v1.5.3

What's Changed

• fix: pre-load the case in every agent session's MCP server by @calebevans in #231
• fix: scan every source when search(regex=True) is given no source by @calebevans in #235
• fix: scope get_raw_output and search to one image via evidence_path by @calebevans in #233
• docs: v1.5.2 NDLC results for four models, with full run outputs by @calebevans in #236
• chore(deps): bump astral-sh/setup-uv from 10.1.0 to 10.2.0 by @dependabot[bot] in #254
• chore(deps): bump the production group across 1 directory with 5 updates by @dependabot[bot] in #255
• fix: accept hive names case-insensitively in query_registry_value by @calebevans in #243
• fix: never store, and always survive, a finding with empty evidence_refs by @calebevans in #240
• fix: fetch ntfs-3g source from GitHub so the container builds in CI by @calebevans in #259
• chore(deps): bump pyjwt from 2.13.0 to 2.15.0 by @dependabot[bot] in #256
• chore(deps): bump virtualenv from 21.7.5 to 21.7.13 by @dependabot[bot] in #257
• chore(deps): bump urllib3 from 2.7.0 to 2.8.0 by @dependabot[bot] in #258
• fix(findings): write a finding's audit entry before its database row by @elhoim in #252
• fix(audit): start a fresh line after a torn audit entry by @elhoim in #248
• [low] docs: add a security policy by @elhoim in #260
• chore(deps): bump the production group with 4 updates by @dependabot[bot] in #261
• fix: decode nested payload layers without going through the tool wrapper by @ParkJeongKyun in #263
• fix: score suspicious processes from suspicion_reasons by @ParkJeongKyun in #265
• fix: re-prompt once for incomplete catalog image coverage by @calebevans in #238
• fix: accept a list of sources in search instead of raising TypeError by @calebevans in #244
• chore: prepare release 1.5.3 by @calebevans in #266

New Contributors

• @ParkJeongKyun made their first contribution in #263

Full Changelog: v1.5.2...v1.5.3