What's Changed

• ci: port CI security hardening to main by @rygel in #331
• feat: optional req/hr burn-rate badge on provider cards by @rygel in #347
• feat(db): migrate fetched_at from TEXT ISO-8601 to INTEGER Unix epoch by @rygel in #348
• fix: SQL hardening, UI polish, and code quality improvements by @rygel in #349
• refactor(ui): extract SVG icon and markdown rendering out of MainWindow by @rygel in #350
• ci(screenshots): auto-update baselines on push, compare-only on PRs by @rygel in #351
• ci(screenshots): open PR for baseline updates instead of direct push by @rygel in #352
• chore: update 9 screenshot baseline(s) from CI (windows-2025) by @rygel in #353
• fix(ci): remove --label from baseline-update PR by @rygel in #354
• fix(ci): use $LASTEXITCODE to detect unchanged baselines in PowerShell by @rygel in #355
• feat(security): add CodeQL, Semgrep, and Trivy scanning by @rygel in #356
• feat: rolling-window time-adjusted quota pace indicator by @rygel in #357
• chore: update 1 screenshot baseline(s) from CI (windows-2025) by @github-actions[bot] in #358
• chore(release): prepare 2.3.2-beta.1 by @rygel in #359
• fix: pace adjustment not applied to Claude Code Sonnet/Opus cards by @rygel in #360
• refactor: upfront provider metadata cleanup by @rygel in #361
• refactor: move static provider flags to ProviderDefinition by @rygel in #362
• chore: update 1 screenshot baseline(s) from CI (windows-2025) by @github-actions[bot] in #363
• chore(release): prepare 2.3.2-beta.2 by @rygel in #364
• refactor: single source of truth — eliminate post-fetch filtering and fallback chains by @rygel in #365
• chore: update 1 screenshot baseline(s) from CI (windows-2025) by @github-actions[bot] in #366
• chore(release): prepare 2.3.2-beta.3 by @rygel in #367
• fix(ci): resolve all zizmor security scanning alerts by @rygel in #368
• fix: correct inverted color threshold logic for quota-based providers by @rygel in #369
• chore: update 1 screenshot baseline(s) from CI (windows-2025) by @github-actions[bot] in #370
• chore(release): prepare 2.3.2-beta.4 by @rygel in #371
• fix: upgrade pace-adjustment formula to stay green when clearly under pace by @rygel in #372
• chore(release): prepare 2.3.2-beta.5 by @rygel in #373
• refactor: remove ResolveRollingWindowInfo fallback chain by @rygel in #379
• Bump Meziantou.Analyzer from 3.0.19 to 3.0.25 by @dependabot[bot] in #378
• chore: update 1 screenshot baseline(s) from CI (windows-2025) by @github-actions[bot] in #377
• chore(deps): bump github/codeql-action from 3.33.0 to 4.34.0 by @dependabot[bot] in #376
• chore(deps): bump actions/cache from 5.0.3 to 5.0.4 by @dependabot[bot] in #374
• chore(deps): bump codecov/codecov-action from 5.5.2 to 5.5.3 by @dependabot[bot] in #375
• chore: update 1 screenshot baseline(s) from CI (windows-2025) by @github-actions[bot] in #380
• chore(release): prepare 2.3.2-beta.6 by @rygel in #381
• chore: update 1 screenshot baseline(s) from CI (windows-2025) by @github-actions[bot] in #382
• fix: resolve zizmor template-injection alerts in publish and pr-size-check workflows by @rygel in #383
• feat(ci): add NuGet/Playwright caching and run CodeQL on push to main/develop by @rygel in #384
• feat(ci): add OSSF Scorecard and Gitleaks secret scanning by @rygel in #385
• chore(ci): update GitHub Actions to latest versions by @rygel in #386
• Refactor pace metadata flow and remove fallback heuristics by @rygel in #387
• chore(release): prepare 2.3.2-beta.7 by @rygel in #388
• Refactor Slim UI pace rendering and fix pace color path by @rygel in #389
• chore: update 1 screenshot baseline(s) from CI (windows-2025) by @github-actions[bot] in #390
• Fix pace-toggle reload after Settings and add regression test by @rygel in #391
• docs: align pace-aware quota documentation for beta by @rygel in #392
• Add startup guards and UI diagnostic logging by @rygel in #393
• refactor: strip to lean core + fix pace calculation by @rygel in #395
• chore: update 1 screenshot baseline(s) from CI (windows-2025) by @github-actions[bot] in #397
• chore(release): prepare 2.3.2-beta.8 by @rygel in #396
• chore(release): prepare 2.3.2-beta.11 by @rygel in #398
• refactor: split large UI files, extract Win32 interop, remove reflection by @rygel in #399
• chore: update 1 screenshot baseline(s) from CI (windows-2025) by @github-actions[bot] in #400
• refactor: convert MonitorLauncher from static to injectable instance class by @rygel in #401
• chore(release): prepare 2.3.2-beta.12 by @rygel in #402
• fix: MonitorLauncher DI resolution fails — empty UI on startup by @rygel in #403
• chore: update 1 screenshot baseline(s) from CI (windows-2025) by @github-actions[bot] in #404
• chore(release): prepare 2.3.2-beta.13 — hotfix for empty UI by @rygel in #405
• test: audit test suite — delete useless tests, add critical integration tests by @rygel in #406
• fix: DateTime overflow in pace calculation crashes UI rendering by @rygel in #407
• chore(release): prepare 2.3.2-beta.14 by @rygel in #408
• feat: per-window pace projection for dual quota bars by @rygel in #409
• chore: update 1 screenshot baseline(s) from CI (windows-2025) by @github-actions[bot] in #410
• feat: UI clarity improvements — auto-collapse, reset format, daily budget by @rygel in #412
• chore: update 2 screenshot baseline(s) from CI (windows-2025) by @github-actions[bot] in #413
• feat: Card Designer, UI improvements, Settings redesign by @rygel in #414
• chore: update 7 screenshot baseline(s) from CI (windows-2025) by @github-actions[bot] in #415
• chore(release): prepare 2.3.2-beta.15 by @rygel in #416
• fix: DateTime overflow in renderer crashes UI (beta.15) by @rygel in #417
• refactor: eliminate remaining duplicated logic across codebase by @rygel in #418
• chore(release): prepare 2.3.2-beta.16 by @rygel in #419
• refactor: inline Card Designer into Settings Cards tab by @rygel in #420
• chore(release): prepare 2.3.2-beta.17 by @rygel in #421
• fix: show cached provider data immediately on startup by @rygel in #422
• perf: eliminate 5 redundant health checks on startup — data in <1 second by @rygel in #423
• perf: startup optimization + consolidate remaining duplicated code by @rygel in #424
• chore(release): prepare 2.3.2-beta.18 by @rygel in #425
• fix: ConfigureAwait(false) in UI startup caused empty UI (beta.18 regression) by @rygel in #426
• test: add ConfigureAwait guardrail + re-enable dangerous analyzer rules by @rygel in #427
• fix: re-enable dangerous analyzer rules, fix all violations — zero warnings by @rygel in #428
• chore(release): prepare 2.3.2-beta.19 by @rygel in #429
• fix: startup 19s → fast — eliminate HTTP timeout + double preferences load by @rygel in #430
• chore(release): prepare 2.3.2-beta.20 by @rygel in #431
• fix: parallelize monitor launch — startup ~19s → ~3.5s by @rygel in #432
• feat: 3-tier pace badges with projected usage text by @rygel in #433
• chore: add gitleaks baseline, fix secret scanning on push by @rygel in #434
• fix: Codex reset badge shows 3 parts instead of 2 by @rygel in #435
• chore(release): prepare 2.3.2-beta.23 by @rygel in #436
• chore(release): prepare 2.3.3 by @rygel in #437
• release: 2.3.3 by @rygel in #438
• chore: trim 2.3.3 changelog to highlights by @rygel in #439
• feat: burst/weekly labels on dual bars + stale badge by @rygel in #440
• fix: code quality sweep — redundant lookups, fragile patterns by @rygel in #442
• chore(release): finalize 2.3.3 changelog by @rygel in #443
• release: 2.3.3 (final) by @rygel in #444 New Contributors
• @github-actions[bot] made their first contribution in #358
• @dependabot[bot] made their first contribution in #378 Full Changelog: v2.3.1...v2.3.3