chore: bump version to 0.3.0 and add CHANGELOG for dep updates (#3)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: kevinccbsg

CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.3.0 (2026-05-08)
+
+### Internal
+
+- **deps:** Bump runtime and dev dependencies. Notably crosses `ajv-formats` v2 → v3. The only behavioral change in v3 is that the `date-time` and `time` formats now require a timezone per RFC3339 — strings like `"2024-04-15T00:00:00"` (no `Z` / offset) will now fail validation. Use the new `iso-time` / `iso-date-time` formats to opt back into the v2 behavior.
+- **security:** Bumping `ajv` to ^8.20.0 closes the high-severity `fast-uri` advisories ([GHSA-q3j6-qgpj-74h6](https://github.com/advisories/GHSA-q3j6-qgpj-74h6), [GHSA-v39h-62p7-jpjc](https://github.com/advisories/GHSA-v39h-62p7-jpjc)) pulled in transitively.
+
+| package | from | to |
+|---|---|---|
+| ajv | ^8.18.0 | ^8.20.0 |
+| ajv-formats | ^2.1.1 | ^3.0.1 |
+| @apidevtools/json-schema-ref-parser | ^15.3.4 | ^15.3.5 |
+| path-to-regexp | ^8.4.0 | ^8.4.2 |
+| vitest | ^4.1.2 | ^4.1.5 |
+| @vitest/coverage-v8 | ^4.1.2 | ^4.1.5 |
+
 ## 0.2.0 (2026-04-20)
 
 ### Features

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "openapi-mock-validator",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Validate JSON payloads against OpenAPI 3.0/3.1 specs — catch mock drift before it hits production",
   "type": "module",
   "main": "./dist/index.js",