Skip to content

SPARC v1.11.0

Choose a tag to compare

View all tags
@clem-field clem-field released this 13 Jul 14:03
v1.11.0
26d5a69
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

SPARC v1.11.0

Public-surface hardening and the SonarCloud code-quality remediation, plus a large accessibility pass. No database migrations. One behavior change (opt-out via config) — see Upgrade notes.

🔒 Security / RBAC

  • Controls layer is now gated behind authentication, secure-by-default (#726). The header "Controls" dropdown (Control Catalogs, Baselines, Mappings) and the catalog/baseline/mapping read pages are no longer public. A new SPARC_PUBLIC_CATALOGS flag (default false) lets deployments that front SPARC with their own network auth (VPN, etc.) opt back into public sharing. Nav visibility and read-access are driven by one predicate, so the nav never advertises a page the request can't reach. (NIST AC-3)

♿ Accessibility

  • ~300 WCAG 2.1 A/AA fixes across 45 views — form controls given accessible names/labels, role="region"/"status" → semantic <section>/<output>, tables given <th scope>, and interactive chips given keyboard equivalents. All CSP-safe (no inline handlers) and visually neutral for sighted users.

🧹 Code quality — SonarCloud remediation (#724)

  • Wave 1 (#727): mechanical rule fixes + duplicated-literal constants.
  • Wave 2 + 3 (#729): JS mechanical (named Stimulus classes, replaceAll, ternary/exception cleanups), Ruby mechanical (.ids, dead-code, merged conditionals, unused-param removal), and behavior-care (bare-string raise → named error classes, each→find, module_function→extend self, ENV.fetch). All behavior-preserving; OSCAL exports verified byte-identical.
  • CI security evidence (#721, #722, #723, #725): SonarQube → OHDF evidence producer vendored for the public repo, SRI on CDN assets, job-scoped workflow permissions, and app-code false-positive suppressions.

⬆️ Dependencies

  • Minor/patch bumps (#730): json 2.20.0→2.21.1, pagy 43.5→43.6, aws-sdk-secretsmanager 1.133→1.134, aws-sdk-rds 1.316→1.317 (+ transitive aws-sdk), selenium-webdriver 4.45→4.46.
  • Dev: simplecov 0.22→1.0 (#731).
  • CI: GitHub Actions bumps — configure-aws-credentials v6.2.2, codeql-action (#732).

⚠️ Upgrade notes

  • If your deployment relied on unauthenticated browsing of catalogs/baselines/mappings, set SPARC_PUBLIC_CATALOGS=true. Otherwise those pages now require sign-in when authentication is enabled. No action needed if auth is disabled (single-user/dev) — behavior is unchanged.
  • No migrations.

✅ Release verification (built from this commit)

Docker image build clean · rspec 2814 / 0 failures / 15 env-pending · tests/api 338 passed · ui-smoke 203 passed, zero CSP violations, no new axe a11y regressions.

Full changelog: v1.10.2...v1.11.0

Assets 2
Loading