v2.26.0

Add an opt-in encrypted DNS view for CLI lookups and refresh DNS security,
failure diagnostics, and verification tooling.

Tool Surface Changes

Tool surface changes: no CLI command or flag changes.

Added

• Opt the recon CLI in to encrypted DNS with RECON_DNS_VIEW=caller-safe.
  Lookups then use the same view as the MCP server (saved RECON_DNS_*
  settings, else a recognized host public resolver, else Cloudflare
  DNS-over-HTTPS) and record resolution_vantage: caller-safe. The default is
  unchanged: without the exact opt-in value the CLI keeps the system resolver.
  With the opt-in set, invalid settings exit with code 2 before any collection
  (lookup, review, batch, discover, capsule capture and chain) and never fall
  back to the system resolver; total failure names a possibly blocked
  encrypted resolver. Links in these messages wrap only at word boundaries.

Security

• Require dnspython 2.9.0, which fixes CVE-2026-114605 (GHSA-45c3-73f7-pv4m):
  a crafted DNS message could make name decompression consume excessive CPU.
  recon parses DNS answers controlled by the owner of any queried domain, and
  MCP parses DNS-over-HTTPS responses by default since v2.25.0. Refresh the
  runtime dependency set, including a current Public Suffix List snapshot for
  apex reduction, certifi 2026.10.23 and cryptography 50.0.2.

Fixed

• When every source fails or times out under the caller-safe MCP DNS view,
  say that a network blocking outbound encrypted DNS is one possible cause and
  link the resolver override, instead of only "Try again". Since v2.25.0 a
  DoH-blocking network reached this generic failure rather than a setup
  message. The hint names no resolver and is absent for the operator and
  disabled views.

Tests

• Warm the synthetic MCP launch installation before its timed handshakes:
  precompile the copied package and import the server once, untimed. The MCP
  SDK bounds server/discover at a fixed 10 seconds, and the first launch of a
  fresh install on a loaded Windows runner had spent that budget on one-time
  bytecode compilation and first-run interpreter cost (issue 303).
• Refresh development and mutation tooling, including ruff 0.17.2 (no code
  changes needed), Hypothesis 6.170.9, coverage 7.17.0 and cosmic-ray 8.7.0,
  and regenerate the build constraints. Hypothesis's improved annotations
  repaired five legacy test typing diagnostics, so the exception inventory is
  narrowed: one stateful test drops its file-level control and another keeps
  only its private-contract exception.

Documentation

• Run the local draft-release verifier through the project environment in the
  release runbook; a bare system python3 can lack its dependencies.