Skip to content

v3.2.0

Latest
Latest

Choose a tag to compare

View all tags
@david-waltermire david-waltermire released this 15 May 11:12
v3.2.0
f0fb6d8

Download the OSCAL CLI tool. (GPG Signature)

✨ Highlights

This release updates to metaschema-java 3.0.0.M4 and liboscal-java 7.2.0, fixes a broken :latest container image on GHCR, and deprecates list-allowed-values in favor of the new metaschema-cli command.

metaschema-java 3.0.0.M4 + liboscal-java 7.2.0

Updated the framework dependencies (#273). Highlights from those releases that flow into oscal-cli:

  • Performance instrumentation for constraint validation with --sarif-timing for per-rule and per-let timing in SARIF 2.1.0 output.
  • Profile multi-import validation fix (liboscal-java#282, closes #250) — profiles importing multiple catalogs with with-ids no longer report control identifiers from later imports as missing.
  • OSCAL v1.2.1 bindings with consolidated select-control-by-id/matching definitions.
  • Metapath evaluation improvements that let module-walk tools evaluate OSCAL lets calling functions like oscal:resolve-reference(@href) without raising FOTY0013.

:latest Container Image Restored

docker pull ghcr.io/metaschema-framework/oscal-cli:latest was failing with failed to copy: ... not found because the daily container-cleanup workflow was deleting untagged sub-manifests that the :latest index referenced. Two changes fix this together (#257, closes #254):

  1. The cleanup workflow now enumerates every version tagged latest or v*, fetches each index manifest, extracts the referenced sub-manifest digests, and passes them through skip-shas so they are protected from pruning.
  2. The latest Docker tag now uses flavor: latest=auto (publishing on tagged-release pushes only) instead of moving on every push to main. The build workflow gained a tags: v* push trigger so tagged releases publish a fresh :latest.

list-allowed-values Deprecated

ListAllowedValuesCommand is now @Deprecated(since = "3.0.0") (#245). The command has been migrated upstream to metaschema-cli, where it is available without OSCAL-specific dependencies. The oscal-cli command remains for backward compatibility but new users should run metaschema-cli list-allowed-values.

🐛 Bug Fixes

⚠️ Deprecations

  • Mark ListAllowedValuesCommand as deprecated; use metaschema-cli list-allowed-values instead (#245) by @david-waltermire

🔧 Build & CI Improvements

📦 Dependency Updates

Java Libraries

  • org.apache.logging.log4j:log4j-bom: 2.25.3 → 2.25.4 (#252)
  • org.fusesource.jansi:jansi: 2.4.2 → 2.4.3 (#251)
  • org.junit:junit-bom: 6.0.2 → 6.0.3 (#244)

Maven Plugins

  • io.github.git-commit-id:git-commit-id-maven-plugin: 9.0.2 → 10.0.0 (#255)

GitHub Actions

  • actions/attest-build-provenance: 3.2.0 → 4.1.0 (#259)
  • actions/download-artifact: 7.0.0 → 8.0.1 (#249, #264)
  • aquasecurity/trivy-action: 0.33.1 → 0.34.1 and subsequent SHA updates (#247, #263)
  • docker/build-push-action: 6.19.0 → 6.19.2 (#240)
  • docker/setup-buildx-action: 3.12.0 → 4.0.0 (#262)
  • github/codeql-action: 4.32.2 → 4.35.2 (#246, #261)
  • lycheeverse/lychee-action: 2.7.0 → 2.8.0 (#248)

Full Changelog: https://github.com/metaschema-framework/oscal-cli/compare/v3.1.0..v3.2.0

Assets 2
Loading