release: v1.3.9

[GSTJ]

Summary

v1.3.9 publishes the rule soundness fixes and release hardening merged since v1.3.8.

Details

• Bumps the package version to 1.3.9.
• Regenerates the changelog from the conventional commits since v1.3.8.
• Records the mutable Boolean evidence fixes, release validation changes, and dependency maintenance in the release notes.

Testing steps

1. Run the repository checks.

   pnpm install --frozen-lockfile
   pnpm audit --audit-level=low
   pnpm exec safe-publish-latest --force-in-publish
   pnpm run lint
   pnpm run format
   pnpm run typecheck
   pnpm run test
   pnpm run build
   pnpm run changelog:check
   pnpm run release:check
   actionlint .github/workflows/npm-publish.yml

   Confirm every command exits successfully and the registry guard reports that v1.3.9 is later than v1.3.8.

2. Build the package tarball.

   proof_dir=$(mktemp -d)
   npm pack --ignore-scripts --pack-destination "$proof_dir"

   Confirm npm creates eslint-plugin-safe-jsx-1.3.9.tgz.

3. Install the tarball and read the plugin metadata.

   runtime_dir=$(mktemp -d)
   (
     cd "$runtime_dir"
     npm install --ignore-scripts --no-save "$proof_dir/eslint-plugin-safe-jsx-1.3.9.tgz"
     node -e 'const plugin=require("eslint-plugin-safe-jsx"); console.log(plugin.meta)'
   )

   Confirm the plugin reports version 1.3.9.

4. Print the release notes.

   node tools/release-notes.mjs

   Confirm the first heading is version 1.3.9 and includes the rule and release fixes.

[github-actions]

🎉 Congratulations on making your first pull request in '@gstj/safe-jsx'! We appreciate your contribution and will review it as soon as possible. Thank you for helping us make this project better.

[GSTJ]

Local proof from aaef6eb. The release suite passes, the registry guard accepts 1.3.9 as newer than 1.3.8, and the packed plugin loads on Node 26.5.0 and the supported Node 14 floor.