Release v1.4.0 · OWASP/pytm

We are so back! And we couldn't be back without these people (In alphabetical order):

Thank you so much for making OWASP pytm a valuable tool!

Removed tm.sqlDump() and the --sqldump CLI flag (#295, #301). Calls to
tm.sqlDump(...) will raise AttributeError at runtime. There is no
drop-in replacement; use --json for machine-readable output. This breakage
is shipped in a minor release on the assumption of no real-world users; if
this is wrong, please open an issue and we will publish a stub release.

New LLM element class with eight associated threat definitions covering
common LLM-specific attack patterns (#316).
New LLM threat for untrusted tool launch configuration (#329).
likelihood field on Finding, propagated from the originating Threat and
overridable per-finding (#318).
flows module providing helpers for declarative Dataflow construction
(#259).
Data object decoding in the JSON decoder, enabling round-trip serialization
of Data instances (#330).
Devcontainer configuration for VS Code / GitHub Codespaces (#307).
Devbox setup with Poetry integration (#274, #282, #283, #289).
Ruff linter configuration alongside Black (#325).
Google-style docstrings on the Actor model entity (#311).
ROADMAP entries for 2025 and beyond.

Internal element model refactored to Pydantic v2 (#320). The user-facing
construction API in tm.py-style scripts is preserved: Element(name),
attribute assignment, and controls.* access continue to work as before.
Pydantic v2 (>=2.10) is now a hard runtime dependency. Users with
environments pinned to Pydantic v1 must upgrade.
Minimum supported Python is now 3.11. Tested against 3.11, 3.12, 3.13, and
3.14. Python 3.10 and earlier are no longer supported. Python 3.9 reached
end-of-life in October 2025; 3.10 reaches end-of-life in October 2026.
Migrated the test suite from unittest to pytest (#276). Existing
invocations via python -m unittest are replaced by pytest; CI scripts
updated accordingly.
Upgraded the Docker base image to python:3.14.4-alpine3.23 (#309).
Updated Makefile and Dockerfile build pipeline (#321).
Cleaned up legacy and unused files in the repository (#326).
CODEOWNERS now defaults a maintainer set on all paths.

getInScopeFindings() regression introduced by the Pydantic refactor (#323).
likelihood regression on resolved findings, with regression tests added
(#324).
Findings on assets with inScope=False are now correctly suppressed (#312).
CVSS and response overrides on Finding are no longer overwritten during
threat resolution (#248).
Various type annotation fixes and minor cleanups (#322).

Escaped HTML metacharacters in DOT (Graphviz) output to prevent injection in
rendered diagrams (#278, #280).

Navigation Menu