v0.2.5

[0.2.5] - 2026-08-02

Fixed

• structlog carried no upper bound, and the index already serves a major past
  the floor. The declared range was structlog>=24.1.0; PyPI has been serving
  26.1.0. The artefact does not change — the resolver's answer to the next
  fresh install does, and that is exactly how swiss-energy-mcp 0.3.3 became
  uninstallable when mcp 2.0.0 removed the module it imported.

  Now structlog>=24.1.0,<27. The bound is measured rather than guessed: this package
  installs and imports against structlog 26.1.0 today, so the cap admits what
  demonstrably works and stops only the next, unknown major.

A dependency range only reaches users through a new release, hence the
version bump. No code changed.

v0.2.4

[v0.2.4] — 2026-07-30

Fixed

• The User-Agent reports the actual package version again. The published
  0.2.3 sent swiss-democracy-mcp/1.0.0 to every upstream — the version string was
  hardcoded and had been left behind by earlier bumps. The version now comes
  from the package metadata, so it can no longer drift from the package.

• Capped mcp at <2. mcp 2.0.0, published 2026-07-28, removed
  mcp.server.fastmcp — the module this server imports. With the previous
  unbounded >=1.28.1 every fresh resolve picked 2.0.0 and failed at import
  with ModuleNotFoundError, in CI and for anyone running pip install alike.
  Verified in both directions: 2.0.0 fails, <2 resolves to 1.29.0 and imports
  cleanly. Migrating to the 2.x API (mcp.server.mcpserver) stays a separate,
  deliberate piece of work.

Release v0.2.0

swiss-democracy-mcp v0.2.0

Erstes audit-verifiziertes Release. Geprüft mit mcp-audit-skill v1.0.0 —
production-ready (29 pass / 0 fail / 7 non-blocking partial, 0 Blocker).

Security & Hardening

• SSRF-Schutz: HTTPS-Enforcement + Egress-Allow-List (frozenset) vor jedem
  ausgehenden Request; caller-supplied URLs zusätzlich DNS-aufgelöst + IP-Blocklist
  (Cloud-Metadata/privat/loopback). (SEC-004 / SEC-005 / SEC-021)
• NeighborJack behoben: MCP_HOST bindet standardmässig an 127.0.0.1;
  0.0.0.0 nur explizit im Container, mit Warnung. (SEC-016)
• Secrets: SRGSSR-Credentials als SecretStr; .env.example, .gitignore,
  Gitleaks-Secret-Scan in CI. (ARCH-005 / SEC-013)
• Fehler-Handling: Ausführungsfehler als isError (ToolError); keine
  Stacktraces zum Modell. (OBS-001 / OBS-002)
• Gehärtetes Dockerfile (non-root), Lethal-Trifecta-Bewertung dokumentiert.
  (SEC-007 / SEC-019)

Architektur & Qualität

• Geteilter, gepoolter httpx.AsyncClient via Lifespan. (SDK-001)
• Zentrale Settings (pydantic-settings). (ARCH-004)
• Strukturiertes JSON-Logging auf stderr (structlog). (OBS-003)
• Context-Injektion mit Progress beim CSV-Load. (SDK-003)
• CORS für Streamable-HTTP (Mcp-Session-Id). (SDK-004)
• Quellen-/Lizenz-Provenance (CC BY 4.0) in allen Antworten. (CH-004)
• <use_case>-Tags, match_type, Literal-Typen, Dependabot, Roadmap-Doku.

Verbleibendes Backlog (nicht-blockierend)

SEC-005 (TLS-IP-Pinning), SEC-009 (Session-Binding), OBS-002 (SDK-Limit),
OPS-001 (Testabdeckung), SCALE-002 (LB), SDK-002 (typed returns),
ARCH-012 (protocolVersion-Pin) — Details im Audit-Report
audits/2026-06-02T035936-Z-swiss-democracy-mcp/.

Full Changelog: https://github.com/malkreide/swiss-democracy-mcp/blob/main/CHANGELOG.md

v0.1.0 – Initial Release

Add GitHub Actions workflow to publish to PyPI