2.0.0

What's Changed

• chore(deps): bump @modelcontextprotocol/sdk from 1.24.2 to 1.25.2 by @dependabot[bot] in #69
• chore(deps): bump hono from 4.11.3 to 4.11.4 by @dependabot[bot] in #70
• chore(deps): bump diff from 4.0.2 to 4.0.4 by @dependabot[bot] in #71
• chore(deps-dev): bump lodash from 4.17.21 to 4.17.23 by @dependabot[bot] in #72
• chore(deps): bump hono from 4.11.4 to 4.11.7 by @dependabot[bot] in #73
• Pr 91 by @davidecarpini in #94
• feat(http): replace HTTP transport with stdio-spawning wrapper by @Vombato in #95
• chore(deps): bump hono from 4.11.7 to 4.12.14 by @dependabot[bot] in #93
• chore(deps-dev): bump follow-redirects from 1.15.11 to 1.16.0 by @dependabot[bot] in #92
• chore(deps): bump axios from 1.13.2 to 1.15.0 by @dependabot[bot] in #90
• chore(deps): bump @hono/node-server from 1.19.7 to 1.19.13 by @dependabot[bot] in #87
• chore(deps): bump lodash from 4.17.21 to 4.18.1 by @dependabot[bot] in #89
• chore(deps-dev): bump axios from 1.13.2 to 1.16.0 by @dependabot[bot] in #96
• chore(deps): bump picomatch by @dependabot[bot] in #83
• chore(deps-dev): bump handlebars from 4.7.8 to 4.7.9 by @dependabot[bot] in #84
• chore(deps): bump rollup from 4.53.2 to 4.59.0 by @dependabot[bot] in #78
• ci(security): pin actions to SHA + fix template injection (H1, H2) by @Vombato in #98
• chore(deps): bump brace-expansion by @dependabot[bot] in #86
• fix(ci): align validate container port with host mapping by @Vombato in #99
• chore(deps): bump path-to-regexp from 8.3.0 to 8.4.2 by @dependabot[bot] in #85
• chore(deps): bump ajv by @dependabot[bot] in #77
• chore(deps): bump @modelcontextprotocol/sdk from 1.25.2 to 1.29.0 by @dependabot[bot] in #74
• fix(dev): boot http server without prebuild, align test/port defaults by @davidecarpini in #101
• fix(ci): unblock validate scan — bump trivy-action, base image, sdk by @Vombato in #100
• chore(docker): pin runtime to non-root UID 65532 explicitly by @Vombato in #104
• chore(deps): bump hono from 4.12.14 to 4.12.18 by @dependabot[bot] in #105
• chore(deps): bump fast-uri from 3.1.0 to 3.1.2 by @dependabot[bot] in #107
• [Aikido] AI Fix for Prototype pollution vulnerability detected by @aikido-autofix[bot] in #103
• [Aikido] AI Fix for Express is not emitting security headers by @aikido-autofix[bot] in #102
• fix(b3tr-actions): pass after/before to indexer in seconds, not ms by @Vombato in #106
• feat(tools): add getVeBetterDaoApps and refactor VeBetterDAO services by @davidecarpini in #110
• fix(b3tr): validate appId + roundId/date at the MCP boundary by @Vombato in #109
• chore(ci): drop deploy-ecs job from publish workflow by @Vombato in #111
• feat: add get-vebetterdao-apps and generic contract registry tools by @davidecarpini in #113
• feat(ci+infra): tag-driven multi-env deploy pipeline + service stack by @Vombato in #114
• fix(security): patch 9 HIGH trivy CVEs + add image scan PR gate by @Vombato in #117
• feat(auth): require bearer API key on protected MCP routes by @Vombato in #116
• chore(release): migrate npm publish to Trusted Publishing by @Vombato in #115
• fix(ci): supply MCP API key to image-validate so /mcp probes auth by @Vombato in #118
• chore(release): 2.0.0 by @Vombato in #119

New Contributors

• @davidecarpini made their first contribution in #94
• @aikido-autofix[bot] made their first contribution in #103

Full Changelog: 1.0.0-beta.0...2.0.0