Release v2.5.0 · codingprotocols/podscape

What's Changed

Background scan: Full and custom scans can now run in the background — start a scan, continue using other panels, and receive a system notification when it completes. A floating pill in the bottom-right corner lets you jump back to Security Hub at any time.
Config Issues vs Image CVEs: Results are now split into two visually distinct panels — a red-tinted "Configuration Issues" card and an orange-tinted "Image Vulnerabilities" card — making it faster to triage each concern type separately.
Richer CVE details: Each image vulnerability now shows the affected image name, package name, and available fix version alongside the CVE ID and severity.
Colored kind badges: Resource kind (Deployment, StatefulSet, Pod, DaemonSet, etc.) is displayed as a colored pill in every result row so you can identify the resource type at a glance.
Pod deduplication: Pods are excluded from scans by default. Because a pod's security posture mirrors its parent controller (Deployment, StatefulSet, etc.), scanning both produces duplicate findings. Pods can be re-included via the Custom Scan kind filter.
System node filter: Nodes and system-namespace workloads (kube-system, kube-node-lease, cert-manager) are hidden by default from scan results. Toggle "Show System" to reveal them.

CommandPalette performance: The palette subscribes to the store with useShallow and skips the 27-array resource build while closed, eliminating re-renders during normal app use.
UnifiedLogs throughput: Log chunk callbacks now flush to React state at most every 100 ms via a ref-buffer throttle, reducing render pressure from 50–100 updates/s to ≤10/s on high-verbosity services.

macOS app menu: The macOS menu bar now correctly shows "Podscape" instead of "podscape-electron".
Trivy scan JSON: Trivy outputs pretty-printed multi-line JSON. Newlines in SSE data were truncating the response to a single {. The sidecar now compacts Trivy output with json.Compact before streaming.
Cost API HTML response: When a port-forward proxy returns 200 OK with an HTML error page, probe() now rejects it via Content-Type check. QueryAllocation also validates before parsing and returns a clear, actionable error message.
Tour overlay: The X dismiss button now carries aria-label="Skip tour" consistent with the visible "Skip" button.
Dashboard warning count: Extracted into a dedicated useMemo([events]) — no longer recomputed on pod or node list changes.

Full Changelog: v2.4.1...v2.5.0