v0.2.0

What's Changed

• feat(registry): read publish times out of an npm packument (#23 part 3, 1/2) by @kms8720 in #61
• feat(cli): deptrail advisory derive (#23 part 3, 2/2) by @kms8720 in #62
• refactor(fetch): move the transport out of registry.py (#23 part 4 prep) by @kms8720 in #63
• feat(osv): take the malicious version list from OSV (#23 part 4, 2/3) by @kms8720 in #64
• feat(feeds): ship the September 2025 incident, validated end to end (#23 part 4, 3/3) by @kms8720 in #67
• feat(yaml): read the YAML subset lockfiles are written in, and refuse the rest (#17 part 1) by @kms8720 in #69
• fix(yaml): read flow collections Prettier broke across lines, and retract a false claim by @kms8720 in #78
• feat(pnpm): split a pnpm package key into a name and a version, three grammars deep (#17 part 2a) by @kms8720 in #81
• feat(lockfile): an origin per package, an unread channel, and a text lockfileVersion by @kms8720 in #84
• feat(pnpm): read a whole pnpm-lock.yaml into the LockfileModel by @kms8720 in #85
• feat(pnpm): judge pnpm trees in the history walk by @kms8720 in #86
• feat(yarn): read a Yarn Berry yarn.lock into the LockfileModel by @kms8720 in #88
• feat(yarn): judge Berry trees in the history walk, and sniff the format per blob by @kms8720 in #90

Full Changelog: v0.1.1...v0.2.0