v0.5.0

What's Changed

• chore(security): pin deps, add 1-week release-age cooldown, adopt staged publishing by @danfry1 in #44
• chore(deps): bump github/codeql-action from 4.35.1 to 4.36.0 by @dependabot[bot] in #42
• chore(deps): bump actions/setup-node from 6.3.0 to 6.4.0 by @dependabot[bot] in #36
• chore(deps): pin @types/node to the major matching engines.node by @danfry1 in #47
• chore(deps-dev): bump the dev-dependencies group with 2 updates by @dependabot[bot] in #45
• fix(security): bound parser recursion and cap method output sizes by @danfry1 in #48
• fix(eval,parser): async/sync parity for array methods and numeric/template parsing by @danfry1 in #49
• fix(stdlib,eval): fail loud on a non-function higher-order callback by @danfry1 in #50
• test(eval): guard sync/async evaluator drift; document the architecture by @danfry1 in #51
• refactor(autocomplete): single source of truth for the safe-method allowlist by @danfry1 in #52
• feat(options): validate BonsaiOptions at construction by @danfry1 in #53
• fix(stdlib): correctness fixes for formatDate, min/max, clamp, and sort by @danfry1 in #54
• test(ci): tighten the performance gate and add bundle-size budgets by @danfry1 in #55
• test(ci): add a test-coverage gate by @danfry1 in #56
• test: migrate property suite to fast-check by @danfry1 in #57
• test: adopt @fast-check/vitest binding for property tests by @danfry1 in #58
• chore: add knip for dead-code and unused-dependency detection by @danfry1 in #59
• test: add property-based sandbox-escape invariants by @danfry1 in #60
• chore(release): 0.5.0 by @danfry1 in #61

Full Changelog: v0.4.0...v0.5.0