v1.4.1

Improvements

• Fix exclusive canonicalization memory growth on nested xmlns declarations (O(m·depth²) prefix-map copies). Namespace state is now push/pop on a single map, with a cap of 8192 in-scope prefixes. Reported by Shuji Ohira (@shuji-oh).
• Enable weekly scanners (Dependabot, CodeQL, zizmor), pin Actions, and add a 7-day Dependabot cooldown
• ci: skip CodeQL when GitHub cannot accept SARIF

Dependencies

• fix(deps): update all by @renovate[bot] in #128
• chore(deps): update go toolchain directive to v1.27.0 by @renovate[bot] in #129
• chore(deps): update github/codeql-action action to v4.37.8 by @renovate[bot] in #130

Full Changelog: v1.4.0...v1.4.1