chore(main): release 1.5.3

[alxxjohn]

🤖 I have created a release beep boop

1.5.3 (2026-08-19)

Bug Fixes

• ci: require immutable GitHub Action refs (#111) (cbcea34)
• ci: validate Homebrew formula version (c6b52bd)
• ci: validate Homebrew formula version (#135) (3b14798)
• config: contain performance history path (#126) (5f2f133)
• make goroutine loop detection linear (b560584)
• parser: bound tree-sitter scan resources (c83a2ce)
• parser: bound tree-sitter scan resources (#133) (a0e4e3c)
• performance: cap complexity regression reads (fca8c4e)
• performance: cap complexity-regression reads to use corpus reader (#131) (25c173c)
• prevent tsconfig from narrowing security scans (a464824)
• quality: skip rolling-hash precompute when no full clone window exists (#125) (19c1874)
• release: protect trusted publishing environment (4350eb9)
• release: require protected release-publish environment for npm/PyPI OIDC publishing (#132) (43cff7e)
• reliability: make goroutine-in-loop detection linear to avoid quadratic AST walks (#130) (23f7558)
• security: contain slop history writes (d5209d5)
• security: contain slop history writes (#136) (6ebbafc)
• security: include targeted node_modules files in TypeScript semantic scans (#137) (0ef6ab1)
• security: scan targeted node modules semantically (728e527)

---

This PR was generated with Release Please. See documentation.

[alxxjohn]

🤖 Created releases:

• v1.5.3

🌻