[SizzleUnrlsd]

Release 0.14.0 adds one change, #165.

• SSRF destinations (Precision: an SSRF flow into a URL whose constant text fixes the host is a hotspot #165). ssrf judges each flow on how + and f-strings build its URL:

  • when constant text fixes scheme://host before any input, the flow becomes a hotspot, because the input still chooses the path and a redirect may lead elsewhere;
  • when the path is fixed too and the call disables redirects, the flow is refuted;
  • anything unproven stays a vulnerability, including a base of unknown value such as an imported BASE_URL.

  A new TaintDetector.judge hook lets a rule refine its own verdict, so the advisory correlation keeps the refutation's verdict. The regression corpus is unchanged.

Changes in this PR

• Version: bumped in pyproject.toml, coretrace_python.__version__, the release test, and the three version examples of the usage guide: the JSON report, its tool.components, and the VEX tooling.
• CHANGELOG.md: the Unreleased section is dated as 0.14.0. No entry changed.

Verification

• pytest: 1221 passed (build installed, so the wheel tests run too).
• pytest -m regression under Python 3.12: 19 passed.
• ruff check on the tracked files and mypy: clean.

Tag v0.14.0 after merge to publish.