chore: release 0.75.11 (#1127)

## Release 0.75.11

### What's new since 0.75.10

- **CWE-aware blast radius** — credentials/tools filtered by
vulnerability impact type (RCE shows full exposure, DoS does not)
- **CWE impact classification engine** — 80 CWE mappings across 8 impact
categories
- **Dependency confusion detection** — flags internal naming patterns
without public registry data
- **Reachability context in SARIF/VEX** — impact_category and
attack_vector_summary in output
- **VEX auto-triage** — availability/client-side vulns in transitive
deps auto-classified as NOT_AFFECTED
- **Proxy detector telemetry** — fire counts, suppression counts, FP
rate tracking, configurable sensitivity
- **CLI polish** — condensed discovery output, orange HIGH severity, CWE
impact in check command, unscored vulns shown
- **README overhaul** — removed redundancy, all 14 frameworks listed, 19
output formats, GPU/K8s/SBOM coverage
- **Supply chain hardening** — hash-pinned pip in all Dockerfiles,
immutable tag protection enabled
- **Dynamic framework count** — COMPLIANCE_FRAMEWORK_COUNT derived from
code, not hardcoded

### Stats

- 88 new tests (6,945 → 7,033)
- 10 PRs merged (#1116-#1126)
- 3 issues closed (#1042, #1120, #567)
- 0 regressions

## Test plan

- [x] 7,033 tests pass
- [x] Release consistency check passes
- [x] Tag protection ruleset active (immutable v* tags)
- [ ] CI validates
- [ ] After merge: tag v0.75.11, PyPI publish, Docker Hub push

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Author: msaad00

.github/workflows/cve-freshness.yml

@@ -26,7 +26,7 @@ jobs:
         run: |
           uv run agent-bom sbom tests/fixtures/test-sbom.cdx.json -f sarif -o results.sarif || true
           if [ ! -f results.sarif ]; then
-            echo '{"version":"0.75.10","$schema":"https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json","runs":[{"tool":{"driver":{"name":"agent-bom","version":"0.75.10"}},"results":[]}]}' > results.sarif
+            echo '{"version":"0.75.11","$schema":"https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json","runs":[{"tool":{"driver":{"name":"agent-bom","version":"0.75.11"}},"results":[]}]}' > results.sarif
           fi
       # CVE freshness results are logged in workflow output.
       # We skip upload-sarif because this workflow only runs on schedule (not PRs),

.github/workflows/mcp-change-scan.yml

@@ -30,7 +30,7 @@ jobs:
           python-version: '3.11'
 
       - name: Install agent-bom
-        run: uv tool install agent-bom==0.75.10  # pinned — bump on each release
+        run: uv tool install agent-bom==0.75.11  # pinned — bump on each release
 
       - name: Scan changed MCP configs
         id: scan

DOCKER_HUB_README.md

@@ -88,7 +88,7 @@ agent-bom answers:
 | Tag | Description |
 |-----|-------------|
 | `latest` | Most recent stable release |
-| `v0.75.10` | Current stable version (pinned) |
+| `v0.75.11` | Current stable version (pinned) |
 
 ## Links
 

Dockerfile

@@ -14,7 +14,7 @@ RUN pip install --no-cache-dir --prefix=/install ".[api]"
 ## ── Runtime stage ────────────────────────────────────────────────────────────
 FROM python:3.14.3-alpine3.23@sha256:faee120f7885a06fcc9677922331391fa690d911c020abb9e8025ff3d908e510
 
-ARG VERSION=0.75.10
+ARG VERSION=0.75.11
 
 LABEL maintainer="W S <34316639+msaad00@users.noreply.github.com>"
 LABEL description="Security scanner for AI infrastructure — CVEs, blast radius, credential exposure, runtime enforcement"

README.md

@@ -173,7 +173,7 @@ docker run --rm agentbom/agent-bom agents    # Docker
 | Mode | Command | Best for |
 |------|---------|----------|
 | CLI | `agent-bom agents` | Local audit |
-| GitHub Action | `uses: msaad00/agent-bom@v0.75.10` | CI/CD + SARIF |
+| GitHub Action | `uses: msaad00/agent-bom@v0.75.11` | CI/CD + SARIF |
 | Docker | `docker run agentbom/agent-bom` | Isolated scans |
 | MCP Server | `agent-bom mcp server` | Inside AI assistants |
 | Runtime proxy | `agent-bom proxy` | MCP traffic enforcement |
@@ -184,7 +184,7 @@ docker run --rm agentbom/agent-bom agents    # Docker
 <summary><b>GitHub Action</b></summary>
 
 ```yaml
-- uses: msaad00/agent-bom@v0.75.10
+- uses: msaad00/agent-bom@v0.75.11
   with:
     scan-type: scan
     severity-threshold: high

deploy/docker/Dockerfile.mcp

@@ -11,7 +11,7 @@ RUN pip install --no-cache-dir --prefix=/install ".[mcp-server]"
 ## ── Runtime stage ────────────────────────────────────────────────────────────
 FROM python:3.12.13-slim@sha256:7026274c107626d7e940e0e5d6730481a4600ae95d5ca7eb532dd4180313fea9
 
-ARG VERSION=0.75.10
+ARG VERSION=0.75.11
 
 LABEL maintainer="W S <34316639+msaad00@users.noreply.github.com>"
 LABEL description="Security scanner for AI infrastructure — MCP server mode"

deploy/docker/Dockerfile.runtime

@@ -16,14 +16,14 @@ FROM python:3.12.13-slim@sha256:7026274c107626d7e940e0e5d6730481a4600ae95d5ca7eb
 WORKDIR /app
 COPY LICENSE ./
 
-ARG VERSION=0.75.10
+ARG VERSION=0.75.11
 
 RUN pip install --no-cache-dir --prefix=/install agent-bom==${VERSION}
 
 ## ── Runtime stage ────────────────────────────────────────────────────────────
 FROM python:3.12.13-slim@sha256:7026274c107626d7e940e0e5d6730481a4600ae95d5ca7eb532dd4180313fea9
 
-ARG VERSION=0.75.10
+ARG VERSION=0.75.11
 
 LABEL org.opencontainers.image.title="agent-bom runtime proxy"
 LABEL org.opencontainers.image.description="MCP runtime security proxy — intercepts JSON-RPC for audit logging and policy enforcement"

deploy/docker/Dockerfile.snowpark

@@ -11,7 +11,7 @@ RUN pip install --no-cache-dir --prefix=/install ".[api,snowflake]"
 ## ── Runtime stage ────────────────────────────────────────────────────────────
 FROM python:3.11.12-slim@sha256:dbf1de478a55d6763afaa39c2f3d7b54b25230614980276de5cacdde79529d0c
 
-ARG VERSION=0.75.10
+ARG VERSION=0.75.11
 
 LABEL maintainer="W S <34316639+msaad00@users.noreply.github.com>"
 LABEL description="agent-bom API for Snowpark Container Services"

deploy/docker/Dockerfile.sse

@@ -24,7 +24,7 @@ RUN pip install --no-cache-dir --prefix=/install ".[mcp-server]"
 ## ── Runtime stage ────────────────────────────────────────────────────────────
 FROM python:3.12.13-slim@sha256:7026274c107626d7e940e0e5d6730481a4600ae95d5ca7eb532dd4180313fea9
 
-ARG VERSION=0.75.10
+ARG VERSION=0.75.11
 
 LABEL org.opencontainers.image.title="agent-bom MCP Server"
 LABEL org.opencontainers.image.description="Security scanner for AI infrastructure — MCP server with streamable HTTP transport"

deploy/helm/agent-bom/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: agent-bom
 description: Open security platform for agentic infrastructure — broad scanning plus MCP, blast radius, runtime, and trust
 version: 0.1.0
-appVersion: "0.75.10"
+appVersion: "0.75.11"
 type: application
 keywords:
   - security