v0.14.0

What's Changed

• Ship no-computed-prop-before-spread as a vendored ESLint rule by @escape-llc in #159
• Add OpenSSF Scorecard workflow by @escape-llc in #161
• Narrow Token-Permissions findings in codecov.yml/release.yml by @escape-llc in #168
• Pin all remaining workflow Actions to commit SHAs by @escape-llc in #167
• Wire TOOLCRIB_READ_TOKEN into scorecard.yml's repo_token by @escape-llc in #171
• Add explicit deny-by-default permissions to release.yml by @escape-llc in #174
• Document the contributor workflow as WORKFLOW.md by @escape-llc in #178
• Fix @manifest/@barrelExport false-positive prose mentions in src/ by @escape-llc in #181
• Add ScaleLegend to demo/App.tsx for real nextjs-fixture coverage by @escape-llc in #183
• Add actionlint and lychee link-checking to CI by @escape-llc in #189
• doctorCommand: don't abort the whole command on a network failure by @escape-llc in #196
• Widen COMPATIBLE_RANGE and fix natural-language search quality by @escape-llc in #198
• Replace COMPATIBLE_RANGE with a schema fingerprint + parser map by @escape-llc in #202
• Fix stale COMPATIBLE_RANGE references and add two WORKFLOW.md patterns by @escape-llc in #205
• Add prefixed release tags (mcp-vX.Y.Z, cli-vX.Y.Z) by @escape-llc in #207
• Bump toolcrib-mcp to v0.3.0 by @escape-llc in #210
• Back-link session summaries from their PR by @escape-llc in #213
• Add doctor --security: generate and disclose vulnerability advisories by @escape-llc in #227
• Add fast-check property tests (Fuzzing check) -- found and fixed two real color-math bugs by @escape-llc in #230
• Add a size/budget check on llms.txt/llms-full.txt by @escape-llc in #233
• Add theme-parameters-from-brief worked example, replacing the UI walkthrough idea by @escape-llc in #236
• Add OpenSSF Best Practices badge to README by @escape-llc in #238
• Add a dependency-graph engine for the generation pipeline by @escape-llc in #240
• Document scripts/build-engine.js in AGENTS.md by @escape-llc in #242
• Skip heavy e2e/screen-reader steps on Dependabot PRs; add PR grouping by @escape-llc in #244
• Group vitest + @vitest/coverage-v8 in dependabot.yml regardless of bump type by @escape-llc in #246
• Bump eslint from 10.9.1 to 10.10.0 in /scripts by @dependabot[bot] in #215
• Bump react-aria-components from 1.20.0 to 1.21.1 by @dependabot[bot] in #218
• Bump playwright from 1.62.1 to 1.63.0 by @dependabot[bot] in #221
• Bump cli/ and mcp/ to vitest 5 together with @vitest/coverage-v8 by @escape-llc in #248
• Bump @internationalized/date from 3.12.3 to 3.12.4 by @dependabot[bot] in #222
• Bump github/codeql-action/upload-sarif from 3.37.9 to 4.37.9 by @dependabot[bot] in #223
• Bump @playwright/test from 1.62.1 to 1.63.0 by @dependabot[bot] in #224
• Revert playwright/@playwright/test to 1.62.1 -- 1.63.0 breaks e2e by @escape-llc in #256
• Skip codecov.yml's run job entirely on Dependabot PRs by @escape-llc in #250
• Skip nextjs-fixture and windows-integration jobs entirely on Dependabot PRs by @escape-llc in #254
• Add no-missing-use-client ESLint rule, a real, named, repeatable CI check by @escape-llc in #258
• Fix Rating's radiogroup losing its accessible name whenever name is passed by @escape-llc in #264
• Announce Listbox's async loading/results state via a live region by @escape-llc in #265
• Extend accessibility.spec.ts to scan Combobox's listbox and the Theme Designer drawer by @escape-llc in #267
• README feature-list update, plus a clearer docsInSync drift-check message by @escape-llc in #269
• Close real test-coverage gaps: injectGlobalStyle, Carousel keyboard nav, Slice fallback branches by @escape-llc in #273
• Systematic unit-test axe checks; fix a real defaultValue-controlled-prop freeze bug by @escape-llc in #276
• Add a best-effort, non-gating Gemini second-model PR review by @escape-llc in #278
• Add a Recommended Complementary Packages section to CORE.md by @escape-llc in #280
• Update aria-compliance-review SKILL.md's stale Theme Designer claim by @escape-llc in #281
• Bump toolcrib to v0.14.0 by @escape-llc in #282
• Feed Gemini its prior PR review history so it stops repeating itself by @escape-llc in #283

Full Changelog: v0.13.0...v0.14.0