v0.2.0 - Security & Stability Release

What's New in v0.2.0

Documentation

• Rewritten README — Quick start guide, badges, comprehensive feature list, and contributor guide
• New CONTRIBUTING.md — Development setup, coding standards, testing, and PR process
• Updated CHANGELOG — Full audit fixes documented under [Unreleased]
• Updated GitHub repo description and topics for discoverability

Security Fixes

• Path traversal protection on import endpoint (files restricted to data/ root)
• Filename sanitization for exports and reports
• KML/XML injection prevention via proper entity escaping
• Dependency bumps: fastapi → 0.115+ (fixes CVE-2024-47874)

Bug Fixes

• Fixed xgs serve command (was documented but non-functional)
• Fixed POST /api/export crash from name shadowing
• Fixed xgs export crash on entities with observations
• Fixed dashboard map not rendering towers (API response shape mismatch)
• Fixed datetime.utcnow() deprecation (Python 3.12+ compatibility)
• Fixed naive/aware datetime mismatch in stats endpoint
• Fixed latitude=0/longitude=0 being dropped (truthiness bug)
• Fixed plugin registry import path (plugins never loaded)
• Fixed PCAP parser: removed broken GSM import and fabricated evidence
• Fixed SDRStreamParser.parse_file() to return empty list instead of raising

Database Improvements

• SQLite WAL mode for concurrent writer support
• 30s connection timeout
• Foreign keys enabled via pragma
• Entity upsert uses flush + single commit (fixes race conditions)

Cleanup

• Removed unused dependencies: pandas, geopandas, shapely, pyyaml, ollama, requests
• Deleted dead code: services/geo.py
• Added AGENTS.md for AI assistant guidance
• Synced version to 0.2.0 across all files
• Added pytest to optional dev dependencies