Skip to content

v3.4.2: Framework Version Maintenance Workflow

Choose a tag to compare

View all tags
@pitimon pitimon released this 22 Feb 02:54
· 38 commits to main since this release
v3.4.2
56df357

What's New

Automated tracking and update process for 50 versioned framework references across 17 domains. Eliminates the reactive, manual QA that found stale versions in v3.3.1 (PCI DSS, CIS Controls, CSA CCM, OWASP LLM Top 10).

New Files

File Purpose
frameworks.json Single source of truth — 50 frameworks with versions, grep patterns, used_in files, staleness thresholds
tests/check-framework-updates.sh Ad-hoc CLI showing color-coded staleness report (CRITICAL / DUE / OK)
.github/workflows/framework-review.yml Quarterly CI (Jan/Apr/Jul/Oct) auto-creates GitHub Issues with review checklists
docs/FRAMEWORK-UPDATE-RUNBOOK.md Step-by-step update procedure for version-string and substantive changes

Enhanced

  • tests/validate-plugin.sh — Section 5: framework JSON validity, grep pattern matching in declared files, staleness warnings (WARN counter added to summary)
  • CLAUDE.md — Framework Maintenance section with key commands and quarterly review info
  • CHANGELOG.md — [Unreleased] entry documenting the maintenance workflow

How It Works

frameworks.json (source of truth)
  ├── validate-plugin.sh Section 5   → CI catches pattern mismatches on every push
  ├── check-framework-updates.sh     → Developer checks staleness ad-hoc
  └── framework-review.yml           → Quarterly GitHub Issue with checklist

Validation

  • validate-plugin.sh: 58 PASS, 0 FAIL, 0 WARN
  • check-framework-updates.sh: 0 CRITICAL, 0 DUE, 50 OK
  • 7 files changed, 1,299 insertions

Framework Categories Tracked

Category Count Examples
NIST SPs 9 CSF 2.0, 800-53 Rev 5, 800-61 Rev 2, 800-207, AI RMF
ISO/IEC 5 27001:2022, 27014:2020, 42001:2023
OWASP 4 Top 10 2021, LLM Top 10 2025, API Top 10 2023, SAMM
MITRE 3 ATT&CK v15, ATLAS 4.0, D3FEND
Compliance 7 PCI DSS v4.0.1, SOC 2, GDPR, HIPAA, PDPA
CIS 3 Controls v8.1, Docker Benchmark, Kubernetes Benchmark
Threat Intel 4 STIX 2.1, TAXII 2.1, TLP 2.0, Diamond Model
Vuln Mgmt 5 CVSS v4.0, EPSS, CISA KEV, SSVC 2.0
Supply Chain 3 SLSA 1.0, CycloneDX 1.6, SARIF 2.1.0
Cloud/AI Gov 7 CSA CCM v4.1, EU AI Act, C2M2, SEC Rules

Full Changelog: v3.4.1...v3.4.2

Assets 2
Loading