[github-actions]

Release

Merging this PR will publish v0.41.1:

• @releasekit/version
• @releasekit/notes
• @releasekit/publish
• @releasekit/release

Show all changes (11 changes, de-duplicated)

Fixed

• validate the manifest against source before publishing (standing-pr) (PR #587 · closes #556, #558)
• harden LLM notes reliability (notes) (PR #585 · closes #543)
• confine config-driven filesystem and env access (config) (PR #586 · closes #559)
• harden gh calls against arg injection; lock down temp .npmrc (publish) (#561)
• restore Examples Smoke as a working regression detector (ci) (PR #577 · closes #575, #576)

Changed

• bump the development-dependencies group with 2 updates (deps-dev) (PR #592)
• add non-dry-run publish e2e coverage (publish) (PR #588 · closes #580)
• harden workflows — SHA-pin actions, drop inlined SSH key, least-privilege (PR #583 · closes #560)
• drop bare origin-issue citations from comments and test titles (PR #574)

Dependencies & version bumps

• bump anthropics/claude-code-action from 1.0.171 to 1.0.178 (deps) (PR #591)
• bump actions/setup-node from 6 to 7 (deps) (PR #590)

---

Merge this PR to publish. The release will be triggered automatically.

Updated automatically by ReleaseKit

[github-actions]

Release manifest (do not edit)