chore(release): date the 3.0.0 changelog heading

[karlwaldman]

One line. ## 3.0.0 (unreleased) → ## 3.0.0 - 2026-09-13, so the tag can be cut.

VersioningTest accepts either form deliberately, which is why the heading was never a merge blocker — it becomes a release blocker.

Suite: OK (229 tests, 747 assertions).

What v3.0.0 delivers

Packagist currently serves v2.1.2. Until this tag exists, composer require oilpriceapi/oilpriceapi installs a version that:

• fabricates timestamps — 2026-13-45T99:99:99Z becomes 2027-02-18T04:40:39+00:00; next friday, now, tomorrow, +1 week and 0000-00-00 all produce valid-looking dates
• fabricates currencies — a missing currency silently becomes USD, labelling a EUR carbon price in dollars
• fabricates labels — currency: ["EUR"] renders as the literal string "Array"
• follows redirects off-origin — a cross-origin 302 returned code=PWNED price=1 as authoritative price data, and on libcurl older than 7.58.0 the Authorization header goes with it

Breaking changes, all documented

Five, including the one that is easy to miss: the new lib-curl >= 7.58.0 constraint is an install-time break — Composer refuses on an older host. That break was in no section of the changelog until #28 caught it during review.

🤖 Generated with Claude Code

https://claude.ai/code/session_015ao5paex73xXvuM424Libo

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: c9664bf7-3977-4df0-9ef3-d1894c779f89

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}