v0.3.4

v0.3.4 — 2026-07-03

Fixed

• CI: web_fetch_structured_warnings_present test no longer hits external endpoint — uses httpmock instead of httpbin.org
• CI: cargo fmt applied to all test files
• API-only live mode now requires configured providers
• Fetch-layer warnings no longer misclassify as provider failure
• Dispatch executor preserves scheduling priority order
• Deterministic identity uses FNV-1a 64-bit instead of DefaultHasher
• Documentation examples validated against real MCP schemas
• Critical: inverted >= in security applicability range evaluation
• Security applicability now preserves Unknown vs NotAffected
• web_fetch now validates timeout_ms > 0
• security_search provider routing fix

Added

• Deterministic cross-tool identity model with FNV-1a 64-bit hashes
• Code-aware fetch and repo evidence enhancements (phase 6)
• Gitea/Forgejo configured-host wiring audit (16 new tests)
• OSV/RustSec affected/fixed range fixtures (7 new tests)
• Dependency parser malformed-input audit (9 new tests)
• assess_version_applicability regression suite (19 tests)
• Neutral fallback warning codes
• Refactored MCP argument parsing helpers

Changed

• Package resolution now documents all 10 supported ecosystems
• MCP server instructions updated for workspace host mode
• repo_fetch documentation updated for workspace host mode

See CHANGELOG.md for full details.