chore: bump release to v2026.09.4

[sgort]

Cuts v2026.09.4, scope both. Merging this pushes acc, which triggers the frontend and backend acceptance deploys.

This release exists so that the next promotion is not a silent one. acc had moved past v2026.09.3 with two runtime dependency updates and three CI changes. Promoting without a release would have run code in production that v2026.09.3's entry does not describe, while the Changelog tab still said v2026.09.3.

What changed

File	Change
packages/frontend/src/changelog.json	new entry prepended, status: "Released", 5 commits
package.json, packages/frontend/package.json, packages/backend/package.json	2026.09.3 → 2026.09.4
package-lock.json	exactly the four matching version fields; nothing else moved

The entry

[ci   ] bd52eac  Steven Gort    Major dependency updates wait for approval, so the lockfile refresh gets a slot
[fix  ] 4ef0848  renovate[bot]  Backend dependency updates
[fix  ] 3e903af  renovate[bot]  Frontend dependency updates
[ci   ] 4b3a1c0  Steven Gort    Lockfile-only changes are built, tested and deployed
[chore] 8d88652  Steven Gort    The last Semgrep false positive is suppressed in the code, not the dashboard

The runtime changes that reach production:

• backend: axios 1.20.0
• frontend: bpmn-js 18.26.0, @bpmn-io/properties-panel 3.53.0 and camunda-bpmn-moddle 7.0.2

Before merging, both dependency PRs were rebased onto the current tree and verified locally.

The Renovate commits carry no body, so their details give the versions and the verification. One docs commit (44b576f) was deliberately excluded. The changelog is kept as a product record. The commit is dropped rather than deferred, because the next range starts at this bump.

Verification

Check	Result
Changelog SHAs	all five are live on origin/acc and appear in no earlier entry; order matches git log --no-merges
npm ci --dry-run	resolves
npm run check-format	clean
Changelog component tests	11/11, so the new entry renders
Full suite	green, run by the maintainer

Process notes

• Followed Linked Data Explorer's own .claude/commands/bump-release.md, read from origin/acc and confirmed unchanged since v2026.09.3.
• Out of scope: the four open Renovate pull requests (chore(deps): update github actions #104, chore(deps): update node.js to v24 #80, chore(deps): update dependency lint-staged to v17 #69, chore(deps): update dependency concurrently to v10 #68) were reviewed in step 0 and left open.
• The changelog splice ran from a node script that refuses to run twice. A second run confirmed it: it exited 1 without writing.

Merging

Use a merge commit. Squash and rebase are disabled, both in the repository settings and in the ruleset. The entry names each commit by SHA.

[github-actions]

Azure Static Web Apps: Your stage site is ready! Visit it here: https://brave-bay-04f351e03-108.westeurope.4.azurestaticapps.net