v4.1.0

v4.1.0 (2026-06-29)

This release is published under the Apache-2.0 License.

Bug Fixes

• Add xlsx format info to -i info (#2252, 908b0d6)

• Add xlsx format info to -i info (#2219, 3177f41)

• Broken urls (#2271, 81db82a)

• Code license copyright year 2026 (#2272, 15bfb1e)

• Configure explicit warn on 429 (#2262, 943e254)

• DCO sign-off for previous merge commits (#2252, 908b0d6)

• Header & improve code quality (#2252, 908b0d6)

• Header & improve code quality (#2219, 3177f41)

• Header & improve test coverage (#2252, 908b0d6)

• Header & improve test coverage (#2219, 3177f41)

• Htmlproofer 429 (#2262, 943e254)

• Htmlproofer raise error after finish (#2262, 943e254)

• Improve security test (d107cd1)

• Replace fragile new bypass with Mock(spec=CatalogInterface) in unit tests (#2222, ebceafa)

• Snyk unrestricted, now compatible with pip (#2252, 908b0d6)

• Snyk unrestricted, now compatible with pip (#2263, 27e87ba)

• Sonar (#2252, 908b0d6)

• Sonar (#2264, 29c5927)

• Sonar complaint (#2252, 908b0d6)

• Sonar complaint (#2264, 29c5927)

• Sonar complaint regular expression (#2252, 908b0d6)

• Sonar complaint regular expression (#2264, 29c5927)

• Ssp-generate KeyError on missing profile-param-value-origin (#2222, ebceafa)

• Update nist-content submodule pointer to track latest main branch (#2252, 908b0d6)

• Update oscal-content submodule to supported version (#2238) (#2252, 908b0d6)

• Update risk status assertion and improve validation checks in xlsx_to_oscal_poam (#2252, 908b0d6)

• Update risk status assertion and improve validation checks in xlsx_to_oscal_poam (#2219, 3177f41)

• Update test assertions to match nist-content v1.5.0 (#2252, 908b0d6)

• Url code 429 implies existence (#2262, 943e254)

• Url validation (d107cd1)

• Use AssociatedRisk and apply ruff formatting (#2252, 908b0d6)

• Use AssociatedRisk and apply ruff formatting (#2219, 3177f41)

• Write canonical JSON for .canonical.json paths (#2227, e92bde9)

• ci: Prevent maintenance branch releases from being marked latest (6483107)

• deps: Bump actions/checkout from 6.0.2 to 6.0.3 (#2255, 124f3b0)

• deps: Bump actions/checkout from 6.0.3 to 7.0.0 (#2265, 52f416c)

• deps: Bump actions/stale from 10.2.0 to 10.3.0 (#2245, c807145)

• deps: Bump github/codeql-action from 4.35.5 to 4.36.0 (#2246, 9d55cac)

• deps: Bump github/codeql-action from 4.36.0 to 4.36.2 (#2254, 35352cc)

• deps: Bump sigstore/gh-action-sigstore-python from 3.3.0 to 3.4.0 (#2261, d7c3834)

• deps: Bump SonarSource/sonarqube-scan-action from 8.0.0 to 8.1.0 (#2244, f976df1)

• deps: Bump SonarSource/sonarqube-scan-action from 8.1.0 to 8.2.0 (#2260, 0187a57)

Build System

• Force-refresh github pr sync state (#2242, e22e35b)

Chores

• Remove accidentally tracked venv.trestle-contrib files (#2222, ebceafa)

Code Style

• Apply code-format and mdformat fixes for lint complianc (#2222, ebceafa)

Features

• Add canonical JSON model support and documentation (#2227, e92bde9)

• Add canonicalize command (#2227, e92bde9)

• Add RFC 8785 canonical JSON helpers (#2227, e92bde9)

• Add SLSA build provenance attestation and update security insights (#2242, e22e35b)

• Add xlsx-to-oscal-poam task (#2252, 908b0d6)

• Add xlsx-to-oscal-poam task (#2219, 3177f41)

• Add xlsx-to-oscal-poam task for OSCAL POAM generation (#2252, 908b0d6)

• Add xlsx-to-oscal-poam task for OSCAL POAM generation (#2219, 3177f41)

Refactoring

• Format dictionary unpacking for improved readability in xlsx_to_oscal_poam (#2252, 908b0d6)

• Format dictionary unpacking for improved readability in xlsx_to_oscal_poam (#2219, 3177f41)

• Move imports to module level and add smoke test clarification (#2222, ebceafa)

Testing

• Add deterministic unit tests for all KeyError paths in _construct_set_parameters_dict (#2222, ebceafa)

---

Detailed Changes: v4.0.3...v4.1.0