vulnscan-ai 0.4.1

Stability release

Hardening of what the tool already does — no new surface. Focus: the code paths that change your system must be trustworthy, and nothing should ever dump a traceback.

• Rollback no longer lies. rollback (and the automatic rollback) now report the true outcome; a missing/partial restore surfaces as ROLLBACK INCOMPLETE instead of a false "reverted", and the audit log records it truthfully.
• No more false-success fixes. A fix command that needs a shell (redirect/pipe/&&/$( )) — which the no-shell runner can't execute as written — is now blocked with a pointer to --export-script, instead of running echo … > file as a silent no-op and reporting "applied".
• Parser robustness. The scanner/feed parsers skip malformed external data (a null item or wrong-typed field in CISA KEV / Rocky Apollo JSON or a container inspect object) instead of crashing news/container scans.
• Never-crash CLI. An unexpected error prints a readable message and exits non-zero instead of a traceback (VULNSCANAI_DEBUG=1 re-raises); a corrupt config or findings.json degrades with a warning.
• Tests: +22 unit tests (a fuzz battery for every parser, engine rollback/shell cases, never-crash paths) plus an opt-in integration suite that runs the real ss/systemd-analyze/oscap and the scanners against a live host (VULNSCANAI_INTEGRATION=1).

Install / upgrade

sudo dnf upgrade --refresh vulnscan-ai