v1.5.1

What's Changed

• chore: reduce container image size while preserving forensic tools by @calebevans in #136
• chore(deps): bump astral-sh/setup-uv from 10.0.1 to 10.1.0 by @dependabot[bot] in #137
• chore(deps): bump the production group with 3 updates by @dependabot[bot] in #138
• [high] fix(case): validate case_id before it becomes a filesystem path by @elhoim in #83
• [low] fix(binary): use the shared IP and path patterns, not local copies by @elhoim in #89
• [high] fix(chainsaw): report a failed Chainsaw run instead of a clean scan by @elhoim in #95
• [high] fix(binary): never triage a binary as benign when rabin2 failed by @elhoim in #100
• [high] fix(case): enforce extract_archive's documented destination contract by @elhoim in #103
• [high] fix(email): give an HTML-only message a searchable body by @elhoim in #106
• [high] fix(email): search the Cc line and attachment names a PST search already parsed by @elhoim in #109
• [high] fix(radare2): run r2 command batches under radare2's sandbox by @elhoim in #110
• [high] fix(zircolite): index the detections, not just how many there were by @elhoim in #112
• [high] fix(chainsaw): pass the --mapping that hunt mode's --sigma requires by @elhoim in #113
• [high] fix(email): detect an attachment by its filename, not its disposition by @elhoim in #114
• [medium] fix(email): parse recipients with RFC 5322 quoting, not a comma split by @elhoim in #115
• [high] fix(binary): request JSON from capa and FLOSS with the flag they define by @elhoim in #116
• [high] fix(pdf): implement the advertised extract_urls and extract_embedded by @elhoim in #118
• [high] fix(phone): index the LEAPP artifacts, not just how many there were by @elhoim in #120
• [high] fix(tsk): stop every fls-driven extractor skipping deleted files by @elhoim in #121
• [high] fix(binary): read the keys capa and FLOSS actually emit by @elhoim in #125
• [high] fix(mvt): index every detection MVT counted, not just the first 100 by @elhoim in #126
• [high] fix(chainsaw): index the detections, not just how many there were by @elhoim in #127
• [high] fix(report): escape finding titles and restore the executive summary's markup by @elhoim in #128
• [high] fix(binary): index the triage analysis, not only the raw rabin2 dump by @elhoim in #129
• fix(tests): provide chainsaw mapping in hunt-mode test helpers by @calebevans in #140
• [high] fix(case): stop reporting a half-finished extraction as complete by @elhoim in #117
• [high] fix(email): decode RFC 2047 headers before searching or reporting them by @elhoim in #122
• [high] fix(chainsaw): make the SRUM invocation match the CLI analyse srum declares by @elhoim in #123
• [high] fix(case): actually decompress a gzipped disk image by @elhoim in #124
• fix: preserve Ollama streaming tool calls by @calebevans in #143
• fix: validate planner task objects before execution by @calebevans in #144
• Add --no-thinking for phase and utility queries by @calebevans in #145
• Add optional agent CLI stderr diagnostics by @calebevans in #146
• chore: prepare v1.5.1 release by @calebevans in #147

Full Changelog: v1.5.0...v1.5.1