PocMap v2.9.1

Security

• HTTP and SSE MCP transports now require bearer authentication for non-loopback
  binds and enforce rate limits for the configured operator principal.
• Credential-bearing HTTP requests bypass the persistent cache, cross-origin
  redirects strip authentication material, and old header-blind cache entries are
  unreachable under the versioned key format.
• HTTP responses are streamed through compressed and decompressed byte limits before
  parsing or caching, preventing unbounded response materialization.
• PoC source downloads use process and OS-backed locking, collision-proof cache names,
  identity-checked completion markers, unique staging directories, crash-recoverable
  atomic publication, and atomic enforcement of the total source storage cap.
• Recent-CVE discovery now bounds explicit date spans, NVD pages, candidate counts,
  and GitHub enrichment work, retains the globally newest bounded candidate set,
  and reports truncated results as incomplete.

Fixed

• Rich formatter tests now use deterministic console dimensions across Windows and
  Linux runners, preserving the visible Unknown PoC state regression check.