[y1o1]

Summary

Writes the ## [0.10.3] — 2026-11-07 CHANGELOG section. A patch: a lockfile-only security fix plus development-only updates.

Range (git log v0.10.2..224afcc --oneline):

224afcc chore(deps-dev): bump the dev-dependencies group with 3 updates (#208)
2956ed2 chore(deps-dev): bump the dev-dependencies group with 2 updates (#206)
42ed2de chore(security): qs 6.17.0 for GHSA-6pq8-jhm2-2vcw (#207)

• Security: chore(security): qs 6.17.0 for GHSA-6pq8-jhm2-2vcw #207 (qs 6.17.0, reaches the image through express)
• Changed (development only): chore(deps-dev): bump the dev-dependencies group with 2 updates #206, chore(deps-dev): bump the dev-dependencies group with 3 updates #208 (jose is a devDependency here)

R6 audit

• forward-version grep: no matches outside CHANGELOG.md and docs/release-policy.md
• no forward-version references in the new section

After merge: tag v0.10.3 on the merge commit; release.yml creates the GitHub Release, whose body is then set to this section.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

The changelog inaccurately says jose signs test tokens when it is used to verify and decode them, so “sign” should be changed to “verify.”

1 open issue

• Correct jose’s role from signing tokens to verifying them · New

What changed in this PR

Prepares the 0.10.3 patch release by documenting previously merged dependency updates; this PR changes release notes only.

Changes:

• Documents the qs security update and instructs operators to rebuild images.
• Summarizes development-only updates to Biome, Node.js types, and jose.

File	Description
CHANGELOG.md	Adds the 0.10.3 release section with security details, rebuild guidance, and development dependency updates.

_{Review effort: Balanced}