🐛 Bug Fixes
- fix: enable hostname verification by default by @jackye1995 in #3304
- fix: address RUSTSEC-2026-0104 cargo-deny advisory by @westonpace in #3326
Other Changes
🔧 Build and CI
- ci: add top-level permissions to GHA workflows by @wjones127 in #3255
- ci: add Dependabot config for shipped Rust binaries by @wjones127 in #3300
- ci: switch PyPI publish to OIDC trusted publishing by @wjones127 in #3302
- ci: add cargo-deny configuration and CI check by @wjones127 in #3307