v2.8.0

What's Changed

• docs: remove em dashes from README and PRIVACY (#32) by @cdeust in #34
• supply-chain: build the release workflow + attestation, SBOM, UI fingerprint (#37) by @cdeust in #38
• fix(scorecard): in-repo canonical workflow (startup_failure on main) by @cdeust in #39
• test(ui): add JS test harness (vitest + jsdom) as a required CI job (#35) by @cdeust in #40
• feat(coverage): surface what each graph view is missing (MissedCallout parity) (#36) by @cdeust in #42
• refactor: split workflow_graph.js below the 500-line cap (#41) by @cdeust in #43
• docs: OpenSSF Best Practices questionnaire answers — passing + silver (.bestpractices.json) by @cdeust in #51
• fix(trace): pin the post-rename Cortex tool prefix in the memory-op classifier by @cdeust in #61
• test(mcp): gate every plugin-scoped MCP tool prefix against an allowlist by @cdeust in #62
• fix(deps): clear all 19 npm audit advisories in the dev toolchain by @cdeust in #63
• fix(deps): sync package-lock with package.json — restore npm ci on main by @cdeust in #64
• chore(ci): bump ossf/scorecard-action from 2.4.1 to 2.4.4 by @dependabot[bot] in #52
• chore(ci): bump actions/checkout from 4.4.0 to 7.0.1 by @dependabot[bot] in #53
• fix(security): stop the static readers following a symlink out of the sandbox by @cdeust in #67
• Revert "fix(security): ... (#67)" — the squash mixed three unrelated changes by @cdeust in #70
• fix(scope): keep the snapshot scope stable when the dev montage is mounted by @cdeust in #68
• fix(security): stop the static readers following a symlink out of the sandbox by @cdeust in #71
• perf(brain): draw the synapse web with GPU-instanced curves by @cdeust in #72
• fix(security): dedup search-index words through a Set, not an object map by @cdeust in #73
• fix(security): contain every request-derived path to one guard (#46) by @cdeust in #75
• fix(security): close the 7 open CodeQL alerts — attribute-breakout escaping + uninitialized delta baselines by @cdeust in #76
• ci: move the JS job off end-of-life Node 20, and group peer-locked dev deps by @cdeust in #77
• fix(http): frame the bodiless error responses so a rejected request fails fast by @cdeust in #78
• chore(deps-dev): bump jsdom from 28.1.0 to 30.0.0 by @dependabot[bot] in #57
• ci: group the three codeql-action paths so a bump cannot straddle two majors by @cdeust in #81
• chore(ci): bump the codeql-action group with 3 updates by @dependabot[bot] in #82
• chore(ci): bump actions/setup-node from 4.4.0 to 7.0.0 by @dependabot[bot] in #83
• chore(ci): bump actions/setup-python from 5.6.0 to 7.0.0 by @dependabot[bot] in #54
• chore(ci): bump actions/attest-build-provenance from 2.4.0 to 4.1.1 by @dependabot[bot] in #55
• chore(ci): bump softprops/action-gh-release from 2.6.2 to 3.0.2 by @dependabot[bot] in #80
• fix(ui): implement the renderings CodeQL found computed and discarded by @cdeust in #84
• fix(security): triage the CodeQL backlog — every high/error/medium/warning alert, and the empty-except tail (#46) by @cdeust in #86
• sec: close the 13 Pillow advisories, and stop ci.yml running on an inherited write token by @cdeust in #87
• fix: close the 31 remaining CodeQL + Scorecard alerts at their root by @cdeust in #89
• fix(http): answer "not ready" and "not installed" without claiming failure by @cdeust in #91
• ci: make ruff and eslint required gates by @cdeust in #92
• test(extras): put a signal behind every optional-extra path (#88) by @cdeust in #93
• feat: add host-neutral live activity events by @cdeust in #94
• docs: present cortex-viz as a cross-platform MCP by @cdeust in #95
• docs: adopt fork-based OpenSSF continuity by @cdeust in #96
• Publish Cortex Viz as hypermnesia-mcp-viz by @cdeust in #102
• Match PyPI release workflow filename casing by @cdeust in #103
• Match pending PyPI Release.yaml identity by @cdeust in #104

New Contributors

• @dependabot[bot] made their first contribution in #52

Full Changelog: v2.7.1...v2.8.0