v0.37.0

Changelog

Features

• f3241f1: feat(config): honor the shared config base via spawn/truffle bump (#18) (@scttfrdmn)

Bug fixes

• 6d52001: fix(mcp): bump spawn/truffle pins + test lifecycle handlers + pin CI actions (#13) (#17) (@scttfrdmn)
• e424225: fix(spawn_extend): floor TTL deadline at now+duration (spore-host#374) (#16) (@scttfrdmn)
• f06e480: fix: address #13 medium/low audit items (@scttfrdmn)
• 2243f42: fix: spawn_extend writes spawn:ttl-deadline, not just spawn:ttl (#11) (#14) (@scttfrdmn)
• 6d991b7: fix: spawn_list state=all + guard destructive spawn_terminate (#12) (@scttfrdmn)

Others

• a0a41e0: chore(release): spore-host-mcp v0.37.0 (@scttfrdmn)
• 5837a24: ci(security): add Security workflow (govulncheck, gitleaks, Trivy, Semgrep) (#10) (@scttfrdmn)
• 54533b6: ci(security): make Semgrep enforcing (--error) (#368) (#15) (@scttfrdmn)
• e0c9e74: ci: force Node 24 for bundled actions (#345) (#7) (@scttfrdmn)
• a475c0e: ci: run tests on self-hosted orion runner (#5) (@scttfrdmn)
• 938f41b: security: sign release artifacts with keyless cosign + SLSA (#19) (#20) (@scttfrdmn)