v8.2.0

Security

• Anchor the US locality pattern, so hostnames like state.il.us.example.com are no longer classified as government (GHSA-xw74-gcfp-37wp)
• For email input, check the domain after the last @, and reject input containing whitespace or control characters, so quoted local parts can't make gman check a different domain than the one mail is delivered to (GHSA-2jrc-9pfc-v397)

Malformed inputs such as foo@bar.gov:25 and user@gsa.gov/path now return false.