v0.7.0 "Channels"

OpenPulse reaches the places where dependency decisions are made: AI coding agents (MCP), DefectDojo and Dependency-Track. This release changes verdicts (#133, below), and the install name is now ikarus-openpulse. Read the upgrade notes before upgrading CI gates.

Fixed

• End-of-life events missed real version pins (#133). Lifecycle events are scoped to release lines (4.2, 13), but versions were compared for equality, so django==4.2.11 or postgres:13.5 against an end-of-life cycle was reported NOT_AFFECTED. Lockfiles and SBOMs always pin patch versions, so end-of-life detection rarely fired on real projects in check, attest, the GitHub Action and digests. A release line now covers its patch releases, variant tags like 13.5-alpine match, and a version that cannot be compared is RELATED, never NOT_AFFECTED.
• Installed packages shipped without their data (#132). A non-editable install (PyPI or pip install git+...) had no catalog, so identities silently fell back to themselves, and attest had no contract schemas. The wheel now ships both, and CI installs the built wheel in a clean environment and tests it.

Upgrade notes

• Install name is now ikarus-openpulse. openpulse on PyPI is an unrelated project (OpenQASM's pulse AST), and pip install "openpulse[mcp]" installed it. Install with pip install "ikarus-openpulse[mcp] @ git+https://github.com/IkarusAILabs/OpenPulse@v0.7.0" until the PyPI release lands. If you previously installed OpenPulse from git under the old name, run pip uninstall openpulse first, so two distributions don't claim the same modules. The CLI command is still openpulse.
• Gates may start failing. Because of #133, pinned dependencies inside an end-of-life release line now report AFFECTED. That is the intended verdict, but a CI gate using --fail-on (or the Action's fail-on) may now fail where it used to pass.

Added

• python -m cli (#146) runs OpenPulse through the interpreter, for MCP clients that can't find the openpulse executable. Configure it as ["-I", "-m", "cli", "mcp"], or -P on Python 3.11+. Without the flag, the working directory is searched first, so a project's own cli/ package would run instead of OpenPulse: in an untrusted repository, that means its code runs. See docs/MCP.md, which also shows the Windows interpreter path. Help and usage text read openpulse either way.
• openpulse mcp: an MCP server for AI coding agents (optional extra, pip install "openpulse[mcp]"). It provides three read-only tools:
  • dependency_status: end-of-life/end-of-support status, curated upstream changes and version-specific OSV advisories for one dependency.
  • check_dependency_file: the same checks for every pinned entry in a project file.
  • project_lifecycle: which release lines of a project are still supported.
• Answers come from live sources. Lifecycle data from endoflife.date, advisories from OSV and repository health from GitHub go through the same evidence gate and verdict engine as check. Results are cached per session.
• Limits. check_dependency_file only reads files inside --root. --offline limits answers to the bundled curated events.
• Separate lock for the SDK. The SDK and its dependencies are pinned in requirements-mcp.lock. A dedicated CI job installs that set, audits it and runs a real stdio session with the SDK client.
• Guide: docs/MCP.md covers setup for Claude Code, Cursor, VS Code/Copilot, Claude Desktop and Windsurf, the tools, an example answer, the security model and troubleshooting.
• DefectDojo export: openpulse attest --defectdojo FILE. It writes DefectDojo's Generic Findings Import JSON, built from the same evidence contracts as the JSONL and SARIF outputs and producing one finding per SARIF result.
  • Severity follows impact: Critical, High, Medium, Low, or Info for RELATED and unknown dependencies. NOT_AFFECTED pairs are left out.
  • Each finding carries its evidence URLs, the recommendation, what could not be established, and the evidence-contract hash.
  • A stable unique_id_from_tool lets re-imports deduplicate.
• Dependency-Track upload: openpulse dependency-track --contracts FILE. It pushes affected findings as INTERNAL vulnerabilities, one per OpenPulse event (OPENPULSE-<event id>), each assigned to the matching components of a DT project.
  • Only affected pairs are pushed, and unmatched dependencies are reported.
  • Re-runs are idempotent.
  • The API key comes from OPENPULSE_DTRACK_API_KEY only.
  • HTTPS is required unless --allow-http is passed.
  • --dry-run shows the plan without sending anything.

Install: pip install "ikarus-openpulse[mcp] @ git+https://github.com/IkarusAILabs/OpenPulse@v0.7.0" (the PyPI name openpulse is an unrelated project).

Full changelog: CHANGELOG.md