gridstart: v0.9.10

What's Changed

• Bump the development-dependencies group with 11 updates by @dependabot[bot] in #81
• Bump form-data from 4.0.5 to 4.0.6 by @dependabot[bot] in #82
• Bump the production-dependencies group across 1 directory with 31 updates by @dependabot[bot] in #83
• Bump undici and wrangler by @dependabot[bot] in #85
• Bump the production-dependencies group with 3 updates by @dependabot[bot] in #86
• Bump actions/checkout from 6 to 7 by @dependabot[bot] in #88
• Bump the development-dependencies group across 1 directory with 7 updates by @dependabot[bot] in #87
• fix: override @babel/core to ^7.29.6 to fix CVE-2026-49356 by @mblancolabs in #89
• chore: remove labels from dependabot config by @mblancolabs in #91
• feat: add DAST scanning against staging (#92) by @mblancolabs in #93
• fix: remove unnecessary quotes from ZAP cmd_options by @mblancolabs in #94
• fix: use --config instead of -config for ZAP long options by @mblancolabs in #95
• fix: wrap ZAP config options inside -z flag by @mblancolabs in #96
• fix: disable ZAP issue writing to prevent 403 error by @mblancolabs in #97
• docs: update Cloudflare setup with actual URLs and secrets generation by @mblancolabs in #98
• chore: suppress 5 known ZAP warnings via rules file by @mblancolabs in #104
• feat: production deploy workflow with CALENDAR_FEEDS_LOCAL_JSON override by @mblancolabs in #105
• P1: Add X-Frame-Options and base security headers to static server responses by @mblancolabs in #107
• Bump prod to 0.9.3 by @mblancolabs in #111
• P3: Refactor inline styles from HTML templates and apply production CSP to all responses by @mblancolabs in #112
• Fix CSS loading on first visit, CSP inline-style violation, and Fontshare CORS by @mblancolabs in #115
• ci(dast): create GH issues from scan results by @mblancolabs in #117
• P3: Add 'unsafe-inline' to style-src in production CSP by @mblancolabs in #120
• fix(dast): remove invalid issue_label input for ZAP full scan by @mblancolabs in #122
• Suppress native PWA install prompt + transparent SW updates by @mblancolabs in #123
• Fix app.html download issue — build pipeline, Response status spread, CSP inline scripts by @mblancolabs in #127
• chore(deps-dev): bump the development-dependencies group with 10 updates by @dependabot[bot] in #131
• chore(deps): bump zaproxy/action-full-scan from 0.12.0 to 0.13.0 by @dependabot[bot] in #132
• chore(deps): bump actions/checkout from 4 to 7 by @dependabot[bot] in #133
• chore(deps): bump the production-dependencies group across 1 directory with 6 updates by @dependabot[bot] in #130
• fix: ensure Content-Type is present on proxied asset responses (#129)… by @mblancolabs in #135
• Establish test coverage and enforcement ahead of v1 implementation plan by @mblancolabs in #158
• Bump production to v0.9.5 (security patching) by @mblancolabs in #168
• docs: fill CONTRIBUTING.md gaps, refresh README/SECURITY/ARCHITECTURE, consolidate test output dirs by @mblancolabs in #169
• Bump production to v0.9.6 by @mblancolabs in #174
• fix: set Content-Type on JS assets via _headers file + harden Worker … by @mblancolabs in #176
• fix: prevent browser caching of sw.js so SW updates propagate promptly by @mblancolabs in #177
• fix: set Cache-Control no-cache on sw.js in Worker to force SW update checks by @mblancolabs in #178
• Bump production to v0.9.7 (deployment workflow improvements) by @mblancolabs in #181
• chore: remove unused deps, fix browser accessibility and PWA metadata by @mblancolabs in #187
• chore: bump version to 0.9.8 by @mblancolabs in #188
• Self-host fonts and enhance server security measures by @mblancolabs in #192
• Add Cloudflare KV CacheProvider and update documentation (v0.9.10) by @mblancolabs in #196

Full Changelog: v0.9.2...v0.9.10