v1.1.0

Listing description: Scan the lockfile on every PR with VDB: refuses hallucinated package names, known CVEs and fresh typosquats; optional harden: true runs call-site hardening on Python projects and fails the check when a decided path is open. Works without a token on the keyless allowance; a free token lifts it.

(Action change to make before listing this: a harden input that runs uvx --from vdb-mcp vdb harden . --manifest and exits 2 on open paths. Not done in this change.)

v1.0.0

Scan a lockfile or SBOM against VDB on every PR. Fails the build on exploited (CISA KEV) or hallucinated dependencies, not just on any CVE.

v1.0.0

Scan a lockfile or SBOM against VDB on every PR. Fails the build on exploited (CISA KEV) or hallucinated dependencies, not just on any CVE.