v0.2.0

A consolidation release. No new subsystems — packaging, dependencies, the demo, and the documentation are brought back in line with what GitNodes actually is.

The demo is now an engineering knowledge base

examples/demo-brain replaces the previous fictional space program with Harbor Engineering: 37 notes of ADRs, systems, incidents, runbooks, postmortems, and issues.

The point is the spine rather than the volume. ADR-0004 moves session state into Redis to make the gateway stateless, and records the benefit without stating what Redis must then guarantee. Fourteen months later a batch job fills the same cluster and its LRU policy evicts live sessions. The postmortem files four issues, and one of them becomes ADR-0009, which supersedes ADR-0004.

That loop is the argument for a typed graph. Reconstructing it by hand means reading a wiki, a tracker, and an incident log at once; node_links walks it in four calls. The new agent walkthrough traces exactly that question over MCP, with real tool calls and real output.

Some notes are deliberately wrong — a runbook that was stale during the incident that needed it, a sev-3 with no postmortem — because real knowledge bases are.

Security

• ammonia 4.1.4 for RUSTSEC-2026-0213: attribute filters were not applied by attributeName, so a javascript: URL survived in SVG <set>/<animate> tags. Ammonia is the sanitiser on the markdown rendering path. Only reachable where those tags are allowed, which is not the default.
• h2 0.4.19 for RUSTSEC-2026-0258, event-listener 5.4.2 for RUSTSEC-2026-0221.

Dependencies

Migrated to reqwest 0.13, which is not a version bump: RequestBuilder::query and ::form moved behind opt-in features, now enabled per crate. The default TLS backend moves from native-tls to rustls, which removes OpenSSL from the dependency tree entirely — one less system library for the single-file binary to find at runtime.

Also cleared the remaining backlog: tower-http 0.7, rmcp 2.2, time 0.3.53, http-body-util 0.1.4, tailwindcss 4.3.3, and six pinned GitHub Actions.

Corrections

• WinGet has been live since 0.1.0. The README said "pending review" for a month after winget-pkgs#396497 merged. Both winget install AndreaBozzo.GitNodes and brew install andreabozzo/tap/gitnodes are documented as the working channels they are.
• The WinGet manifest templates had drifted two schema versions behind what was actually published, and omitted a Microsoft.VCRedist.2015+.x64 dependency added during the 0.1.1 review. Fixed at the template, so it carries forward.
• The cargo audit CI job had been failing on a permissions error rather than on any finding — a security gate that can go red for non-security reasons teaches people to ignore it.
• AGENTS.md documented four subcommands where the binary dispatches six.
• 0.1.1 shipped with no changelog entry at all; it is recorded retroactively.

Install

brew install andreabozzo/tap/gitnodes     # macOS / Linux — live
winget install AndreaBozzo.GitNodes       # Windows — 0.2.0 pending review

Or download a binary below and put it on PATH. Verify against SHA256SUMS.

Full detail in the changelog.