chore: bump version to 0.26.9 and update changelog

- Update version from 0.26.8 to 0.26.9
- Add changelog entry for GitHub remote detection fix and code scanning fixes

Co-authored-by: Cursor <[email protected]>

Author: djm81

CHANGELOG.md

@@ -9,6 +9,23 @@ All notable changes to this project will be documented in this file.
 
 ---
 
+## [0.26.9] - 2026-01-27
+
+### Fixed (0.26.9)
+
+- **GitHub Remote Detection**: Extended URL pattern matching to support all valid GitHub URL formats
+  - **Added Support**: Now detects `ssh://[email protected]/owner/repo.git` and `git://github.com/owner/repo.git` formats
+  - **Root Cause**: Previous regex only matched `https?://` and scp-style `git@host:path` URLs, causing regression for repos using `ssh://` or `git://` schemes
+  - **Solution**: Extended regex pattern to include `ssh://` and `git://` schemes, with proper URL parsing for hostname validation
+  - **Impact**: All valid GitHub URL formats are now properly detected, ensuring GitHub adapter is selected correctly
+
+- **Code Scanning Vulnerabilities**: Mitigated all 13 code scanning findings
+  - **ReDoS Fix**: Replaced regex-based section removal with line-by-line processing in `github_mapper.py`
+  - **URL Sanitization**: Replaced substring matching with proper URL parsing using `urllib.parse.urlparse()` in multiple files
+  - **Workflow Permissions**: Added explicit `permissions: contents: read` blocks to 7 GitHub Actions jobs
+  - **SSH Host Aliases**: Added support for `ssh.github.com` SSH host alias detection
+  - **Test Fixes**: Fixed async cleanup issues in test mode for progress display utilities
+
 ## [0.26.8] - 2026-01-27
 
 ### Fixed (0.26.8)

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "specfact-cli"
-version = "0.26.8"
+version = "0.26.9"
 description = "Brownfield-first CLI: Reverse engineer legacy Python → specs → enforced contracts. Automate legacy code documentation and prevent modernization regressions."
 readme = "README.md"
 requires-python = ">=3.11"