[longieirl]

Summary

Patch release 0.1.9 → 0.1.10.

15 commits since last release:

sec: pin pillow>=13.0.0 and certifi>=2026.10.18 (CVE fixes)
sec: mask IBAN in iban_detector log; lock down ci-docs workflow permissions
chore: docker python 3.12-slim → 3.13-slim
chore: python-minor-patch group dep bumps
chore: pypdf, python-dotenv, ruff, pyright, types-tabulate bumps
fix: group recurring charges and repeated vendors by normalised vendor key
fix: repoint bump_version.py at monorepo version files
sec: fix perpetual critical alert — patch perl, honor .trivyignore

Merge Danger

Door: one-way

Blast Radius: Release

After merge, push v0.1.10 tag to trigger release.yml → builds and publishes ghcr.io/longieirl/bankstatements:latest.

Type

• Bug fix
• Security

Testing

• Tests pass (coverage ≥ 91%)

Checklist

• Code follows project style
• Self-reviewed
• No new warnings

Downstream impact

• This PR changes a public interface in bankstatements_core