NBER CLI v0.5.0 Release Notes

What's New

RSS parsing is now protected against XXE attacks. The feed parser uses defusedxml instead of the standard library XML parser, blocking external entities and entity expansion.
Downloads stay inside your working directory by default. Run nber-cli download --restrict false to opt out per invocation. The download.restrict_dir config key is stored and validated, but the current CLI default remains true.
Database paths are constrained to your home directory on Unix. db init and db migrate reject paths outside $HOME on macOS and Linux.
TLS 1.2 is now the minimum version for synchronous HTTP requests.
Selected info/download failure paths expose less raw exception detail. Download log messages and soft database warnings use sanitized summaries or exception class names.

New nber-cli config subcommand: show, get <key>, set <key> <value>, and verify make it easy to inspect and edit ~/.nber-cli/config.json without touching the file directly.
JSON Schema validation is shipped in the package as config.schema.json; config verify validates your file against it.
Strict raw-config validation reports malformed JSON, invalid section/value types, and values below schema minima without hiding them behind injected defaults.
New public Python API exports for config management: read_config, write_config, get_config_value, set_config_value, and validate_config.

Concurrent downloads are capped. The new download.concurrency setting defaults to 3; use --concurrency / -c to override on the fly.
Invalid concurrency values fail safely. Per-call invalid values are rejected, while invalid persisted values fall back to the documented default.
Malformed RSS items are skipped instead of aborting the whole feed fetch.
Feed persistence is ordered and transactional. The database schema is established before the network request, and feed items plus fetch history are committed together.
Cache cleanup is transactional with schema validation. Feed and info cache cleanup pair schema validation/upgrade and deletion in one SQLite transaction.
More tolerant RSS parsing handles unescaped < characters in titles and abstracts, plus the ⓡ author separator used in some NBER feed titles.
Better retries use exponential backoff with a 30-second ceiling.

Fetched metadata is validated for a non-empty title, positive citation ID, and agreement between requested and returned paper IDs.
Future database schemas are protected. Schema-changing and writing operations reject a database newer than the installed package without downgrading it.

SSE transport. nber-cli mcp-server --transport sse starts the new SSE transport.
Custom ports require confirmation. nber-cli mcp-server --transport streamable-http --port 8080 --yes starts the HTTP transport on the requested port; omitting --yes on a non-default port exits with a clear error.

Plugin metadata is synchronized. Claude and Codex plugin manifests plus the Claude marketplace metadata share the package version.
Claude skill path is case-correct. The plugin points to the tracked ./skills/NBER-CLI directory, which matters on case-sensitive filesystems.

uv tool install nber-cli==0.5.0
# or
pip install nber-cli==0.5.0
# or
uvx nber-cli==0.5.0

Full Changelog: v0.4.0...v0.5.0
Download: v0.5.0 Release