Changelog - v4.0.1

All notable changes to the law-scrapper-mcp project for version v4.0.1 will be documented in this file.

The format is based on Keep a Changelog 1.1.0,
and this project adheres to Semantic Versioning 2.0.0.

[4.0.1] - 2026-08-31

Cleanup release — hardening and test coverage from Klaster 7 review findings, no behavior change for existing correct configurations.

trusted_proxies CIDR validation moved to startup — Invalid LAW_MCP_TRUSTED_PROXIES entries now fail fast at configuration time instead of on the first proxied request.
Binary auth token files no longer crash with UnicodeDecodeError — LAW_MCP_AUTH_TOKEN_FILE pointing at a non-text file now produces a clean, Polish-language configuration error.
OAuth JWKS discovery rejects non-https:// URIs — A discovered JWKS URI that isn't https:// is refused instead of being fetched, closing a downgrade path.
LAW_MCP_AUTH_ISSUER/LAW_MCP_AUTH_JWKS_URI now must be https:// — The discovery-time check above only covered a JWKS URI discovered from the issuer; a directly configured auth_jwks_uri skipped discovery entirely, and the discovery request itself could still go out over plain HTTP. Both are now rejected at startup.
JWKS/IdP communication failures now log at WARNING instead of INFO — Includes a fix for an except-clause ordering bug that had silently suppressed the intended WARNING level for these failures.

Test coverage strengthened — Added a 31-byte token boundary test, a rate-limit-zero rejection test, a compare_digest timing-safety spy, and fixed caplog scoping so auth-related log assertions can't leak between tests. Also restores the wildcard-bind regression guard (test_config_contains_no_wildcard_bind) dropped when config.py's security-boundary logic moved out, now scanning all three modules.
httpx2 declared as an explicit dev dependency — It was previously an undeclared transitive dependency; its test client is now properly closed after use.
bearer_app test fixture no longer mutates global module state — Removed a use of importlib.reload that could leak state between tests.
Security-boundary validation extracted from config.py — Moved into a dedicated config_validation.py module, alongside a genuinely dependency-free config_primitives.py for shared leaf helpers. No behavior change; internal organization only.