Version is now derived from the git tag (uv-dynamic-versioning); a failed
VCS detection yields an unpublishable 0.0.0+unknown. Includes the mcp
1.28.1 CVE bump and the README link fixes that v0.5.2 never shipped.