v26.9.4

What's Changed

• Refactor runtime state handling and harden CI by @Kamidzu9 in #1
• Add scoped provider, package contracts, and security automation by @Kamidzu9 in #3
• ci: bump github/codeql-action/init from c3400c2f38909e0dcf3c3a41f2030a8217be5d3e to c4dd10e44af883a891fe31ced449bcb4a6728b9b by @dependabot[bot] in #10
• ci: bump actions/setup-node from 4.4.0 to 7.0.0 by @dependabot[bot] in #4
• deps: bump the development-dependencies group with 2 updates by @dependabot[bot] in #6
• deps: bump lucide-react from 1.23.0 to 1.28.0 in the production-dependencies group across 1 directory by @dependabot[bot] in #7
• deps: bump typescript from 5.9.3 to 7.0.2 by @dependabot[bot] in #8
• deps: bump eslint from 9.39.5 to 10.8.0 by @dependabot[bot] in #9
• Add package quality gates and complete public exports by @Kamidzu9 in #11
• Harden repository security and dependency review by @Kamidzu9 in #12
• Add lint, formatting, runtime tests, and accessibility baseline by @Kamidzu9 in #13
• Secure and configure sidebar persistence by @Kamidzu9 in #14
• Add package validation gates by @Kamidzu9 in #15
• Enforce the public component registry by @Kamidzu9 in #16
• Add overlay runtime and accessibility tests by @Kamidzu9 in #17
• Add forms, tabs, and switch runtime tests by @Kamidzu9 in #18
• Add sidebar interaction and shortcut tests by @Kamidzu9 in #19
• Verify Node 20, 22, and 24 compatibility by @Kamidzu9 in #20
• Document repository protection settings by @Kamidzu9 in #21
• ci: use self-hosted runner by @Kamidzu9 in #24
• Restore mergeable CI runner routing by @Kamidzu9 in #25
• Check formatting across the repository by @Kamidzu9 in #22
• Centralize package verification by @Kamidzu9 in #26
• Lint TypeScript and React sources by @Kamidzu9 in #27
• Establish coverage baseline by @Kamidzu9 in #28
• Verify Vite React 19 consumers by @Kamidzu9 in #29
• Verify Vite React 18 consumers by @Kamidzu9 in #30
• Verify Next App Router consumers by @Kamidzu9 in #31
• Verify packed SSR imports by @Kamidzu9 in #32
• Establish public TypeScript API baseline by @Kamidzu9 in #33
• Add cross-browser Playwright foundation by @Kamidzu9 in #34
• Test feedback component semantics by @Kamidzu9 in #35
• Clean public TypeScript API signatures by @Kamidzu9 in #36
• Expand overlay browser interaction coverage by @Kamidzu9 in #37
• Test navigation and layout primitives by @Kamidzu9 in #38
• Test sidebar browser behavior by @Kamidzu9 in #39
• Add visual regression baselines by @Kamidzu9 in #40
• Synchronize package export documentation by @Kamidzu9 in #41
• Add Changesets release primitives by @Kamidzu9 in #42
• Add npm Trusted Publishing workflow by @Kamidzu9 in #43
• Enforce compressed bundle and tree-shaking budgets by @Kamidzu9 in #44
• Test accessibility media and RTL modes by @Kamidzu9 in #45
• Modularize Sidebar internals without public API changes by @Kamidzu9 in #53
• Add Storybook as the canonical component documentation surface by @Kamidzu9 in #56
• Reuse packed consumers for registry release probes by @Kamidzu9 in #57
• Add targeted browser accessibility and visual state coverage by @Kamidzu9 in #55
• Harden supply-chain and design-system governance by @Kamidzu9 in #46
• Remove duplicate consumer and publish paths by @Kamidzu9 in #58
• Remove unused self-hosted smoke workflow by @Kamidzu9 in #62
• Remove stale compatibility guidance from current docs by @Kamidzu9 in #61
• Unify Vite and Next consumer lifecycle by @Kamidzu9 in #63
• Bound remaining v3 compatibility paths by @Kamidzu9 in #64
• Make security reporting match repository capabilities by @Kamidzu9 in #65
• Complete end-to-end Trusted Publishing verification by @Kamidzu9 in #66
• Remove duplicated package verification infrastructure by @Kamidzu9 in #67
• Refactor contract ownership and remove stale v3 duplication by @Kamidzu9 in #69
• Remove remaining cross-domain contract duplication by @Kamidzu9 in #70
• Consolidate app consumer bootstrap by @Kamidzu9 in #71
• Remove redundant process buffer overrides by @Kamidzu9 in #75
• Remove legacy ESM path workarounds by @Kamidzu9 in #76
• Finish native ESM path cleanup by @Kamidzu9 in #77
• Consolidate isolated package consumer bootstrap by @Kamidzu9 in #78
• Finish shadcn path cleanup by @Kamidzu9 in #79
• ci: synchronize verified npm and GitHub releases by @Kamidzu9 in #80
• fix: keep release version lockfile in sync by @Kamidzu9 in #81
• fix: align release identity with canonical repository by @Kamidzu9 in #84
• chore: version @mivama/ui 3.0.1 by @Kamidzu9 in #86

New Contributors

• @Kamidzu9 made their first contribution in #1
• @dependabot[bot] made their first contribution in #10

Full Changelog: v2.0.0...v26.9.4