Documentation-Only Patch

v4.7.0 used real deployment code names in tests/test_bm25_tokenizer_fragment.py and the CHANGELOG entry describing the fix. Those strings identified a specific production corpus and should not have shipped in a public repository.

This patch replaces them with:

• Synthetic placeholders: RULE-A00X, PROJECT-Custom001-xxxx
• Well-known public identifiers: CVE-2024-1234, MS17-010, ADR-0003, T1078.002

Zero Behavior Change

mcp_server/server.py is byte-identical to v4.7.0. The tokenizer fix, the digit-required heuristic, and all 28 fragment tests all work exactly the same way.

v4.7.0 Status: YANKED

• PyPI: v4.7.0 is being yanked (pip install knowledge-rag now picks v4.7.1)
• NPM: v4.7.0 will be deprecated (npm install knowledge-rag picks v4.7.1; latest re-tagged)
• Docker: ghcr.io/lyonzin/knowledge-rag:v4.7.0 remains (image tags are immutable), but latest will re-point to v4.7.1

Upgrade

If you're on v4.7.0, upgrade for the sanitized fixtures/docs — no code or config change is needed on your side.

pip install --upgrade knowledge-rag
# or
npm install knowledge-rag@latest
# or
docker pull ghcr.io/lyonzin/knowledge-rag:latest

Full Fix Description

See v4.7.0 CHANGELOG — behavior is identical.

Follow-up to #140 / #143.