diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 7b6d092..dcbb3f8 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -60,4 +60,4 @@ jobs:
     steps:
       - name: Deploy GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 224e7dd..e45b68f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,19 +2,18 @@
 
 ## Unreleased
 
-- separate general feedback and pin conversations beside the image without
-  dimming the artwork, with labelled review colors and localized comment headers
-- attribute signed-in reviews to Nextcloud accounts while retaining guest
-  authorship, private ratings, link restrictions, and private selection updates
-- identify pin replies by their root comment rather than matching coordinates;
-  retain conversations when their initial comment is deleted
-- invalidate live collaboration cursors after account or guest data erasure so
-  open viewers refresh without exposing deleted identity data
-- keep annotations attached during zoom and support bounded touch panning
-- add account attribution and private event recipient migrations; complete the
-  database upgrade before serving the updated application
-- accept empty settings during user migration and fail migration smoke checks
-  with a nonzero exit status
+## 0.10.0 — 2026-09-10
+
+- make collaborative reviews clearer with separate general feedback and image
+  discussions, labelled review colors, localized headers, and account
+  attribution for signed-in reviewers while retaining guest authorship
+- keep ratings, selections, and link restrictions private, and safely refresh
+  open viewers after a user or guest is removed
+- preserve image discussions across replies and deletions, while keeping
+  annotations aligned during zoom and improving touch panning
+- make updates safer for existing galleries and event deliveries by completing
+  required data updates before the new version becomes active
+- update bundled third-party libraries to address known security advisories
 
 ## 0.9.1 — 2026-09-06
 
diff --git a/composer.lock b/composer.lock
index 847d6e3..f7aefdf 100644
--- a/composer.lock
+++ b/composer.lock
@@ -545,11 +545,11 @@
         },
         {
             "name": "phpstan/phpstan",
-            "version": "2.2.13",
+            "version": "2.2.8",
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/9ba9ac76ee9c5cf5b56d58eb5deec6315b7a0260",
-                "reference": "9ba9ac76ee9c5cf5b56d58eb5deec6315b7a0260",
+                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/e285254e60f33c21902efef4a926ca0987c06804",
+                "reference": "e285254e60f33c21902efef4a926ca0987c06804",
                 "shasum": ""
             },
             "require": {
@@ -605,7 +605,7 @@
                     "type": "github"
                 }
             ],
-            "time": "2026-09-03T20:38:19+00:00"
+            "time": "2026-08-04T22:21:45+00:00"
         },
         {
             "name": "phpunit/php-code-coverage",