chore: bump release to v2026.09.3

[sgort]

Cuts v2026.09.3, scope both. Merging this pushes acc, which triggers the frontend and backend acceptance deploys.

What changed

File	Change
packages/frontend/src/changelog.json	new entry prepended, status: "Released", 3 commits
package.json, packages/frontend/package.json, packages/backend/package.json	2026.09.2 → 2026.09.3
package-lock.json	exactly the four matching version fields: top-level, packages[""], and both workspaces. Nothing else moved

The scope is both because #95 touched packages/backend and packages/frontend. ropa-site has no package.json and is never version-bumped.

The entry

[fix  ] f347bbf  Steven Gort    Hardening from the first Semgrep triage
[chore] eed4ebb  renovate[bot]  The transitive dependency tree refreshed for the first time since January
[ci   ] f0ed220  Steven Gort    Semgrep scans every pull request, and now gates acc and main

• Semgrep adoption and triage, 86 findings → 5. Semgrep now runs as a required check on both acc and main, in one job covering all three workspaces.
• The first lock-file maintenance since January. It moved 338 packages, 82 of them runtime, and closed 63 of 66 Supply Chain findings, including all five that Semgrep classed as reachable, all HIGH. None of the refreshed versions was published within the 14-day cooldown; each was checked against the registry.
• Hardening. Exact-segment CORS matching, XML escaping in the BPMN modeler, and the DMN export log line.

eed4ebb has no commit body, because Renovate writes none. Its details come from facts verified while it was being merged, not from a commit message.

Four docs commits in range were deliberately excluded (3f2dd6b, eb5af4f, a1410af, 689006d). The changelog is kept as a product record, not a repository record. They are dropped rather than deferred: the next range starts at this bump.

Verification

Check	Result
Changelog SHAs	all three resolve and are live on origin/acc; none appears in any earlier entry; order matches git log --no-merges
npm ci --dry-run	lockfile still resolves
npm run check-format	clean
Changelog component tests	11/11, so the new entry renders

Process notes

• The five open Renovate pull requests (fix(deps): update backend dependencies #86, fix(deps): update frontend dependencies #85, chore(deps): update dependency node to v24 #80, chore(deps): update dependency lint-staged to v17 #69, chore(deps): update dependency concurrently to v10 #68) were reviewed in step 0 and deliberately left for the next release, so no lockfile rewrite raced this bump.
• The changelog splice ran from a node script and refuses to run twice. That was verified by a second run, which exited 1 without writing.

Merging

Use a merge commit. Squash and rebase are disabled, both in the repository settings and in the ruleset's allowed_merge_methods. The entry names each commit by its SHA, and both alternatives rewrite those hashes.

This is the first release to go through the acc gate with scan required. The promotion to main that follows will be the first through the main promotion gate with scan required.

[github-actions]

Azure Static Web Apps: Your stage site is ready! Visit it here: https://brave-bay-04f351e03-100.westeurope.4.azurestaticapps.net