[remigiusz-antczak]

Release 1.639.0 ships 1 merged change: 3 bundled semgrep rules for XSS from browser URL input, request params in HTML responses, and markdown rendered from non-constant input.

Changes

• Version 1.639.0 in the skill VERSION files, the SKILL.md frontmatter and the plugin manifests.
• CHANGELOG section built from the one pending fragment, which this removes.
• SHA256SUMS, indexes and size-budget rows regenerated.
• Ships Bundled semgrep rules for URL-input, request-param and markdown XSS #2193.

Verification

• Tests: changelog fragments 23/23, size-ratchet ok against main, privacy gate clean on the 11 changed files that remain (39 patterns plus gitleaks rules), git diff --check clean, regen reproduces the commit with a clean status. The content itself passed CI on Bundled semgrep rules for URL-input, request-param and markdown XSS #2193 before merge.

🤖 Generated with Claude Code