1.20.2

Maintenance release: toolchain, dependency, and CI updates only — no changes to the plugin's runtime behavior.

Changed

• Toolchain upgraded to current majors: TypeScript 5.9 → 6.0 (tsconfig.json updated with an explicit rootDir and types, and ignoreDeprecations: "6.0" for the baseUrl/node10 module-resolution deprecations), Jest and @types/jest → 30, @types/node → 26, esbuild → 0.28, plus a grouped dev-dependencies bump.
• ESLint upgraded 8 → 10 and migrated from the legacy .eslintrc/.eslintignore to a flat eslint.config.mjs (built on typescript-eslint); all existing rules and the spec/mocks overrides are preserved.

CI

• Workflows hardened: explicit least-privilege permissions, third-party actions pinned to commit SHAs, and a Dependabot config added for npm and GitHub Actions.
• GitHub Actions bumped: actions/checkout → 7, softprops/action-gh-release → 3.0.1.

Documentation

• README gains a Privacy section documenting the plugin's no-network and read-only (no file mutation) guarantees.