Release v0.6.3

What's Changed

• ci: bump mozilla-actions/sccache-action from 0.0.10 to 0.0.11 by @dependabot[bot] in #310
• ci: bump taiki-e/install-action from 2 to 2.85.5 by @dependabot[bot] in #311
• fix(js-client): patch high-severity npm audit vulnerabilities by @bug-ops in #343
• ci: exclude pjs-wasm from windows build/doctest to fix check-cfg crash by @bug-ops in #345
• ci: bump google/osv-scanner-action from 2.3.8 to 2.5.0 by @dependabot[bot] in #341
• ci: bump taiki-e/install-action from 2.85.5 to 2.85.10 by @dependabot[bot] in #342
• chore(deps): bump clap from 4.6.4 to 4.6.6 in the minor-and-patch group by @dependabot[bot] in #340
• fix(security): HTTP rate limiter trusts unauthenticated X-Forwarded-For/X-Real-IP by @bug-ops in #347
• fix(pjson-rs)!: assign EventId at publish time, bound outgoing channels by @bug-ops in #348
• fix(pjs-js-client): fix WASM initialization bugs and add typecheck CI gate by @bug-ops in #351
• fix(pjson-rs): evict event_log oldest-first by sequence, not DashMap order by @bug-ops in #352
• fix(pjson-rs)!: make SchemaAnalyzer dictionary strategy reachable and correct by @bug-ops in #354
• ci: bump taiki-e/install-action from 2.85.10 to 2.85.13 by @dependabot[bot] in #362
• ci: bump lewagon/wait-on-check-action from 1.9.0 to 1.9.1 by @dependabot[bot] in #363
• fix(wasm): run pjs-wasm tests in CI and enforce SecurityConfig limits by @bug-ops in #355
• fix(security)!: bound WebSocket resource usage by bytes, frame size, and write timeout by @bug-ops in #364
• fix(security)!: prune unbounded rate-limiter and dictionary-store maps by @bug-ops in #360
• fix(pjson-rs): abort and supervise per-session websocket streaming tasks by @bug-ops in #366
• fix(pjson-rs-domain)!: remove Priority::unwrap_or and unused FlowControlCredits by @bug-ops in #367
• fix(pjson-rs): restore pjs-demo as a buildable workspace member by @bug-ops in #356
• test(pjson-rs): deterministically reproduce the eviction stale-len race by @bug-ops in #365
• fix(pjson-rs)!: remove redundant simd-avx2/simd-neon/simd-sse42 features by @bug-ops in #368
• Make websocket write_timeout configurable by @bug-ops in #371
• refactor(pjson-rs): wire TimeProvider port into StreamSession by @bug-ops in #369
• refactor(http): split axum_adapter.rs and rename colliding StreamError enums by @bug-ops in #372
• docs(pjs-js-client): document already-shipped npm audit fix for #337 by @bug-ops in #373
• refactor!: drop get_ prefix from public getters (C-GETTER) by @bug-ops in #377
• test(pjson-rs): cover SearchSessionsQuery has_more=true branch by @bug-ops in #374
• fix(pjson-rs): avoid leaking metrics recorder error details in /metrics response by @bug-ops in #375
• refactor(pjson-rs): clean up axum_adapter duplication and public re-exports by @bug-ops in #370
• chore(deps): bump thiserror from 2.0.19 to 2.0.20 in the minor-and-patch group by @dependabot[bot] in #361
• fix(security): migrate paste to pastey, closing RUSTSEC-2024-0436 by @bug-ops in #378
• fix(http): stop leaking error Display text at two more HttpError sites by @bug-ops in #381
• chore: sort workspace dependencies alphabetically by @bug-ops in #384
• fix(pjs-demo): bind websocket session id to route to fix 404 on upgrade by @bug-ops in #386
• docs(http): fix broken intra-doc link in HttpError doc comment by @bug-ops in #388
• fix(wasm): resolve ESM/CJS mismatch that still broke Node.js WASM init after #351 by @bug-ops in #389
• refactor(pjson-rs)!: consolidate divergent JsonPath types in domain and core by @bug-ops in #390
• fix(application): SearchSessionsQuery pagination pushdown + command handler refactor by @bug-ops in #395
• fix(domain): make GatStreamingOrchestrator::process_concurrent_streams actually concurrent by @bug-ops in #396
• fix(stream): stop PriorityStreamer::analyze() from duplicating object-nested arrays on reconstruction by @bug-ops in #397
• release: v0.6.3 by @bug-ops in #401

Full Changelog: v0.6.2...v0.6.3