v2.0.9

What's Changed

• Add proactive threading support by @corinagum in #523
• Extract threading suffixes to constant by @corinagum in #532
• feat: add action-based sub-route routing for dialogs and card actions by @heyitsaamir in #529
• Remove supportsThreading guard from app.reply() by @corinagum in #533
• Security hardening: token validation and service URL improvements by @corinagum in #515
• feat: add custom feedback loop by @lilyydu in #522
• python CLI - remove devtools and ai sample by @lilyydu in #519
• chore(client): remove unused uuid dependency by @lilyydu in #539
• fix: route app.graph + .ctx.graph to sovereign endpoints via cloud.graphScope by @corinagum in #538
• Tighten additionalAllowedDomains API contract by @corinagum in #541
• Revert serviceUrl allowlist (ADO 5310460) by @corinagum in #545
• Security hardening: remove eval() from MCP plugin by @corinagum in #537
• fix: address npm audit vulnerabilities by @heyitsaamir in #546
• fix: regenerate lockfile to apply npm overrides by @heyitsaamir in #550
• fix: make GraphError body/cause non-enumerable by @heyitsaamir in #552

Full Changelog: v2.0.8...v2.0.9