v0.5.0

v0.5.0 — security hardening, perf/ops, and seven opt-in triage capabilities

Default JSON output is unchanged; every new field/behavior is opt-in.

Security

• Bounded, redirect-free upstream reads (MSRC/EPSS/KEV) so a misbehaving upstream can't exhaust container memory
• X-Forwarded-For honored only from private/loopback peers without a proxy allowlist (no forged-header rate-limit bypass on directly-exposed deployments)
• msrc_search never leaks raw exceptions — structured error_kind="internal"; KB/chain scans report upstream failures instead of false "not found"

New opt-in msrc_search parameters

include_references, exploitation_likely, ransomware, include_kev_details, include_kb_details (incl. restart-required), cwe, include_temporal, list_months

Quality / performance / ops

LRU + right-sized caches (12-month), concurrent EPSS batches, uvicorn concurrency/keep-alive limits, MCP_LOG_LEVEL, lifespan client cleanup, and telemetry for 429/413/cache-hit/enrichment paths

Supply chain

CI (pytest 3.11/3.12 + ruff + 90% coverage gate + Trivy scan + SBOM), CodeQL, Dependabot, SHA-pinned Actions, committed uv.lock, multi-stage digest-pinned non-root Dockerfile with HEALTHCHECK, build-provenance attestation, and SECURITY.md

Full details in #3.