0.6.0 — F5 advisory support and scoped maintenance

Research preview of infrastructure vulnerability impact tracking across nine vendor plugins.

• Add two reviewed F5 PHP/OpenSSH advisory PDFs, preserving shared-CVE tables, BIG-IP versus BIG-IP Next, authentication conditions, lifecycle limits and literal fix states.
• Preserve publisher date precision and reject changed semantic scope for review. Generated PDF byte changes do not alone become disclosure signals.
• Add bounded, vendor-scoped normalization maintenance with single-run workflow inputs. Retain original capture times and earlier evidence.
• Map only the two explicit F5 central-management labels into the common product-role taxonomy.
• Includes 0.5.0's private SPDX/CycloneDX observations, shared strict JSON boundary, recovery capacity profiles and scheduled-run observation checks.

Validation: 850 source tests; clean export passed 849 tests with one Git-checkout-only skip and 12 subtests. Installed-wheel/external-plugin acceptance passed. Python 3.11/3.13 and container CI passed on this exact commit: https://github.com/abedegno/infrastructure-impact/actions/runs/40516635748

The deployed publication was independently checked at 774 advisories across nine vendors. Its declared benchmark passed 44/47 cases; three Check Point cases remain source-access gaps on the hosted runner. Coverage is bounded. Independent human review and the seven-day reliability observation remain pending; manual workflow success does not prove scheduled delivery. Vendor rates, rankings and concealment conclusions remain suppressed. F5 is outside the frozen human-review sample.

Assets contain public software only. This source tag does not imply publication to PyPI or a container registry. Apache-2.0 applies to original code; source-evidence rights remain separate.

Infrastructure Impact 0.5.0 — research preview

Infrastructure Impact 0.5.0 is a research preview for tracing official infrastructure-product CVE statements across vendors.

• Inspect private CycloneDX 1.5–1.7 and SPDX 2.2–2.3 JSON through a common component-observation schema. Preserve literal versions, package identifiers, hashes and exact source locators; fetch no external references and create no firmware-inventory or CVE conclusions.
• Retain affected and unaffected branches from two reviewed Fortinet range-list advisories, including authentication prerequisites and unresolved publisher solution-text discrepancies.
• Add read-only vault payload accounting and explicit 512 MiB / 1 GiB recovery profiles, with unchanged archive and decoder limits and preserved historical evidence.
• Track actual scheduled-run observations separately from manual publication freshness. Link the dashboard to scheduled workflow history, bound monitor manifest reads and reject implausible future publication timestamps.
• Verify that distribution checks install the wheel matching the declared version, together with an external vendor plugin.

Validation: 809 source tests and 12 subtests; 808 tests plus one Git-checkout-only parity skip in the clean export; installed-wheel/plugin acceptance; lint, frontend formatting and container checks. Exact-commit CI.

Coverage remains bounded across eight bundled vendor plugins. Independent human review, the elapsed seven-day service observation and defensible build-inventory denominators remain pending. Rates and rankings stay suppressed; source access failures and disclosure leads do not establish vendor concealment. A source release is separate from the continuously collected evidence publication.

Original code is licensed under Apache-2.0. The wheel and SHA256SUMS contain software only; no private vault, captures, keys or review submissions are included. This release does not imply a PyPI or container-registry publication.

v0.4.1 — Inventory evidence workflow and reader schema fix

Patch preview for the v0.4.0 inventory evidence workflow. Use v0.4.1 for the Python reader.

• Fix the Python reader's route allowlist so /schemas/build-inventory-submission-v1.json is served, matching the static publication.
• Exercise every exported schema route in source and isolated installed-wheel acceptance checks, including the external vendor plugin.
• Link pilot proposal downloads to evidence-preparation instructions and update the deployment/trust-boundary architecture guide.

CI passes on Python 3.11 and 3.13, including 727 tests, one environment-specific skip and 12 subtests, plus the reader container. Clean-export tests, source privacy checks and installed-wheel/plugin checks pass. The audited Apache-2.0 wheel and SHA256SUMS are attached; no PyPI or container-registry publication is implied.

Research limits are unchanged: partial firmware references are not verified installed inventories. No inventory proposal certifies CVE applicability, reviewer independence, redistribution rights or comparison eligibility. Vendor rates and rankings remain suppressed; no concealment finding is made. Independent review and the scheduled-service observation window remain pending.

Inventory evidence guide · Changes since v0.3.0 · Public dashboard

v0.4.0 — Product and build evidence research preview

Use v0.4.1 for the corrected Python reader schema route and inventory-preparation link. This preview remains available for reproducibility.

Infrastructure Impact v0.4.0 is a research preview of product/build evidence preparation and disclosure investigation. It adds an exact-firmware pilot comparison and a vendor-neutral, offline inventory evidence workflow. Source coverage remains bounded; independent human review is pending.

• Prepare blank inventory proposals for any installed vendor plugin, component and service role. Audit scoped local evidence files, exact hashes and evidence references without opening the vault, contacting devices or publishing the proposal.
• Compare the Arista EOS 4.32.2F and Aruba AOS-CX 10.13.1031 pilot evidence side by side, with separate advisory-check status, field provenance and explicit build-to-component binding gaps.
• Add product-scope cohorts and a source-bound disclosure review queue, including earlier-advisory counter-evidence and unresolved timing/security-linkage leads.
• Preserve reviewed Arista EOS fix boundaries and publisher backport context; version strings alone cannot establish exposure.
• Document official source alternatives, exact-build acquisition leads and SBOM access/redistribution constraints.

Validation: Python 3.11/3.13 and container CI, clean-source tests, public-source privacy checks, frontend formatting, and an isolated installed-wheel/external-plugin check. The example plugin's supported dependency range includes v0.4.0. The wheel includes the Apache-2.0 license and notices; verify its checksum using the accompanying SHA256SUMS.

Limits: neither pilot target is a verified installed inventory. No generic SBOM-to-CVE mapper, image extraction or automatic version evaluator is provided. Inventories, hardware/configuration scope, historical availability, comparable denominators and independent review remain outstanding. Vendor rates and security rankings remain suppressed. No finding of intentional concealment is made.

The source tag identifies code and contracts. The live dataset has a separate generation ID and source failures. Manual deployment success does not complete the scheduled-service observation window. No PyPI or container-registry publication is implied.

Inventory evidence guide · Changelog · Public dashboard

v0.3.0 — research preview

Infrastructure Impact traces upstream CVEs to the infrastructure products that vendors explicitly identify. This first tagged source release is a research preview with bounded coverage.

• Eight vendor plugins, a shared advisory schema, a versioned component-reference contract and an independently installed extension example.
• Source hashes, retained capture times, separate HTTP observations, bounded offline normalization and parser-change lineage.
• A frozen OpenSSH service reference study: 21 CVEs, six selected firewall families and 126 evidence cells with explicit unknowns.
• Reviewed appliance, platform and configuration scope, including CloudVision management advisories and preservation of all explicit CVE rows sharing a Check Point SK.
• A read-only dashboard/API, scheduled GitHub Pages publication, authenticated encrypted recovery, pinned workflow actions and public integrity monitoring.

Validation at source commit 3299f58ddff98cea1ee6b9e601ded46a2a67fbc6: 669 tests and 12 subtests, Python 3.11/3.13 CI, container checks, and an installed-wheel probe with an external vendor, archive hook and component-reference hook. The attached wheel matches all 156 packaged source files and includes license/notice metadata. Its SHA-256 is in SHA256SUMS.

The public app held 697 advisories across eight vendors in publication 9c1d338eb10a4b939f45bfe2f29d8b91, generated 27 October 2026 at 06:11 UTC. Evidence publications refresh independently of this source tag. Source-access and historical-layout gaps remain visible. Missing evidence remains unknown. Independent human review, portfolio denominators and independently verified fix timing remain outstanding; vendor rates and rankings are suppressed.

Original code, documentation and synthetic fixtures use Apache-2.0. Vendor data retains its own rights and terms. Release assets contain source software, not private vaults, raw source captures, encryption keys or review submissions. No PyPI or container-registry publication is implied.

Dashboard · README · Schema · Vendor plugins · Operations and recovery