chore(release): prepare 0.4.0

CHANGELOG.md

@@ -7,6 +7,8 @@ and this project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.ht
 
 ## [Unreleased]
 
+## v0.4.0 — 2026-06-01
+
 - New rule `agent.python_fastapi_path_auth_no_host_validation` (high
   severity). Flags FastAPI / Starlette middleware that reads
   `request.url.path` for path-based security decisions when the same file

PYPI_README.md

@@ -42,7 +42,7 @@ lurkr scan --path . --baseline .lurkr-baseline.json --fail-on high
 Use the GitHub Action when you want the same check in CI:
 
 ```yaml
-- uses: agentveil-protocol/lurkr@v0.3.0
+- uses: agentveil-protocol/lurkr@v0.4.0
   with:
     path: "."
     output: lurkr-report.json
@@ -165,14 +165,14 @@ The goal: find high-severity capabilities worth controlling before they become p
 - AI-specific static checks for credential flow into LLM context, direct prompt interpolation, and external MCP endpoints
 - Baseline mode for CI adoption: save current findings, then fail only on new findings
 
-### v0.4.0 — broader framework coverage
+### v0.5.0 — broader framework coverage
 
 Candidates for broader framework coverage:
 - AutoGen / AG2 (re-validation against current Microsoft direction)
 - PydanticAI
 - Semantic Kernel
 
-### v0.5.0+ — quality and ergonomics
+### v0.6.0+ — quality and ergonomics
 
 Roadmap items being considered:
 - Auto-fix patches via SARIF `fixes` field
@@ -196,7 +196,7 @@ pip install lurkr
 **From GitHub release:**
 
 ```bash
-pip install git+https://github.com/agentveil-protocol/lurkr@v0.3.0
+pip install git+https://github.com/agentveil-protocol/lurkr@v0.4.0
 ```
 
 **From source (development):**
@@ -229,7 +229,7 @@ present.
 Use the action from the same repository:
 
 ```yaml
-- uses: agentveil-protocol/lurkr@v0.3.0
+- uses: agentveil-protocol/lurkr@v0.4.0
   with:
     path: "."
     output: lurkr-report.json
@@ -243,7 +243,7 @@ path to the `report` output and does not upload data to AgentVeil. Omit
 For existing repositories, commit a baseline and only fail on new findings:
 
 ```yaml
-- uses: agentveil-protocol/lurkr@v0.3.0
+- uses: agentveil-protocol/lurkr@v0.4.0
   with:
     path: "."
     output: lurkr-report.json
@@ -254,7 +254,7 @@ For existing repositories, commit a baseline and only fail on new findings:
 For GitHub Code Scanning, write SARIF and upload it with CodeQL:
 
 ```yaml
-- uses: agentveil-protocol/lurkr@v0.3.0
+- uses: agentveil-protocol/lurkr@v0.4.0
   with:
     path: "."
     output: lurkr.sarif
@@ -275,7 +275,7 @@ Add to your `.pre-commit-config.yaml`:
 ```yaml
 repos:
   - repo: https://github.com/agentveil-protocol/lurkr
-    rev: v0.3.0
+    rev: v0.4.0
     hooks:
       - id: lurkr
         args: ["--fail-on", "high"]

README.md

@@ -13,7 +13,7 @@ does not make network calls during scan, and redacts sensitive output.
 ## GitHub Actions
 
 ```yaml
-- uses: agentveil-protocol/lurkr@v0.3.0
+- uses: agentveil-protocol/lurkr@v0.4.0
   with:
     path: "."
     output: lurkr-report.json
@@ -173,14 +173,14 @@ The goal: find high-severity capabilities worth controlling before they become p
 - AI-specific static checks for credential flow into LLM context, direct prompt interpolation, and external MCP endpoints
 - Baseline mode for CI adoption: save current findings, then fail only on new findings
 
-### v0.4.0 — broader framework coverage
+### v0.5.0 — broader framework coverage
 
 Candidates for broader framework coverage:
 - AutoGen / AG2 (re-validation against current Microsoft direction)
 - PydanticAI
 - Semantic Kernel
 
-### v0.5.0+ — quality and ergonomics
+### v0.6.0+ — quality and ergonomics
 
 Roadmap items being considered:
 - Auto-fix patches via SARIF `fixes` field
@@ -208,7 +208,7 @@ pip install lurkr
 <summary><b>From GitHub release</b></summary>
 
 ```bash
-pip install git+https://github.com/agentveil-protocol/lurkr@v0.3.0
+pip install git+https://github.com/agentveil-protocol/lurkr@v0.4.0
 ```
 
 </details>
@@ -249,7 +249,7 @@ present.
 Use the action from the same repository:
 
 ```yaml
-- uses: agentveil-protocol/lurkr@v0.3.0
+- uses: agentveil-protocol/lurkr@v0.4.0
   with:
     path: "."
     output: lurkr-report.json
@@ -263,7 +263,7 @@ path to the `report` output and does not upload data to AgentVeil. Omit
 For existing repositories, commit a baseline and only fail on new findings:
 
 ```yaml
-- uses: agentveil-protocol/lurkr@v0.3.0
+- uses: agentveil-protocol/lurkr@v0.4.0
   with:
     path: "."
     output: lurkr-report.json
@@ -274,7 +274,7 @@ For existing repositories, commit a baseline and only fail on new findings:
 For GitHub Code Scanning, write SARIF and upload it with CodeQL:
 
 ```yaml
-- uses: agentveil-protocol/lurkr@v0.3.0
+- uses: agentveil-protocol/lurkr@v0.4.0
   with:
     path: "."
     output: lurkr.sarif
@@ -295,7 +295,7 @@ Add to your `.pre-commit-config.yaml`:
 ```yaml
 repos:
   - repo: https://github.com/agentveil-protocol/lurkr
-    rev: v0.3.0
+    rev: v0.4.0
     hooks:
       - id: lurkr
         args: ["--fail-on", "high"]

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "lurkr"
-version = "0.3.0"
+version = "0.4.0"
 description = "Lurkr — local-only pre-deployment scanner for risky AI agent capabilities. No telemetry."
 keywords = ["security", "agent", "mcp", "ai-agents", "github-actions", "static-analysis", "pre-deployment"]
 readme = "PYPI_README.md"

src/lurkr/__init__.py

@@ -2,4 +2,4 @@
 
 __all__ = ["__version__"]
 
-__version__ = "0.3.0"
+__version__ = "0.4.0"