v1.2.1

Packaging and CI hardening only — no runtime code changed in this release. Upgrading from v1.2.0 requires no code changes on your side.

Changed

• Dist archive no longer ships development-only paths. A .gitattributes marks docs/, tests/, art/, .github/ and phpunit.xml.dist as export-ignore, so a composer require install drops from ~2.5 MB (153 files) to ~123 KB (58 files) — a 95% reduction. Only src/, resources/, config/ and the package metadata now ship. docs/ (the Nuxt site source) was the bulk of the old weight.

Security

• All GitHub Actions pinned to full commit SHAs. Every uses: ref previously pointed at a mutable tag (@v6, @v2, @v4), which the upstream owner can force-move. Pinning removes that path for altering what runs in CI — notably in the docs workflow, which holds contents: write. Resolved from the tags already in use, so CI behaviour is unchanged.
• Added a Dependabot config covering github-actions, composer, and the docs npm tree, with weekly grouped updates and a release cooldown. The github-actions entry is what keeps the new SHA pins from going stale.

Note on export-ignore

export-ignore applies at tag time, so v1.2.1 is the first release with the lean archive. v1.2.0 and earlier are unaffected and keep their original size.

Full Changelog: v1.2.0...v1.2.1