v2.5.0

Changelog

• 42a3a21 Add MCP launcher config contract (#561)
• 629a051 Add cluster MCP proxy contract to sidecar init (#559)
• b7f5856 Add pipelock-verifier: standalone Audit Packet + receipt validator (#500)
• cbca120 Add route-scoped non-JSON redaction exceptions (#506)
• 19e0a93 Add signed MCP integrity manifest trust (#560)
• 99693ac Harden redaction and transport coverage for 2.5 (#568)
• 9ced70b Tune adaptive burst scoring and Browser Shield defaults (#550)
• 7db413b chore(deps): bump idna in /.github in the pip group across 1 directory (#565)
• 7682367 chore(deps): migrate from dependabot to renovate with cooldown (#543)
• ebdd08f chore(verifiers): add prettier to TS verifier + pre-commit hooks for rust/ts (#517)
• e7a5a4a ci: Update ci-actions (#555)
• 037f324 ci: add verifier workflow for TypeScript and Rust SDKs (#511)
• 3762663 ci: bump the ci-actions group with 4 updates (#504)
• 7537dea deps: Pin ghcr.io/luckypipewrench/pipelock Docker tag to 3dcd7e8 (#544)
• 3840794 deps: Update Rust crate thiserror to v2 (#556)
• 7217252 deps: Update docker-base-images (#547)
• e2096f0 deps: Update gcr.io/oss-fuzz-base/base-builder-go Docker digest to 3efcff1 (#563)
• 1c6caa0 deps: Update gcr.io/oss-fuzz-base/base-builder-go Docker digest to 803021b (#553)
• e23dcf6 deps: Update ts-verifier (#554)
• fa9c4cd deps: bump cryptography (#502)
• bd79004 deps: bump the go-deps group with 6 updates (#503)
• f81afff deps: bump the pr-review-deps group across 1 directory with 2 updates (#509)
• 5285686 deps: bump urllib3 from 2.6.3 to 2.7.0 in /.github (#507)
• 4cf74d2 docs(security): add policy and threat-model documents (#515)
• f184d87 emit: optional OTel agent.threat.detection.* attributes on scanner-decision OTLP records (#518)
• 5912e80 feat(cli): add pipelock cline install subcommand for MCP wrapping (#519)
• 5e15aff feat(cli): add pipelock opencode install subcommand for MCP wrapping (#523)
• 1a7ae79 feat(cli): add pipelock zed install (#531)
• 17df0e9 feat(cli/contain): add read-only verify subcommand and cobra skeleton (#512)
• 10ba1dc feat(cli/setup): add codex install command for Codex CLI MCP servers (#499)
• eed8329 feat(contain): add enforcement doctor and workspace ACL lifecycle (#549)
• 8b12b57 feat(contain): add snapshot restore CA regeneration (#538)
• 3040a80 feat(contain): implement containment install lifecycle (#527)
• 7b535ad feat(contract): enforce tombstones at activation and accepted-load time (#521)
• 08aef2c feat(diag): add enforcement smoke checks to verify-install (#562)
• c3e01b1 feat(envelope): require SPIFFE actors on inbound + add envelope trust CLI (#522)
• 60d8fae feat(mcp): add integrity manifest tooling (#557)
• 382a1c7 feat(mcp): attribute Layer/Pattern/Severity on block receipts (#536)
• 69d843e feat(proxy): productionize Browser Shield evidence and transport parity (#533)
• d58d168 feat(sandbox): bridge MCP sandbox egress through scanner (#535)
• 9b95692 feat(scanner): close three skill-poisoning vector gaps in response patterns (#514)
• 0f24f72 feat(sdk): add Rust audit packet verifier (#508)
• bdedb6b feat(sdk): add TypeScript audit packet verifier (#505)
• 36f9585 feat(sdk): publish Audit Packet v0 schema with Go bindings (#498)
• bfa4f44 feat: agent egress overhead benchmark with Go runtime metrics (#528)
• 66a0a5e fix(audit): apply DLP validators in project scan (#510)
• 3710f15 fix(audit): drop misleading T1046 tag on DNS-resolver-failure blocks (#539)
• 925b739 fix(claude-hook): fail-closed on unsupported hook events (#524)
• 419f397 fix(contain): make install idempotent across .bak rotations and fix version banner double-v (#541)
• d0583b0 fix(proxy): drive SSE streaming activation from response Content-Type (#530)
• c93a322 fix(rules): separate bundle keyring from license key (#526)
• ebfc2ef refactor(proxy): drop blockreason severity/retry delegate wrappers (#537)
• d140751 scanner: add SigV4 presigned URL structural carve-out to URL DLP (#516)
• fa16985 scanner: harden response disclosure and split-payload detection (#540)