v11.0.0

What's Changed

• chore(deps): bump picomatch by @dependabot[bot] in #724
• chore(deps-dev): bump handlebars from 4.7.8 to 4.7.9 by @dependabot[bot] in #725
• chore(deps): bump lodash from 4.17.23 to 4.18.1 by @dependabot[bot] in #728
• chore(deps-dev): bump ts-jest from 29.4.6 to 29.4.9 by @dependabot[bot] in #727
• chore(deps): bump @actions/github from 9.0.0 to 9.1.0 by @dependabot[bot] in #729
• chore(deps): bump @actions/github from 9.1.0 to 9.1.1 by @dependabot[bot] in #732
• chore(deps): bump @actions/core from 3.0.0 to 3.0.1 by @dependabot[bot] in #733
• ci(deps): bump actions/dependency-review-action from 4 to 5 by @dependabot[bot] in #734
• chore(deps-dev): bump ts-jest from 29.4.9 to 29.4.11 by @dependabot[bot] in #736
• chore(deps-dev): bump jest from 30.3.0 to 30.4.2 by @dependabot[bot] in #735
• chore(deps-dev): bump eslint-plugin-prettier from 5.5.5 to 5.5.6 by @dependabot[bot] in #738
• chore(deps): bump js-yaml from 4.1.1 to 4.2.0 by @dependabot[bot] in #739
• ci(deps): bump actions/checkout from 6 to 7 by @dependabot[bot] in #741
• chore(deps): bump undici from 6.24.1 to 6.27.0 by @dependabot[bot] in #744
• ci(deps): bump actions/setup-node from 6 to 7 by @dependabot[bot] in #749
• chore(deps-dev): bump @vercel/ncc from 0.38.4 to 0.44.1 by @dependabot[bot] in #746
• chore(deps): bump js-yaml from 4.2.0 to 5.2.1 by @dependabot[bot] in #747
• chore(deps-dev): bump ts-jest from 29.4.11 to 29.4.12 by @dependabot[bot] in #750
• chore(deps): bump js-yaml from 5.2.1 to 5.2.2 by @dependabot[bot] in #751
• chore(deps): bump undici from 6.27.0 to 6.28.0 by @dependabot[bot] in #753
• fix: reject remote-helper git flags that enable RCE by @EndBug in #754
• fix: prevent git option injection via new_branch by @EndBug in #755
• fix: verify committed lib/ matches source in CI by @EndBug in #756
• fix: stop logging full git config (credential leak) by @EndBug in #758
• fix: reject -F/--file git args that can exfiltrate runner files by @EndBug in #759
• fix: reject unmatched quotes in matchGitArgs to prevent flag injection by @EndBug in #760
• fix: refuse unexpected gitlinks staged by git add by @EndBug in #761
• fix: do not report committed=true for empty commit SHA by @EndBug in #757
• ci: pin actions-tagger and restrict release workflow permissions by @EndBug in #762
• fix: neutralize bidi and control chars in action logs by @EndBug in #763

Full Changelog: v10.0.0...v11.0.0