Skip to content

v1.9.1 — POA&M-from-amendments + security remediations

Choose a tag to compare

View all tags
@clem-field clem-field released this 28 Jun 21:01
v1.9.1
4716b8e

SPARC v1.9.1 — cleanup on v1.9.0: restores OSCAL POA&M generation under hdf-cli 3.2.0, plus security remediations and an accessibility fix.

New

  • poam_from_amendments endpoint (#663) — POST /api/v1/oscal/poam_from_amendments (hdf convert --from hdf-amendments --to oscal-poam). The hdf-cli 3.2.0-supported replacement for the removed direct hdf → oscal-poam converter (poam_from_hdf returns 501 on 3.2.0). Full API-first surface: shared service + audit event + optional boundary enrichment, request spec, tests/api contract test, and INVENTORY / endpoint-doc / Postman entries.

Fixes

  • Profile-index accessibility (#668) — the "Duplicate" button now uses btn-primary (white-on-#1f6fa5, 5.78:1) instead of an inline low-contrast background, resolving a WCAG 2.1 AA color-contrast violation surfaced by the axe UI smoke.

Security — dependency remediations

  • concurrent-ruby 1.3.6 → 1.3.7 — remediates CVE-2026-54906 (CRITICAL — ReadWriteLock wrong-thread write release / stray read-release counter corruption; GHSA-6wx8-w4f5-wwcr) and the related CVE-2026-54904 / CVE-2026-54905. (#671; also hot-fixed onto the release branch when it gated CI.)
  • faraday 2.14.2 → 2.14.3 — remediates CVE-2026-54297 (HIGH — uncontrolled recursion in NestedParamsEncoder enabling stack-exhaustion DoS via deeply nested query params; GHSA-98m9-hrrm-r99r). (#669)
  • Additional dependency bumps: oauth2 2.0.24, json, aws-sdk-rds/-s3, i18n, kamal, zeitwerk (#669/#671); GitHub Actions group bumps — download-artifact/upload-artifact/configure-aws-credentials (#670).

Both gem CVEs were caught by the SBOM/SCA CRITICAL gate and remediated by version bump (not suppression); bundle exec bundler-audit is clean. These are app-dependency findings (outside the container-scoped sparc-findings.yml), so this changelog is their authoritative remediation record.

Tests / internal

  • API contract suite realigned (#644) — tests/api pydantic schemas updated for the content-completeness fields (SSP/CDEF/Profile only), the Rails session-cookie name, the discovery auth_mode set (local|oidc|hybrid), and the KSI validation-error path. Full tests/api suite green (298 passed) against a live instance.
  • Sonar S1192 literal-duplication cleanup in the translation service + spec.

Full diff: v1.9.0...v1.9.1

Assets 2
Loading