4.0.9 - Maintenance release

What's Changed

• chore: split cursor rules into focused files and improve tooling by @TomerFi in #385
• build(deps-dev): bump eslint from 10.0.0 to 10.0.1 by @dependabot[bot] in #386
• build(deps-dev): bump eslint from 10.0.1 to 10.0.2 by @dependabot[bot] in #387
• ci: disable fail-fast in test matrix by @TomerFi in #389
• build(deps-dev): bump c8 from 10.1.3 to 11.0.0 by @dependabot[bot] in #388
• build(deps-dev): bump minimatch from 9.0.5 to 9.0.9 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #390
• fix: override yargs to v18 for Node 25 compatibility by @TomerFi in #391
• fix: override @conventional-changelog/git-client to ^2.0.0 for CVE-2025-59433 by @TomerFi in #394
• build(deps): bump conventional-changelog-conventionalcommits from 9.1.0 to 9.2.0 by @dependabot[bot] in #397
• build(deps-dev): bump globals from 17.3.0 to 17.4.0 by @dependabot[bot] in #396
• build(deps): bump git-semver-tags from 8.0.0 to 8.0.1 by @dependabot[bot] in #395
• fix: override serialize-javascript to ^7.0.3 for GHSA-5c6j-r48x-rmvq by @TomerFi in #399
• ci: bump docker/setup-qemu-action from 3 to 4 by @dependabot[bot] in #400
• ci: bump docker/login-action from 3 to 4 by @dependabot[bot] in #401
• build(deps): bump conventional-changelog-conventionalcommits from 9.2.0 to 9.3.0 by @dependabot[bot] in #402
• ci: bump docker/setup-buildx-action from 3 to 4 by @dependabot[bot] in #404
• ci: bump docker/metadata-action from 5 to 6 by @dependabot[bot] in #405
• ci: bump docker/build-push-action from 6 to 7 by @dependabot[bot] in #403
• build(deps-dev): bump eslint from 10.0.2 to 10.0.3 by @dependabot[bot] in #406
• chore: remove yargs override for c8 by @TomerFi in #407
• build(deps-dev): bump flatted from 3.3.1 to 3.4.2 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #408
• build(deps-dev): bump eslint from 10.0.3 to 10.1.0 by @dependabot[bot] in #409
• build(deps-dev): bump picomatch from 2.3.1 to 2.3.2 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #410
• ci: bump codecov/codecov-action from 5 to 6 by @dependabot[bot] in #411
• build(deps): bump conventional-changelog-conventionalcommits from 9.3.0 to 9.3.1 by @dependabot[bot] in #412
• build(deps-dev): bump eslint from 10.1.0 to 10.2.0 by @dependabot[bot] in #413
• ci: bump actions/github-script from 8 to 9 by @dependabot[bot] in #414
• build(deps-dev): bump globals from 17.4.0 to 17.5.0 by @dependabot[bot] in #415
• build(deps-dev): bump eslint from 10.2.0 to 10.2.1 by @dependabot[bot] in #416
• docs: converted cursor to opencode by @TomerFi in #418
• docs: clarified skill from agent mistakes by @TomerFi in #420
• build(deps-dev): bump eslint from 10.2.1 to 10.3.0 by @dependabot[bot] in #419
• build(deps-dev): bump globals from 17.5.0 to 17.6.0 by @dependabot[bot] in #421
• fix(snyk): security upgrade node from 20.20.0-slim to 20.20.2-slim by @snyk-io[bot] in #422
• ci: change npm publish approach to use trusted publishing by @TomerFi in #423
• ci: sec hardening - explicit secrets, SHA-pin actions, remove deploy key and unnecessary git config by @TomerFi in #424
• fix(release): restore deploy key for git push bypass by @TomerFi in #425

New Contributors

• @snyk-io[bot] made their first contribution in #422

Full Changelog: 4.0.8...4.0.9