v3.2.2

Added (3.2.2)

• Security and Maven correctness review, with regression coverage for credential isolation, CVSS vectors, recovery after upstream failures, bounded input handling, and precise POM edits.

Changed (3.2.2)

• Delegate effective-model construction and repository metadata parsing to Apache Maven 3.9.16 components; use Maven's license reader and retain the complete version history for release-line selection.
• Evaluate default Maven profiles in isolation from server environment/files. Profile-only and otherwise ambiguous declarations remain visible in analysis and require manual edits.
• Upgrade Spring Boot to 4.1.1, Spring AI to 2.0.1, and Tomcat to 11.0.25, bringing corrected Jackson and Log4j versions.
• Build JVM images with Jib 3.5.2 under a distinct -jvm tag, keeping startup output compatible with MCP STDIO.
• Upgrade MCP Java testkit to 0.7.0 and add JVM-image conformance checks to CI.

Fixed (3.2.2)

• Repair native startup, weighted cache factories, nested error serialization, and cached POM recommendation calls with targeted runtime hints and regression tests.
• Make shell build helpers work from any directory and paths containing spaces; repair Windows routing and error handling, and add its HTTP build option.
• Quote the Mockito agent path for Maven repositories containing spaces; return INVALID_INPUT for invalid coordinates.
• Isolate private repository credentials from OSV requests and reject authenticated cross-origin requests and redirects.
• Calculate CVSS v2/v3/v4 vectors and verify newer remediation candidates against OSV; report exact severity counts and avoid caching failed or incomplete security responses.
• Correct imported BOM property scope, direct dependency-management precedence, and coordinate interpolation through Maven Model Builder.
• Apply configured resilience policies, avoid cached transient repository failures, and prevent local rate-limit rejections from opening upstream circuit breakers.
• Bound response sizes, XML nesting, property expansion, model bundles, cache weight and concurrent batches; cancel timed-out work without indefinite executor shutdown waits.
• Apply updater actions only at matching XML locations and current versions; require consistent authorization for shared-property references and reject application-error responses.
• Require successful validation and matching release tags before Docker publication; native smoke checks now exercise MCP instead of ignoring failures.

Removed (3.2.2)

• Custom metadata XML DTO/Jackson XML dependency, regex license parsing, hand-maintained effective-model merge loops, and guessed property-name edits.