v0.4.6

Supply-chain transparency

• SBOMs: iris-npm-sbom.spdx.json + iris-docker-sbom.spdx.json (attached below). Both are SPDX 2.3 JSON, cover direct + transitive dependencies.
• SBOM signatures: each SBOM has a companion .cosign.bundle (Sigstore bundle — signature + cert + Rekor entry) attached to this release. Verify with:

  cosign verify-blob \
    --bundle iris-npm-sbom.spdx.json.cosign.bundle \
    --certificate-identity-regexp='https://github.com/iris-eval/mcp-server' \
    --certificate-oidc-issuer='https://token.actions.githubusercontent.com' \
    iris-npm-sbom.spdx.json
  

• npm provenance: published with --provenance (verifiable via npm audit signatures or on the package page).
• Docker signature: image signed with cosign keyless (Sigstore). Verify with:

  cosign verify ghcr.io/iris-eval/mcp-server:v0.4.6 \
    --certificate-identity-regexp='https://github.com/iris-eval/mcp-server' \
    --certificate-oidc-issuer='https://token.actions.githubusercontent.com'
  

• Build attestation: both the npm SBOM and Docker image manifest carry GitHub-signed build-provenance attestations. Inspect with gh attestation verify or cosign verify-attestation.

What's Changed

• fix(utils): atomic writes raced on a shared temp path (Windows flake) by @irparent in #296
• fix(release): server.json advertised 0.4.5 but pointed installs at 0.4.4 by @irparent in #297
• fix(website): npm version badge cached the OLD version for 24h after release by @irparent in #298
• fix(tests): IRIS_HOME override — stop test runs mutating the user's real ~/.iris by @irparent in #321
• chore(lint): drop stale eslint-disable in tenant.ts by @irparent in #322
• fix(security): bind the dashboard to loopback + add DNS-rebinding guard by @irparent in #323
• fix(storage): evals silently dropped from every time window + rule store destroying user data by @irparent in #324
• ci: bump all four github/codeql-action steps to v4.37.6 together by @irparent in #326
• fix(ci): close four gaps where a gate covered less than it claimed by @irparent in #325
• fix(eval): custom rules discarded or evicted; safety violations undercounted by @irparent in #328
• fix(security): bound PII pattern quantifiers — ReDoS via attacker-controlled agent output by @irparent in #330
• fix(security): measure regex backtracking at deploy — safe-regex2 misses polynomial patterns by @irparent in #331
• fix(tests): confine in-process tests to a scratch IRIS_HOME by @irparent in #336
• release: v0.4.6 — dashboard exposure, two DoS vectors, three silent-wrong-number bugs by @irparent in #337

Full Changelog: v0.4.5...v0.4.6