v0.7.1

A hardening patch. No verdict or output changes.

Security

• Collector responses are size-capped (#155). Every collector (endoflife.date, OSV, GitHub, registries) now streams its HTTP response and stops at a byte cap (32 MiB by default), counting decoded bytes so a gzip bomb is caught. Oversized responses fail that source with an error instead of exhausting memory. This closes A6b, the last unbounded input channel.
• Every install is hash-checked (#156). CI, the MCP job and the GitHub Action install with pip install --require-hashes from complete, hash-pinned locks generated by scripts/compile_locks.py. A re-uploaded or tampered package with the same version now fails the install. scripts/check_lock.py --exact also fails CI on any installed package the lock doesn't list. The Action installs requirements-runtime.lock (no dev tools), then OpenPulse with --no-deps.

Fixed

• The lock was incomplete (#156). typing-inspection (pulled in by pydantic) and colorama (Windows) weren't listed, so they floated. The locks are now resolved for every platform at once.

Notes

• The mcp extra needs Python 3.11 or newer (MCP SDK 2.x requires it). The rest of OpenPulse still supports 3.10.

Install: pip install "ikarus-openpulse[mcp] @ git+https://github.com/IkarusAILabs/OpenPulse@v0.7.1"

If you are upgrading from before v0.7.0, read the v0.7.0 notes first: #133 changes verdicts.