Release 9.0.0

[OGPoyraz]

Explanation

Release 9.0.0. This is the re-cut of the 9.0.0 release: the original (#420) was tagged but never published to npm, and was reverted in #423 so the release could be re-created on top of the OIDC trusted-publishing migration (#421). This release will publish via OIDC.

Changes

• package.json: 8.2.0 → 9.0.0.
• CHANGELOG.md: move the [Unreleased] entries into a new ## [9.0.0] section and add the compare links.

Included in 9.0.0

• BREAKING: Drop support for Node.js versions 18 and 20 (#422) — minimum supported Node.js is now 22.
• BREAKING: Reject ambiguous bool values in signTypedData instead of coercing them (#419).
• Add additional validation to EIP7702 methods (#410).

Checklist

• yarn auto-changelog validate --rc passes
• yarn lint passes
• yarn build passes
• yarn test passes (2782 tests)

Notes

• First publish over OIDC — trusted publishing must be enabled for @metamask/eth-sig-util before the publish-npm job runs; delete NPM_TOKEN after the first successful OIDC publish.

---

Note

Low Risk
This PR only changes version and changelog metadata; runtime risk comes from the breaking signing and Node requirements documented for 9.0.0, not from new code in the diff.

Overview
Cuts 9.0.0 by bumping package.json from 8.2.0 to 9.0.0 and moving the former [Unreleased] notes into a new ## [9.0.0] section, with updated Keep a Changelog compare links ([Unreleased] now tracks v9.0.0...HEAD).

The release notes captured in the changelog (already merged elsewhere) highlight two breaking consumer changes: minimum Node.js 22 (18/20 dropped), and signTypedData bool fields that no longer coerce ambiguous values—only true/false or 'true'/'false' are accepted. EIP-7702 helpers also gain stricter validation.

^{Reviewed by Cursor Bugbot for commit b68a464. Bugbot is set up for automated code reviews on this repo. Configure here.}