Prepare SDK 3.9.5 lease maintenance patch release

CHANGELOG.md

@@ -6,6 +6,24 @@ project follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [3.9.5] - 2026-11-07
+
+### Fixed
+
+- Reuse a Worker's activity lease helper across sequential activities after a
+  confirmed finish, instead of starting a process and rebuilding its Client for
+  each callback (#326). Every claim retains its own lease, business deadline and
+  heartbeat authority. Dead or unconfirmed helpers are replaced, forked callbacks
+  cannot use their parent's helper, and shutdown closes the idle process.
+  Poll transit consumes the fresh activity grant's margin; slow, unknown or short
+  grants require confirmation before another callback starts.
+- Skip the initial workflow-task renewal for a fresh, fully fenced poll grant
+  with a valid Server clock and sufficient remaining lease (#327). Request time,
+  payload loading and history paging consume that margin. Servers without a
+  qualifying clock and stale or short grants retain the existing renewal path.
+- Update the optional Laravel HTTP example's Symfony HTTP Client, HttpFoundation,
+  HttpKernel, Routing and YAML lock entries to their accepted security patches.
+
 ## [3.9.4] - 2026-11-04
 
 ### Fixed

composer.json

@@ -94,7 +94,7 @@
             }
         },
         "durable-workflow": {
-            "product-train": "3.9.4",
+            "product-train": "3.9.5",
             "supported-server-versions": "2.5.0",
             "supported-server-release-baselines": {
                 "2": "2.5.0",

docs/quickstart-contract.json

@@ -3,8 +3,8 @@
   "schema_version": 2,
   "package": {
     "name": "durable-workflow/sdk",
-    "published_version": "3.9.4",
-    "composer_requirement": "3.9.4",
+    "published_version": "3.9.5",
+    "composer_requirement": "3.9.5",
     "onboarding_requirement": "^3.9"
   },
   "runtime_targets": {