v1.11.1

Security — boundary-scoped document access (#738 / #739)

• Boundary-scoped access enforcement across SSP, SAR, SAP, POA&M, Evidence, and CDEF: authenticated users only see and act on documents in the authorization boundaries they have access to; global (nil-boundary) documents remain open to all. Web UI now enforces the same rules as the API (BoundaryScopedDocument). NIST AC-3.
• Evidence validity guards: Description and Source are now required; collected_at/collected_by are system-recorded in UTC (no self-asserted provenance); "Upload Evidence" → "Add Evidence".
• SSP metadata enrichment sourcing (#737): import System Users from authorization-boundary members, System Components from the boundary's CDEFs (then org-wide), and reuse existing back-matter resources — pulled from canonical SPARC locations instead of hand entry.

Supply-chain & scan tooling hardening (#743)

• Gem CVE remediation: websocket-driver → 0.8.2 (CVE-2026-54463/54464/54465 + GHSA-2x63-gw47-w4mm), crass → 1.0.7 (ReDoS / stack-overflow GHSAs); pinned so they can't regress.
• Grype vuln-DB freshness fixed: the pinned Grype (v0.91.0) could not hydrate the current DB schema, so CI had been scanning ~8-week-stale data; bumped to v0.115.0 and fixed the weekly cache-key rotation. The security gate now evaluates current vulnerability intelligence.
• SBOM false-positive fixed at the source: the ruby SBOM step now strips cdxgen's phantom empty-version components, eliminating spurious nokogiri criticals (and any future ones) without perpetual dispositions.
• CVE disposition: glibc CVE-2026-5450 (libc6/libc-bin) documented unreachable (base-image, Debian wont-fix; retired by the planned UBI9 migration #742).

Accessibility (#736)

• Associated orphaned form labels — cleared the remaining WCAG S6853 / InputWithoutLabel residuals.

Code quality (#735)

• Resolved 5 SonarCloud security findings in the test tooling (fixed the true issues; suppressed verified false positives).

Full changelog: v1.11.0...v1.11.1