release: bump 0.8.8 -> 0.8.9 (#285 )

Maintenance release — supply-chain and CI housekeeping only. No library code or public API changes. ### Security - Triaged the pyo3 advisories RUSTSEC-2026-0176 / RUSTSEC-2026-0177 as not affecting Wickra (vulnerable APIs unreachable from the binding; fix blocked upstream by rust-numpy pinning pyo3 `^0.28`). Recorded in `deny.toml` and `osv-scanner.toml`. ### Changed - Java binding: `central-publishing-maven-plugin` 0.5.0 → 0.10.0. - CI GitHub Actions bumped to latest (checkout, setup-go, setup-java, codeql-action, taiki-e/install-action). - Added a Maven ecosystem to Dependabot. Version bumped across all manifests/lockfiles via `bump_version.py`; Cargo.lock refreshed. CHANGELOG `[0.8.9]` filled. Tag/publish to follow on explicit GO.
chore(supply-chain): osv-scanner suppressions, bump publishing plugin, track Maven in Dependabot (#272 )
2026-06-12 23:21:39 +02:00 · 2026-06-12 23:15:56 +02:00 · 2026-06-12 22:49:45 +02:00 · 2026-06-12 22:36:18 +02:00 · 2026-06-12 22:21:13 +02:00 · 2026-06-12 22:08:01 +02:00
30 changed files with 201 additions and 111 deletions
@@ -59,3 +59,20 @@ updates:
      default-days: 7
    commit-message:
      prefix: "deps(actions)"
+
+  # Java binding + examples (Maven). Tracks the C-ABI binding's build plugins
+  # (e.g. central-publishing-maven-plugin) and the examples' jackson dependency,
+  # which had no Dependabot coverage before — a stale publishing plugin slipped
+  # through unnoticed until an OSV scan flagged it.
+  - package-ecosystem: maven
+    directories:
+      - "/bindings/java"
+      - "/bindings/java/benchmarks"
+      - "/examples/java"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    cooldown:
+      default-days: 7
+    commit-message:
+      prefix: "deps(maven)"
@@ -48,7 +48,7 @@ jobs:
    name: Cross-library benchmark report
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

@@ -122,7 +122,7 @@ jobs:
    name: Rust cross-library benchmark report
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

@@ -40,7 +40,7 @@ jobs:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

@@ -107,7 +107,7 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 20 # backstop: cap a wedged job instead of GitHub's 6h default (slowest real job ~5 min)
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

@@ -197,7 +197,7 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 20 # backstop: cap a wedged job instead of GitHub's 6h default (slowest real job ~5 min)
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

@@ -291,7 +291,7 @@ jobs:
            toolchain: "1.88"
            packages: "-p wickra-node"
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

@@ -330,7 +330,7 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 20 # backstop: cap a wedged job instead of GitHub's 6h default (slowest real job ~5 min)
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

@@ -345,7 +345,7 @@ jobs:
        timeout-minutes: 6

      - name: Install cargo-llvm-cov
-        uses: taiki-e/install-action@0fd46367812ee04360509b4169d9f659d6892bb2 # v2.79.15
+        uses: taiki-e/install-action@59012be0884e296ca2da49b530610e72c49039ad # v2.81.6
        timeout-minutes: 10 # fail fast on a stuck download instead of hanging the job
        with:
          tool: cargo-llvm-cov
@@ -372,7 +372,7 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 20 # backstop: cap a wedged job instead of GitHub's 6h default (slowest real job ~5 min)
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

@@ -391,7 +391,7 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 20 # backstop: cap a wedged job instead of GitHub's 6h default (slowest real job ~5 min)
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

@@ -415,7 +415,7 @@ jobs:
        # attributes the modern nightly compiler rejects, so the install
        # never gets off the ground. The prebuilt binary avoids the entire
        # transitive-dep compile.
-        uses: taiki-e/install-action@0fd46367812ee04360509b4169d9f659d6892bb2 # v2.79.15
+        uses: taiki-e/install-action@59012be0884e296ca2da49b530610e72c49039ad # v2.81.6
        timeout-minutes: 10 # fail fast on a stuck download instead of hanging the job
        with:
          tool: cargo-fuzz
@@ -450,7 +450,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
        python-version: ["3.9", "3.11", "3.12", "3.13"]
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

@@ -527,7 +527,7 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 20 # backstop: cap a wedged job instead of GitHub's 6h default (slowest real job ~5 min)
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

@@ -549,7 +549,7 @@ jobs:
        # same taiki-e prebuilt-binary installer we already use for
        # cargo-llvm-cov and cargo-fuzz; it tracks the latest wasm-pack
        # release, which has `--features` as a top-level flag (since 0.12).
-        uses: taiki-e/install-action@0fd46367812ee04360509b4169d9f659d6892bb2 # v2.79.15
+        uses: taiki-e/install-action@59012be0884e296ca2da49b530610e72c49039ad # v2.81.6
        timeout-minutes: 10 # fail fast on a stuck download instead of hanging the job
        with:
          tool: wasm-pack
@@ -576,7 +576,7 @@ jobs:
        os: [ubuntu-latest, macos-latest, windows-latest]
        node-version: ["18", "20"]
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

@@ -649,7 +649,7 @@ jobs:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

@@ -662,7 +662,7 @@ jobs:
        timeout-minutes: 6

      - name: Install cbindgen
-        uses: taiki-e/install-action@0fd46367812ee04360509b4169d9f659d6892bb2 # v2.79.15
+        uses: taiki-e/install-action@59012be0884e296ca2da49b530610e72c49039ad # v2.81.6
        timeout-minutes: 10 # fail fast on a stuck download instead of hanging the job
        with:
          tool: cbindgen
@@ -705,7 +705,7 @@ jobs:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

@@ -756,7 +756,7 @@ jobs:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

@@ -766,7 +766,7 @@ jobs:
      - name: Set up Go
        id: setup-go
        continue-on-error: true
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version: "stable"
          cache: false
@@ -780,7 +780,7 @@ jobs:

      - name: Set up Go (retry)
        if: steps.setup-go.outcome == 'failure'
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version: "stable"
          cache: false
@@ -882,7 +882,7 @@ jobs:
      WICKRA_INCLUDE_DIR: ${{ github.workspace }}/bindings/c/include
      WICKRA_LIB_DIR: ${{ github.workspace }}/target/release
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

@@ -961,7 +961,7 @@ jobs:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

@@ -983,7 +983,7 @@ jobs:
      - name: Set up JDK 22
        id: setup-java
        continue-on-error: true
-        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: temurin
          java-version: "22"
@@ -998,7 +998,7 @@ jobs:

      - name: Set up JDK 22 (retry)
        if: steps.setup-java.outcome == 'failure'
-        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: temurin
          java-version: "22"
@@ -40,17 +40,17 @@ jobs:
            build-mode: none
    steps:
      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Initialize CodeQL
-        uses: github/codeql-action/init@03e4368ac7daa2bd82b3e85262f3bf87ee112f57 # v3.36.0
+        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build-mode }}

      - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@03e4368ac7daa2bd82b3e85262f3bf87ee112f57 # v3.36.0
+        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
        with:
          category: "/language:${{ matrix.language }}"
@@ -45,7 +45,7 @@ jobs:
    # Settings -> Environments.
    environment: release
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable branch, 2026-03-27
@@ -110,7 +110,7 @@ jobs:
      # consumers can audit the published dependency tree without
      # re-resolving Cargo.lock.
      - name: Install cargo-cyclonedx
-        uses: taiki-e/install-action@0fd46367812ee04360509b4169d9f659d6892bb2 # v2.79.15
+        uses: taiki-e/install-action@59012be0884e296ca2da49b530610e72c49039ad # v2.81.6
        timeout-minutes: 10 # fail fast on a stuck download instead of hanging the job
        with:
          tool: cargo-cyclonedx
@@ -157,7 +157,7 @@ jobs:
          - { os: windows-11-arm, target: aarch64, manylinux: auto }
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - name: Set up Python
@@ -197,7 +197,7 @@ jobs:
    name: Build Python sdist
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - name: Sync root README into bindings/python so it ships in the sdist
@@ -249,7 +249,7 @@ jobs:
          - { host: windows-11-arm, target: aarch64-pc-windows-msvc }
    runs-on: ${{ matrix.host }}
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

@@ -310,7 +310,7 @@ jobs:
      contents: read
      id-token: write
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

@@ -479,7 +479,7 @@ jobs:
      contents: read
      id-token: write
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

@@ -512,7 +512,7 @@ jobs:
      - name: Install wasm-pack (latest, via prebuilt binary)
        # See the matching note in ci.yml: jetli's default installs an old
        # 0.10.x wasm-pack whose build subcommand rejects --features.
-        uses: taiki-e/install-action@0fd46367812ee04360509b4169d9f659d6892bb2 # v2.79.15
+        uses: taiki-e/install-action@59012be0884e296ca2da49b530610e72c49039ad # v2.81.6
        timeout-minutes: 10 # fail fast on a stuck download instead of hanging the job
        with:
          tool: wasm-pack
@@ -588,7 +588,7 @@ jobs:
          - { host: windows-11-arm, target: aarch64-pc-windows-msvc }
    runs-on: ${{ matrix.host }}
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

@@ -638,7 +638,7 @@ jobs:
      contents: read
      id-token: write # request the GitHub OIDC token for trusted publishing
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

@@ -718,7 +718,7 @@ jobs:
    runs-on: ubuntu-latest
    environment: release
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

@@ -758,7 +758,7 @@ jobs:
      # setup-java writes a settings.xml with the 'central' server credentials
      # (mapped from the env vars below) and imports the GPG signing key.
      - name: Set up JDK 22 + Maven Central credentials + GPG
-        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: temurin
          java-version: "22"
@@ -788,7 +788,7 @@ jobs:
    needs: c-abi-build
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

@@ -877,7 +877,7 @@ jobs:
    outputs:
      tag: ${{ steps.tag.outputs.tag }}
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
          fetch-depth: 0
@@ -24,7 +24,7 @@ jobs:
      id-token: write # OIDC token to publish results to the OpenSSF API
    steps:
      - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

@@ -51,6 +51,6 @@ jobs:
          retention-days: 5

      - name: Upload SARIF to code-scanning
-        uses: github/codeql-action/upload-sarif@03e4368ac7daa2bd82b3e85262f3bf87ee112f57 # v3.36.0
+        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
        with:
          sarif_file: results.sarif
@@ -93,7 +93,7 @@ jobs:
      # Fetching the now-gone `refs/heads/<branch>` then fails the run (exit 1).
      # The head SHA stays reachable via `refs/pull/N/head` after the branch is
      # gone, so the checkout — and the run — survives an instant merge.
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          fetch-depth: 1
          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.ref }}
@@ -14,7 +14,7 @@ jobs:
    name: metadata audit
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
@@ -32,7 +32,7 @@ jobs:
      actions: read # online audits resolve referenced actions
    steps:
      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

@@ -7,6 +7,31 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

 ## [Unreleased]

+## [0.8.9] - 2026-06-12
+
+Maintenance release: supply-chain and CI housekeeping only. No library code or
+public API changes.
+
+### Security
+- Triaged the pyo3 advisories RUSTSEC-2026-0176 (out-of-bounds read in
+  `PyList`/`PyTuple` `nth`/`nth_back`) and RUSTSEC-2026-0177 (missing `Sync`
+  bound on `PyCFunction::new_closure`) as **not affecting Wickra**: neither
+  vulnerable API is reachable from the Python binding. Both are fixed in pyo3
+  0.29, but rust-numpy 0.28 pins pyo3 `^0.28`, so the upgrade is blocked
+  upstream; the advisories are recorded with their not-affected rationale in
+  `deny.toml` and `osv-scanner.toml` and will be cleared once rust-numpy 0.29
+  ships.
+
+### Changed
+- Java binding: bumped `central-publishing-maven-plugin` 0.5.0 → 0.10.0 (the
+  Maven Central publishing plugin used at release time).
+- Bumped the SHA-pinned GitHub Actions used in CI (`actions/checkout`,
+  `actions/setup-go`, `actions/setup-java`, `github/codeql-action`,
+  `taiki-e/install-action`) to their latest releases.
+- Added a Maven ecosystem to Dependabot so the Java binding's build plugins and
+  dependencies are tracked going forward.
+
+
 ## [0.8.8] - 2026-06-11
 ### Fixed
 - R binding: declare `Depends: R (>= 2.10)`, clearing the `R CMD check` warning
@@ -1572,7 +1597,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
  optional Binance live feed.
 - Bindings for Python, Node.js, and WebAssembly.

-[Unreleased]: https://github.com/wickra-lib/wickra/compare/v0.8.8...HEAD
+[Unreleased]: https://github.com/wickra-lib/wickra/compare/v0.8.9...HEAD
+[0.8.9]: https://github.com/wickra-lib/wickra/compare/v0.8.8...v0.8.9
 [0.8.8]: https://github.com/wickra-lib/wickra/compare/v0.8.7...v0.8.8
 [0.8.7]: https://github.com/wickra-lib/wickra/compare/v0.8.6...v0.8.7
 [0.8.6]: https://github.com/wickra-lib/wickra/compare/v0.8.5...v0.8.6
@@ -1944,7 +1944,7 @@ dependencies = [

 [[package]]
 name = "wickra"
-version = "0.8.8"
+version = "0.8.9"
 dependencies = [
 "approx",
 "criterion",
@@ -1955,7 +1955,7 @@ dependencies = [

 [[package]]
 name = "wickra-bench"
-version = "0.8.8"
+version = "0.8.9"
 dependencies = [
 "criterion",
 "kand",
@@ -1967,14 +1967,14 @@ dependencies = [

 [[package]]
 name = "wickra-c"
-version = "0.8.8"
+version = "0.8.9"
 dependencies = [
 "wickra-core",
 ]

 [[package]]
 name = "wickra-core"
-version = "0.8.8"
+version = "0.8.9"
 dependencies = [
 "approx",
 "proptest",
@@ -1984,7 +1984,7 @@ dependencies = [

 [[package]]
 name = "wickra-data"
-version = "0.8.8"
+version = "0.8.9"
 dependencies = [
 "approx",
 "csv",
@@ -2001,7 +2001,7 @@ dependencies = [

 [[package]]
 name = "wickra-examples"
-version = "0.8.8"
+version = "0.8.9"
 dependencies = [
 "serde_json",
 "tokio",
@@ -2011,7 +2011,7 @@ dependencies = [

 [[package]]
 name = "wickra-node"
-version = "0.8.8"
+version = "0.8.9"
 dependencies = [
 "napi",
 "napi-build",
@@ -2021,7 +2021,7 @@ dependencies = [

 [[package]]
 name = "wickra-python"
-version = "0.8.8"
+version = "0.8.9"
 dependencies = [
 "numpy",
 "pyo3",
@@ -2030,7 +2030,7 @@ dependencies = [

 [[package]]
 name = "wickra-wasm"
-version = "0.8.8"
+version = "0.8.9"
 dependencies = [
 "console_error_panic_hook",
 "js-sys",
@@ -14,7 +14,7 @@ members = [
 exclude = ["fuzz"]

 [workspace.package]
-version = "0.8.8"
+version = "0.8.9"
 authors = ["kingchenc <support@wickra.org>"]
 edition = "2021"
 rust-version = "1.86"
@@ -26,7 +26,7 @@ keywords = ["finance", "trading", "indicators", "technical-analysis", "ta"]
 categories = ["finance", "mathematics", "science"]

 [workspace.dependencies]
-wickra-core = { path = "crates/wickra-core", version = "0.8.8" }
+wickra-core = { path = "crates/wickra-core", version = "0.8.9" }

 thiserror = "2"
 rayon = "1.10"
@@ -2,13 +2,13 @@

 ## Supported versions

-Wickra is pre-1.0. Security fixes are applied to the latest released `0.8.8`
+Wickra is pre-1.0. Security fixes are applied to the latest released `0.8.9`
 version only; please upgrade to the newest release before reporting an issue.

 | Version | Supported |
 | --- | --- |
-| 0.8.8 (latest) | :white_check_mark: |
-| < 0.8.8 | :x: |
+| 0.8.9 (latest) | :white_check_mark: |
+| < 0.8.9 | :x: |

 ## Reporting a vulnerability

@@ -11,7 +11,7 @@

    <!-- NuGet package metadata -->
    <PackageId>Wickra</PackageId>
-    <Version>0.8.8</Version>
+    <Version>0.8.9</Version>
    <Authors>kingchenc</Authors>
    <Description>High-performance streaming technical-analysis indicators (514 indicators) for .NET, backed by the native Rust core via the Wickra C ABI.</Description>
    <PackageLicenseExpression>MIT OR Apache-2.0</PackageLicenseExpression>
@@ -30,14 +30,14 @@ Maven:
 <dependency>
  <groupId>org.wickra</groupId>
  <artifactId>wickra</artifactId>
-  <version>0.8.8</version>
+  <version>0.8.9</version>
 </dependency>
 ```

 Gradle:

 ```kotlin
-implementation("org.wickra:wickra:0.8.8")
+implementation("org.wickra:wickra:0.8.9")
 ```

 The native library ships prebuilt per platform (Linux, macOS, Windows — x64 and
@@ -6,7 +6,7 @@

  <groupId>org.wickra</groupId>
  <artifactId>wickra</artifactId>
-  <version>0.8.8</version>
+  <version>0.8.9</version>
  <packaging>jar</packaging>

  <name>Wickra</name>
@@ -157,7 +157,7 @@
          <plugin>
            <groupId>org.sonatype.central</groupId>
            <artifactId>central-publishing-maven-plugin</artifactId>
-            <version>0.5.0</version>
+            <version>0.10.0</version>
            <extensions>true</extensions>
            <configuration>
              <publishingServerId>central</publishingServerId>
@@ -1,6 +1,6 @@
 {
  "name": "wickra-darwin-arm64",
-  "version": "0.8.8",
+  "version": "0.8.9",
  "description": "Native binding for wickra (macOS Apple Silicon). Installed automatically as an optional dependency of wickra on matching platforms.",
  "main": "wickra.darwin-arm64.node",
  "files": [
@@ -1,6 +1,6 @@
 {
  "name": "wickra-darwin-x64",
-  "version": "0.8.8",
+  "version": "0.8.9",
  "description": "Native binding for wickra (macOS Intel). Installed automatically as an optional dependency of wickra on matching platforms.",
  "main": "wickra.darwin-x64.node",
  "files": [
@@ -1,6 +1,6 @@
 {
  "name": "wickra-linux-arm64-gnu",
-  "version": "0.8.8",
+  "version": "0.8.9",
  "description": "Native binding for wickra (linux arm64 GNU). Installed automatically as an optional dependency of wickra on matching platforms.",
  "main": "wickra.linux-arm64-gnu.node",
  "files": [
@@ -1,6 +1,6 @@
 {
  "name": "wickra-linux-x64-gnu",
-  "version": "0.8.8",
+  "version": "0.8.9",
  "description": "Native binding for wickra (linux x64 GNU). Installed automatically as an optional dependency of wickra on matching platforms.",
  "main": "wickra.linux-x64-gnu.node",
  "files": [
@@ -1,6 +1,6 @@
 {
  "name": "wickra-win32-arm64-msvc",
-  "version": "0.8.8",
+  "version": "0.8.9",
  "description": "Native binding for wickra (Windows arm64 MSVC). Installed automatically as an optional dependency of wickra on matching platforms.",
  "main": "wickra.win32-arm64-msvc.node",
  "files": [
@@ -1,6 +1,6 @@
 {
  "name": "wickra-win32-x64-msvc",
-  "version": "0.8.8",
+  "version": "0.8.9",
  "description": "Native binding for wickra (Windows x64 MSVC). Installed automatically as an optional dependency of wickra on matching platforms.",
  "main": "wickra.win32-x64-msvc.node",
  "files": [
@@ -1,12 +1,12 @@
 {
  "name": "wickra",
-  "version": "0.8.8",
+  "version": "0.8.9",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "wickra",
-      "version": "0.8.8",
+      "version": "0.8.9",
      "license": "MIT OR Apache-2.0",
      "devDependencies": {
        "@napi-rs/cli": "^2.18.0"
@@ -15,12 +15,12 @@
        "node": ">= 18"
      },
      "optionalDependencies": {
-        "wickra-darwin-arm64": "0.8.8",
-        "wickra-darwin-x64": "0.8.8",
-        "wickra-linux-arm64-gnu": "0.8.8",
-        "wickra-linux-x64-gnu": "0.8.8",
-        "wickra-win32-arm64-msvc": "0.8.8",
-        "wickra-win32-x64-msvc": "0.8.8"
+        "wickra-darwin-arm64": "0.8.9",
+        "wickra-darwin-x64": "0.8.9",
+        "wickra-linux-arm64-gnu": "0.8.9",
+        "wickra-linux-x64-gnu": "0.8.9",
+        "wickra-win32-arm64-msvc": "0.8.9",
+        "wickra-win32-x64-msvc": "0.8.9"
      }
    },
    "node_modules/@napi-rs/cli": {
@@ -41,8 +41,8 @@
      }
    },
    "node_modules/wickra-darwin-arm64": {
-      "version": "0.8.8",
-      "resolved": "https://registry.npmjs.org/wickra-darwin-arm64/-/wickra-darwin-arm64-0.8.8.tgz",
+      "version": "0.8.9",
+      "resolved": "https://registry.npmjs.org/wickra-darwin-arm64/-/wickra-darwin-arm64-0.8.9.tgz",
      "integrity": "sha512-4eZiBR/yGUdr4nzhEUFy2i69XgNx64iI2ax/LPamsThgylC0KpHOZKK19QzJ2d9KbK4C8nMjME5FLuR+4GNEwQ==",
      "cpu": [
        "arm64"
@@ -57,8 +57,8 @@
      }
    },
    "node_modules/wickra-darwin-x64": {
-      "version": "0.8.8",
-      "resolved": "https://registry.npmjs.org/wickra-darwin-x64/-/wickra-darwin-x64-0.8.8.tgz",
+      "version": "0.8.9",
+      "resolved": "https://registry.npmjs.org/wickra-darwin-x64/-/wickra-darwin-x64-0.8.9.tgz",
      "integrity": "sha512-6hf8zI3QPjTFp4zCpmgUwDvNtu6jHqNUHKD5e55POo0CgA52HkpyxSPtVm8TGTIZDI7kPjlbOdBM8CJ76mmXwA==",
      "cpu": [
        "x64"
@@ -73,8 +73,8 @@
      }
    },
    "node_modules/wickra-linux-arm64-gnu": {
-      "version": "0.8.8",
-      "resolved": "https://registry.npmjs.org/wickra-linux-arm64-gnu/-/wickra-linux-arm64-gnu-0.8.8.tgz",
+      "version": "0.8.9",
+      "resolved": "https://registry.npmjs.org/wickra-linux-arm64-gnu/-/wickra-linux-arm64-gnu-0.8.9.tgz",
      "integrity": "sha512-kSe6y0xBMSiqdPLXNjwop5WZdHtvdBNKSEBCwZ4hFq33p4apW25/wrlzv9/oDuyD4kuPabJEhCCnFOplh58CUg==",
      "cpu": [
        "arm64"
@@ -89,8 +89,8 @@
      }
    },
    "node_modules/wickra-linux-x64-gnu": {
-      "version": "0.8.8",
-      "resolved": "https://registry.npmjs.org/wickra-linux-x64-gnu/-/wickra-linux-x64-gnu-0.8.8.tgz",
+      "version": "0.8.9",
+      "resolved": "https://registry.npmjs.org/wickra-linux-x64-gnu/-/wickra-linux-x64-gnu-0.8.9.tgz",
      "integrity": "sha512-tWBWS4qz7hxM4xnpFb59bhf6TaLwXq0Z3jEa/2l7r8PiHA94g8r8S53NRMiT+4yiL5hSWe/nUiC/YXdRrhEZ4g==",
      "cpu": [
        "x64"
@@ -105,8 +105,8 @@
      }
    },
    "node_modules/wickra-win32-arm64-msvc": {
-      "version": "0.8.8",
-      "resolved": "https://registry.npmjs.org/wickra-win32-arm64-msvc/-/wickra-win32-arm64-msvc-0.8.8.tgz",
+      "version": "0.8.9",
+      "resolved": "https://registry.npmjs.org/wickra-win32-arm64-msvc/-/wickra-win32-arm64-msvc-0.8.9.tgz",
      "integrity": "sha512-EXIckHxAtF75PUGDKRzXyqMe9ldP0JjSdu68WFN6iJfp+McYrGu6h40TEJlQ/oUEIoPqiZB/xhVyo/el5Lg7zw==",
      "cpu": [
        "arm64"
@@ -121,8 +121,8 @@
      }
    },
    "node_modules/wickra-win32-x64-msvc": {
-      "version": "0.8.8",
-      "resolved": "https://registry.npmjs.org/wickra-win32-x64-msvc/-/wickra-win32-x64-msvc-0.8.8.tgz",
+      "version": "0.8.9",
+      "resolved": "https://registry.npmjs.org/wickra-win32-x64-msvc/-/wickra-win32-x64-msvc-0.8.9.tgz",
      "integrity": "sha512-Yfsqq1Xwp6hdxMyLze411vNdo7BDwI6+lPSe7A9XdqyPecNDbtKwYLpsal2r8EHbNzqM+R8XnuRtUaEQS5VlUQ==",
      "cpu": [
        "x64"
@@ -1,6 +1,6 @@
 {
  "name": "wickra",
-  "version": "0.8.8",
+  "version": "0.8.9",
  "description": "Streaming-first technical indicators: incremental, fast, install-free. Node bindings powered by Rust.",
  "author": "kingchenc <support@wickra.org>",
  "main": "index.js",
@@ -47,12 +47,12 @@
    "node": ">= 18"
  },
  "optionalDependencies": {
-    "wickra-linux-x64-gnu": "0.8.8",
-    "wickra-linux-arm64-gnu": "0.8.8",
-    "wickra-darwin-x64": "0.8.8",
-    "wickra-darwin-arm64": "0.8.8",
-    "wickra-win32-x64-msvc": "0.8.8",
-    "wickra-win32-arm64-msvc": "0.8.8"
+    "wickra-linux-x64-gnu": "0.8.9",
+    "wickra-linux-arm64-gnu": "0.8.9",
+    "wickra-darwin-x64": "0.8.9",
+    "wickra-darwin-arm64": "0.8.9",
+    "wickra-win32-x64-msvc": "0.8.9",
+    "wickra-win32-arm64-msvc": "0.8.9"
  },
  "scripts": {
    "build": "napi build --platform --release",
@@ -4,7 +4,7 @@ build-backend = "maturin"

 [project]
 name = "wickra"
-version = "0.8.8"
+version = "0.8.9"
 description = "Streaming-first technical indicators: incremental, fast, install-free."
 readme = "README.md"
 license = "MIT OR Apache-2.0"
@@ -1,7 +1,7 @@
 Package: wickra
 Type: Package
 Title: Streaming-First Technical Indicators
-Version: 0.8.8
+Version: 0.8.9
 Authors@R: person("Wickra contributors", role = c("aut", "cre"), email = "support@wickra.org")
 Description: R bindings for the Wickra technical-analysis library over its C ABI
    hub. Exposes 514 indicators, each an O(1) streaming state machine shared with
@@ -9,6 +9,18 @@ all-features = true
 # Fail on any security advisory or unmaintained/unsound crate in the tree.
 version = 2
 yanked = "deny"
+# Temporary, upstream-blocked exception. Both advisories are fixed in pyo3
+# 0.29.0, but rust-numpy 0.28 (latest release) hard-pins `pyo3 ^0.28.0`, so the
+# resolver cannot select 0.29 until rust-numpy ships a 0.29-compatible release
+# (PyO3/rust-numpy "Updated to PyO3 version 0.29.0" is open, not yet published).
+# Neither vulnerable code path is reachable from our binding: it never calls
+# `BoundListIterator::nth`/`nth_back` or the `PyTuple` equivalents (0176), nor
+# `PyCFunction::new_closure` (0177) — verified by grep over bindings/python/src.
+# Remove both once rust-numpy 0.29 lands and the pyo3 0.29 bump goes in.
+ignore = [
+    "RUSTSEC-2026-0176",
+    "RUSTSEC-2026-0177",
+]

 [bans]
 # Catch accidental duplicate versions and wildcard ("*") version requirements.
@@ -6,7 +6,7 @@

  <groupId>org.wickra.examples</groupId>
  <artifactId>wickra-examples</artifactId>
-  <version>0.8.8</version>
+  <version>0.8.9</version>
  <packaging>jar</packaging>

  <name>Wickra Java examples</name>
@@ -21,7 +21,7 @@
    <dependency>
      <groupId>org.wickra</groupId>
      <artifactId>wickra</artifactId>
-      <version>0.8.8</version>
+      <version>0.8.9</version>
    </dependency>
    <!-- Only the network examples (fetch_btcusdt) parse JSON. -->
    <dependency>
@@ -17,7 +17,7 @@
    },
    "../../bindings/node": {
      "name": "wickra",
-      "version": "0.8.8",
+      "version": "0.8.9",
      "license": "MIT OR Apache-2.0",
      "devDependencies": {
        "@napi-rs/cli": "^2.18.0"
@@ -26,12 +26,12 @@
        "node": ">= 18"
      },
      "optionalDependencies": {
-        "wickra-darwin-arm64": "0.8.8",
-        "wickra-darwin-x64": "0.8.8",
-        "wickra-linux-arm64-gnu": "0.8.8",
-        "wickra-linux-x64-gnu": "0.8.8",
-        "wickra-win32-arm64-msvc": "0.8.8",
-        "wickra-win32-x64-msvc": "0.8.8"
+        "wickra-darwin-arm64": "0.8.9",
+        "wickra-darwin-x64": "0.8.9",
+        "wickra-linux-arm64-gnu": "0.8.9",
+        "wickra-linux-x64-gnu": "0.8.9",
+        "wickra-win32-arm64-msvc": "0.8.9",
+        "wickra-win32-x64-msvc": "0.8.9"
      }
    },
    "node_modules/wickra": {
@@ -0,0 +1,35 @@
+# OSV-Scanner suppressions (VEX record). Consumed by the OpenSSF Scorecard
+# Vulnerabilities check, which runs OSV-Scanner over this repository. Each entry
+# is an advisory assessed as not affecting Wickra; this mirrors the cargo-deny
+# `ignore` list in deny.toml at the OSV layer. See the "Vulnerability
+# exploitability (VEX)" section of SECURITY.md.
+
+# pyo3 — both advisories are fixed in pyo3 0.29.0, but rust-numpy 0.28 (latest
+# release) hard-pins pyo3 ^0.28.0, so the bump is upstream-blocked. Neither
+# vulnerable code path is reachable from the binding: it never calls
+# BoundListIterator nth/nth_back, the PyTuple equivalents, or
+# PyCFunction::new_closure (verified by grep over bindings/python/src). Also
+# tracked in deny.toml; remove once rust-numpy 0.29 ships and pyo3 is bumped.
+[[IgnoredVulns]]
+id = "RUSTSEC-2026-0176"
+reason = "pyo3 OOB read in PyList/PyTuple nth/nth_back; vulnerable API unused; fix blocked upstream by rust-numpy. Tracked in deny.toml."
+
+[[IgnoredVulns]]
+id = "GHSA-36hh-v3qg-5jq4"
+reason = "Alias of RUSTSEC-2026-0176."
+
+[[IgnoredVulns]]
+id = "RUSTSEC-2026-0177"
+reason = "pyo3 missing Sync on PyCFunction::new_closure; vulnerable API unused; fix blocked upstream by rust-numpy. Tracked in deny.toml."
+
+[[IgnoredVulns]]
+id = "GHSA-chgr-c6px-7xpp"
+reason = "Alias of RUSTSEC-2026-0177."
+
+# jackson-core 3.x async-parser DoS — tools.jackson.core:jackson-core 3.x is not
+# a dependency of this project. No manifest, Maven plugin, or the GitHub
+# dependency-graph SBOM references jackson 3.x; the only jackson present is
+# com.fasterxml.jackson.core:jackson-databind 2.17.1 (examples only). Not affected.
+[[IgnoredVulns]]
+id = "GHSA-72hv-8253-57qq"
+reason = "tools.jackson.core:jackson-core 3.x is not a dependency of this project; only jackson-databind 2.17.1 is present. Not affected."