SSVC v2026.6

Highlights

• Add support for CISA BOD 26-04
• SSVC calculator bug fixes
• SSVC namespace ABNF improvements
• Improvements to project CI workflows
• Dependency updates

What's Changed

• Publish v2025.9.4 by @ahouseholder in #1059
• improve ABNF integration of ssvc namespaces via runtime parsing by @bernhardreiter in #1067
• Bump tj-actions/changed-files from 47.0.1 to 47.0.4 by @dependabot[bot] in #1068
• Bump actions/upload-artifact from 6 to 7 by @dependabot[bot] in #1071
• Update license by @sei-renae in #1073
• Bump python-multipart from 0.0.20 to 0.0.22 by @dependabot[bot] in #1074
• Bump orjson from 3.11.3 to 3.11.5 by @dependabot[bot] in #1075
• Add GitHub Action to run doctools.py on pull requests and commit data changes by @Copilot in #1070
• Bump urllib3 from 2.5.0 to 2.6.3 by @dependabot[bot] in #1077
• Fix test failures from starlette 0.49.1 upgrade by @Copilot in #1083
• Bump starlette from 0.48.0 to 0.49.1 by @dependabot[bot] in #1076
• Bump tj-actions/changed-files from 47.0.4 to 47.0.5 by @dependabot[bot] in #1078
• Bump the mkdocs group across 1 directory with 2 updates by @dependabot[bot] in #1079
• Bump mkdocstrings-python from 1.17.0 to 2.0.3 by @dependabot[bot] in #1080
• Bump mkdocstrings from 0.30.0 to 1.0.3 by @dependabot[bot] in #1081
• Bump jsonschema from 4.25.1 to 4.26.0 by @dependabot[bot] in #1082
• Fix deployer decision points doc: Utility → Automatable by @Copilot in #1084
• Bump black from 25.9.0 to 26.3.1 by @dependabot[bot] in #1088
• Bump mkdocs-material from 9.7.4 to 9.7.5 in the mkdocs group across 1 directory by @dependabot[bot] in #1089
• Bump pytest from 8.4.2 to 9.0.2 by @dependabot[bot] in #1090
• Bump networkx from 3.4.2 to 3.6.1 by @dependabot[bot] in #1091
• Bump pandas from 2.3.2 to 3.0.1 by @dependabot[bot] in #1092
• Bump scikit-learn from 1.6.1 to 1.8.0 by @dependabot[bot] in #1093
• Add CI workflow to check mkdocs build on PRs by @Copilot in #1086
• Bump mkdocs-material from 9.7.5 to 9.7.6 in the mkdocs group across 1 directory by @dependabot[bot] in #1095
• Bump pydantic from 2.11.7 to 2.12.5 by @dependabot[bot] in #1096
• Bump scipy from 1.16.1 to 1.17.1 by @dependabot[bot] in #1097
• Bump requests from 2.32.5 to 2.33.0 by @dependabot[bot] in #1098
• Edits for clarity by @ahouseholder in #1110
• Add ADR-0014: Terminology shift from "decision tree" to "decision table" by @Copilot in #1100
• Bump actions/configure-pages from 5 to 6 by @dependabot[bot] in #1104
• Bump DavidAnson/markdownlint-cli2-action from 22 to 23 by @dependabot[bot] in #1105
• Bump actions/deploy-pages from 4 to 5 by @dependabot[bot] in #1106
• Bump mkdocs-include-markdown-plugin from 7.2.1 to 7.2.2 in the mkdocs group across 1 directory by @dependabot[bot] in #1107
• Bump pandas from 3.0.1 to 3.0.2 by @dependabot[bot] in #1112
• Bump pydantic from 2.12.5 to 2.13.0 by @dependabot[bot] in #1113
• Bump pytest from 9.0.2 to 9.0.3 by @dependabot[bot] in #1114
• Resolve docker hiccups around regexp build by @ahouseholder in #1101
• revise topics/decision trees for decision tables terminology shift by @sei-renae in #1111
• Bump python-multipart from 0.0.22 to 0.0.26 by @dependabot[bot] in #1115
• Bump tj-actions/changed-files from 47.0.5 to 47.0.6 by @dependabot[bot] in #1116
• Bump actions/upload-pages-artifact from 4 to 5 by @dependabot[bot] in #1117
• Bump mkdocstrings from 1.0.3 to 1.0.4 in the mkdocs group across 1 directory by @dependabot[bot] in #1118
• Bump pydantic from 2.13.0 to 2.13.3 by @dependabot[bot] in #1119
• Bump python-dotenv from 1.1.1 to 1.2.2 by @dependabot[bot] in #1120
• Add SSVC doc explaining "human-scale bottleneck" idea by @ahouseholder in #1087
• Add ADR-0015: SSVC JSON schemas use SchemaVer for versioning by @sei-renae in #1121
• Bump python-multipart from 0.0.26 to 0.0.27 by @dependabot[bot] in #1125
• Bump pygments from 2.19.2 to 2.20.0 by @dependabot[bot] in #1109
• Bump urllib3 from 2.6.3 to 2.7.0 by @dependabot[bot] in #1127
• Bump pydantic from 2.13.3 to 2.13.4 by @dependabot[bot] in #1128
• Bump pandas from 3.0.2 to 3.0.3 by @dependabot[bot] in #1129
• Bump idna from 3.10 to 3.15 by @dependabot[bot] in #1150
• Bump mkdocs-include-markdown-plugin from 7.2.2 to 7.3.0 in the mkdocs group across 1 directory by @dependabot[bot] in #1146
• Bump pymdown-extensions from 10.21.2 to 10.21.3 by @dependabot[bot] in #1147
• Bump black from 26.3.1 to 26.5.1 by @dependabot[bot] in #1148
• Bump scikit-learn from 1.8.0 to 1.9.0 by @dependabot[bot] in #1157
• Bump starlette from 0.49.1 to 1.0.1 by @dependabot[bot] in #1158
• Bump mkdocstrings-python from 2.0.3 to 2.0.4 in the mkdocs group across 1 directory by @dependabot[bot] in #1159
• Fix calculator checkbox order dependency in tree pruning by @Skalman in #1160
• Update CODEOWNERS to include CISA-namespaced items by @sei-ahouseholder in #1163
• Add CISA BOD 26-04 decision framework with Asset Exposure decision point by @sei-ahouseholder in #1164

New Contributors

• @Skalman made their first contribution in #1160
• @sei-ahouseholder made their first contribution in #1163

Full Changelog: v2025.9.5...v2026.6