chore(release): bump version to 0.2.0

[bpedro]

Summary

Apply multiple dependency fixes and improvements.

Checklist

• Commits are signed (git commit -S)
• Commit messages follow Conventional Commits

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[github-actions]

❌ No changes in CHANGELOG.md

Update the ## [Unreleased] section listing the changes for this release before merging.

[ivanasabi]

⚠️ Release Preview failing: No changes in CHANGELOG.md

Root cause: the ## [Unreleased] content (CVE fixes for swagger-ui-react, js-yaml, dompurify, immutable…) is already on main — it landed directly in commit 91306491 (fix: detected security vulnerabilities in dependencies (#18)). The release PR therefore has no CHANGELOG diff vs main, so the gate's git diff origin/main...HEAD -- CHANGELOG.md is empty.

Also: the CodeQL failure (1 critical, actions/envvar-injection/critical on .github/workflows/code-npm_node-release-core.yml:661) was triaged as false positive in Code Scanning (alert #47 dismissed: RELEASE_LABELS is only string-matched against fixed literals, never evaluated/interpolated into commands).

Fix: #48 adds the release-facing ### Changed entries (verify script, governance CI refresh, vitest ^5.0.1) and merges on top of current develop. Once it merges into develop, this release PR should have a non-empty CHANGELOG diff and pass Release Preview.

[github-actions]

Node Release Preview

• Current version: 0.1.0
• Proposed release version: 0.1.0
• Next development version: 0.2.0-SNAPSHOT
• Release type: minor
• Expected merge strategy: Create a merge commit

Changes

Security

• Bumped swagger-ui-react to ^5.32.14 (root and example/), which transitively resolves:
  • js-yaml to >=4.3.1, fixing merge-key/omap quadratic complexity issues (CVE-2026-59869, CVE-2026-59868)
  • dompurify to >=3.4.13, fixing an IN_PLACE XSS bypass
  • immutable (nested instance) to 4.3.9, removing the vulnerable 3.x line entirely (CVE-2026-59880, CVE-2026-59879)
• Bumped the immutable devDependency floor to ^4.3.9 (CVE-2026-59880, CVE-2026-59879)
• Updated transitive brace-expansion to >=1.1.18/>=5.0.9, fixing DoS via unbounded expansion (CVE-2026-14257, CVE-2026-69152)
• Updated transitive postcss to >=8.5.23, fixing an incomplete sourceMappingURL path-traversal fix (CVE-2026-69153)
• Updated transitive undici to >=7.29.0, fixing several request/response handling issues

Changed

• Added a verify npm script (lint, format:check, test, build) used by the governed CI verify workflows.
• Updated governance CI: issue/PR templates, REUSE.toml, repolinter.json, .prettierignore, .sync-exclude, and the governed workflow set.
• Updated vitest to ^5.0.1 and refreshed lockfiles.