From 924c483e591b4c82dc712becbee54e9871824ce7 Mon Sep 17 00:00:00 2001
From: Alexander Tartmin <alexander@tartmin.name>
Date: Mon, 14 Sep 2026 11:17:55 +0300
Subject: [PATCH] chore(release): prepare 0.1.0-beta.4

---
 AGENTS.md                                        |  2 +-
 CHANGELOG.md                                     | 16 +++++++++++++++-
 README.md                                        |  4 ++--
 docs/src/content/docs/index.mdx                  |  2 +-
 .../content/docs/project/release-integrity.md    | 16 ++++++++--------
 .../docs/reference/apple-compatibility.md        |  2 +-
 package-lock.json                                |  4 ++--
 package.json                                     |  2 +-
 8 files changed, 31 insertions(+), 17 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index 558869f..a6f5b6e 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -4,7 +4,7 @@ This file is the durable engineering context for humans and coding agents workin
 
 ## Product intent
 
-Build a small, framework-agnostic, server-side TypeScript core for Apple Profile Service profile generation, optional signing, CMS response verification, and lossless response parsing. The current release target is `0.1.0-beta.3` under the npm scope `@udid-tools`.
+Build a small, framework-agnostic, server-side TypeScript core for Apple Profile Service profile generation, optional signing, CMS response verification, and lossless response parsing. The current release target is `0.1.0-beta.4` under the npm scope `@udid-tools`.
 
 MDM is a separate product boundary. Do not add MDM enrollment, APNs, check-in, commands, declarative management, SCEP orchestration, profile delivery state machines, HTTP servers, persistence, or UI code here. A future MDM package may reuse stable low-level primitives without changing this package’s Profile Service contract.
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 71edd29..864b8b0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,19 @@ Versioning]. Prereleases use npm's `beta` distribution tag.
 
 ## [Unreleased]
 
+## [0.1.0-beta.4] - 2026-09-14
+
+### Changed
+
+- Refreshed the verified documentation toolchain with Astro 7.3.2,
+  `typedoc-plugin-frontmatter` 1.3.2, and `typescript-eslint` 8.70.0. The runtime API and runtime
+  dependencies are unchanged from `0.1.0-beta.3`.
+
+### Security
+
+- Updated the pinned CodeQL Action to 4.38.0 and its default CodeQL bundle to 2.27.0.
+- Adopted Astro 7.3.2's stricter escaping for dynamic MDX `<script>` and `<style>` content.
+
 ## [0.1.0-beta.3] - 2026-09-13
 
 ### Changed
@@ -46,7 +59,8 @@ Versioning]. Prereleases use npm's `beta` distribution tag.
 
 [keep a changelog]: https://keepachangelog.com/en/1.1.0/
 [semantic versioning]: https://semver.org/spec/v2.0.0.html
-[unreleased]: https://github.com/udid-tools/core/compare/v0.1.0-beta.3...HEAD
+[unreleased]: https://github.com/udid-tools/core/compare/v0.1.0-beta.4...HEAD
+[0.1.0-beta.4]: https://github.com/udid-tools/core/compare/v0.1.0-beta.3...v0.1.0-beta.4
 [0.1.0-beta.3]: https://github.com/udid-tools/core/compare/v0.1.0-beta.2...v0.1.0-beta.3
 [0.1.0-beta.2]: https://github.com/udid-tools/core/compare/v0.1.0-beta.1...v0.1.0-beta.2
 [0.1.0-beta.1]: https://github.com/udid-tools/core/releases/tag/v0.1.0-beta.1
diff --git a/README.md b/README.md
index 2ed96d0..f4ce3f1 100644
--- a/README.md
+++ b/README.md
@@ -11,7 +11,7 @@
 
 Security-first TypeScript primitives for Apple Profile Service profiles: generate XML, optionally produce attached CMS/PKCS#7 SignedData, verify device responses, and parse every returned plist field without losing unknown data.
 
-> **Beta:** `0.1.0-beta.3` is ready for evaluation. Its public API follows semantic versioning, but beta releases may still contain breaking changes. MDM is intentionally out of scope.
+> **Beta:** `0.1.0-beta.4` is ready for evaluation. Its public API follows semantic versioning, but beta releases may still contain breaking changes. MDM is intentionally out of scope.
 
 ## Install
 
@@ -101,7 +101,7 @@ The default verification mode checks RSA/SHA-1 and RSA/SHA-256 signature integri
 
 ## Capability matrix
 
-| Capability                                  | `0.1.0-beta.3`                                                                     |
+| Capability                                  | `0.1.0-beta.4`                                                                     |
 | ------------------------------------------- | ---------------------------------------------------------------------------------- |
 | Apple Profile Service payload               | Supported                                                                          |
 | Documented attributes                       | `UDID`, `VERSION`, `PRODUCT`, `SERIAL`, `MEID`, `IMEI`, `ICCID`, `MAC_ADDRESS_EN0` |
diff --git a/docs/src/content/docs/index.mdx b/docs/src/content/docs/index.mdx
index e1e71dd..c7e3c25 100644
--- a/docs/src/content/docs/index.mdx
+++ b/docs/src/content/docs/index.mdx
@@ -75,5 +75,5 @@ Signing is selected by providing a complete nested `signing` object. Parsing ver
 - Read the [security model](/core/concepts/security-model/) before exposing an endpoint to the internet.
 
 :::caution[Beta software]
-Version `0.1.0-beta.3` supports PKCS#12 RSA identities with SHA-256. Review the capability matrix before using the package in production.
+Version `0.1.0-beta.4` supports PKCS#12 RSA identities with SHA-256. Review the capability matrix before using the package in production.
 :::
diff --git a/docs/src/content/docs/project/release-integrity.md b/docs/src/content/docs/project/release-integrity.md
index 72a48cf..ee34439 100644
--- a/docs/src/content/docs/project/release-integrity.md
+++ b/docs/src/content/docs/project/release-integrity.md
@@ -17,34 +17,34 @@ Each GitHub Release contains:
 The workflow also records a GitHub artifact attestation for the tarball. npm Trusted Publishing
 adds registry provenance without a long-lived npm token.
 
-## Verify version 0.1.0-beta.3
+## Verify version 0.1.0-beta.4
 
 Download the immutable release assets:
 
 ```bash
-gh release download v0.1.0-beta.3 --repo udid-tools/core --dir core-release
+gh release download v0.1.0-beta.4 --repo udid-tools/core --dir core-release
 cd core-release
 ```
 
 Verify the tarball checksum on Linux:
 
 ```bash
-sha256sum --check udid-tools-core-0.1.0-beta.3.tgz.sha256
+sha256sum --check udid-tools-core-0.1.0-beta.4.tgz.sha256
 ```
 
 On macOS, use the compatible checksum command:
 
 ```bash
-shasum --algorithm 256 --check udid-tools-core-0.1.0-beta.3.tgz.sha256
+shasum --algorithm 256 --check udid-tools-core-0.1.0-beta.4.tgz.sha256
 ```
 
 Verify the tarball's keyless Sigstore signature, certificate identity, and transparency-log proof:
 
 ```bash
-cosign verify-blob udid-tools-core-0.1.0-beta.3.tgz \
-  --bundle udid-tools-core-0.1.0-beta.3.tgz.sigstore.json \
+cosign verify-blob udid-tools-core-0.1.0-beta.4.tgz \
+  --bundle udid-tools-core-0.1.0-beta.4.tgz.sigstore.json \
   --certificate-identity \
-  "https://github.com/udid-tools/core/.github/workflows/release.yml@refs/tags/v0.1.0-beta.3" \
+  "https://github.com/udid-tools/core/.github/workflows/release.yml@refs/tags/v0.1.0-beta.4" \
   --certificate-oidc-issuer "https://token.actions.githubusercontent.com"
 ```
 
@@ -52,7 +52,7 @@ Repeat `cosign verify-blob` with each SBOM or checksum file and its adjacent bun
 those assets directly. Verify the GitHub artifact attestation independently:
 
 ```bash
-gh attestation verify udid-tools-core-0.1.0-beta.3.tgz \
+gh attestation verify udid-tools-core-0.1.0-beta.4.tgz \
   --repo udid-tools/core
 ```
 
diff --git a/docs/src/content/docs/reference/apple-compatibility.md b/docs/src/content/docs/reference/apple-compatibility.md
index 84dde5b..58dfce4 100644
--- a/docs/src/content/docs/reference/apple-compatibility.md
+++ b/docs/src/content/docs/reference/apple-compatibility.md
@@ -9,7 +9,7 @@ The special Profile Service protocol is primarily documented in Apple’s archiv
 2. **Observed:** verified on specified platform versions with reproducible fixtures.
 3. **Extension:** accepted losslessly but not yet normalized or claimed as Apple-defined.
 
-`0.1.0-beta.3` types the documented attribute names `UDID`, `VERSION`, `PRODUCT`, `SERIAL`, `MEID`, `IMEI`, `ICCID`, and `MAC_ADDRESS_EN0`. Availability depends on device hardware, OS, privacy behavior, and enrollment context. A requested value is not automatically guaranteed.
+`0.1.0-beta.4` types the documented attribute names `UDID`, `VERSION`, `PRODUCT`, `SERIAL`, `MEID`, `IMEI`, `ICCID`, and `MAC_ADDRESS_EN0`. Availability depends on device hardware, OS, privacy behavior, and enrollment context. A requested value is not automatically guaranteed.
 
 Apple Profile Service responses may use RSA/SHA-1. Apple's archived guide requires a signed CMS response but does not prescribe the digest algorithm. Response verification accepts both RSA/SHA-1 and RSA/SHA-256.
 
diff --git a/package-lock.json b/package-lock.json
index 580d788..c2cfcd0 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@udid-tools/core",
-  "version": "0.1.0-beta.3",
+  "version": "0.1.0-beta.4",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@udid-tools/core",
-      "version": "0.1.0-beta.3",
+      "version": "0.1.0-beta.4",
       "license": "MIT",
       "dependencies": {
         "asn1js": "3.0.10",
diff --git a/package.json b/package.json
index f1e547c..f794ecf 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@udid-tools/core",
-  "version": "0.1.0-beta.3",
+  "version": "0.1.0-beta.4",
   "description": "Framework-agnostic TypeScript SDK for Apple Profile Service profiles, CMS signing, verification, and device response parsing.",
   "keywords": [
     "apple",