v0.4.1

Security release. 0.4.1 is 0.4.0 plus one fix, and every user of the HOPE server (powermcp[hope]) should upgrade.

HOPE: Julia code injection fixed (#130)

The HOPE server built Julia programs by pasting the solver name and case paths into the source string passed to julia -e, and $ was not escaped. A crafted solver value, passed directly or taken from a case's HOPE_model_settings.yml, ran as Julia code with the privileges of the user running the MCP server. Every release from 0.1.0 through 0.4.0 is affected.

• hope_debug_solver_environment and its async variant now reject any solver outside cbc, clp, highs, scip, gurobi and cplex.
• Case paths and solver names reach Julia as ARGS, never as generated source, in the run, holistic, EREC and debug launches.
• julia_string_literal escapes $.

Reported responsibly by @hexisteme, who also reviewed the fix. Details are in the GitHub Security Advisory for this release.

Nothing else changed since 0.4.0. Work merged to main since then ships in the next minor release.

Full changelog: v0.4.0...v0.4.1