Release 1.4.0

LGTM. No new critical alerts introduced.

Try it:

curl -s "https://doaas.dev/lgtm?format=text"

---

Added

• HTTP 405 Method Not Allowed — Non-GET requests now receive a 405 response with Allow: GET, OPTIONS and a JSON { "error": "Method not allowed" } body, matching HTTP semantics. Tests added for POST, PUT, PATCH, DELETE, HEAD.

Changed

• Observability — Enabled traces in wrangler.toml ([observability.traces].enabled = true) alongside existing invocation logs (head_sampling_rate = 1) for clearer production visibility.
• TypeScript 6 — Bumped typescript to 6.0.3 (Dependabot #70). Switched tsconfig.json moduleResolution from "node" (deprecated alias for node10 in TS 6, errors with TS5107) to "bundler" (#74), the correct fit for a Cloudflare Worker bundled by Wrangler/esbuild with "module": "ESNext". typescript-eslint v8.58+ already supports TS 6, so no floor bump was required.
• Dependencies — npm — Rolled up Dependabot bumps for ajv, prettier, @types/node, @cloudflare/workers-types, markdownlint-cli, typescript-eslint, wrangler, lint-staged, eslint (10), @eslint/js, and eslint-plugin-security (4). Aligned package-lock.json with package.json. Tightened the minimatch override to >=10.2.4; npm audit --audit-level=high is clean.
• Dependencies — GitHub Actions — Bumped actions/checkout to v6.0.2 (SHA-pinned), actions/setup-node to v6.4.0, actions/upload-artifact to v7.0.1, actions/github-script to v9, and softprops/action-gh-release to v3. Added workflow_dispatch to the Scorecards workflow for on-demand runs.
• Dependabot configuration — Grouped npm and GitHub Actions patch/minor updates to reduce PR churn (majors still surface as standalone PRs).

Fixed

• Moderation script (ESLint 10) — Removed a redundant initializer tripping no-useless-assignment under ESLint 10.