v0.5.0

0.5.0 (2026-10-22)

Features

• alias npm @next/env to next so Next.js advisories apply (#64) (0dbfc22)
• central MATCH_RHEL_ASSUME_LATEST_MINOR switch for latest-minor RHEL remediation (#63) (1b356ce)
• github_repo source — per-repo GitHub security advisories for non-ecosystem software (#28) (b2f1b7d)
• ingest php-src repository advisories with per-branch fix ranges (#69) (e5ad573)
• source Microsoft applicability context from CPE fields, not the metadata side-channel (#59) (b62d2f7)

Bug Fixes

• align Microsoft and GHSA remediation matching with Tenable (#56) (e3d28b3)
• backfill empty Edge FixedBuild so all Edge (Chromium) CVEs match (#29) (86986c9)
• intermediate tolerance for glance's Windows R2/SP product name + 10.0 kernel (#67) (ab1216c)
• match Microsoft SQL Server CPE across its edition products (#44) (#46) (9306c1a)
• matcher looks up the binary package first, source only as fallback (#38) (9dcbc34)
• Microsoft CPE family match uses exact keys (index scan, not a 14M-row seq scan) (#48) (e9bc072)
• only emit affected rows for base-RHEL platforms, skip layered products (#40) (85d1171)
• rebuild each affected origin with an atomic swap so /match stays consistent (#33) (6db3882)
• redhat _resolve returns a 5-tuple in the base-platform guard (daily crash) (#47) (a28dd6f)
• rpm matcher — binary+source lookup and bare .elN stream expansion (#31) (e0a370f)
• rpm matcher — scope to the host's own line (fips/ksplice variant + EUS minor) (#32) (6d95743)
• scope a kernel host to its own version line (kernel-alt cross-line FP) (#53) (a2e567b)
• scope AppStream module fixes to the host's stream (module_stream) (#43) (e6f8c06)
• scope Microsoft remediation by applicability (#58) (1d1670b)
• scope Microsoft rows by platform, Office train and update spelling (#70) (27676e2)
• scope SharePoint vulnerability matching by edition (#51) (070965e)
• scope SUSE/SLE hosts to their own codestream + product family (#22, #23) (#45) (44ba6b4)
• suppress AppStream module co-rebuild false positives (parallel-line guard + VEX) (#39) (c6cfa51)
• track-aware SQL Server servicing-line matching across all releases (#62) (1a0393e)
• treat azure_data_studio and azure_site_recovery as single-line rolling products (#65) (e1b9985)

v0.4.0

0.4.0 (2026-07-18)

Features

• per-component remediation in /match (highest fix that closes all) (#21) (247640a)

v0.3.0

0.3.0 (2026-07-07)

Features

• matcher accuracy, fix_kb, curation layer, Node.js source, read-only MCP (#19) (a8d1cfc)

v0.2.0

0.2.0 (2026-06-26)

Features

• add shared CWE dictionary table with rich weakness definitions (#19) (20bb9a9)
• LVE (custom entries) + bulk match — MCP tools + REST API (#10) (e089a44)
• mcp: add optional self-hosted MCP server (#18) (0567fff)
• Microsoft MSRC affected layer + NVD-validated CPE matching (#8) (d7115ea)
• NVD CPE enrichment + matcher correctness & coverage fixes (#14) (30b45ff)
• NVD ingestor, distro status de-noising (Debian/Ubuntu), explain_status MCP tool, compact get_cve_detail (#15) (d8222c3)

Bug Fixes

• exploitdb: store only link and metadata, not the exploit body (#11) (337760e)
• maven matcher — normalize group:artifact (#7) (065e88e)
• ofelia daily job — run the pipeline via a single vdb daily command (#9) (f04b085)
• prefer CPE over a generic purl in bulk match (#13) (8efff0b)
• prevent lve_history collision on simultaneous advisories (03de94c)

CI

• allow manual dispatch of release-please (4a357fb)
• path-filtered CI with aggregating gate, dependabot groups, prod image (#12) (fe2d556)
• publish image from the release-please run, add manual tag dispatch (#15) (0bd36c6)

Chores

• set next release to 0.2.0 (#12) (7124756)
• start release line at 0.1.0 (978edee)

v0.1.0

0.1.0 (2026-06-18)

Features

• add shared CWE dictionary table with rich weakness definitions (#19) (20bb9a9)
• mcp: add optional self-hosted MCP server (#18) (0567fff)

Bug Fixes

• exploitdb: store only link and metadata, not the exploit body (#11) (337760e)
• prevent lve_history collision on simultaneous advisories (03de94c)

CI

• allow manual dispatch of release-please (4a357fb)
• path-filtered CI with aggregating gate, dependabot groups, prod image (#12) (fe2d556)
• publish image from the release-please run, add manual tag dispatch (#15) (0bd36c6)

Chores

• start release line at 0.1.0 (978edee)