task-manager v0.13.0

• Action required for go install users and importers of sdk/tasks: taskmgr and sdk/tasks need Go 1.27 or newer. They needed Go 1.26. Both go.mod files now say go 1.27.0. They said go 1.26.0. Any Go 1.27.x builds them. go get github.com/hk9890/task-manager/sdk@v0.13.0 raises the go line of your own go.mod to 1.27.0. With Go 1.26, upgrade Go, or let GOTOOLCHAIN=auto download a Go 1.27 toolchain.
• The released taskmgr binaries are built with Go 1.27.2. They were built with Go 1.26.0. Under Go 1.26.0, govulncheck reported one called vulnerability in the standard library: GO-2026-4602 (CVE-2026-27139) in os. It lets a directory listing escape an os.Root. taskmgr does not use os.Root. Under Go 1.27.2, govulncheck reports none.
• Action required for SDK callers that encode or decode Config, GlobalConfig or PackageRef with their own YAML library: the YAML methods of these types now take and return go.yaml.in/yaml/v3 nodes. They used gopkg.in/yaml.v3, which is archived. This applies to (*Config).UnmarshalYAML, (*GlobalConfig).UnmarshalYAML, (*PackageRef).UnmarshalYAML and PackageRef.MarshalYAML. A well-formed config still decodes and encodes with gopkg.in/yaml.v3, but that decoder does not call UnmarshalYAML and records no defect of the file. A use: value that is not a list fails, a use: entry that is not a mapping fails, a bare - entry is dropped and the next write deletes it, and hooks: is ignored. The encoder still calls MarshalYAML, and it writes a malformed use: entry as the fields of the node, for example kind: 8, in place of the entry. Change the import to go.yaml.in/yaml/v3, or read and write the config files through Store, LoadGlobalConfig, UpdateGlobalConfig and SaveGlobalConfig. The SDK module now requires go.yaml.in/yaml/v3 v3.0.5 in place of gopkg.in/yaml.v3 v3.0.1. See The config types and their YAML library in the SDK spec.
• A comment body that starts with a blank line keeps that line. Before, the line was dropped when the comment was written to disk, so taskmgr comment add, taskmgr comment edit, AddComment and EditComment stored the body without it, and later returned it without it. Comments stored before v0.13.0 do not get the line back. The store format does not change, and v0.12.x reads the new files correctly.
• Action required for anyone who parses the release SBOMs: the SBOM files are now CycloneDX 1.7 JSON. They were SPDX 2.3 JSON, although the README and the release docs said CycloneDX. The file names stay the same, one <archive>.sbom.json for each archive. Change your parser from SPDX to CycloneDX. The SBOMs of earlier releases do not change.