v0.9.0

Changelog

• 6b62441 Merge pull request #59 from katbyte/kt/v0.8.1
• 5dfe620 Update CHANGELOG.md
• 7a91e41 changelog: 0.8.1, x/mod past CVE-2026-56864 and CVE-2026-56865
• 88e6195 Merge pull request #58 from katbyte/kt/binary-sec-checks
• 5228a84 ci: scan the release and main binaries with trivy
• 8433f04 Merge pull request #56 from katbyte/dependabot/github_actions/github-actions-03ad6eec6c
• b32b83a Merge pull request #57 from katbyte/kt/codeql-4.38.0
• e9fb0eb Merge pull request #55 from katbyte/kt/dependabot-groups
• 0f93208 ci: run dependabot checks monthly instead of weekly
• cd3638b ci: group dependabot updates into one PR per ecosystem
• f99238f Merge pull request #40 from katbyte/dependabot/go_modules/dot-tools/github.com/golangci/golangci-lint/v2-2.13.2
• 36f6527 Merge main, switch actionlint to the katbyte fork and drop the yaml/v4 pin
• 23b2858 Merge pull request #50 from katbyte/dependabot/go_modules/golang.org/x/tools-0.50.0
• 8e7f64c Merge pull request #54 from katbyte/dependabot/go_modules/dot-tools/mvdan.cc/gofumpt-0.12.0
• 4e652ac Merge pull request #53 from katbyte/kt/zizmar-it
• 3db6269 actions: audit workflows with zizmor, and fix what it found
• 61a4b91 Revise CHANGELOG for v0.8.0 updates
• d7b6854 Merge pull request #49 from katbyte/kt/better-testing
• 55b75d1 tests: cover lib helpers and rule edge cases; fix the analyzer gaps they exposed
• 7d838b4 Merge pull request #47 from katbyte/kt/azp001-docs-url-locale
• 20da539 AZP001: match the host by string search, keep the regex to the locale segment
• d32583c CHANGELOG: AZP001 PR link
• c2227c2 add AZP001: Microsoft docs URLs must not carry a locale segment; new AZP category
• 0119891 tools: point the yaml/v4 pin comment at the upstream fix
• d273975 tools: match .custom-gcl.yml to golangci-lint v2.13.2, pin yaml/v4 to the rc actionlint builds against