Unreleased
Changed / Added / Changed / Security / Fixed
- YouTube channel live detection is retired (#8167; #5503). It scraped youtube.com channel pages through a residential proxy, which #5503 flagged as a YouTube Terms of Service violation. On GET /api/aviation/v1/get-youtube-live-stream-info, a channel-only query now returns error channel_live_detection_retired without contacting YouTube; isLive is always false and hlsUrl is always empty. The channel query field and the isLive and hlsUrl response fields are deprecated and kept for v1 wire compatibility; the operation itself is not deprecated. GET /api/youtube/live?channel= now returns HTTP 410 with {"error":"channel_live_detection_retired"}, cacheable for one day; ?videoId= still returns the video's oEmbed title and channel name. Migration: pass video_id (videoId on /api/youtube/live) to name a video. There is no replacement for channel live detection; Live News and Live Webcams play verified streams listed in src/config/live-video-sources.ts.
- Corporate intelligence is live; get-company-enrichment and list-company-signals are no longer deprecated (#5695). Both /api/intelligence/v1/get-company-enrichment and /api/intelligence/v1/list-company-signals previously returned an empty stub (disabled in #3777 because the old domain-slug attribution heuristic fabricated company intelligence — issues #3754/#3755). They now aggregate real data behind authoritative SEC ticker→CIK resolution: EDGAR identity and recent filings, Finnhub market profile and earnings surprises, and recent news mentions. A company that does not resolve in the SEC registry returns an empty envelope with sources: [] rather than a guess. Verified lookup keys are ticker and name — a name resolves solely when it identifies exactly one filer. The legacy domain request field remains deprecated for v1 wire compatibility and returns the same empty, non-attributing stub as before. Legacy response fields github, techStack, hackerNewsMentions, and company.founded likewise remain deprecated and empty. Added: market, earningsSurprises, newsMentions, company.cik, company.ticker, filing url/items on enrichment; cik on signals (empty CIK distinguishes "no such company" from "resolved but quiet"); a ticker query param on both. Two new endpoints ship alongside: /api/intelligence/v1/search-sec-filings (EDGAR full-text search) and /api/intelligence/v1/list-material-events (market-wide 8-K material-event stream). All four are exposed through the new get_company_intelligence MCP tool. Earnings surprises remain enrichment facts; they are not emitted as time-ordered signals because Finnhub's period is a fiscal period end, not an authoritative report timestamp.
- CII formula v8 — fixed dead UCDP conflict-floor attribution. The server scorer read non-existent intensity_level / type_of_violence fields from the cached conflict:ucdp-events:v1 feed (whose rows actually carry violenceType, deathsBest, and dateStart), so UCDP never applied its war (floor 70) / minor (floor 50) score floor and never counted toward /api/health.riskScores realtime signal coverage. UCDP is now classified per country over a 2-year trailing window (war when total deaths > 1000 or event count > 100; minor when event count > 10), matching the frontend deriveUcdpClassifications heuristic. The health coverage metric's conflict family is now satisfied by EITHER the ACLED API path OR UCDP, so a thin/empty ACLED window no longer flips health to COVERAGE_PARTIAL while UCDP is healthy. combinedScore values rise for active UCDP conflict countries (e.g. UA/PK/MX gain a war floor); the risk-score cache key family moved to risk:scores:sebuf:v8 and emitted methodology_version is now v8, so clients should re-baseline.
- CII formula v7 — score attribution now changes for the second gap-closure batch. Coordinate attribution resolves three-way bbox overlaps before pairwise border rules, so Punggye-ri maps to KP instead of CN and Lublin maps to PL instead of UA; the seed mirror uses the same resolver. Targeted probes also cover Lhasa, Gaziantep, Kermanshah, Quetta/Islamabad, Dammam, Tabuk, Ruili, Belogorsk, north Hokkaido, and Amman. Climate anomaly boosts now cover the producer-emitted Europe, East Asia, and Latin America zones, restoring KP/KR/JP/PL/DE/FR/GB/VE coverage, and future unknown zones can fall back through anomaly coordinates when available. combinedScore values may shift for affected records, the risk-score cache key family moved to risk:scores:sebuf:v7, and emitted methodology_version is now v7; clients should re-baseline. Remaining coordinate attribution is still a rectangular approximation, not full point-in-polygon border geometry.
- CII formula v6 — score attribution now changes as one batch for country text, coordinate, and climate anomaly inputs. The seed and server country resolvers now agree on token/phrase matching, Rio Grande US/MX border segments, the western Korean DMZ, RU/UA, IN/PK, CN/RU, and RU/JP bbox overlaps; north korean maps to KP and taiwanese maps to TW while bare korean remains ambiguous. Climate anomalies now feed the emitted producer zones (Ukraine, California, Amazon, Taiwan Strait, Caribbean, etc.) into CII and translate enum severities into the numeric climate boost scale. combinedScore values may shift for affected records, the risk-score cache key family moved to risk:scores:sebuf:v6, and emitted methodology_version is now v6; clients should re-baseline.
- CII formula v5 — dynamicScore is now a signed movement delta in the range -100..100, derived from a valid CII snapshot from approximately 24 hours earlier. Positive values mean rising risk, negative values mean falling risk, and 0 means stable or no valid prior snapshot. The browser fallback trend deadband now matches the server rule (> 1 / < -1, an effective two-point threshold for whole-point scores). combinedScore coefficients are unchanged, the risk-score cache key family moved to risk:scores:sebuf:v5, and emitted methodology_version is now v5; clients that previously treated dynamicScore as a non-negative live score should re-baseline.
- CII methodology v4 — country attribution and source inputs were tightened for the Composite Instability Index. Text attribution now uses token exact-match / phrase matching, known bounding-box overlaps route through explicit heuristics, the earthquake seed uses the USGS 4.5-week (4.5_week) feed, and sanctions scoring reads the full country-count map. Client impact: combinedScore values may shift for affected countries, the risk-score cache key family moved to risk:scores:sebuf:v4, and emitted methodology_version is now v4.
- CII formula v3 — conflict event activity now uses log-scaled calibration before the final component cap, preserving distance between moderate and extreme event volumes. The browser CII path now matches the server displacement log-ramp instead of the old +4/+8 tiers, and browser news-alert pressure is no longer amplified by per-country eventMultiplier. Public combinedScore values may shift and methodology_version is bumped v2 → v3; clients pinned on it should re-baseline. See docs/methodology/cii-risk-scores.mdx (#2457, methodology portions of #3726).