Release v1.5.0 — Hardening, performance & English-first · devlint/GitWand

🔒 Security

XSS hardening across 10 views — all v-html usage now routes through a shared useSafeHtml / useMarkdown composable that sanitizes output with DOMPurify (markdown-it for the markdown path). README rendering, PR bodies, commit-message previews, and every other bit of user- or Git-authored markup is filtered through a conservative DOMPurify profile with a URI allow-list, target="_blank" rel="noopener noreferrer" hardening, and javascript: protocol blocking.
Dev-server CORS + filesystem path enforcement — the Node dev-server now refuses requests from unexpected origins and validates every repo/file path against a safe root, preventing path traversal on the desktop app's local HTTP bridge.

English-first UI — the desktop app now defaults to English, with French as a secondary locale kept in sync. The landing page on the website mirrors the same default. French is picked up automatically when the browser/OS prefers it; the Settings panel still lets users force either language.
.gitwandrc — generatedFiles option — declare extra glob patterns (e.g. "dist/**", "**/*.generated.ts") that GitWand treats as generated when applying the generated_file resolver. Patterns are additive on top of the built-in list.
Post-merge validation — YAML + TOML — validateMergedContent is extended with format-specific parsers. Invalid YAML/TOML after a merge is surfaced as a syntaxError with a YAML: … / TOML: … prefix, matching the existing JSON behaviour.
Rust ↔ Node parity probe — a new test harness catches drift between the Tauri/Rust and Node/dev-server backends. 3 commands covered end-to-end.

LCS memory O(n·m) → O(min(n, m)) — the diff engine's LCS now runs a hybrid Int32Array DP under 4M cells and switches to Hirschberg's divide-and-conquer above. Measured on 3000×3000 inputs: ~36 MB → ~1 MB, a ~35× reduction. Tie-break behaviour is preserved so existing diffs are byte-identical.
Parallel conflict loading in the desktop app (bounded concurrency). Same model applied to saveAllFiles.
Parallel CLI file loop — gitwand resolve walks the conflict set concurrently rather than serially. Throughput scales with file count on big merges.

Shared markdown pipeline — every view now goes through useMarkdown.
Resolver split — monolithic resolver.ts broken into 6 focused sub-modules (validation, policy, generated-detection, …); public API unchanged.
CLI split — cli/index.ts broken into sub-modules, one per command concern.
Removed deprecated @types/dompurify — DOMPurify 3.x ships its own types.

No breaking changes to any public API.