From 3ef31cce957daed99719a022251d6d837360def6 Mon Sep 17 00:00:00 2001
From: kurok <22548029+kurok@users.noreply.github.com>
Date: Fri, 18 Sep 2026 12:59:06 +0100
Subject: [PATCH] docs: record 4.0.1 and 4.0.2, and prepare the 4.0.3 release
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The CHANGELOG had no 4.0.1 or 4.0.2 sections: both shipped in July but only
the releases page recorded them, and the [Unreleased] block still described
#67 — which had already gone out in 4.0.2. So the file said the opposite of
what the tags said.

This adds the two missing sections (moving the #67 entry into 4.0.2 where it
belongs) and writes 4.0.3 for the eight commits since: two runner-version
bumps, the Dependabot/code-scanning sweep in #74, three dependency bumps and
the security policy. All patch-level — no input, output or behaviour change.

dist/ is unchanged: verified by rebuilding with `npm run package` against a
clean `npm ci`, byte-identical to what is committed. 245 tests pass, lint
clean.

Signed-off-by: kurok <22548029+kurok@users.noreply.github.com>
---
 CHANGELOG.md | 45 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b61eb3f0..234f5d97 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,8 +6,44 @@ always points at the latest release in that major line.
 
 ## [Unreleased]
 
+## [4.0.3] - 2026-09-18
+
+Housekeeping: a newer bundled runner, and every open Dependabot and
+code-scanning alert closed. No behaviour change to the action's inputs or
+outputs.
+
 ### Fixed
 
+- **Default `actions/runner` bumped to 2.337.0** (#70, #75, via `bump-runner`).
+  A launch that does not pin `runner-version` gets the newer agent and its
+  pinned-checksum verification.
+
+### Security
+
+- **Dependabot and code-scanning alerts resolved** (#74). Transitive dev
+  dependency `js-yaml` 3.14.2 -> 3.15.1 (GHSA-5p4m-2wfm-xmqj,
+  GHSA-52cp-r559-cp3m, GHSA-h67p-54hq-rp68), and a least-privilege
+  `permissions: contents: read` block on the PR workflow. Both are outside the
+  bundle: `dist/` rebuilt byte-identical.
+- `undici` 6.27.0 -> 6.28.0 (#71) and `brace-expansion` (#72).
+
+### Documentation
+
+- **Security policy** (#73): how to report a vulnerability, and which versions
+  are supported.
+
+### Internal
+
+- Dev-dependency bumps: `browserslist` 4.28.2 -> 4.28.9 (#77), `js-yaml`
+  3.15.1 -> 3.15.2 (#78).
+
+## [4.0.2] - 2026-07-10
+
+### Fixed
+
+- **`mode: stop` returned before the instance had stopped** (#69): the stop step
+  issued `StopInstances` and returned, so a warm pool's next start could race a
+  still-stopping instance. It now waits for the `stopped` state.
 - **Warm-restart registration race** (#67): on a `reuse: stop` warm restart the
   runner could re-register and report `online` on the very first poll
   (`elapsed_s=0`) and then drop before the dependent job was scheduled — the
@@ -22,6 +58,15 @@ always points at the latest release in that major line.
   now stress scheduling the `cleanup` reaper for warm pools, since it is the
   backstop that reaps a leaked *running* instance whose runner never came up.
 
+## [4.0.1] - 2026-07-08
+
+### Fixed
+
+- **Warm restart corrupted user data** (#66): `ModifyInstanceAttribute` was
+  handed an already-base64-encoded string and encoded it a second time, so a
+  restarted warm instance booted with unusable user data. The raw bytes are now
+  passed through.
+
 ## [4.0.0] - 2026-07-02
 
 A capability wave across cost, reliability, reach, and toil. 10 features, each