v0.14.0

Breaking release. Highlights:

• Dependency bumps (breaking) - reqwest 0.13, toml 1, toml_edit 0.25, quick-xml 0.40, all now in Fedora/EPEL. reqwest::Error appears in some public signatures, so the major bump is itself breaking. Built with rustls-no-provider + ring (statically linked) to keep the unpackaged aws-lc-rs out; trust roots come from the system store.
• ebranch check-update --give-karma - cast Bodhi karma with per-bug feedback based on the check result; reuses the bodhi CLI's login session, posts the full report, and offers to regenerate stale side-tag repos.
• poi-tracker retirement tracking - prune-retired marks packages no longer carried on any active branch as unshipped (parallel scan); sync-distgit --mark-unshipped does it at sync time; sync-gitlab --mark-unshipped flags archived CentOS SIG packages via a CBS release check. Field-aware multi-inventory merge (breaking).
• hs-relmon prune-archived - untag CBS builds for archived-upstream packages once stock (CentOS Stream / AlmaLinux) catches up, leaving ahead-of-stock builds for review; CBS auth checked up front.
• sandogasa-distgit group syncs keep only the rpms namespace (breaking: ProjectInfo gained a fullname field).

Full details: https://github.com/slopfest/sandogasa/blob/v0.14.0/CHANGELOG.md#v0140

v0.13.0

• New semver-audit subcommand (poi-tracker) - classifies pending upstream updates as breaking/non-breaking per the Cargo caret rule
• triage-updates closes already-addressed bugs via Bodhi - ERRATA when stable everywhere, MODIFIED when in testing; always sets Fixed In Version; short-circuits rawhide-only inventories
• Consistent --pattern/--start-from/--end-with filters across all inventory-walking commands; --package removed (breaking CLI)
• --batch mode for semver-audit and triage-updates - one email-scoped Bugzilla query instead of one per package
• Retirement tracking - triage-retired --mark records retired branches in the inventory (retired_on field); other commands skip them (breaking inventory schema)
• sync-distgit fixes: forks no longer leak into inventories as directly-owned packages; transport errors are retried; failed runs resume from the dumped .partial file; new --fast path fetches the owner-alias dump in one request (direct maintainership only)
• Deprecated sync-distgit --auto-prefix --pattern spelling removed (breaking CLI)
• Security hardening: clients refuse to send credentials over plaintext HTTP (breaking; BzClient::with_api_key now returns Result), identifiers are validated before URL interpolation, external-tool argv uses -- separators, Bugzilla query values are URL-encoded
• fedora-cve-triage: new fix-version subcommand
• sandogasa-report: reports grouped by domain in --domain order (breaking JSON)
• sandogasa-distgit: new list_branches and user_packages_fast APIs

Full details: https://github.com/slopfest/sandogasa/blob/v0.13.0/CHANGELOG.md#v0130