4.0.0 (2026-10-05)

• fix(security)!: pin browser origins and bound HTTP metrics (08e8abd)

BREAKING CHANGES

• configure at least one trusted origin using --allowed-origin,
  ALLOWEDORIGINS, or server.allowedOrigins before starting WeTTY. No localhost
  or request-derived origins are implicitly allowed.