chore(release): hooray 0.9.0

CHANGELOG.md

@@ -1,5 +1,34 @@
 # Changelog
 
+## 0.9.0 (2026-09-22)
+
+### Features
+
+- **scanners:** IaC checks for docker-compose and GitHub Actions (3a6cbe6)
+
+### Bug Fixes
+
+- **parsers:** resolve lockfile edge, scope, and abort defects from audit (985a893)
+- **reports:** harden SBOM ingestion, renderers, model, monitor, and store (362111e)
+- **parity:** harden corpus loading, comparison keys, gates, and recording validation (7767d39)
+- **parsers:** harden archive readers and expose OCI filesystem builder (99a1f78)
+- **engine:** harden OSV matching, graph classification, and input handling (0a5caaa)
+- **scanners:** close audit findings in secret, IaC, service-config, SAST, and license (9ec9d45)
+- **parsers:** resolve quoted and multi-version Yarn classic dependencies (9a7fa8a)
+- **store:** require FULL synchronous for commit durability (35e3491)
+- **risk:** rank Unknown severity above Low in severity_points (43cee0a)
+- **input:** bound serde_yaml alias expansion on untrusted lockfiles (9a24589)
+- **parsers:** accept multi-document pnpm-lock.yaml (#337) (2f1cd6f)
+
+### Other Changes
+
+- **ci:** align dependabot naming with hoolicy policy (#116) (de8f062)
+- **parity:** harden recording integrity and corpus coverage assertions (54112a3)
+- bump actions/github-script from 8.0.0 to 9.0.0 (#117) (847f10b)
+- bump rusqlite from 0.37.0 to 0.40.2 (#118) (776a160)
+- bump zstd from 0.13.3 to 0.14.0 (#119) (1c59e21)
+- bump toml from 0.9.12+spec-1.1.0 to 1.1.6+spec-1.1.0 (#120) (9ed037b)
+
 ## 0.8.0 (2026-09-18)
 
 ### Features

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "hooray"
-version = "0.8.0"
+version = "0.9.0"
 edition = "2024"
 rust-version = "1.90"
 license = "Apache-2.0"

actions/README.md

@@ -5,7 +5,7 @@ Use immutable action revisions in consuming repositories.
 ```yaml
 - uses: openhoo/hooray/actions/scan@<full-commit-sha>
   with:
-    version: 0.8.0
+    version: 0.9.0
     policy: hooray-policy.yaml
 ```
 

actions/scan/action.yml

@@ -4,7 +4,7 @@ inputs:
   version:
     description: Hooray release version to install.
     required: false
-    default: "0.8.0"
+    default: "0.9.0"
   executable:
     description: Optional Hooray executable path; skips release installation when set.
     required: false

actions/setup/action.yml

@@ -4,7 +4,7 @@ inputs:
   version:
     description: Hooray release version to install.
     required: false
-    default: "0.8.0"
+    default: "0.9.0"
 outputs:
   version:
     description: Hooray version configured by this action.