chore(main): release helpbutton-qs 4.0.0

[mountaindude]

🤖 I have created a release beep boop

4.0.0 (2026-06-07)

⚠ BREAKING CHANGES

• auth: Remove the "Sense session" auth strategy, as it really had nothing to do with Sense auth...

Features

• add configurable menu item merge modes (b42b371)
• add cooldown period for new npm libraries (bf2c821)
• add live updates to demo server dashboard (1299b7a)
• add more icon options for help menu items and toolbar button (ff27d4e)
• Add optional payload viewer to bug report/feedback dialogs (662fc78)
• Add todo template for structured handling of in-repo todo items (f1fa0ff)
• add video embed support in markdown content (@title syntax) (7743046)
• add video embed support in tooltip and dialog markdown content (2968b03)
• auth: Remove the "Sense session" auth strategy, as it really had nothing to do with Sense auth... (27852d3)
• enhance GitNexus code intelligence documentation with CLI commands and usage guidelines (3e6cf69)
• Enhance VirusTotal workflow to scan both inner and outer ZIP files (c710b93)
• security: Add new zizmor workflow (7f54110)
• security: do security review and take needed actions to mitigate findings (2e8cf74)

Bug Fixes

• address code review - remove autoplay, tighten placeholder regex, improve slot pattern (18aca01)
• address latest payload viewer review comments (c72769e)
• address payload viewer review feedback (986a6b2)
• Address PR review feedback for payload viewer (e68cd4f)
• clamp rating to [1,5] to prevent resource exhaustion in demo-server (4d6a13c)
• disable funding via Polar, as they cannot handle Github sponsorships (according to their won support) (b1e2886)
• guard renderStars against resource exhaustion via unbounded repeat() (40787d0)
• harden VirusTotal release workflow (581506e)
• harden VirusTotal release workflow (897a373)
• harden VirusTotal release workflow (b0030b8)
• harden VirusTotal release workflow (4c84832)
• harden VirusTotal release workflow (1793686)
• harden VirusTotal release workflow (4ffd88e)
• keep focus on confirmation dialog when already open, update stale comment (a3e5c50)
• log resolved merge mode in debug output, not raw undefined (604718c)
• pin checkout action in copilot setup workflow (a21ad2d)
• remove iframe sandbox attr (YouTube Error 153) and add min-width for hover popup video (9d9a285)
• require integer feedback ratings in demo server (b15a278)
• show generated xrf key in payload viewer (f2f7d07)
• simplify release artifact upload glob (dfdbcde)
• tighten release SBOM generation (c515d71)
• Update conditional checks for repository owner in CI workflows (fdeca39)
• update dependabot configuration for npm and github-actions (bd01c50)
• update express dependency to version 5.2.1 in demo server (cc3d348)
• update express dependency to version 5.2.1 in demo server (394bac4)
• Update todo template with examples (2e10f42)
• update video embed URL format for YouTube in markdown toolbar (8b177fb)
• use comma-separated release artifacts (2ab1158)
• use factory functions for menu item defaults and improve dirty-tracking reliability (1236654)
• Use word-boundary matching for sensitive header detection and remove unused regex params (d54b8dc)
• validate rating in renderStars to prevent resource exhaustion (fb5fbd0)

Miscellaneous

• add Gitleaks configuration to ignore placeholder API keys (59dd0cc)
• add husky pre-commit hook with lint-staged and gitleaks (667f1a5)
• add Prettier configuration file for code formatting (e6396a8)
• demo server: update deps to latest versions (9ea0669)
• deps: bump actions/checkout from 4.2.2 to 6.0.2 (a58a593)
• deps: bump astral-sh/setup-uv from 8.0.0 to 8.1.0 (2b62380)
• deps: bump crazy-max/ghaction-virustotal from 4.2.0 to 5.0.0 (7d416f5)
• deps: bump github/codeql-action from 4.31.7 to 4.35.5 (f99198e)
• deps: bump github/codeql-action from 4.31.7 to 4.35.5 (563777e)
• deps: bump github/codeql-action from 4.35.5 to 4.36.0 (e841b60)
• deps: bump github/codeql-action from 4.35.5 to 4.36.0 (28dcc25)
• deps: bump googleapis/release-please-action from 4.4.0 to 5.0.0 (c2b3ada)
• deps: bump googleapis/release-please-action from 4.4.0 to 5.0.0 (51d5442)
• deps: bump ncipollo/release-action from 1.20.0 to 1.21.0 (047e4e9)
• deps: bump ncipollo/release-action from 1.20.0 to 1.21.0 (d647b50)
• deps: bump webpack-dev-server (2cfbcab)
• deps: bump webpack-dev-server from 5.2.3 to 5.2.4 in the npm_and_yarn group across 1 directory (b7cdac2)
• main: release helpbutton-qs 2.6.0 (4672e85)
• main: release helpbutton-qs 2.6.0 (0196d9b)
• main: release helpbutton-qs 2.7.0 (0eb7451)
• main: release helpbutton-qs 2.7.0 (ddca1e3)
• main: release helpbutton-qs 3.0.0 (49e86ad)
• main: release helpbutton-qs 3.0.0 (b159eed)
• main: release helpbutton-qs 3.1.0 (8558dda)
• main: release helpbutton-qs 3.1.0 (c78c157)
• merge main branch (refactor-1) into PR branch, accept deletion of extension/README.md (1d7fb2c)
• Move legacy HTML inject help button to legacy folder (e3b6764)
• update all source code with new, uniform format (bee2024)
• update archiver to version 8.0.0 and refactor zip creation accordingly (23498b7)
• update demo server to use Node 24 (1ba7e0f)
• update dependencies to latest versions (047ca43)
• update nebula.js dependencies and eslint version in package.json (6600fba)
• update Node.js version to 24 in configuration files and documentation (88b6e59)

Refactoring

• align stored demo rating with integer validation (21bc131)
• clarify inline comments in mergeMenuItems two-pass logic (b4d0c85)
• Improve PDF generation during CI workflow (4f51f53)
• major restructure of the entire repository. HTML-native helpbuttons moved to legecy folder. (da234a8)
• normalize menu merge mode internally (04514fb)
• replace O(n²) splice dedup with O(n) two-pass approach in mergeMenuItems (9ea62e3)

Documentation

• Add app developer docs for menu items and tooltips (fda3155)
• add cloud vs client-managed app guide (c3f0d2d)
• Add menu item documentation for app developers (e3314c6)
• add menu items property refs (42f5ed5)
• add missing JSDoc to source helpers (9be3ab8)
• add property panel reference (63dff6b)
• add README security stance (ee5c447)
• add security overview for app developers (41d592d)
• add supply-chain security note (7837e46)
• add template placeholder explanation (b44ca26)
• align JSDoc formatting with review feedback (d3cfd96)
• clarify menu merge behavior (492a7e6)
• clarify menu merge comment (640229c)
• clarify merge mode property and caveat (4ead1ed)
• clarify security review follow-up note (f74a761)
• clarify unlabeled merge behavior (f49aada)
• correct capitalization in project title (477fce3)
• document video embed feature in extension README (3bfc6c4)
• enhance property panel reference with additional sections and details (d65ae98)
• enhance todo template with file naming guidelines (0260f40)
• finalize property panel reference (c383365)
• fix bug report dialog heading (31f8ec2)
• fix bug report webhook heading (64b7471)
• fix two remaining README inaccuracies (Qlik Sense product name, Feedback auth description) (89c97a5)
• merge main into PR branch and resolve conflict in extension/README.md (ab30cc1)
• polish platform comparison guide (c9bcd79)
• record 2026 security review findings (f3b68da)
• reorganize documentation by audience (f99eeff)
• rewrite README for restructured repo — fix inaccuracies, add missing features (f8f06ef)
• update extension README to match current feature set (a364ec5)
• update extension README to reflect current features accurately (76bcfc0)
• update security findings in release workflow section (c4d3dd8)

---

This PR was generated with Release Please. See documentation.