[Release] Publish v1.1.5 dependency refresh

[mohanagy]

Goal

Publish @lubab/miftah@1.1.5 as a compatible patch release carrying the refreshed @hono/node-server runtime dependency and the development-toolchain modernization landed in #446.

The prior npm and GitHub Release baseline was 1.1.4. Since that release, development gained the Dependabot backlog (#446), which superseded five PRs that could not pass on their own, and restored branch-ancestry containment (#444).

Scope and honest boundary

The only change that reaches installers is the @hono/node-server 2.0.10 → 2.1.1 runtime dependency. Neither version carries a security advisory, so this is a dependency refresh, not a security release.

Everything else in #446 is development tooling that is not published: Vitest 3.2.7 → 5.0.0 with @vitest/coverage-v8 and an explicit vite peer, @types/node 22 → 26, esbuild 0.28.1 → 0.28.2, eslint 10.8.0 → 10.10.0, and typescript-eslint 8.65.0 → 8.70.0. The accompanying source edits are type-only and erased at compile time. No runtime behavior and no public API changed, so this is a patch release.

The Vitest 5 upgrade does clear the two development-only advisories that v1.1.4 explicitly did not claim, so both the production-only and full npm audits now report zero — but that improvement is to this repository's toolchain, not to the published artifact.

Release scope

• chore(deps): land the Dependabot backlog and migrate to Vitest 5 #446: publish the refreshed @hono/node-server runtime dependency and the development-toolchain modernization

Acceptance criteria

• Record the missing [Unreleased] changelog entry for chore(deps): land the Dependabot backlog and migrate to Vitest 5 #446, which merged without one.
• Set package.json and package-lock.json to 1.1.5 without creating a local tag.
• Finalize the 1.1.5 changelog dated 2026-09-11 and link this release issue.
• Align pinned release/version documentation and release-contract tests with 1.1.5.
• Verify the npm audit and state its scope honestly.
• Run the documented release checks, including source, package, installed-artifact, lint, typecheck, build, and cross-platform CI gates.
• Merge the release-preparation PR into development only after current-head CI and CodeRabbit gates pass.
• Open and merge the exact development to main promotion PR as a merge commit.
• Confirm the v1.1.5 tag and GitHub Release point to the exact current main commit.
• Publish only through the protected GitHub Release workflow using npm trusted publishing.
• Verify npm latest, provenance, workflow success, a fresh install, contents, and signatures.
• Restore main/development ancestry containment after the promotion.

[mohanagy]

Completed. @lubab/miftah@1.1.5 is published and verified, and main/development containment was restored in #450.

Completion evidence

• preparation PR: chore(release): prepare v1.1.5 #448 (0bd7cce)
• promotion PR: chore(release): promote v1.1.5 to main #449 — merge commit 6463ff950f0c94e6c1d19fbb7050f129b2c92c97 (two parents, not squashed)
• release commit and tag target: 6463ff950f0c94e6c1d19fbb7050f129b2c92c97
• GitHub Release: https://github.com/mohanagy/miftah/releases/tag/v1.1.5
• trusted Publish workflow: https://github.com/mohanagy/miftah/actions/runs/34564219698
• provenance transparency log: https://search.sigstore.dev/?logIndex=2790430189
• ancestry sync: chore: sync the v1.1.5 promotion merge into development #450

Acceptance criteria

• Recorded the missing [Unreleased] changelog entry for chore(deps): land the Dependabot backlog and migrate to Vitest 5 #446
• package.json and package-lock.json set to 1.1.5 without a local tag
• 1.1.5 changelog dated 2026-09-11, linking this issue
• Pinned release/version documentation and release-contract tests aligned
• npm audit verified and its scope stated honestly
• Release checks run: full suite 1999 passed / 0 failed (162/162), typecheck, lint, build, packed-artifact, fixture parity, CLI smoke
• Preparation PR merged after current-head CI and CodeRabbit gates passed
• Promotion PR merged as a merge commit
• v1.1.5 tag and Release point to the exact current main commit
• Published only through the protected GitHub Release workflow using npm trusted publishing; no NPM_TOKEN, no workstation publish
• Verified npm latest, provenance, workflow success, fresh install, contents, signatures
• Ancestry containment restored (main-only count back to 0)

Post-publish verification

• Registry dist-tags.latest = 1.1.5; provenance attestation present
• Fresh install into a clean project: found 0 vulnerabilities, with @hono/node-server resolving to 2.1.1 — confirming the one user-facing change reaches installers
• npm audit signatures: verified registry signatures and 15 attestations
• Installed CLI smoke test (dist/cli/main.js schema) passes

Scope, restated

The only change reaching installers was @hono/node-server 2.0.10 → 2.1.1, which carries no advisory in either version. This was a dependency refresh, not a security release. The Vitest 5 toolchain work in #446 is not published; it cleared the two development-only advisories that v1.1.4 explicitly did not claim, so this repository's full audit is now zero.

No superseded version needs deprecation: 1.1.5 is a compatible refresh over 1.1.4, which carries no known-unsafe runtime defect.