CHANGELOG [Unreleased] misses fixes since v0.10.0 and has no version links #231

Summary

The CHANGELOG [Unreleased] section leaves out several user-visible fixes merged since v0.10.0, and the file has no link definitions for its version headings.

Where

• CHANGELOG.md ([Unreleased] section; end of file)

Details

Commits since v0.10.0 with no [Unreleased] entry:

• 989741e: a failed -seeds read left a .tmp file beside the -o output (Bad -seeds path leaves a temporary -o file behind #212)
• 2e325a4: -o/-stats/-sarif NUL (and other device/pipe targets) failed on Windows (-o NUL fails on Windows: CreateFile opens devices with O_TRUNC #208, fix(output): open device and pipe targets without O_TRUNC #209)
• 4183518: verify release attestations; restrict Pages permissions (fix(security): verify downloaded release provenance and scope Pages token #210)
• 3e2cb2b: the wordlist is normalized once per run instead of per target (Wordlist is re-normalized with a regex per label for every -dL target #182)

Also:

• There are no [Unreleased]: …compare/v0.10.0...HEAD / [0.10.0]: … link definitions at the end, so the headings render as literal bracketed text.

Impact

Release notes for the next tag will undersell the fixes, and the Windows NUL fix in particular is something users will look for.

Acceptance criteria

• Each commit above has an entry under Fixed/Changed/Security
• The version headings link to compare views

Getting started

• Relevant files: CHANGELOG.md
• git log v0.10.0..HEAD --oneline lists the candidates

_{Filed by repo-audit/docs-audit at 1fcd5bc. Severity: medium. Effort: S. audit-key: documentation|CHANGELOG.md|unreleased-since-v0.10.0}