Add 0.5.0 release notes

Author: eldryoth

CHANGELOG.md

@@ -5,6 +5,12 @@
 - Starting with `0.5.0`, project licensing is dual `MIT OR Apache-2.0`
 - Added `LICENSE-MIT` and `LICENSE-APACHE`
 - Removed the previous EUPL license files
+- Added Fluxheim-style local and GitHub CI checks through `scripts/checks.sh`
+- Added Dependabot configuration for Cargo and GitHub Actions updates
+- Pinned GitHub Actions to immutable commit SHAs for CodeQL-friendly workflow hardening
+- Moved demo-server WebP rendering and encoding onto Tokio's blocking task pool
+- Added defense-in-depth HTTP security headers to demo HTML, image, and error responses
+- Updated `tokio` to `1.52.3`
 
 ## 0.4.2
 

GITHUB_METADATA.md

@@ -36,12 +36,20 @@ Release title example:
 Release notes template:
 
 ```text
-License migration and version preparation.
+License migration and demo server hardening.
 
 Highlights:
 - Starting with 0.5.0, project licensing is MIT OR Apache-2.0
 - LICENSE-MIT and LICENSE-APACHE are included
 - Previous EUPL license files were removed
+- Demo-server avatar encoding now runs on Tokio's blocking task pool
+- Demo responses now include defense-in-depth HTTP security headers
+- GitHub Actions are pinned to immutable commit SHAs
+- Local and GitHub checks now run through scripts/checks.sh
+
+Compatibility:
+- No avatar rendering behavior changes are intended
+- Published 0.4.x and older versions retain their original release licensing
 
 Licence:
 - MIT OR Apache-2.0

README.md

@@ -310,6 +310,10 @@ The test suite includes:
 - Starting with `0.5.0`, project licensing is dual `MIT OR Apache-2.0`
 - Added separate `LICENSE-MIT` and `LICENSE-APACHE` files
 - Removed the previous EUPL license files
+- Added Fluxheim-style local and GitHub CI checks through `scripts/checks.sh`
+- Pinned GitHub Actions to immutable commit SHAs for CodeQL-friendly workflow hardening
+- Moved demo-server WebP rendering and encoding onto Tokio's blocking task pool
+- Added defense-in-depth HTTP security headers to demo HTML, image, and error responses
 
 ## What's New In 0.4.2
 

RELEASE_NOTES_0.5.0.md

@@ -0,0 +1,26 @@
+# hashavatar 0.5.0
+
+`hashavatar` 0.5.0 prepares the crate for dual permissive licensing and hardens the bundled demo server without changing the deterministic avatar rendering contract.
+
+## Highlights
+
+- Starting with `0.5.0`, the project is licensed as `MIT OR Apache-2.0`
+- Added `LICENSE-MIT` and `LICENSE-APACHE`
+- Removed the previous EUPL license files from the current source tree
+- Added Fluxheim-style local and GitHub CI checks through `scripts/checks.sh`
+- Added Dependabot configuration for Cargo and GitHub Actions updates
+- Pinned GitHub Actions to immutable commit SHAs for CodeQL-friendly workflow hardening
+
+## Security And Quality
+
+- Moved demo-server WebP rendering and encoding onto Tokio's blocking task pool to avoid starving async worker threads
+- Added defense-in-depth HTTP security headers to demo HTML, image, and error responses
+- Added regression coverage for the demo response security headers
+- Updated `tokio` to `1.52.3`
+- Verified with `scripts/checks.sh`, including formatting, build, clippy, tests, CLI smoke exports, `cargo deny check`, and `cargo audit`
+
+## Compatibility
+
+- No avatar rendering behavior changes are intended in this release.
+- Existing deterministic fingerprints remain covered by the golden regression tests.
+- Published `0.4.x` and older versions retain their original release licensing. The `MIT OR Apache-2.0` license applies starting with `0.5.0`.