0.5.0

What's Changed

• test(audit): pin the empty-set guards at the note call sites by @plusky in #95
• test(server): capture logs through one process-wide subscriber by @plusky in #96
• build(deps): bump the cargo-minor-patch group with 3 updates by @dependabot[bot] in #98
• build(deps): bump the actions-minor-patch group with 2 updates by @dependabot[bot] in #99
• build(deps): bump Swatinem/rust-cache from a45951ff880207c249adf57334cf2e9bd81d6e1e to 258712b0b7b1ddf8bddc9fc3b0faca682b2736c3 by @dependabot[bot] in #100
• docs: refresh the rmcp reference-tree version to 3.1.2 by @plusky in #101
• build(deps): bump h2 to 0.4.16 for RUSTSEC-2026-0258 by @plusky in #103
• feat(server): let the environment set allowed hosts and the auth header by @plusky in #104
• feat(server): require a bearer token on the http transport by @plusky in #105
• feat: ship a container image on ghcr.io by @plusky in #106
• build(deps): bump rust from 1.97.0-alpine to 1.97.1-alpine by @dependabot[bot] in #107
• build: bump the pinned toolchain to 1.97.1 by @plusky in #109
• docs: correct the invariant range and stale counts in AGENTS.md by @plusky in #110
• ci: pin Swatinem/rust-cache to the v2.9.2 release commit by @plusky in #111
• test(core): select the create_bug request by method and path by @plusky in #112
• test(audit): pin note_redacted and record identity on real calls by @plusky in #113
• fix(server): normalize tool schemas for gemini/vertex clients by @mimi1vx in #119
• fix(server): handle SIGTERM so docker stop is graceful by @plusky in #122
• test(server): make an empty log capture unrepresentable by @plusky in #123
• test: stop aiming I12 transport tests at recycled ports by @plusky in #124
• fix(server): recurse portable_schema into all draft-2020-12 positions by @plusky in #126
• fix(server): refuse unparsable allowed-hosts at startup by @plusky in #125
• feat: export audit records and diagnostics to an OTLP collector by @plusky in #121
• docs: record the I12 refuse address as 127.0.0.1:1 by @plusky in #128
• chore: release 0.5.0 by @plusky in #129

Full Changelog: 0.4.0...0.5.0

0.4.0

What's Changed

• feat: generate man page and shell completions from the CLI by @plusky in #49
• build(deps): bump the actions-minor-patch group with 2 updates by @dependabot[bot] in #47
• build(deps): bump the cargo-minor-patch group across 1 directory with 3 updates by @dependabot[bot] in #50
• refactor(audit): hex-encode the policy digest without LowerHex by @plusky in #51
• build(deps): bump sha2 from 0.10.9 to 0.11.0 by @dependabot[bot] in #46
• feat(server): move to rmcp 3.1 and pin what the transport may serve by @plusky in #54
• fix(server): introduce this build by name in the handshake by @plusky in #56
• build: inherit the workspace version in bugwarden-core by @plusky in #57
• feat: identify this build to Bugzilla with a User-Agent by @plusky in #58
• docs(readme): use an absolute URL for the logo by @plusky in #62
• docs(design): record the stateless-metadata decision for #34 by @plusky in #63
• build(deps): refresh the lockfile and move the Bugzilla client to reqwest 0.13 by @mimi1vx in #64
• docs: document the audit stream, generated assets and TLS trade-off by @mimi1vx in #66
• fix(policy): stop shipping the whoami-dependent example rule by @mimi1vx in #70
• feat(server): fail startup when identity cannot be resolved by @mimi1vx in #72
• feat(core): portable identity via a declared, verified login by @mimi1vx in #73
• feat(server): add product and field discovery tools by @mimi1vx in #74
• fix(server): derive the http body cap from the attachment ceiling by @plusky in #75
• feat(server): accept custom fields when filing a bug by @mimi1vx in #76
• fix(server): stop imposing one instance's status workflow by @mimi1vx in #77
• build(deps): bump the actions-minor-patch group with 3 updates by @dependabot[bot] in #79
• fix(core): stop reading a capped search page as the end of results by @mimi1vx in #78
• feat(server): add --allowed-hosts for inbound host by @grisu48 in #81
• ci: exempt the rust-cache action from the copyleft deny-list by @plusky in #82
• build(deps): bump Swatinem/rust-cache from e18b497796c12c097a38f9edb9d0641fb99eee32 to a45951ff880207c249adf57334cf2e9bd81d6e1e by @dependabot[bot] in #80
• docs: record what guard.rule names and when it is absent by @plusky in #83
• fix(audit): stop under-reporting suppressed_count as a maximum by @plusky in #86
• test(audit): pin the suppressed_count zero guard and list_attachments by @plusky in #89
• fix(policy): reserve the rule names the guard decides under by @plusky in #90
• chore: release 0.4.0 by @plusky in #91

New Contributors

• @mimi1vx made their first contribution in #64
• @grisu48 made their first contribution in #81

Full Changelog: 0.3.0...0.4.0

0.3.0

What's Changed

• fix(policy): scope rules by operation so create cannot shadow reads by @plusky in #35
• docs(readme): replace packaging roadmap with install instructions by @plusky in #36
• feat(policy): add created_by_me identity-relative matcher by @plusky in #37
• feat(server): server-held Bugzilla API key via --api-key-file by @plusky in #39
• feat(server): widen update_bug_fields per the update-field audit by @plusky in #40
• feat(audit): populate trace context from params._meta traceparent by @plusky in #41
• feat(audit): account for rows dropped by the search window scan by @plusky in #42
• chore: bump version to 0.3.0 by @plusky in #43

Full Changelog: 0.2.0...0.3.0

0.2.0

What's Changed

• ci: publish to crates.io from the release workflow by @plusky in #15
• fix(core): classify one id per request, whatever the answer by @plusky in #16
• fix(server): serve bug_info bodies on their own verdict by @plusky in #17
• fix: paginate bugs_quicksearch over the bugs a client may see by @plusky in #18
• fix: scrub denied bug ids from bodies, history and comments by @plusky in #19
• feat(server): add create_bug and add_attachment by @plusky in #20
• fix(server): steer exact id sets to bug_info by @plusky in #21
• chore: bump version to 0.2.0 by @plusky in #22
• feat(policy): deny security groups by name in the example policy by @plusky in #23
• feat(server): add audit event schema and JSONL sink by @plusky in #24
• feat(server): wire the audit stream into every MCP request by @plusky in #25

Full Changelog: 0.1.0...0.2.0

0.1.0

What's Changed

• Fix remaining typos in docs and example policy by @plusky in #2
• Self-contained docs, release workflow, macOS coverage by @plusky in #3
• Add project logo by @plusky in #4
• Add Dependabot version updates by @plusky in #5
• Bump actions/download-artifact from 7.0.0 to 8.0.1 by @dependabot[bot] in #6
• Bump toml from 0.8.23 to 1.1.3+spec-1.1.0 by @dependabot[bot] in #7
• Fetch server-info endpoints sequentially with per-endpoint degradation by @plusky in #8
• docs: document commit and pull request conventions by @plusky in #9
• feat(server): annotate every MCP tool with behavior hints by @plusky in #10
• feat(server): add guarded attachment download by @plusky in #11
• docs: add social preview header to assets by @plusky in #12
• feat(policy): match undisclosed issues by title marker and restriction by @plusky in #13
• build: add crates.io package metadata by @plusky in #14

New Contributors

• @dependabot[bot] made their first contribution in #6

Full Changelog: https://github.com/plusky/bugwarden/commits/0.1.0