+      - "/bindings/java"
+      - "/bindings/java/benchmarks"
+      - "/examples/java"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    cooldown:
+      default-days: 7
+    commit-message:
+      prefix: "deps(maven)"
+    groups:
+      maven:
+        patterns: ["*"]
+
+  # C# binding (NuGet). The published Wickra.csproj is a thin C-ABI wrapper with
+  # no external packages, but the test and benchmark projects pull xunit,
+  # Microsoft.NET.Test.Sdk and BenchmarkDotNet.
+  - package-ecosystem: nuget
+    directories:
+      - "/bindings/csharp/Wickra.Tests"
+      - "/bindings/csharp/benchmarks"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    cooldown:
+      default-days: 7
+    commit-message:
+      prefix: "deps(nuget)"
+    groups:
+      nuget:
+        patterns: ["*"]
+
+  # Node examples (npm) — separate from the binding's own package.json.
+  - package-ecosystem: npm
+    directory: "/examples/node"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    cooldown:
+      default-days: 7
+    commit-message:
+      prefix: "deps(npm)"
+    groups:
+      node-examples:
+        patterns: ["*"]
+
+  # Go examples (Go modules). The binding's own go.mod has no external deps;
+  # the examples pull coder/websocket.
+  - package-ecosystem: gomod
+    directory: "/examples/go"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    cooldown:
+      default-days: 7
+    commit-message:
+      prefix: "deps(gomod)"
+    groups:
+      go-examples:
+        patterns: ["*"]

.github/workflows/bench.yml

@@ -48,7 +48,7 @@ jobs:
     name: Cross-library benchmark report
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -122,7 +122,7 @@ jobs:
     name: Rust cross-library benchmark report
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 

.github/workflows/ci.yml

@@ -40,7 +40,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -107,7 +107,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20 # backstop: cap a wedged job instead of GitHub's 6h default (slowest real job ~5 min)
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -197,7 +197,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20 # backstop: cap a wedged job instead of GitHub's 6h default (slowest real job ~5 min)
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -291,7 +291,7 @@ jobs:
             toolchain: "1.88"
             packages: "-p wickra-node"
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -330,7 +330,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20 # backstop: cap a wedged job instead of GitHub's 6h default (slowest real job ~5 min)
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -345,7 +345,7 @@ jobs:
         timeout-minutes: 6
 
       - name: Install cargo-llvm-cov
-        uses: taiki-e/install-action@0fd46367812ee04360509b4169d9f659d6892bb2 # v2.79.15
+        uses: taiki-e/install-action@59012be0884e296ca2da49b530610e72c49039ad # v2.81.6
         timeout-minutes: 10 # fail fast on a stuck download instead of hanging the job
         with:
           tool: cargo-llvm-cov
@@ -372,7 +372,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20 # backstop: cap a wedged job instead of GitHub's 6h default (slowest real job ~5 min)
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -391,7 +391,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20 # backstop: cap a wedged job instead of GitHub's 6h default (slowest real job ~5 min)
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -415,7 +415,7 @@ jobs:
         # attributes the modern nightly compiler rejects, so the install
         # never gets off the ground. The prebuilt binary avoids the entire
         # transitive-dep compile.
-        uses: taiki-e/install-action@0fd46367812ee04360509b4169d9f659d6892bb2 # v2.79.15
+        uses: taiki-e/install-action@59012be0884e296ca2da49b530610e72c49039ad # v2.81.6
         timeout-minutes: 10 # fail fast on a stuck download instead of hanging the job
         with:
           tool: cargo-fuzz
@@ -450,7 +450,7 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
         python-version: ["3.9", "3.11", "3.12", "3.13"]
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -527,7 +527,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20 # backstop: cap a wedged job instead of GitHub's 6h default (slowest real job ~5 min)
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -549,7 +549,7 @@ jobs:
         # same taiki-e prebuilt-binary installer we already use for
         # cargo-llvm-cov and cargo-fuzz; it tracks the latest wasm-pack
         # release, which has `--features` as a top-level flag (since 0.12).
-        uses: taiki-e/install-action@0fd46367812ee04360509b4169d9f659d6892bb2 # v2.79.15
+        uses: taiki-e/install-action@59012be0884e296ca2da49b530610e72c49039ad # v2.81.6
         timeout-minutes: 10 # fail fast on a stuck download instead of hanging the job
         with:
           tool: wasm-pack
@@ -576,7 +576,7 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
         node-version: ["18", "20"]
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -649,7 +649,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -662,7 +662,7 @@ jobs:
         timeout-minutes: 6
 
       - name: Install cbindgen
-        uses: taiki-e/install-action@0fd46367812ee04360509b4169d9f659d6892bb2 # v2.79.15
+        uses: taiki-e/install-action@59012be0884e296ca2da49b530610e72c49039ad # v2.81.6
         timeout-minutes: 10 # fail fast on a stuck download instead of hanging the job
         with:
           tool: cbindgen
@@ -705,7 +705,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -756,7 +756,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -766,7 +766,7 @@ jobs:
       - name: Set up Go
         id: setup-go
         continue-on-error: true
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version: "stable"
           cache: false
@@ -780,7 +780,7 @@ jobs:
 
       - name: Set up Go (retry)
         if: steps.setup-go.outcome == 'failure'
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version: "stable"
           cache: false
@@ -882,7 +882,7 @@ jobs:
       WICKRA_INCLUDE_DIR: ${{ github.workspace }}/bindings/c/include
       WICKRA_LIB_DIR: ${{ github.workspace }}/target/release
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -961,7 +961,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -983,7 +983,7 @@ jobs:
       - name: Set up JDK 22
         id: setup-java
         continue-on-error: true
-        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: temurin
           java-version: "22"
@@ -998,7 +998,7 @@ jobs:
 
       - name: Set up JDK 22 (retry)
         if: steps.setup-java.outcome == 'failure'
-        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: temurin
           java-version: "22"

.github/workflows/codeql.yml

@@ -40,17 +40,17 @@ jobs:
             build-mode: none
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@03e4368ac7daa2bd82b3e85262f3bf87ee112f57 # v3.36.0
+        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@03e4368ac7daa2bd82b3e85262f3bf87ee112f57 # v3.36.0
+        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/release.yml

@@ -45,7 +45,7 @@ jobs:
     # Settings -> Environments.
     environment: release
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
       - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable branch, 2026-03-27
@@ -110,7 +110,7 @@ jobs:
       # consumers can audit the published dependency tree without
       # re-resolving Cargo.lock.
       - name: Install cargo-cyclonedx
-        uses: taiki-e/install-action@0fd46367812ee04360509b4169d9f659d6892bb2 # v2.79.15
+        uses: taiki-e/install-action@59012be0884e296ca2da49b530610e72c49039ad # v2.81.6
         timeout-minutes: 10 # fail fast on a stuck download instead of hanging the job
         with:
           tool: cargo-cyclonedx
@@ -157,7 +157,7 @@ jobs:
           - { os: windows-11-arm, target: aarch64, manylinux: auto }
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
       - name: Set up Python
@@ -197,7 +197,7 @@ jobs:
     name: Build Python sdist
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
       - name: Sync root README into bindings/python so it ships in the sdist
@@ -249,7 +249,7 @@ jobs:
           - { host: windows-11-arm, target: aarch64-pc-windows-msvc }
     runs-on: ${{ matrix.host }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -310,7 +310,7 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -479,7 +479,7 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -512,7 +512,7 @@ jobs:
       - name: Install wasm-pack (latest, via prebuilt binary)
         # See the matching note in ci.yml: jetli's default installs an old
         # 0.10.x wasm-pack whose build subcommand rejects --features.
-        uses: taiki-e/install-action@0fd46367812ee04360509b4169d9f659d6892bb2 # v2.79.15
+        uses: taiki-e/install-action@59012be0884e296ca2da49b530610e72c49039ad # v2.81.6
         timeout-minutes: 10 # fail fast on a stuck download instead of hanging the job
         with:
           tool: wasm-pack
@@ -588,7 +588,7 @@ jobs:
           - { host: windows-11-arm, target: aarch64-pc-windows-msvc }
     runs-on: ${{ matrix.host }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -638,7 +638,7 @@ jobs:
       contents: read
       id-token: write # request the GitHub OIDC token for trusted publishing
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -718,7 +718,7 @@ jobs:
     runs-on: ubuntu-latest
     environment: release
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -758,7 +758,7 @@ jobs:
       # setup-java writes a settings.xml with the 'central' server credentials
       # (mapped from the env vars below) and imports the GPG signing key.
       - name: Set up JDK 22 + Maven Central credentials + GPG
-        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: temurin
           java-version: "22"
@@ -788,7 +788,7 @@ jobs:
     needs: c-abi-build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -877,7 +877,7 @@ jobs:
     outputs:
       tag: ${{ steps.tag.outputs.tag }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           fetch-depth: 0

.github/workflows/scorecard.yml

@@ -24,7 +24,7 @@ jobs:
       id-token: write # OIDC token to publish results to the OpenSSF API
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -51,6 +51,6 @@ jobs:
           retention-days: 5
 
       - name: Upload SARIF to code-scanning
-        uses: github/codeql-action/upload-sarif@03e4368ac7daa2bd82b3e85262f3bf87ee112f57 # v3.36.0
+        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           sarif_file: results.sarif

.github/workflows/sync-about.yml

@@ -93,7 +93,7 @@ jobs:
       # Fetching the now-gone `refs/heads/<branch>` then fails the run (exit 1).
       # The head SHA stays reachable via `refs/pull/N/head` after the branch is
       # gone, so the checkout — and the run — survives an instant merge.
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 1
           ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.ref }}

.github/workflows/sync-metadata.yml

@@ -14,7 +14,7 @@ jobs:
     name: metadata audit
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0

.github/workflows/zizmor.yml

@@ -32,7 +32,7 @@ jobs:
       actions: read # online audits resolve referenced actions
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 

CHANGELOG.md

@@ -7,6 +7,55 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.9.0] - 2026-06-13
+
+Maintenance release: Java build-dependency updates and CI/Dependabot
+housekeeping only. No library code or public API changes.
+
+### Changed
+- Java binding: upgraded the test framework to JUnit Jupiter 6.1.0 (from
+  5.10.2) and bumped the Maven build plugins — `maven-compiler-plugin`
+  3.13.0 → 3.15.0, `maven-surefire-plugin` 3.2.5 → 3.5.6, `maven-jar-plugin`
+  3.4.1 → 3.5.0, `maven-source-plugin` 3.3.1 → 3.4.0, `maven-javadoc-plugin`
+  3.7.0 → 3.12.0, and `maven-gpg-plugin` 3.2.4 → 3.2.8.
+- Java benchmarks and examples: bumped `maven-compiler-plugin` to 3.15.0 and
+  `exec-maven-plugin` to 3.6.3; examples bumped `jackson-databind` 2.17.1 →
+  2.22.0.
+- Grouped Dependabot updates per ecosystem into a single pull request and
+  extended tracking to the NuGet (C#) binding and the Node/Go examples.
+
+
+## [0.8.9] - 2026-06-12
+
+Maintenance release: supply-chain and CI housekeeping only. No library code or
+public API changes.
+
+### Security
+- Triaged the pyo3 advisories RUSTSEC-2026-0176 (out-of-bounds read in
+  `PyList`/`PyTuple` `nth`/`nth_back`) and RUSTSEC-2026-0177 (missing `Sync`
+  bound on `PyCFunction::new_closure`) as **not affecting Wickra**: neither
+  vulnerable API is reachable from the Python binding. Both are fixed in pyo3
+  0.29, but rust-numpy 0.28 pins pyo3 `^0.28`, so the upgrade is blocked
+  upstream; the advisories are recorded with their not-affected rationale in
+  `deny.toml` and `osv-scanner.toml` and will be cleared once rust-numpy 0.29
+  ships.
+
+### Changed
+- Java binding: bumped `central-publishing-maven-plugin` 0.5.0 → 0.10.0 (the
+  Maven Central publishing plugin used at release time).
+- Bumped the SHA-pinned GitHub Actions used in CI (`actions/checkout`,
+  `actions/setup-go`, `actions/setup-java`, `github/codeql-action`,
+  `taiki-e/install-action`) to their latest releases.
+- Added a Maven ecosystem to Dependabot so the Java binding's build plugins and
+  dependencies are tracked going forward.
+
+
+## [0.8.8] - 2026-06-11
+### Fixed
+- R binding: declare `Depends: R (>= 2.10)`, clearing the `R CMD check` warning
+  ("package needs dependence on R (>= 2.10)") that the bundled, lazy-loaded
+  `sample_ohlcv` dataset triggers on r-universe / CRAN.
+
 ## [0.8.7] - 2026-06-11
 ### Added
 - R binding: a *Getting started* vignette and a synthetic `sample_ohlcv` example
@@ -1566,7 +1615,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   optional Binance live feed.
 - Bindings for Python, Node.js, and WebAssembly.
 
-[Unreleased]: https://github.com/wickra-lib/wickra/compare/v0.8.7...HEAD
+[Unreleased]: https://github.com/wickra-lib/wickra/compare/v0.9.0...HEAD
+[0.9.0]: https://github.com/wickra-lib/wickra/compare/v0.8.9...v0.9.0
+[0.8.9]: https://github.com/wickra-lib/wickra/compare/v0.8.8...v0.8.9
+[0.8.8]: https://github.com/wickra-lib/wickra/compare/v0.8.7...v0.8.8
 [0.8.7]: https://github.com/wickra-lib/wickra/compare/v0.8.6...v0.8.7
 [0.8.6]: https://github.com/wickra-lib/wickra/compare/v0.8.5...v0.8.6
 [0.8.5]: https://github.com/wickra-lib/wickra/compare/v0.8.4...v0.8.5

Cargo.lock

@@ -1944,7 +1944,7 @@ dependencies = [
 
 [[package]]
 name = "wickra"
-version = "0.8.7"
+version = "0.9.0"
 dependencies = [
  "approx",
  "criterion",
@@ -1955,7 +1955,7 @@ dependencies = [
 
 [[package]]
 name = "wickra-bench"
-version = "0.8.7"
+version = "0.9.0"
 dependencies = [
  "criterion",
  "kand",
@@ -1967,14 +1967,14 @@ dependencies = [
 
 [[package]]
 name = "wickra-c"
-version = "0.8.7"
+version = "0.9.0"
 dependencies = [
  "wickra-core",
 ]
 
 [[package]]
 name = "wickra-core"
-version = "0.8.7"
+version = "0.9.0"
 dependencies = [
  "approx",
  "proptest",
@@ -1984,7 +1984,7 @@ dependencies = [
 
 [[package]]
 name = "wickra-data"
-version = "0.8.7"
+version = "0.9.0"
 dependencies = [
  "approx",
  "csv",
@@ -2001,7 +2001,7 @@ dependencies = [
 
 [[package]]
 name = "wickra-examples"
-version = "0.8.7"
+version = "0.9.0"
 dependencies = [
  "serde_json",
  "tokio",
@@ -2011,7 +2011,7 @@ dependencies = [
 
 [[package]]
 name = "wickra-node"
-version = "0.8.7"
+version = "0.9.0"
 dependencies = [
  "napi",
  "napi-build",
@@ -2021,7 +2021,7 @@ dependencies = [
 
 [[package]]
 name = "wickra-python"
-version = "0.8.7"
+version = "0.9.0"
 dependencies = [
  "numpy",
  "pyo3",
@@ -2030,7 +2030,7 @@ dependencies = [
 
 [[package]]
 name = "wickra-wasm"
-version = "0.8.7"
+version = "0.9.0"
 dependencies = [
  "console_error_panic_hook",
  "js-sys",

Cargo.toml

@@ -14,7 +14,7 @@ members = [
 exclude = ["fuzz"]
 
 [workspace.package]
-version = "0.8.7"
+version = "0.9.0"
 authors = ["kingchenc <support@wickra.org>"]
 edition = "2021"
 rust-version = "1.86"
@@ -26,7 +26,7 @@ keywords = ["finance", "trading", "indicators", "technical-analysis", "ta"]
 categories = ["finance", "mathematics", "science"]
 
 [workspace.dependencies]
-wickra-core = { path = "crates/wickra-core", version = "0.8.7" }
+wickra-core = { path = "crates/wickra-core", version = "0.9.0" }
 
 thiserror = "2"
 rayon = "1.10"

SECURITY.md

@@ -2,13 +2,13 @@
 
 ## Supported versions
 
-Wickra is pre-1.0. Security fixes are applied to the latest released `0.8.7`
+Wickra is pre-1.0. Security fixes are applied to the latest released `0.9.0`
 version only; please upgrade to the newest release before reporting an issue.
 
 | Version | Supported |
 | --- | --- |
-| 0.8.7 (latest) | :white_check_mark: |
+| 0.9.0 (latest) | :white_check_mark: |
-| < 0.8.7 | :x: |
+| < 0.9.0 | :x: |
 
 ## Reporting a vulnerability
 

bindings/csharp/Wickra/Wickra.csproj

@@ -11,7 +11,7 @@
 
     <!-- NuGet package metadata -->
     <PackageId>Wickra</PackageId>
-    <Version>0.8.7</Version>
+    <Version>0.9.0</Version>
     <Authors>kingchenc</Authors>
     <Description>High-performance streaming technical-analysis indicators (514 indicators) for .NET, backed by the native Rust core via the Wickra C ABI.</Description>
     <PackageLicenseExpression>MIT OR Apache-2.0</PackageLicenseExpression>

bindings/java/README.md

@@ -30,14 +30,14 @@ Maven:
 <dependency>
   <groupId>org.wickra</groupId>
   <artifactId>wickra</artifactId>
-  <version>0.8.7</version>
+  <version>0.9.0</version>
 </dependency>
 ```
 
 Gradle:
 
 ```kotlin
-implementation("org.wickra:wickra:0.8.7")
+implementation("org.wickra:wickra:0.9.0")
 ```
 
 The native library ships prebuilt per platform (Linux, macOS, Windows — x64 and

bindings/java/benchmarks/pom.xml

@@ -30,7 +30,7 @@
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-compiler-plugin</artifactId>
-        <version>3.13.0</version>
+        <version>3.15.0</version>
       </plugin>
 
       <!--
@@ -41,7 +41,7 @@
       <plugin>
         <groupId>org.codehaus.mojo</groupId>
         <artifactId>exec-maven-plugin</artifactId>
-        <version>3.2.0</version>
+        <version>3.6.3</version>
         <configuration>
           <executable>${java.home}/bin/java</executable>
           <arguments>

bindings/java/osv-scanner.toml

@@ -0,0 +1,12 @@
+# OSV-Scanner suppression for this Maven manifest. OSV-Scanner looks for an
+# osv-scanner.toml next to each manifest it scans, and the repo-root config does
+# not cover Maven sub-directory scans — so the jackson finding is suppressed
+# here as well. See the root osv-scanner.toml and the SECURITY.md VEX section.
+#
+# tools.jackson.core:jackson-core 3.x is NOT a dependency of this project. Full
+# Maven resolution (the publishing plugin tree and the project dependency tree)
+# resolves only jackson 2.16.1 / 2.17.1; tools.jackson 3.x appears nowhere.
+# OSV-Scanner's own resolver flags it as a false positive.
+[[IgnoredVulns]]
+id = "GHSA-72hv-8253-57qq"
+reason = "tools.jackson.core:jackson-core 3.x is not a dependency; only jackson 2.x resolves. Not affected."

bindings/java/pom.xml

@@ -6,7 +6,7 @@
 
   <groupId>org.wickra</groupId>
   <artifactId>wickra</artifactId>
-  <version>0.8.7</version>
+  <version>0.9.0</version>
   <packaging>jar</packaging>
 
   <name>Wickra</name>
@@ -44,7 +44,7 @@
   <properties>
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
     <maven.compiler.release>22</maven.compiler.release>
-    <junit.version>5.10.2</junit.version>
+    <junit.version>6.1.0</junit.version>
     <!-- The FFM API is restricted; grant native access to the unnamed module so
          tests and examples run without warnings. Consumers pass the same flag. -->
     <native.access.arg>--enable-native-access=ALL-UNNAMED</native.access.arg>
@@ -64,13 +64,13 @@
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-compiler-plugin</artifactId>
-        <version>3.13.0</version>
+        <version>3.15.0</version>
       </plugin>
 
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-surefire-plugin</artifactId>
-        <version>3.2.5</version>
+        <version>3.5.6</version>
         <configuration>
           <argLine>${native.access.arg}</argLine>
         </configuration>
@@ -79,7 +79,7 @@
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-jar-plugin</artifactId>
-        <version>3.4.1</version>
+        <version>3.5.0</version>
         <configuration>
           <archive>
             <manifestEntries>
@@ -107,7 +107,7 @@
           <plugin>
             <groupId>org.apache.maven.plugins</groupId>
             <artifactId>maven-source-plugin</artifactId>
-            <version>3.3.1</version>
+            <version>3.4.0</version>
             <executions>
               <execution>
                 <id>attach-sources</id>
@@ -119,7 +119,7 @@
           <plugin>
             <groupId>org.apache.maven.plugins</groupId>
             <artifactId>maven-javadoc-plugin</artifactId>
-            <version>3.7.0</version>
+            <version>3.12.0</version>
             <configuration>
               <!-- Generated members are self-descriptive; do not fail on doclint. -->
               <doclint>none</doclint>
@@ -136,7 +136,7 @@
           <plugin>
             <groupId>org.apache.maven.plugins</groupId>
             <artifactId>maven-gpg-plugin</artifactId>
-            <version>3.2.4</version>
+            <version>3.2.8</version>
             <executions>
               <execution>
                 <id>sign-artifacts</id>
@@ -157,7 +157,7 @@
           <plugin>
             <groupId>org.sonatype.central</groupId>
             <artifactId>central-publishing-maven-plugin</artifactId>
-            <version>0.5.0</version>
+            <version>0.10.0</version>
             <extensions>true</extensions>
             <configuration>
               <publishingServerId>central</publishingServerId>

bindings/node/npm/darwin-arm64/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wickra-darwin-arm64",
-  "version": "0.8.7",
+  "version": "0.9.0",
   "description": "Native binding for wickra (macOS Apple Silicon). Installed automatically as an optional dependency of wickra on matching platforms.",
   "main": "wickra.darwin-arm64.node",
   "files": [

bindings/node/npm/darwin-x64/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wickra-darwin-x64",
-  "version": "0.8.7",
+  "version": "0.9.0",
   "description": "Native binding for wickra (macOS Intel). Installed automatically as an optional dependency of wickra on matching platforms.",
   "main": "wickra.darwin-x64.node",
   "files": [

bindings/node/npm/linux-arm64-gnu/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wickra-linux-arm64-gnu",
-  "version": "0.8.7",
+  "version": "0.9.0",
   "description": "Native binding for wickra (linux arm64 GNU). Installed automatically as an optional dependency of wickra on matching platforms.",
   "main": "wickra.linux-arm64-gnu.node",
   "files": [

bindings/node/npm/linux-x64-gnu/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wickra-linux-x64-gnu",
-  "version": "0.8.7",
+  "version": "0.9.0",
   "description": "Native binding for wickra (linux x64 GNU). Installed automatically as an optional dependency of wickra on matching platforms.",
   "main": "wickra.linux-x64-gnu.node",
   "files": [

bindings/node/npm/win32-arm64-msvc/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wickra-win32-arm64-msvc",
-  "version": "0.8.7",
+  "version": "0.9.0",
   "description": "Native binding for wickra (Windows arm64 MSVC). Installed automatically as an optional dependency of wickra on matching platforms.",
   "main": "wickra.win32-arm64-msvc.node",
   "files": [

bindings/node/npm/win32-x64-msvc/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wickra-win32-x64-msvc",
-  "version": "0.8.7",
+  "version": "0.9.0",
   "description": "Native binding for wickra (Windows x64 MSVC). Installed automatically as an optional dependency of wickra on matching platforms.",
   "main": "wickra.win32-x64-msvc.node",
   "files": [

bindings/node/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "wickra",
-  "version": "0.8.7",
+  "version": "0.9.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "wickra",
-      "version": "0.8.7",
+      "version": "0.9.0",
       "license": "MIT OR Apache-2.0",
       "devDependencies": {
         "@napi-rs/cli": "^2.18.0"
@@ -15,12 +15,12 @@
         "node": ">= 18"
       },
       "optionalDependencies": {
-        "wickra-darwin-arm64": "0.8.7",
+        "wickra-darwin-arm64": "0.9.0",
-        "wickra-darwin-x64": "0.8.7",
+        "wickra-darwin-x64": "0.9.0",
-        "wickra-linux-arm64-gnu": "0.8.7",
+        "wickra-linux-arm64-gnu": "0.9.0",
-        "wickra-linux-x64-gnu": "0.8.7",
+        "wickra-linux-x64-gnu": "0.9.0",
-        "wickra-win32-arm64-msvc": "0.8.7",
+        "wickra-win32-arm64-msvc": "0.9.0",
-        "wickra-win32-x64-msvc": "0.8.7"
+        "wickra-win32-x64-msvc": "0.9.0"
       }
     },
     "node_modules/@napi-rs/cli": {
@@ -41,8 +41,8 @@
       }
     },
     "node_modules/wickra-darwin-arm64": {
-      "version": "0.8.7",
+      "version": "0.9.0",
-      "resolved": "https://registry.npmjs.org/wickra-darwin-arm64/-/wickra-darwin-arm64-0.8.7.tgz",
+      "resolved": "https://registry.npmjs.org/wickra-darwin-arm64/-/wickra-darwin-arm64-0.9.0.tgz",
       "integrity": "sha512-4eZiBR/yGUdr4nzhEUFy2i69XgNx64iI2ax/LPamsThgylC0KpHOZKK19QzJ2d9KbK4C8nMjME5FLuR+4GNEwQ==",
       "cpu": [
         "arm64"
@@ -57,8 +57,8 @@
       }
     },
     "node_modules/wickra-darwin-x64": {
-      "version": "0.8.7",
+      "version": "0.9.0",
-      "resolved": "https://registry.npmjs.org/wickra-darwin-x64/-/wickra-darwin-x64-0.8.7.tgz",
+      "resolved": "https://registry.npmjs.org/wickra-darwin-x64/-/wickra-darwin-x64-0.9.0.tgz",
       "integrity": "sha512-6hf8zI3QPjTFp4zCpmgUwDvNtu6jHqNUHKD5e55POo0CgA52HkpyxSPtVm8TGTIZDI7kPjlbOdBM8CJ76mmXwA==",
       "cpu": [
         "x64"
@@ -73,8 +73,8 @@
       }
     },
     "node_modules/wickra-linux-arm64-gnu": {
-      "version": "0.8.7",
+      "version": "0.9.0",
-      "resolved": "https://registry.npmjs.org/wickra-linux-arm64-gnu/-/wickra-linux-arm64-gnu-0.8.7.tgz",
+      "resolved": "https://registry.npmjs.org/wickra-linux-arm64-gnu/-/wickra-linux-arm64-gnu-0.9.0.tgz",
       "integrity": "sha512-kSe6y0xBMSiqdPLXNjwop5WZdHtvdBNKSEBCwZ4hFq33p4apW25/wrlzv9/oDuyD4kuPabJEhCCnFOplh58CUg==",
       "cpu": [
         "arm64"
@@ -89,8 +89,8 @@
       }
     },
     "node_modules/wickra-linux-x64-gnu": {
-      "version": "0.8.7",
+      "version": "0.9.0",
-      "resolved": "https://registry.npmjs.org/wickra-linux-x64-gnu/-/wickra-linux-x64-gnu-0.8.7.tgz",
+      "resolved": "https://registry.npmjs.org/wickra-linux-x64-gnu/-/wickra-linux-x64-gnu-0.9.0.tgz",
       "integrity": "sha512-tWBWS4qz7hxM4xnpFb59bhf6TaLwXq0Z3jEa/2l7r8PiHA94g8r8S53NRMiT+4yiL5hSWe/nUiC/YXdRrhEZ4g==",
       "cpu": [
         "x64"
@@ -105,8 +105,8 @@
       }
     },
     "node_modules/wickra-win32-arm64-msvc": {
-      "version": "0.8.7",
+      "version": "0.9.0",
-      "resolved": "https://registry.npmjs.org/wickra-win32-arm64-msvc/-/wickra-win32-arm64-msvc-0.8.7.tgz",
+      "resolved": "https://registry.npmjs.org/wickra-win32-arm64-msvc/-/wickra-win32-arm64-msvc-0.9.0.tgz",
       "integrity": "sha512-EXIckHxAtF75PUGDKRzXyqMe9ldP0JjSdu68WFN6iJfp+McYrGu6h40TEJlQ/oUEIoPqiZB/xhVyo/el5Lg7zw==",
       "cpu": [
         "arm64"
@@ -121,8 +121,8 @@
       }
     },
     "node_modules/wickra-win32-x64-msvc": {
-      "version": "0.8.7",
+      "version": "0.9.0",
-      "resolved": "https://registry.npmjs.org/wickra-win32-x64-msvc/-/wickra-win32-x64-msvc-0.8.7.tgz",
+      "resolved": "https://registry.npmjs.org/wickra-win32-x64-msvc/-/wickra-win32-x64-msvc-0.9.0.tgz",
       "integrity": "sha512-Yfsqq1Xwp6hdxMyLze411vNdo7BDwI6+lPSe7A9XdqyPecNDbtKwYLpsal2r8EHbNzqM+R8XnuRtUaEQS5VlUQ==",
       "cpu": [
         "x64"

bindings/node/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wickra",
-  "version": "0.8.7",
+  "version": "0.9.0",
   "description": "Streaming-first technical indicators: incremental, fast, install-free. Node bindings powered by Rust.",
   "author": "kingchenc <support@wickra.org>",
   "main": "index.js",
@@ -47,12 +47,12 @@
     "node": ">= 18"
   },
   "optionalDependencies": {
-    "wickra-linux-x64-gnu": "0.8.7",
+    "wickra-linux-x64-gnu": "0.9.0",
-    "wickra-linux-arm64-gnu": "0.8.7",
+    "wickra-linux-arm64-gnu": "0.9.0",
-    "wickra-darwin-x64": "0.8.7",
+    "wickra-darwin-x64": "0.9.0",
-    "wickra-darwin-arm64": "0.8.7",
+    "wickra-darwin-arm64": "0.9.0",
-    "wickra-win32-x64-msvc": "0.8.7",
+    "wickra-win32-x64-msvc": "0.9.0",
-    "wickra-win32-arm64-msvc": "0.8.7"
+    "wickra-win32-arm64-msvc": "0.9.0"
   },
   "scripts": {
     "build": "napi build --platform --release",

bindings/python/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "maturin"
 
 [project]
 name = "wickra"
-version = "0.8.7"
+version = "0.9.0"
 description = "Streaming-first technical indicators: incremental, fast, install-free."
 readme = "README.md"
 license = "MIT OR Apache-2.0"

bindings/r/DESCRIPTION

@@ -1,7 +1,7 @@
 Package: wickra
 Type: Package
 Title: Streaming-First Technical Indicators
-Version: 0.8.7
+Version: 0.9.0
 Authors@R: person("Wickra contributors", role = c("aut", "cre"), email = "support@wickra.org")
 Description: R bindings for the Wickra technical-analysis library over its C ABI
     hub. Exposes 514 indicators, each an O(1) streaming state machine shared with
@@ -21,6 +21,7 @@ SystemRequirements: the Wickra C ABI shared library, downloaded automatically at
     Set WICKRA_INCLUDE_DIR and WICKRA_LIB_DIR to build against a locally built C
     ABI instead (e.g. after `cargo build -p wickra-c --release`).
 Roxygen: list(markdown = TRUE)
+Depends: R (>= 2.10)
 Suggests: testthat (>= 3.0.0), knitr, rmarkdown
 VignetteBuilder: knitr
 LazyData: true

deny.toml

@@ -9,6 +9,18 @@ all-features = true
 # Fail on any security advisory or unmaintained/unsound crate in the tree.
 version = 2
 yanked = "deny"
+# Temporary, upstream-blocked exception. Both advisories are fixed in pyo3
+# 0.29.0, but rust-numpy 0.28 (latest release) hard-pins `pyo3 ^0.28.0`, so the
+# resolver cannot select 0.29 until rust-numpy ships a 0.29-compatible release
+# (PyO3/rust-numpy "Updated to PyO3 version 0.29.0" is open, not yet published).
+# Neither vulnerable code path is reachable from our binding: it never calls
+# `BoundListIterator::nth`/`nth_back` or the `PyTuple` equivalents (0176), nor
+# `PyCFunction::new_closure` (0177) — verified by grep over bindings/python/src.
+# Remove both once rust-numpy 0.29 lands and the pyo3 0.29 bump goes in.
+ignore = [
+    "RUSTSEC-2026-0176",
+    "RUSTSEC-2026-0177",
+]
 
 [bans]
 # Catch accidental duplicate versions and wildcard ("*") version requirements.

examples/java/osv-scanner.toml

@@ -0,0 +1,12 @@
+# OSV-Scanner suppression for this Maven manifest. OSV-Scanner looks for an
+# osv-scanner.toml next to each manifest it scans, and the repo-root config does
+# not cover Maven sub-directory scans — so the jackson finding is suppressed
+# here as well. See the root osv-scanner.toml and the SECURITY.md VEX section.
+#
+# tools.jackson.core:jackson-core 3.x is NOT a dependency of this project. This
+# example resolves only com.fasterxml.jackson.core:jackson-databind 2.17.1 (and
+# its 2.x jackson-core); tools.jackson 3.x appears nowhere. OSV-Scanner's own
+# resolver flags it as a false positive.
+[[IgnoredVulns]]
+id = "GHSA-72hv-8253-57qq"
+reason = "tools.jackson.core:jackson-core 3.x is not a dependency; only jackson 2.x resolves. Not affected."

examples/java/pom.xml

@@ -6,7 +6,7 @@
 
   <groupId>org.wickra.examples</groupId>
   <artifactId>wickra-examples</artifactId>
-  <version>0.8.7</version>
+  <version>0.9.0</version>
   <packaging>jar</packaging>
 
   <name>Wickra Java examples</name>
@@ -21,13 +21,13 @@
     <dependency>
       <groupId>org.wickra</groupId>
       <artifactId>wickra</artifactId>
-      <version>0.8.7</version>
+      <version>0.9.0</version>
     </dependency>
     <!-- Only the network examples (fetch_btcusdt) parse JSON. -->
     <dependency>
       <groupId>com.fasterxml.jackson.core</groupId>
       <artifactId>jackson-databind</artifactId>
-      <version>2.17.1</version>
+      <version>2.22.0</version>
     </dependency>
   </dependencies>
 
@@ -36,7 +36,7 @@
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-compiler-plugin</artifactId>
-        <version>3.13.0</version>
+        <version>3.15.0</version>
       </plugin>
 
       <!--
@@ -46,7 +46,7 @@
       <plugin>
         <groupId>org.codehaus.mojo</groupId>
         <artifactId>exec-maven-plugin</artifactId>
-        <version>3.2.0</version>
+        <version>3.6.3</version>
         <configuration>
           <executable>${java.home}/bin/java</executable>
           <arguments>

examples/node/package-lock.json

@@ -17,7 +17,7 @@
     },
     "../../bindings/node": {
       "name": "wickra",
-      "version": "0.8.7",
+      "version": "0.9.0",
       "license": "MIT OR Apache-2.0",
       "devDependencies": {
         "@napi-rs/cli": "^2.18.0"
@@ -26,12 +26,12 @@
         "node": ">= 18"
       },
       "optionalDependencies": {
-        "wickra-darwin-arm64": "0.8.7",
+        "wickra-darwin-arm64": "0.9.0",
-        "wickra-darwin-x64": "0.8.7",
+        "wickra-darwin-x64": "0.9.0",
-        "wickra-linux-arm64-gnu": "0.8.7",
+        "wickra-linux-arm64-gnu": "0.9.0",
-        "wickra-linux-x64-gnu": "0.8.7",
+        "wickra-linux-x64-gnu": "0.9.0",
-        "wickra-win32-arm64-msvc": "0.8.7",
+        "wickra-win32-arm64-msvc": "0.9.0",
-        "wickra-win32-x64-msvc": "0.8.7"
+        "wickra-win32-x64-msvc": "0.9.0"
       }
     },
     "node_modules/wickra": {

osv-scanner.toml

@@ -0,0 +1,35 @@
+# OSV-Scanner suppressions (VEX record). Consumed by the OpenSSF Scorecard
+# Vulnerabilities check, which runs OSV-Scanner over this repository. Each entry
+# is an advisory assessed as not affecting Wickra; this mirrors the cargo-deny
+# `ignore` list in deny.toml at the OSV layer. See the "Vulnerability
+# exploitability (VEX)" section of SECURITY.md.
+
+# pyo3 — both advisories are fixed in pyo3 0.29.0, but rust-numpy 0.28 (latest
+# release) hard-pins pyo3 ^0.28.0, so the bump is upstream-blocked. Neither
+# vulnerable code path is reachable from the binding: it never calls
+# BoundListIterator nth/nth_back, the PyTuple equivalents, or
+# PyCFunction::new_closure (verified by grep over bindings/python/src). Also
+# tracked in deny.toml; remove once rust-numpy 0.29 ships and pyo3 is bumped.
+[[IgnoredVulns]]
+id = "RUSTSEC-2026-0176"
+reason = "pyo3 OOB read in PyList/PyTuple nth/nth_back; vulnerable API unused; fix blocked upstream by rust-numpy. Tracked in deny.toml."
+
+[[IgnoredVulns]]
+id = "GHSA-36hh-v3qg-5jq4"
+reason = "Alias of RUSTSEC-2026-0176."
+
+[[IgnoredVulns]]
+id = "RUSTSEC-2026-0177"
+reason = "pyo3 missing Sync on PyCFunction::new_closure; vulnerable API unused; fix blocked upstream by rust-numpy. Tracked in deny.toml."
+
+[[IgnoredVulns]]
+id = "GHSA-chgr-c6px-7xpp"
+reason = "Alias of RUSTSEC-2026-0177."
+
+# jackson-core 3.x async-parser DoS — tools.jackson.core:jackson-core 3.x is not
+# a dependency of this project. No manifest, Maven plugin, or the GitHub
+# dependency-graph SBOM references jackson 3.x; the only jackson present is
+# com.fasterxml.jackson.core:jackson-databind 2.17.1 (examples only). Not affected.
+[[IgnoredVulns]]
+id = "GHSA-72hv-8253-57qq"
+reason = "tools.jackson.core:jackson-core 3.x is not a dependency of this project; only jackson-databind 2.17.1 is present. Not affected."