[7.0.0] - 2026-10-30

Added

• Optional OpenTelemetry and Datadog observability across all CLI commands, outbound HTTP/GraphQL requests, sync item counters and secret-redacted structured logs over OTLP/gRPC, installed with the telemetry extra (also part of all) and configured only through REGSCALE_OTEL_*, OTEL_* and DD_* environment variables, never init.yaml
• ServiceNow PySNC SDK support is now installed with regscale-cli[all]
• New regscale appdetectivepro import_appdetectivepro command imports AppDetectivePRO XML database scan exports as assets, vulnerabilities and issues
• Jira Cloud evidence mode for regscale jira tasks --to-evidence that syncs Jira Tasks with Security Plan Evidence records, including attachments and comments, in both directions
• Qualys sync_qualys options --tc-tag-by and --tc-tag-include-selector, with the init.yaml keys totalCloudTagSetBy and totalCloudTagIncludeSelector, to select Total Cloud tags by name or by tag ID and to match any or all of the include tags
• Orchestration Hub can run the Microsoft Defender sync commands and Entra ID evidence collection through a new defender command group
• Tenable SC JSONL sync accepts --no-skip-validation to check that the security plan can be read before syncing
• Wiz finding family filters for wiz vulnerabilities: --finding-families imports only the named families and --exclude-finding-families imports all others (for example --exclude-finding-families network_exposure); all eight families (vulnerability, configuration, host, data, secret, network exposure, end-of-life and excessive access findings) still import by default as before; a run with a filter warns that mop-up may close the findings of skipped families already in RegScale as no longer reported; and an option that names no family, such as ' , ', is a usage error
• Published GraphQL usage manifest, scripts/model_sync/graphql_usage_manifest.json, which lists the platform GraphQL types and fields the CLI uses (its mapped models' fields plus the root fields, collection envelopes and navigations its own queries select) and the fields whose CLI models reject null, so platform PR CI can flag a breaking schema change that would break the CLI before it merges; regenerate it with python -m scripts.model_sync.usage_manifest (also run by make regen-model-fields)
• axoniusRebaselineHours setting that forces a full Axonius sync, which closes what Axonius no longer reports, once the last full sync is 168 hours old by default

Changed

• Files encrypted with this release cannot be decrypted by earlier regscale-cli releases, so upgrade every installation that reads a shared encrypted file before encrypting it with this release
• Scripts that run regscale change_passkey must now pass --file once per encrypted file
• regscale encrypt, decrypt and change_passkey now replace the file instead of writing into it, so they need write access to its folder and do not keep its hard links or its owner when someone else owns it
• Files encrypted by earlier releases will not decrypt while the key files in .secrets are writable by their group or by others, and the error now names the chmod 600 command that fixes it
• regscale-cli 7.0 now needs RegScale platform 6.35.1.0 or newer with the Client API enabled, instead of 6.36.0.0
• The regscale-rest Flask REST API server and the regscale-cli[server] install extra are removed; run CLI commands through the regscale executable instead
• CrowdStrike integration no longer carries a BETA label in its help text and documentation
• HTTP error messages and HTTP client log lines for requests to your RegScale instance now keep their query string (paging, filters and flags), while credential-shaped values and other hosts' query strings stay redacted
• jcam import_controls reports a JCAM status it cannot read once per run at WARNING, with a count and the jcamValueMapping key that maps it, instead of once per control
• Newly generated and upgraded init.yaml files no longer carry the deprecated per-integration TLS verification keys, so a deprecation warning now appears only when your own configuration still sets one; existing configurations keep loading and are still warned
• Nessus import treats every severity 0 item as informational, so an item with no risk factor no longer becomes a Low vulnerability and Low vulnerabilities that earlier imports created from such items are closed on the next import
• Nessus import leaves the CVSS v3 score of a vulnerability empty when the plugin has no v3 score instead of storing 0.0
• Nessus vulnerabilities show the Nessus plugin name as their plugin name instead of the CVE, which stays in the CVE field
• Nessus import reads large scan files faster and uses far less memory
• Aqua imports use less memory on large reports
• RegScale API request errors and the API call summary now appear in the CLI's console output and log file instead of only on stderr
• A configured customCaCert now keeps TLS verification on even when sslVerify is false, with a warning, and the Microsoft Sentinel integration, remote jobs configuration and GraphQL client now resolve sslVerify, customCaCert, SSL_CERT_FILE and REQUESTS_CA_BUNDLE the same way as the rest of the CLI
• regscale nist sort_control_ids now asks the platform to normalize a catalog's control sort ids in one request (POST /api/SecurityControls/sortByCatalog/{catalogId}, RegScale 6.34.5.0 or newer) and reports the per-control outcome, saving the server's result object as regscale-catalog-{catalogId}-sort-results.json in the artifacts directory in place of the former regscale-catalog-{id}-controls.json, catalog-{id}-sorted-control-ids.json and failed-/retry-*-controls.json files, instead of re-deriving the sort ids client-side and updating every control one PUT at a time
• Scanner asset and issue syncs now check that the RegScale platform is 6.34.1.0 or newer (the release that ships the Client API asset and issue batch endpoints) before the first request, and a 404/405 from an older platform reports the required release instead of a bare HTTP error
• CLI version line moved to 7.0.0; this major line requires the RegScale Client API to be deployed and enabled on the target instance
• Asset and Issue records no longer carry client-side audit stamps (dateCreated, dateLastUpdated, createdById, lastUpdatedById) or a client-side isPublic default on Issue: the RegScale platform stamps every create and update itself, so the values the CLI used to compute were never persisted
• Links, component mappings, milestones, tasks, comments, asset mappings, data records, evidence mappings, properties and components are now created or updated through the RegScale Client API, which matches existing records on the server instead of the CLI listing and comparing a parent's records locally; the get-or-create paths (the GitHub and GitLab project components and their plan mappings) send only the fields the CLI set, so an existing component keeps the status, owner and compliance settings it has on the server instead of taking the CLI's defaults for them, as in 6.x
• Scanner integrations now create and update assets through the RegScale Client API, so the CLI and direct API callers produce the same assets from the same data
• An asset's explicitly supplied tracking number is now kept instead of being replaced by the integration's identifier
• Assets missing from a scan are marked Off-Network, and assets the server rejects are reported individually with the reason
• regscale aws sync_assets now warns when init.yaml still sets ingestBackend: grpc, naming the removed gRPC ingest keys, since asset sync always writes through the RegScale API
• The gRPC asset ingest option for AWS (ingestBackend: grpc and its ingestTarget, ingestInsecure and ingestToken settings) has been removed; AWS asset sync always uses the RegScale API
• Scanner integrations now attach assets to components through the RegScale Client API, which finds or creates each component in the security plan and links it to the plan and the asset in one request per batch instead of one call per asset
• Scanner integrations now create and update issues through the RegScale Client API issue batch endpoint, which applies the platform's defaults for status, owner, identification, organization and risk rating and normalizes severity aliases server-side
• Severity values a scanner reports that RegScale does not recognise are stored as "IV - Not Assigned" and listed once per value in the sync log, instead of being silently defaulted
• Issue titles, descriptions and compliance references are no longer truncated by the CLI before upload; the platform's own limits apply and an over-long value is reported per issue
• Issues reported by scanners now carry their affected controls and asset identifiers directly in the batch upload
• Issues created in bulk from scanner findings are now linked to the control implementations the finding named, as issues created one at a time already were
• Syncing issues requires the RegScale Client API to be enabled on the instance; when it is not, the sync stops with a message naming it instead of falling back to the legacy endpoints
• Issues created or updated one at a time now go through the RegScale Client API, which applies the platform's defaults for status, owner, identification, organization and risk rating, normalizes severity and status aliases, and reports in the CLI log any field the instance's form configuration stopped the platform from storing; this requires a RegScale platform at or above 6.34.1.0 with the Client API enabled
• Scanner integrations now send a finding's control labels, control implementation ids and CCI reference on each issue and let the RegScale Client API resolve and link them to the security plan's controls, instead of resolving labels and CCIs client-side and re-applying fields with a second update pass
• Scanner integrations no longer compute issue due dates client-side: an issue is sent without a due date unless the scanner supplied one, and the per-severity day counts, useKev and kevDueDate under issues.<integration> in init.yaml (merged over the same defaults as before, so every severity carries a count) travel with the batch and RegScale dates every undated issue from them (the CISA KEV date first, then the configured count) while the security plan's remediation SLA is not consulted for scanner-created issues; noPastDueDates is honored as the batch option of the same name
• Wiz retention reconciliation lets the RegScale platform close the issues whose findings aged out of the retention window when the run's findings are posted in a single final vulnerability batch request (same protections, audit note and control-status refresh; the sync logs "Closed N outdated issues." from the platform's count), and keeps closing them from the CLI as before on an older platform or when a run is posted in several flushes or requests
• Scanner integrations now let the RegScale Client API close issues that are absent from a scan (once per run, on the final request, skipping issues protected from automatic closure and recording an audit note on each issue it closes) instead of closing them client-side; preventAutoClose in init.yaml keeps its 6.x meaning and does not affect that server-side mop-up
• Vulnerability descriptions and plug-in text are no longer cut at 4000 characters by the CLI: the full text is stored up to the RegScale column, any free text the platform does shorten is reported in the sync log as "normalized", and the Qualys VMDR and CIS report imports create vulnerabilities through the RegScale Client API like every other scanner
• Scanner integrations now create and update vulnerabilities through the RegScale Client API, which validates every record and reports each rejected or adjusted one, and require a RegScale platform at or above 6.35.0.0 with the Client API enabled
• Compliance integrations now record control assessment results and control test results through the RegScale Client API, which keeps one assessment per control per day and derives each control's implementation status from the plan's compliance settings server-side, so the CLI and direct API callers write the same assessments and statuses from the same results (requires a RegScale platform that ships the Client API control-result routes with the Client API enabled; an older platform is refused with guidance naming the required release)
• Issue descriptions, remediation text and other free-text fields are sent to RegScale exactly as the scanner produced them: the platform's Client API wrappers now own length handling, report every truncation per record (surfaced in the sync log as "normalized"), and reject an over-long identifier by name instead of the CLI silently cutting Issue descriptions at 4000 characters
• Issues, assets, control objectives, controls and links under a security plan or component now load completely and in fewer requests, so large plans no longer stop at the first page or time out while syncing
• These reads now require RegScale platform 6.35 or newer; against an older platform they stop with an upgrade message naming the required release instead of returning nothing
• Security plan creates and updates now go through the RegScale Client API, which drops any field disabled by the instance's form configuration server-side and reports each dropped field in the CLI log, replacing the CLI's silent retry without those fields and its FedRAMP deployment-flag pre-zeroing, and require a RegScale platform at or above 6.34.5.0 with the Client API enabled
• Scripts that call Api.graph() directly now receive a GraphQLQueryError when a query fails instead of an empty or partial result, and paginated fetches raise IncompleteFetchError instead of returning a short list; see docs/upgrade-to-7.0.md
• Jira tasks and issues sync now exits with code 5 instead of 0 when the issue type is not available in the Jira project, or cannot be confirmed because the project's issue types cannot be read
• The single issue that an earlier version created for a whole AWS compliance run (or, in PerAsset issue mode, for each resource, unless an AWS S3, KMS, IAM, Systems Manager or GuardDuty sync finds that resource still failing) is no longer updated by later runs and can be closed by hand
• jira tasks now maps To Do and every other open Jira status as jira issues does, to the issues.jira.status setting when it is Backlog or Open and to Open otherwise, instead of Backlog or Open by status name
• Deprecated the --use_security_hub and --no_use_security_hub options of regscale aws sync_config_compliance because they change nothing, with removal planned for 8.0.0 and regscale aws sync_securityhub_compliance as the command for Security Hub compliance data
• Removed the jiraDefaultIssueType and jiraDefaultPriority settings, which the Jira commands never read; delete them from init.yaml, because config validate now reports them
• The ingestClosedIssues init.yaml key is deprecated because no integration reads it, and setting it now logs a warning; delete the key, because it will be removed in 8.0.0
• The CLI now asks the RegScale platform for its version once per command and reuses that answer for every version check in the run, instead of each check resolving it on its own
• regscale nist sort_control_ids again writes the artifact files every 6.x release wrote (regscale-catalog-{id}-controls.json, catalog-{id}-sorted-control-ids.json and, when a control is rejected, the failed/retry control files) alongside the new regscale-catalog-{id}-sort-results.json, logs the 6.x summary lines and exits with the 6.x messages when the catalog cannot be read
• A scanner integration reads the per-severity day counts, useKev and kevDueDate from its issues.<integration> block in init.yaml again and sends them with each issue batch, and warns once per run about a value that is not a positive whole number of days (the 6.x default is used in its place)
• Scanner asset, issue and vulnerability syncs and compliance assessments log the same summary lines as CLI 6.x (Successfully submitted N ... in batch, Sending N assets to RegScale via batch API, Issue batch results: N items returned, Successfully created N control assessments), with the per-outcome breakdown appended
• Scanner and compliance integrations send and print what 6.x did: issues are marked public, a closed issue is completed when its finding was last seen, a vulnerability's plug-in name is its CVE when it has one, long Azure resource-path asset names are shortened to their meaningful parts, preventAutoClose no longer turns off the platform's issue mop-up, control assessments carry the source control id in their title and the run's date stamps, get_or_create never rewrites a record it finds, insert_issue/update_issue use the Client API once the platform accepts the custom-field switch, and the "Closed N outdated issues", per-control test-result and bulk update/creation log lines are back; scanner issue syncs, compliance assessment recording and get_or_create now require RegScale platform 6.35.0.0 or newer and stop with an upgrade message on an older platform
• Scanner syncs on RegScale 7 log the same INFO lines as 6.x for every batch submission (assets, vulnerabilities with their id range, issues and their asset mappings, the plan's remediation SLAs and the compliance cache summary); the Client API's per-batch breakdown moved to DEBUG
• Scanner syncs such as Tenable SC vulnerability queries save large asset batches as quickly as earlier releases again instead of taking several times longer
• Scanner syncs such as Tenable SC vulnerability queries send their asset and vulnerability batches to RegScale concurrently again, restoring the sync speed of earlier releases
• Microsoft Defender sync commands (365 alerts, 365 recommendations, Cloud alerts and Cloud recommendations) now name each record they could not map to an issue, exit 1 when they retrieve records but none can be compared or mapped to issues or RegScale creates none of the mapped issues, and report item-level failures under REGSCALE_STRICT_EXIT_CODES
• Microsoft Defender sync commands treat resolved and dismissed alerts and healthy Defender for Cloud assessments as no longer reported, so they close the matching open issues and create no new ones
• Qualys import_total_cloud now imports nothing and exits 1 when a page of the host detection list fails, cannot be requested, or is truncated without a continuation URL, and exits 6 on a Qualys timeout, as sync_qualys with --include-total-cloud now does too
• Qualys sync_qualys now exits 2 when an asset group is combined with Total Cloud tags, from the command line, init.yaml or the environment, under --include-total-cloud or when --tc-exclude-tags (or init.yaml exclude-only tags) is used without --include-total-cloud, and skips Total Cloud containers on asset group runs and on runs whose exclude tags are applied client-side
• Rapid7 InsightVM requests now follow the CLI-wide proxy rule, so proxy environment variables such as HTTPS_PROXY apply to them only when REGSCALE_USE_PROXY_ENV is set
• regscale-cli 7.x requires RegScale platform 6.35.1.0 or later
• When the platform's catalog migrator is enabled, the catalog update command (catalog update_via_platform) uses the platform's tracked background update and waits for it, reporting whether a new catalog version was created, the catalog was already up to date, or the update failed; otherwise it updates synchronously as before
• Qualys syncs whose host list stops early, because of an API error or because it exceeds 500 pages, now sync the hosts they read and close nothing, with a warning
• AWS Config compliance syncs file new issues under the source AWS Config, so issues filed by earlier syncs under Scanner Integration are no longer closed automatically and the next failing sync files a new issue beside each, which must be closed by hand
• Tanium sync_cis_benchmarks stores a CIS benchmark title or rule id that holds <, > or quotes whole, with those characters in their fullwidth forms (＜Level 1＞), so RegScale no longer cuts it at a tag and two CIS profiles named inside a tag keep separate checklists; a checklist an earlier run stored with a cut title is left as it is and the next run adds it once with its full title
• Wiz syncs that find another Wiz sync still running on the same plan now wait up to one hour for it to finish instead of stopping at once
• Wiz vulnerability syncs on a plan with no assets now exit 1 and name the count and the missing assets when findings stay skipped, instead of reporting success with nothing written
• When a vulnerability's own IP address or DNS name is one of the assets left out over maxAssetIdentifiersPerVulnerability, the vulnerability now records one of its linked assets there instead, or no IP address when none of them has one, so it links no more than that many assets
• When RegScale refuses to map an evidence record to its security plan or a control implementation, the error now names each refused target, found with RegScale's read-only access check, and lists every id the check could not answer for
• AWS sync_directory_services exits with an authentication failure when its AWS credential cannot be resolved, instead of returning cached data
• Control IDs from QRadar, JCAM, CI/CD pipeline scans, CrowdStrike evidence, Tenable control compliance and the Wiz STIG control flip are now matched to security plan controls by the RegScale platform, which also resolves AC-2-1 to AC-2(1) (previously read as AC-2) and AC.2.1 (previously matched only as a CMMC practice)
• Scanner syncs with incrementPoamIdentifier now let RegScale assign POA&M ids per security plan or component, so two runs no longer give the same id to different issues
• Scanner syncs now report each run to RegScale as one sync run, so stale records and Wiz findings past their retention window are closed once by the server when the run ends, and a sync whose batches failed exits with status 1 instead of closing records it could not confirm
• Integrations that save evidence now keep one evidence record per security plan and source, refreshing its status and due date and adding each run's file to it, instead of creating a new record on every run
• Jira, Jira Data Center, ServiceNow, Salesforce, Archer, GitLab, Microsoft Defender and Synqly ticketing syncs now let RegScale match each ticket to its issue by the ticket's id, taking over the issues earlier versions synced instead of creating new ones, and the ticket id is no longer stored in Other Identifier
• Control implementations are now created through the server's create-or-update route, which fills status, responsibility, owner, implementation, source, status flags and the Planned and Not Applicable fields with one platform policy; a control implementation the server refuses counts as an item-level failure, and a request that fails makes the command exit 1
• Checklist results are now created or updated by the server, which matches them on asset, tool and vulnerability ID and fills blank fields itself; checklists it refuses count as item-level failures, and a checklist request that fails makes the command exit 1
• cisa ingest_cisa_kev, scanner kevList and the FedRAMP POA&M v5 KEV due dates now use the RegScale platform's CISA KEV store instead of a catalog the CLI downloads or bundles, KEV Threats are stored with Source "CISA KEV" instead of "Open Source", the cisaKev init.yaml key is no longer read, and each exits 1 when the KEV store cannot answer
• Removed the standalone FedRAMP parameter ID migration script, which called API routes the platform does not serve
• Removed the unused Issue.set_is_poam SDK method and the ISO_DATETIME_FORMAT constant in the issue model module
• Removed the unused internal.workflow.create_workflow SDK function; use create_regscale_workflow_from_template instead
• Removed the unused ComplianceIssueHandler methods for updating existing issues, since compliance issues are now updated by server-side deduplication
• Removed the unused catalog_utils.update_catalog and update_catalog_v2 SDK modules; use update_catalog_v3.import_catalog instead
• regscale model new, generate and load now use the RegScale Client API for assessments, control implementations, issues, assets and components, send only the cells changed since generate, report each row or cell that was not applied with its spreadsheet row number wherever RegScale identifies the row, and exit non-zero when any row or cell is not applied or the pre-change workbook is missing
• regscale model load for assessments, control implementations, issues, assets and components no longer exits non-zero when the edit workbook is unchanged, and still logs the totals for rows created from the new workbook
• regscale model load no longer sends edits to read-only columns such as CreatedBy, and reports each one with its spreadsheet row number and exits non-zero
• regscale model load keeps the existing differences.txt when no existing record was changed
• regscale model generate greys out the read-only columns of the edit workbook and notes on their header that load does not send changes to them
• regscale model new no longer adds an Id column to the new-records workbook, and load refuses a new-records row with an Id filled in, naming its row number, instead of creating a duplicate record
• catalog sync_security_plans now syncs plan controls, objectives and parameters on the RegScale platform instead of in the CLI
• catalog sync_security_plans --all syncs every plan in one platform job that keeps going past a plan that fails, reports each failed plan and the number of skipped plans, and exits non-zero when any plan fails
• catalog sync_security_plans --all keeps waiting for the platform job through up to three consecutive connection or server errors while checking its status
• cve-cleanup fix --confirm now runs on the RegScale platform and always keeps the first valid CVE in the field, and discover and fix --dry-run list each issue's CVEs in that same order
• cve-cleanup fix --confirm now applies the whole repair as one all-or-nothing change
• cve-cleanup fix --confirm now names the missing Issue Update permission when RegScale refuses the repair
• cve-cleanup discover and fix now reject a --parent-id below 1 as a usage error, where 0 previously ran unfiltered across every issue and a negative id silently reported no issues
• cve-cleanup fix --confirm now exits non-zero when a repair errors or a split copy is not created, while issues skipped for having no valid CVE still exit zero
• evidence start now has RegScale evaluate the evidence rules and create each project's child assessment from that project's own evidence folder, stops before sending anything when a config.json rule or score cannot be read, skips a list.json project whose id or folder name cannot be read, skips with a warning a project that has no evidence folder, and exits non-zero when any readable project with evidence does not get an assessment or any list.json entry cannot be read
• evidence build_package now downloads the evidence package RegScale assembles for the security plan and exits non-zero when the plan does not exist or the package cannot be built, instead of logging and exiting successfully
• The issue_linker, assessment_linker and risk_linker commands now link record lineage in a single pass on the RegScale server, report how many records were linked and how many have no parent record, and exit non-zero when the server does not confirm the pass completed
• When the issue_linker, assessment_linker or risk_linker command gets no answer, or a gateway error, from the RegScale server, it now says the server may still have completed the pass and that re-running the command is safe
• The deprecated migrations process_data helper works again when called directly, without the progress and counter globals the linker commands no longer create
• The issuelinker, assessment_linker and risk_linker commands now log the real module and path of the RegScale.json file they write, instead of always naming a risk list file that was never written
• cleanup delete_issues, delete_assets and delete_vulnerabilities now delete through the RegScale platform in one request, check before the prompt and again before deleting that the platform would delete exactly the records listed, delete nothing and exit non-zero when it would not, and exit non-zero when the number deleted differs from the number confirmed
• cleanup delete_issues now deletes only the issues whose parent is the security plan or component, and reports issues only linked to it through another record (such as an asset or a mapped component) as left in place
• cleanup delete_vulnerabilities with --include-scans now deletes the linked scan history records that belong to the same security plan or component and that nothing outside it still uses, and keeps and reports the rest
• cleanup delete_vulnerabilities --no-mappings now stops before deleting anything when the vulnerabilities still have mappings, because a vulnerability that still has mappings cannot be deleted
• cleanup delete_issues, delete_assets and delete_vulnerabilities --dry-run and --preview still print their listing when the platform does not confirm it, and then exit 1
• cleanup delete_vulnerabilities now keeps scan history records by default, and deletes them only when --include-scans is passed
• set_permissions load now applies spreadsheet permissions through the RegScale Client API instead of the record permission routes the platform has retired
• set_permissions load now reports each row that was skipped, forbidden or failed with its spreadsheet row number
• set_permissions load and --preview now reject a row whose id is not a whole number or whose visibility is blank or unrecognized or whose R/RU value is unrecognized instead of applying it as public or no-access, and read R/RU in any case
• set_permissions load now exits non-zero when any row is not applied
• cve-cleanup discover and fix --dry-run now run on the RegScale platform with only Issue Read permission, and name the missing permission when RegScale refuses a run
• regscale model load writes what RegScale applied back into the workbooks, putting each created record's id on its row, so re-running it sends only what is still to apply, sends later edits to created rows as updates, and no longer skips or duplicates rows when rows are inserted, deleted or sorted between runs
• regscale model load puts back an Id cleared from an otherwise unchanged edit-workbook row instead of refusing the workbook's new rows, and names the missing Ids when it still refuses them
• Control results, control test results, CVE cleanup and security plan writes now use the platform's final Client API routes and mop-up counts, which require RegScale 6.35.1.0 or newer
• Checklist scanner results are rolled up into control and objective status by the server, where a failing check lowers a control to In Remediation and a passing check no longer marks it Fully Implemented
• STIG mapper rules are now applied by the RegScale platform in one request, existing rules files that name a stig keep working, and stig_mapper run exits 1 when the rules are refused or not confirmed
• cleanup delete_issues, delete_assets and delete_vulnerabilities now send the confirmed record ids with the delete, so when the records under the security plan or component change after the prompt the RegScale platform deletes nothing and the command prints the ids on each side and exits 1
• In PerAsset issue mode, the AWS S3, KMS, IAM, Systems Manager and GuardDuty syncs now close the per-resource issue a 6.x release left open once the resource has one issue per failing control, and that closed issue keeps its due date, basis for adjustment and false-positive status, which the new per-control issues do not inherit
• An aws sync-config-compliance run with --tags or --conformance-pack-name no longer closes the findings of controls that pass on those rules, because the controls can still fail on other rules
• aws sync_findings now reads the findings below issues.amazon.minimumSeverity from Security Hub before dropping them, so a high setting no longer shortens the read, and the setting now also applies when the CLI falls back to its basic Security Hub read
• Compliance syncs and imports adopt the v3 compliance bulk endpoints on RegScale 6.36+ (control implementation bundles, bulk patch, objective batch updates, bulk inheritance provider models, multi-parent properties/links/comments/assessments, evidence batchUpsert, and OSCAL catalog child batches) with automatic fallback on older servers

Fixed

• jcam import_artifacts records an artifact RegScale refused, or whose local copy is missing, as a failure instead of a success, so the run summary and strict exit codes see it
• regscale encrypt on a file that is already encrypted, regscale decrypt on a file that is not encrypted and regscale change_passkey with a wrong passkey now exit with status 1 and leave the file unchanged, instead of exiting with status 0
• Encrypted files no longer depend on keys stored on disk: regscale encrypt now derives the key from a passkey of at least 12 characters that you enter, regscale encrypt refuses files already encrypted by earlier releases, those files still decrypt and can be upgraded with regscale change_passkey --file (then delete the old .secrets folder), and change_passkey now asks for the file to re-key
• set_permissions load now sets each group's grant as 6.x did: an R row over RU lowers the group to read, and a blank R/RU cell in an otherwise filled row removes the group's grant (requires RegScale platform 6.35.1.0 or newer)
• Commands that re-read configuration mid-run, such as secret migration, no longer fail later RegScale requests with "Cannot send a request, as the client has been closed"
• Scanner syncs stopped with SIGTERM, such as a scheduled job that times out, now let their in-flight batches finish (normally a few seconds), close their open sync run and then end by the signal as before, instead of blocking the next sync of the same plan for up to 7 days; a sender that escalates to SIGKILL first, as regscale jobs run-due does after 10 seconds, still leaves the run open
• Acunetix import keeps each scanned host as its own asset when the export lists the start URL without https://
• regscale tenable nessus import_nessus now fills the Azure identifier on Azure hosts with the Azure resource ID (falling back to the VM ID), matching the Defender and Wiz integrations, and records the VM ID, subscription, resource group and instance name in the asset notes
• regscale sarif import now keeps a rule's remediation guidance as the finding's recommendation (the solution OWASP ZAP writes, or the SARIF help text from other tools) along with the rule's reference links; previously the recommendation held the rule description instead
• Scanner syncs refused because another sync of the same plan and source is still open now stop at once and report the refusal a single time, instead of reading the whole vendor inventory, logging an error per batch and ending with advice to run the sync again
• jcam import_controls leaves a new control's Implementation Status and Control Origin unset when JCAM gives none, so RegScale fills the plan's defaults instead of the importer writing Not Implemented
• aws commands no longer exit 1 with a traceback when STS answers the credential check with something other than its own response, such as a proxy page; the check warns and the command goes on
• The "PySNC SDK not installed" warning now appears only when the ServiceNow use_sdk option is enabled
• Tanium Cloud vulnerability sync now uses a descriptive title instead of the CVE ID and populates last seen date, remediation, CISA KEV, EPSS score and exploit availability
• Nessus import no longer moves a scan file to the processed folder before its upload and compliance issue sync finish, so a file whose upload failed is imported again on the next run
• Nessus import no longer fails the run when the processed folder is read-only
• Nessus import no longer closes the existing record of a finding it could not read and now reports that finding as an error
• Nessus findings now include their port and protocol
• Nessus STIG and CIS check findings each get their own plugin name instead of sharing the scan plugin's name
• Tenable findings no longer put the CVE in the title, so the platform no longer shows it twice; the title is the synopsis, else the plugin name
• The sync_compliance commands and the AWS evidence commands built on them, such as aws sync_inspector and aws sync_guardduty, now refuse a security plan or component that does not exist before anything is read or written, in one ERROR line; a --dry-run warns and still counts
• aws sync_findings_and_assets now refuses a security plan that does not exist before AWS is read, aws sync_findings reports that refusal in one ERROR line instead of a traceback, and crowdstrike sync_incidents / query_incidents and jira warn when their --regscale_module parent cannot be checked
• Comparing two security controls, or looking one up in a list or set, no longer fails with an AttributeError
• Grype, Trivy, SAP Concur Tenable, Wiz and flat-file imports now log a warning naming the date field when a scan date cannot be read instead of silently substituting the current time, and a Wiz issue with an unreadable creation date no longer counts as its earliest creation date
• Scanner syncs now check the Assets and Issues forms for required custom fields on every tenant, so a required field is reported before the sync writes instead of the check being skipped
• Log redaction no longer rewrites the log lines of an application that loads the CLI as a library, apart from its HTTP client request lines, whose URL query strings are now always redacted
• A STIG or compliance checklist result with no CCI, from a .nessus file or a .ckl checklist, no longer changes the CCI-000366 (CM-6) control objective, and the issue for a failing one names no CCI; the checklist row and the finding's external id keep CCI-000366 as before, so existing records still match
• tenable sync_vulns (Tenable Security Center) and tenable io sync_findings (Tenable Vulnerability Management) now send each DISA STIG result's CCI and pass or fail to the RegScale control objective roll-up, as the Nessus and checklist imports do, while still creating its vulnerability and issue; a STIG result with no CCI changes no objective, and a passing STIG check from Tenable Security Center is no longer dropped by the severity filter
• tenable sc sync_jsonl now sends each DISA STIG result's CCI and pass or fail to the RegScale control objective roll-up, as tenable sync_vulns does, and no longer drops a passing STIG check at the severity filter; Tenable STIG results sent to the roll-up are now dated by their scan rather than by the STIG content
• Orchestration Hub can run the Tanium ports and protocols sync and the Tanium CIS benchmark sync
• Microsoft Defender alert and recommendation syncs run with --offset or --limit no longer close RegScale issues outside the selected range
• Tanium ports and protocols dry run reports the number of endpoints, the same unit --offset and --limit select, so split runs cover every endpoint
• RegScale platform version checks now require the release that actually contains each server-side change, so a 6.35.0.0 platform is no longer offered Client API behaviour that first ships in a later release
• Issues whose asset identifier is an IP address, ARN, or hostname that differs from the asset name are now linked to their assets instead of being silently dropped from scanner imports
• GraphQL-backed queries now report server-side query errors instead of silently returning partial results, and every paginated collection is fetched to completion
• Importing the observability package no longer reconfigures the CLI logger as an import side effect; callers that want structured JSON logging call configure_logging() explicitly
• Synqly integrations no longer stop fetching partway through paginated results when the provider's numeric cursor does not match the number of records returned
• Single-object lookups no longer error when the platform reports a missing record with an empty response body
• Jira tasks and issues sync checks the issue type against the Jira project's own issue types on Jira Cloud, so a type the project has is no longer rejected
• Tenable.io and Tenable SC CIS checklist sync now records each run as an assessment on the security plan, with the counts of passed, failed, not reviewed and not applicable checks and an overall result, instead of finishing with no CIS record, and a refused assessment counts as a partial failure, so the sync exits with code 3 when REGSCALE_STRICT_EXIT_CODES is set
• aws sync_assets now records the real diskStorage of every EC2 instance when one attached volume no longer exists, instead of giving every volume in the batch the 8 GB floor because AWS refused the whole batch of 200 volumes
• aws sync_findings, sync_findings_and_assets and the ten AWS compliance commands (sync_s3, sync_kms, sync_cloudtrail, sync_cloudwatch, sync_iam, sync_guardduty, sync_ssm, sync_org, sync_config_compliance, sync_compliance) accepted --dry-run but synced anyway, so an Orchestration Hub split job wrote everything twice (in the count run and again in the children); a dry run now only counts and echoes the splitter's JSON summary; the findings commands count the raw Security Hub findings that --offset/--limit slice and parse nothing; and a compliance dry run stops before the scan history and writes no assets, assessments, issues or evidence
• Compliance commands for AWS, GCP, Tanium, CrowdStrike, Qualys CIS, PAN-OS and QRadar now create one issue for each failing control instead of one issue per run
• The AWS compliance commands that write a bucket, KMS key, GuardDuty detector or account asset (sync_s3, sync_kms, sync_iam, sync_ssm, sync_guardduty, sync_config_compliance, sync_compliance and sync_securityhub_compliance) now send those assets under sync_assets' source with their region recorded, and sync_assets on a plan that holds assets in more than one region keeps other regions' assets active while still marking Inactive the regional resources deleted from the region it ran in (on such plans, global assets such as IAM roles and assets with no recorded region are not marked Inactive; compliance reruns reactivate any mopped-up Inactive assets)
• AWS sync_assets on plans with assets in more than one region now marks a deleted resource as not in the latest scan and keeps edits made to it during the run, and the AWS compliance commands keep an Inactive status a user set and give S3 buckets the Cloud Storage type without replacing their description
• AWS load balancers from Security Hub findings now get the Load Balancer asset type and name that aws sync_assets gives them, instead of Other
• aws and gcp asset syncs type each component from its assets' category, and a re-sync retypes an existing Hardware or Software component when all its assets agree, so a GCP service account, firewall rule, service or bucket component an earlier version made Hardware becomes Software and the aws "AWS Account" component becomes Hardware to match its asset
• GCP sync_findings and sync_compliance now map a finding to the same NIST controls, so sync_findings no longer writes a passed row for a control that sync_compliance fails: both commands read NIST 800-53 tags however Security Command Center spells the standard and ignore tags of other NIST standards such as CSF and 800-171; both map an untagged finding by one shared category table and an untagged CVE finding to SI-2; and sync_compliance also assesses a tagged control that its framework table does not list
• gcp sync_compliance and gcp collect_evidence no longer add a second project asset when Resource Manager refuses the project lookup or when gcpSccUrl overrides the endpoint, because the compliance pass now reads the project number from Cloud Asset Inventory with the same endpoint and credentials as gcp sync_assets
• jira issues and jira tasks now sync the remaining attachments of a Jira issue when one attachment fails to download, instead of stopping the attachment sync for the whole issue, and name that attachment in a warning; while that attachment fails to download, they hold back the RegScale files they would send to that Jira issue, so that they add no duplicates, and name each file they hold back
• jira issues now reports how many Jira issues RegScale did not save in its summary line, instead of reporting only "created 0, updated 0" when RegScale refuses the issues
• jira issues now dates a Done, Closed or Cancelled issue from Jira's status-change date, else its resolution date, else its created date, as jira tasks does, and a malformed Jira date no longer stops the other issues from syncing
• jira tasks gives a task created closed and a task closed on a later run the same close date when Jira's status change date is missing or unreadable, using the resolution or creation date instead, and keeps a closed task's close date when other fields change
• BigQuery asset sync no longer reports success when rows have no assetId value, and fails when no row has one
• AWS S3, CloudTrail, CloudWatch and Systems Manager syncs now accept an --account_id with surrounding spaces and treat a blank one as no account filter
• AWS S3, CloudTrail, CloudWatch and Systems Manager syncs no longer reuse cached data from a run with a different AWS credential or different filters, and keep that cache in the artifacts directory instead of the shared temporary directory
• Jira task syncs no longer create a RegScale task or Jira attachment twice when RegScale answers slowly or with a gateway error, and the run summary counts only the tasks RegScale stored
• With REGSCALE_STRICT_EXIT_CODES, an asset sync no longer exits 3 for a row RegScale merged into a later row with the same identifier in the same request
• Scanner and BigQuery asset syncs no longer send an asset batch a second time after a gateway error, timeout or dropped connection, and fail the run so that a rerun lands the batch (except with REGSCALE_USE_LEGACY_REQUESTS)
• BigQuery asset sync dry run in table mode counts the rows of a table whose metadata has no row count instead of failing
• GCP sync_findings help and the GCP page now say that findings land as vulnerabilities, and the page lists the extra control mappings sync_compliance applies
• Wiz issue sync now asks Wiz for open, in-progress, resolved and rejected issues when the filter names no status, instead of leaving the statuses to Wiz
• Corrected the Wiz documentation for the default inventory entity types and the default issue status filter
• On a RegScale platform that supports it, aws sync-config-compliance updates and closes the issues an earlier version opened instead of adding a second issue per failing control, and closes the duplicate issues those versions left
• Asset syncs now name each asset RegScale refused beside the reason RegScale gave, and say an asset came back with no reason only when none was given
• Nessus and other scanner imports no longer fail with an empty HTTP 400 when creating issues through the Client API
• A compliance batch response (POST /api/client/v1/assessments/control-results, POST /api/client/v1/control-test-results/batch) whose saved entry names no submitted index is now reported as a Client API contract error, with the earlier chunks attached as the partial result, instead of being silently credited to the first submitted row
• Scanner syncs split large vulnerability submissions by the number of affected assets again, so imports with many hosts per finding are not lost to a timed-out request
• Tanium vulnerability sync now picks the same representative endpoint for a consolidated finding on every run, so the issue description, asset identifiers, DNS and IP address no longer change between syncs of the same data
• Vulnerability batches again send an empty plugInText, as 6.x did, when a finding has neither plug-in text nor observations, instead of omitting the field
• CLI v7 prints the 6.x log lines a Nessus import and the AWS compliance syncs printed (issue-asset mapping count, records-cache summary) and moves the lines 6.x never printed (nothing closed by mop-up, control-reference link notes, the per-scan vulnerability success line) to DEBUG
• Issues created from scanner findings again carry the Current/Planned milestone note that the 6.x releases wrote
• CLI v7 reports the wrapper normalizations that store exactly what 6.x stored (a defaulted placeholder, a value accepted as sent, a dns stored as 6.x's own "unknown") at DEBUG, worded for what happened; a truncation still warns
• CLI v7 prints the plan's remediation-SLA line only on the commands 6.x printed it on (Nessus imports and Wiz issues), not on the Wiz vulnerability, Qualys and Tenable syncs that dated their own findings in 6.x
• Findings that --skip-assets leaves out because no matching asset exists are no longer closed as remediated
• Prisma sync_hosts and sync_images with --skip-assets no longer create or update assets
• aws sync_assets skips AWS services that the target region does not offer, such as App Runner, Lightsail, AppSync, CloudFront, Global Accelerator and Audit Manager in GovCloud and Rekognition, Comprehend and Timestream in us-gov-east-1, with an INFO line instead of retrying and logging each at ERROR
• Microsoft Defender 365 recommendations with no severity score are created as Moderate issues instead of being dropped, and reopening an issue from such a recommendation keeps its severity and due date
• Microsoft Defender sync commands now close issues Defender no longer reports and reopen closed issues it reports again, keeping their control links, and a Defender for Cloud sync closes an issue whose record it no longer receives only when the issue's other identifier is an Azure resource id in the subscription it reads, and warns about issues without one
• Microsoft Defender for Cloud recommendation issues for a resource with no resource details are no longer titled with a trailing "on"
• Tanium Cloud vulnerability and compliance syncs no longer stop with a pagination data limit error, reducing the request size automatically when the Tanium API Gateway rejects it
• Tanium Cloud vulnerability, compliance, ports and SBOM syncs no longer stop early when a page of endpoints has no matching data
• Qualys Total Cloud sync now reads every page of the host detection list instead of only the first, and a run that stops early on a later page no longer closes assets or findings it did not read
• Qualys sync_qualys no longer fails when Qualys truncates the host detection list without a continuation URL, and closes nothing it did not read on that run
• Qualys Total Cloud sync now scopes hosts to the asset group, excludes tagged hosts when only exclude tags are given, accepts numeric tag IDs, and keeps the asset group or tag filter when it falls back to VMDR
• Rapid7 findings with an InsightVM risk score above 10 are no longer rejected by the Client API, and the risk score is no longer saved as the VPR score; a VPR score already stored on an existing vulnerability is kept
• aws sync_iam now exits 4 (authentication failure) when AWS refuses its credentials, checking them before it writes anything to RegScale, instead of reporting "completed successfully" having read nothing
• Tenable SC query_vuln and sync_vulns now exit with a non-zero status when the import fails, instead of reporting success
• Tenable SC query and sync commands now import every vulnerability a query returns, instead of importing nothing for small queries and dropping the last results of larger ones
• Tanium sync_compliance --dry-run now honors --offset and --limit, and a dry run of sync_compliance or sync_all fails when the Tanium Comply fetch fails instead of reporting 0 items
• Tanium sync_all --dry-run no longer writes compliance assets and assessments to RegScale; it logs how many compliance items, one per finding and mapped control, it would sync
• Tanium sync-all in security plan mode now links compliance results to the endpoint's existing asset instead of creating a duplicate, and the compliance step of sync-all and sync-compliance no longer marks endpoint assets Inactive
• Qualys fetch-vm-report, import-vm-report and import-cis-report now exit non-zero instead of 0 when the report cannot be fetched or parsed, the CIS report has no results, the security plan is not accessible, or no report option is given
• Tenable SC JSONL sync now fails when the Tenable SC login or query download fails, instead of syncing nothing and reporting success
• Tenable SC JSONL sync accepts a query id of 0 instead of reporting that no query id was provided
• Tenable SC JSONL sync now fails when neither a query id nor a file path is given or when the sync itself fails, instead of reporting success
• Qualys vulnerabilities now carry the CVSS v3 and v2 base scores and vectors from the Qualys knowledge base, and each sync fills in or updates them on existing vulnerabilities
• Slow start-up of every command, most noticeable on short AWS, Microsoft Defender and Wiz runs
• Scanner syncs that return no findings, or whose findings exactly fill the last batch, now close the findings and issues the vendor no longer reports, which previously stayed open after such a sync, while Nessus imports close only what the reports they contain no longer list
• Asset syncs that return no assets now mark the assets the vendor no longer lists, which previously stayed active after such a sync
• OpenSCAP syncs whose run produced no issues now close the compliance issues the vendor no longer reports, which previously stayed open after such a sync
• Nessus imports of a named scan whose every host was fully scanned now close the findings and issues that scan no longer reports, even when the scan has no findings, which previously stayed open after such an import
• Prisma Cloud sync_hosts and sync_images runs no longer retire each other's assets or close each other's vulnerabilities and issues when both use the standard API mode: each run now tells the RegScale server which asset type it covers so its clean-up touches only those records (assets written by a CSV download-mode run share one type, so a plan that has used CSV mode for either command is still not separated)
• Compliance syncs store the issue's organisation on the first run; the RegScale Client API issue wrapper resolves it from the issue owner, the plan owner or the plan, where earlier releases left it empty until the next run
• A Rapid7 sync now retries a brief connection drop and stops with the host named if Rapid7 stays unreachable, and a console sync whose asset load fails now stops instead of finishing with missing findings
• SentinelOne sync commands now check the URL, token, timeout and page size before they contact RegScale, print a configuration error that names the setting without a traceback, and trim leading or trailing whitespace from a token instead of sending it as is, so the token no longer appears in an error
• CrowdStrike incident syncs now record the device serial number on each asset they create for an alert's device
• Qualys vulnerabilities whose knowledge-base record carries no CVSS v2 or v3 vector are stored with an empty vector, as they were before, instead of a null one
• Prisma Cloud host and container image syncs no longer overwrite each other's record for a CVE found on both: each command keeps its own vulnerability and issue
• aws sync_iam again caches its IAM data in artifacts/aws/iam_data.json and stores its account asset's scanning tool and its issues' source as 6.x did, so existing records are updated rather than duplicated
• The AWS compliance commands sync_s3, sync_org, sync_cloudtrail, sync_kms, sync_ssm, sync_cloudwatch, sync_directory_services and sync_compliance again store their account asset's scanning tool and their issues' source as 6.x did, so the existing account asset is updated rather than duplicated and issue due dates again follow the issues.scanner integration block of init.yaml
• Scanner integrations once again send each asset's type exactly as the scanner reported it; the RegScale platform now resolves vendor terms such as Server, Workstation and Virtual Machine to the same asset types the 6.52 CLI stored, so the saved asset types do not change
• A vulnerability, asset or issue batch chunk the RegScale server could not process is retried item by item through the same Client API route, as 6.x did, instead of being reported as rejected and dropped
• CrowdStrike compliance sync no longer warns that partially supported controls read as a full pass; the platform records them with the framework's partial implementation status
• crowdstrike sync_compliance now keeps the exit code and message of a usage error or a CrowdStrike timeout instead of reporting every failure as exit 1
• Qualys syncs of an account with no hosts, or with hosts that report no detections, now complete instead of failing and close the findings, issues and assets Qualys no longer reports
• AWS Security Hub, AWS Config compliance and AWS Inspector syncs that report no failing control, no failing rule or no active finding now close the findings and issues an earlier sync created, unless the sync was filtered, AWS returned an error, every result was inconclusive, or a Security Hub compliance-only sync ran with --no-collect-evidence
• Scan file imports whose file holds only the expected header row are now accepted as a report with no findings and close the findings, issues and assets an earlier import created, instead of being rejected as invalid
• Intune, Splunk, Axonius plan-field and full Synqly vulnerability syncs that report no devices, alerts or vulnerabilities now close the findings and issues an earlier sync created, and an Intune sync with no devices also retires the Intune assets it created
• AWS Config compliance syncs now close the issues of the findings they close, and a sync filtered by account or tags no longer closes findings outside the filter
• Prisma sync_images now attaches the findings of an image whose name the Prisma API reports as empty or null to that image's asset, instead of skipping them
• Prisma sync_hosts now reports the findings --skip-assets skipped, and the assets it created or updated, in the --output json run summary, and its failed records count toward REGSCALE_STRICT_EXIT_CODES
• A platform refusal that stops a vulnerability, asset or issue batch now reports every record the server already saved, however the batch's parallel requests completed
• Tanium sync_all in components mode now assesses the component's controls and files its ports roll-up on the component
• Wiz vulnerabilities resolved in Wiz now record the date Wiz resolved them as their close date, instead of the date of the sync that first saw them closed
• Commands now stop with an error naming the module when RegScale refuses to let the account read it, instead of continuing as if no records existed
• GraphQL responses that carry an empty or null errors value alongside their data are no longer treated as failed pages, and a malformed errors value is reported as the query error it is instead of crashing the error summary
• Qualys Total Cloud and VMDR host detection pagination now preserves tag and asset group filters across continuation pages
• Scanner findings with an unassigned severity are stored as Low vulnerabilities with Low issues again, instead of Informational vulnerabilities with Not Assigned issues
• Microsoft Defender for Cloud recommendation syncs no longer raise an issue for an assessment Defender marks not applicable to the resource, and close the open issue of one
• Tanium CIS benchmark and ports/protocols syncs now stop with a clear error when RegScale refuses or fails the asset lookup, instead of treating the assets they could not read as missing and creating duplicates
• The Policies Tested table of a compliance assessment report now shows Not Applicable, Inconclusive or No Result for a policy whose checks did not pass or fail, instead of Pass with a passing count of zero
• Tanium sync_cis_benchmarks now writes its CIS checklists, updates them on a rerun instead of adding copies, and exits with an error when none of its checklists could be written
• Qualys sync_qualys now reads every page of the Container Security container list instead of the first page only, and closes no hosts, containers or findings in a run that could not read the container list or a container's vulnerabilities in full
• Tanium sync_cis_benchmarks no longer adds a copy of a CIS checklist on every rerun when its benchmark title or rule holds an HTML-like tag such as <Level 1>
• DRF imports now read every column correctly when the header row has blank cells, no longer fail on an issue whose DR Number is empty, and log a missing column once instead of on every row
• tanium sync_compliance on a plan last synced with CLI 6.x no longer leaves each endpoint with two Active assets: the endpoint asset 6.x created is set Off-Network once the endpoint's current asset is on the plan
• aws sync_guardduty --create_vulnerabilities now writes a vulnerability for each GuardDuty finding that names a CVE, and --create_issues a record for each finding without one; both are vulnerability records, and the server makes each one's issue; these records close when GuardDuty archives the finding, not by mop-up, because each region's run shares the "AWS GuardDuty" source
• aws sync_assets and aws sync_cloudtrail no longer hang when AWS returns the same page of CloudTrail trails twice; they log an error instead
• Wiz syncs on a plan that a killed Wiz sync left held now close that sync's run after 4 hours and continue, instead of waiting for it until the server releases it after 7 days
• Wiz vulnerability syncs run at the same time as a Wiz inventory sync on one plan now wait until the inventory sync has written its assets before they skip the findings on assets that are not in the plan
• Microsoft Defender 365 recommendation syncs no longer raise or reopen an issue for a recommendation with an exception (risk accepted) in Defender, and close the open issue of one
• Nessus STIG and other compliance issues whose due date has already passed are saved as POA&Ms again, as 6.x saves them: the CLI asks RegScale to mark a past-due issue as a POA&M when RegScale computes its due date (not in IssueOnly mode)
• Scanner syncs now send a vulnerability that affects thousands of assets in several smaller requests, so a slow server no longer drops the request and every asset up to maxAssetIdentifiersPerVulnerability is linked
• A vulnerability found on more assets than maxAssetIdentifiersPerVulnerability now links at most that many assets in a sync, with a warning that says how many it left out
• aws sync_findings --generate-evidence now refuses an empty --control-ids value, or a part that is not a whole number from 1 to 2147483647, before it reads AWS or writes evidence, and without --generate-evidence the command logs that it ignores --control-ids
• AWS sync_directory_services no longer reuses Directory Services data cached by another credential or region
• AWS sync_directory_services now keys its account asset and evidence record by the AWS account its credentials belong to and the region, and renames an existing ds-service asset to that key in place, so each account and region keeps its own asset and record
• AWS sync_directory_services with --account-id or --tags now updates control assessments, and its --help and logs no longer say those options filter its data; AWS sync_compliance --help no longer lists account ID among its filters
• AWS evidence commands now link evidence to the controls named by --evidence_control_ids when a run skips the control assessment step, such as with --no_update_control_status, --account_id, --tags, or --offset and --limit, and on every run a NIST control id given to --evidence_control_ids also links on a plan of another framework, such as SOC2, through that framework's crosswalk
• Flat-file scan imports, such as Aqua, now send each asset once instead of once per row and keep the values of its last row, so rows that repeat an asset are no longer rejected as duplicates
• The file comparison command now names the supported file types, CSV, XLSX or XLS, when it refuses a pair of files
• regscale model generate now exports every assessment and control implementation linked to the parent instead of only the first 50
• regscale model load exits non-zero and warns that the import may already be committed when RegScale returns a record id that is not a number, instead of showing a traceback
• regscale model dropdowns whose values join to exactly 256 characters now use a lookup sheet, since Excel rejects an inline list longer than 255 characters
• regscale model load exits non-zero with "no workbook found" when neither the new nor the edit workbook is in the given path, instead of reporting that files were uploaded
• regscale model load no longer sends a new row whose only filled cells are read-only, which could create a blank record, and reports it with its row number
• regscale model load refuses the edit workbook's new rows, naming each row number, when an Id from the pre-change copy was removed, instead of risking a duplicate record
• regscale model load skips new rows that an earlier load already created, using the workbook's Ids sheet, so re-running it after a partial failure no longer creates duplicate records
• cve-cleanup discover --output now writes the CSV export instead of failing after the header row
• evidence start signature checks now read each PDF from its program folder, so a signed document in a program sub-folder no longer fails the signature-required test
• evidence start now reads config.json and list.json when evidenceFolder is a relative path such as the default ./evidence, instead of falling back to default rules and creating no assessments
• fedramp import-drf treats a cell as the export's empty-value text only in the column the export writes it to, as the platform's DRF import does: the same text in another column is stored as written, "N/A" in Remediation Level Explanation keeps the stored value, a Risk Adjustment row no longer needs a Justification, and a new deviation with an empty or placeholder Operational Impact Statement or Justification is created without one instead of "N/A" or "Unknown Justification"
• Scanner syncs now exit 1 and hold back closing findings when RegScale saves a batch but cannot finish applying it, and count records RegScale refuses as item-level failures under REGSCALE_STRICT_EXIT_CODES
• Saving a single issue no longer warns that a control label it could not link was changed to an empty value, since the label is stored as sent
• Trivy, Grype, OpenText WebInspect, SAP Concur Tenable, Sicura, Splunk, STIG, Acunetix and Synqly vulnerabilities imports no longer log the security plan remediation SLAs, which they do not use to date their findings
• Scan history after a Snyk import no longer counts twice two findings that RegScale stores as one vulnerability
• Orca commands now report that the Orca host could not be reached, naming the host, instead of saying the API token was rejected, and exit without a traceback
• The cisa ingest_cisa_alerts command now reports that it could not reach the CISA site and exits with an error, instead of crashing with an AttributeError, when www.cisa.gov is unreachable
• Evidence that Wiz sync_compliance, the eMASS importers and other integrations write is now created, owned by the signed-in user, on tenants whose Evidence form requires an Evidence Owner instead of failing for the missing owner, and on those tenants a refreshed evidence record also becomes the signed-in user's
• Scanner imports into a security plan date new issues from the plan's compliance-setting remediation SLAs again, ahead of init.yaml's issues.<integration> day counts, as 6.x did, so a high OpenSCAP issue under the RegScale Default Setting is due 30 days after it is first detected rather than 60
• regscale gitlab sync_issues reports that it could not connect to GitLab, naming the host, and exits with an error instead of ending with a connection-error traceback
• Salesforce sync now reports that the Salesforce login failed, with the reason, and exits with an error when the connection is refused or a credential is rejected, instead of stopping with a traceback
• Microsoft Sentinel sync_content now names the content type that failed to load, such as watchlists or bookmarks, instead of reporting every failed read as an incident page
• AWS sync commands save their evidence records and link them to the security plan instead of exiting with an Evidence Owner is required error
• When one checklist is empty or damaged, stig sync_assets now syncs the hosts of every other checklist and sync_assets_and_findings and process_checklist now import every other checklist, naming each unreadable checklist in one error line and exiting 1, instead of stopping at that file with a traceback
• stig sync_assets, sync_findings, sync_assets_and_findings and process_checklist now reject a --stig_directory that does not exist with a usage error (exit 2), instead of reporting success and exiting 0
• regscale qualys get_asset_groups, export_scans, save_results, sync_qualys, list_policies and export_policy now end with one error line and exit 6 when Qualys cannot be reached, instead of a traceback
• regscale qualys export_scans now exits 6, or 4 when Qualys refuses the credentials, when Qualys answers with an HTTP error, instead of failing with a traceback while reading the error as scan data
• regscale qualys save_results now exits 6, or 4 when Qualys refuses the credentials, when Qualys answers every scan list with an HTTP error, instead of failing with a traceback
• Qualys get_asset_groups and list_scans now exit with an error when Qualys refuses, fails or does not answer a request, instead of reporting an empty result, and list_scans honours qualysTimeout
• Qualys save_results now saves the scan results as a .json file in the given directory, keeps the scans of every scan list, and handles a scan list with no scan or one scan
• Qualys VM report import now saves a vulnerability for a finding without a CVE, and its issue stays open
• wiz sync_benchmarks exiting 0 when Wiz refused the framework or rule query or a benchmark import failed; it now exits 4 when Wiz refuses the token, 6 on another HTTP or connection failure, 1 on a GraphQL error or a failed import, and reports a malformed --framework_id as a usage error
• A second scanner import on the same day, for example a Tanium findings sync, now closes the findings it no longer reports: each run tags its vulnerability batch with its own id instead of the date
• When the evidence form requires an Evidence Owner and the signed-in user cannot be read from the login token, integration evidence records are owned by the userId in init.yaml instead of failing for the missing owner
• Scanner asset syncs no longer reset an asset status set in RegScale, such as Off-Network or Decommissioned, back to Active (On Network) on RegScale 6.35.1.0 and later
• AWS Security Hub findings now name a CloudWatch log group asset by its full log group name, including any "/" path, instead of "" or a shortened name such as "api:"
• AWS Lambda assets named by a version or alias ARN now take the function name and link to the function's console page
• aws sync_assets now resolves the AWS account ID via STS (or the collector's configured account) for Redshift clusters whose DescribeClusters response omits ClusterNamespaceArn, keeping the account segment in the cluster ARN and preserving the cluster when --account_id matches
• AWS findings and assets sync now renames assets an earlier version named by their full ARN, fixing their name, description and console link (requires RegScale 6.35.1.0 or later, not on a dry run; versioned or aliased Lambda functions, Lambda layer versions and log groups ending in ":*" keep their ARN name for now)
• regscale aws sync_guardduty now keeps GuardDuty findings read before or around a failed ListFindings page or GetFindings chunk and leaves IR-4 unassessed with a warning instead of passing IR-4 on an incomplete findings read
• The pre-release workflow's extract-version step now receives the workflow_dispatch tag_name input through env instead of inline ${{ }} expansion and rejects multi-line values before the tag format check, so a crafted dispatch tag cannot break out of quotes or bypass validation
• jira issues now syncs RegScale attachments to a linked Jira issue even when that Jira issue has no attachments of its own yet
• gcp sync_compliance now classifies a Cloud SQL instance (//cloudsql.googleapis.com/projects/<p>/instances/<i>) as Hardware, matching gcp sync_assets (sqladmin.googleapis.com/Instance)
• The jira tasks command no longer creates two RegScale tasks, and the jira issues command no longer counts a ticket twice, when the Jira search returns the ticket on more than one result page
• AWS sync_guardduty and sync_assets no longer create a second asset for a GuardDuty detector when the account lookup fails on one run and succeeds on a later one; detector assets that earlier versions keyed without an account are not yet merged
• aws sync_config_compliance now closes the record an earlier version kept under the bare account id, so an account keeps one open record per failing control, and the remaining record keeps the original first-seen date
• aws sync-config-compliance no longer closes the findings and issues of another AWS account synced into the same plan
• regscale aws sync_config_compliance --conformance_pack_name no longer closes the findings and issues of controls that pass, so the findings and issues of failing rules outside the conformance pack stay open
• Asset syncs no longer name an asset refused, or fail the run, when RegScale merged it into a later row of the same request whose identifier differs only in letter case
• Repeat Axonius syncs no longer close vulnerabilities and issues, or mark assets Inactive, that Axonius still reports
• prisma sync_hosts and panw sync_hosts now refuse a security plan that does not exist and exit 1 naming it, before they read Prisma Cloud or write to RegScale
• aws sync_findings_by_plan_field and the aws Security Hub pipeline commands (sync_securityhub, sync_securityhub_by_plan_field, sync_securityhub_by_component_map) now log, for each security plan, how many findings below issues.aws.minimumSeverity they dropped
• aws sync_findings now logs how many findings issues.amazon.minimumSeverity left out, as it already did for issues.aws.minimumSeverity
• The http2 setting now takes its value from the REGSCALE_HTTP2 environment variable, and reads 0 as off
• An empty environment variable named like a configuration key no longer overwrites the value saved in init.yaml
• maxAssetIdentifiersPerBatch now takes its value from the REGSCALE_MAX_ASSET_IDENTIFIERS_PER_BATCH environment variable, as maxAssetIdentifiersPerVulnerability does
• Wiz compliance report evidence attachment is now skipped with a warning when --regscale_module components is used, instead of failing the run after writing assessments, issues, and assets
• Wiz sync_compliance now rejects an unsupported --regscale_module value, naming the module, instead of silently running as securityplans
• AWS sync_assets no longer creates a duplicate Athena workgroup asset with an empty account ARN (::workgroup/) when sts:GetCallerIdentity fails on one run and succeeds (or --account_id is supplied) on another
• AWS Security Hub findings sync now names a CloudWatch log group asset by its log group name, matching the CloudWatch sync
• AWS Security Hub findings now name an ECR repository asset and build its console URI from the full repository name, including any "/" path, instead of only the segment after the last "/"
• aws sync_securityhub, aws sync_securityhub_by_plan_field and aws sync_securityhub_by_component_map no longer rename inventory assets or rewrite their description, notes and asset type: assets the plan already holds keep what aws sync_assets wrote, and only resources the inventory lacks (or rows an earlier build named by their full ARN) are written
• AWS sync_assets and sync_guardduty re-key GuardDuty detector assets that releases up to 6.55.0 stored with an empty account (arn:aws:guardduty:<region>::detector/<id>) to the full detector ARN instead of creating a second asset on upgrade
• A folder import of several scan files (for example snyk import_snyk or veracode import_veracode with a folder) no longer closes the findings of every file but the last: the whole folder now reports to one RegScale sync run per record type, closed once after the last file
• Control implementation imports (eMASS, FedRAMP) no longer wipe a control implementation's approval workflow state (approval status, date, notes, version and workflow instance) or other stored columns the CLI does not model when they write fields the create-or-update route does not carry
• FedRAMP CIS/CRM imports update control implementations created by applying a profile again: an update now sends "N/A" when the stored implementation statement is blank, instead of being refused with HTTP 400 "Implementation Statement is required", and a failed implementation update makes the command exit non-zero instead of 0
• STIG CCI assessments record a test result for each CCI instead of failing on plans with control implementations
• Dated evidence file names now keep a compressed file's full type: findings.jsonl.gz is stored as findings_<timestamp>.jsonl.gz instead of findings.jsonl_<timestamp>.gz
• defender import_alerts now stores every CVE of a multi-CVE alert row as its own vulnerability instead of keeping only the first; single-CVE rows keep their existing identity
• ControlImplementation.save() preserves nextAssessmentDueDate instead of clearing it to null on PUT /api/controlImplementation/{id}
• aws sync_findings stops with exit code 6 when a Security Hub page fails partway through the pull, instead of reporting success and closing findings it never read
• AWS Security Hub pipeline commands (sync_securityhub, sync_securityhub_by_plan_field and sync_securityhub_by_component_map) now sync active non-control findings and their assets instead of skipping every one
• A folder import of several scan files (for example snyk import_snyk or veracode import_veracode with a folder, or a Qualys file folder) no longer fails on the second file with "Another ... sync is still open" and exit code 1: every file now reports its assets to the folder's one asset sync run, as the first file does, so the second file's assets and findings are written
• FedRAMP OSCAL SSP import (fedramp import_oscal and fedramp ssp import-oscal) no longer stops with "Object of type PortsProtocol is not JSON serializable" when the platform rejects a component port and protocol; it logs the rejected record and continues
• Fixed an error when syncing ServiceNow change requests for a specific parent record
• jira issues again dates a Jira issue with no due date by its Jira priority as 6.x did (Highest 7, High 30, Medium 90, Low 180, Lowest 365 days by default) instead of the severity policy, and the issue description names its due date on the Due Date line again, including the stored date on a re-sync
• jira issues and jira tasks fall back to the medium count with a warning, instead of failing, when an issues.jira day count is not a positive whole number
• fedramp export_poam_v5 and fedramp poam export no longer stop with exit 1 when the RegScale platform's KEV catalog is empty or unreadable; as in 6.x they warn once, write N/A in the KEV Due Date column and finish the workbook
• Jira task sync no longer fails when updating a task whose Jira issue has no due date
• Compliance syncs such as aws sync_config_compliance, sync_ec2 and sync_ecr record a scan history again when their run saves no vulnerability, as 6.x did; 7.0 recorded no scan history for such a run
• Fixed ServiceNow change sync: change requests map onto the RegScale change fields, reruns update the synced change instead of creating duplicates, and a request with no planned dates no longer gets 0001-01-01 written into them
• wiz vulnerabilities exits 1 and names the findings it did not write when the plan holds no asset that wiz inventory wrote, instead of reporting success after a wiz inventory started too late
• aws sync_guardduty now writes a finding's CVE to its vulnerability and issue, and keys an EC2 instance or account-level finding the way aws sync_assets keys that asset (arn:aws:ec2:<region>:<account>:instance/<id>, AWS::::Account:<id>), so the record links to the inventory asset
• aws sync_assets now records a load balancer listener's port with its transport protocol (TCP, UDP, TCP/UDP or Other) and puts the listener protocol, such as HTTPS, in the port's service, instead of storing HTTP or HTTPS as the protocol
• The RegScale API client's SSL verification is DISABLED warning is logged once per command even when several threads build their client at the same time (for example qualys list_scans --module all), where it could print twice
• Prisma CSV import with software inventory now creates inventory for each host from the files it imported, and exits with an error when no file was imported or the inventory could not be created
• Prisma software inventory now reads the security plan's assets, and exits with an error when they cannot be fetched
• JFrog Xray imports send one asset per impacted artifact, so rows sharing an artifact are no longer refused as duplicates
• ServiceNow change sync no longer creates a change made in RegScale again as a new change request on every run
• AWS asset sync no longer reuses an inventory cached for another region, account ID, tag filter, profile or credential, which wrote other assets into the plan and set its own assets inactive
• AWS sync_findings no longer closes the open issues of a service turned off in aws.inventory.enabled_services while their findings are still active, and logs how many findings each turned-off service skipped
• regscale aws inventory collect now honours aws.inventory.enabled_services in init.yaml and collects the same services as regscale aws sync_assets
• AWS asset sync removes a load balancer's old AwsElbv2LoadBalancers component mapping once the asset is mapped to Load Balancers
• Jira attachment download warnings now show the whole file name, so two failed attachments with similar long names can be told apart
• Compliance syncs that create control tests, such as wiz sync_compliance, save their control test results again on platforms that do not yet create those control tests themselves
• Updated the pyasn1 dependency to a release that fixes known security vulnerabilities

ROH 6.35.0.1 Release

Release Overview

• Release Name: ROH Hotfix Release.
• Release Type: Hotfix.
• Release Number: 6.35.0.1

Purpose

RegScale Orchestration Hub (ROH) enables organizations to automate the import and export of data between RegScale and external systems through configurable integrations and commands.

This hotfix release keeps the features of 6.35.0.0. For the stability of current customer deployments, classic integration jobs go back to the previous CLI engine. The recent changes to the CLI engine move to an upcoming release. This release also updates the web server and the Python dependencies to versions that fix known vulnerabilities.

What's Changed

• Classic integration jobs use the earlier CLI engine. The recent CLI engine changes are reverted and move to an upcoming release. Next Gen jobs do not use the CLI and do not change.

Maintenance and Updates

• Updated web server. The application image now ships nginx 1.30.6 from nginx.org. The earlier image shipped the operating system nginx build, which contains known vulnerabilities that its vendor does not fix.
• Updated Python dependencies. This release updates several Python dependencies, including aiohttp, pillow, certifi, filelock, graphql-core, virtualenv, mako and OpenTelemetry, to versions that fix known vulnerabilities.

Deployment Notes

• Upgrade all Orchestration Hub containers. The changes are in both the application image and the worker image. Upgrade every Orchestration Hub container to 6.35.0.1.
• The CLI items in the previous release's Deployment Notes no longer apply. After you upgrade, review the classic jobs that you changed for them. If a classic job does not run, contact RegScale support.

No other configuration change is required.

ROH 6.34.3.2 Release

Release Overview

• Release Name: ROH Hotfix Release.
• Release Type: Hotfix.
• Release Number: 6.34.3.2.

Purpose

RegScale Orchestration Hub (ROH) enables organizations to automate the import and export of data between RegScale and external systems through configurable integrations and commands.

This hotfix release is for customers who stay on the 6.34.3 line. It updates the web server and the Python dependencies in Orchestration Hub to versions that fix known vulnerabilities. It does not change how Orchestration Hub works.

Maintenance and Updates

• Updated web server. The application image now ships nginx 1.30.6 from nginx.org. The earlier image shipped nginx 1.20.1, which contains known vulnerabilities that its operating system vendor does not fix.
• Updated Python dependencies. This release updates several Python dependencies, including PyJWT, aiohttp, pillow, urllib3, tornado, graphql-core and OpenTelemetry, to versions that fix known vulnerabilities.

Deployment Notes

This release has the same platform requirement as 6.34.3.0: RegScale 6.34.3.0 or newer.

• Upgrade all Orchestration Hub containers. The dependency updates are in both the application image and the worker image. Upgrade every Orchestration Hub container to 6.34.3.2.
• Upgrading from 6.34.2.0 or 6.34.2.1 includes 6.34.3.0. Read the 6.34.3.0 Deployment Notes before you upgrade.

No other configuration change is required.

[6.55.0] - 2026-10-22

Added

• DevSecOps release and deploy Change records can now be completed directly, sent for policy approval, or always routed to the CCB per change type with change.approval_by_type or --approval-mode
• Added Python 3.15 support and updated CI test matrices and wheel bounds
• otxUrl setting (environment variable REGSCALE_OTX_URL) that points alienvault ingest_pulses at another AlienVault OTX server, defaulting to https://otx.alienvault.com

Changed

• • Packaging and dependency management migrated from Poetry (poetry-core and poetry.lock) to uv (hatchling and uv.lock) for faster dependency resolution and container builds
• DevSecOps Emergency release and deploy Change records now go to the CCB by default (change.approval_by_type.Emergency: ccb), where a policy reject is reported but does not fail the job; set it to request to keep the policy engine's decision
• Removed the unused regscale-dev update_docs command, which pushed per-integration markdown to readme.io and Confluence
• Behavior change: set_permissions load now exits with an error after trying every row when the platform rejects a row or a row holds an invalid value, where it previously logged a warning and exited 0
• The set_permissions load command now keeps a record's current visibility when its public | private cell is blank and rejects rows with an unrecognized visibility, access level or ID, where a blank or mistyped visibility previously made the record public
• A wiz compliance_report run whose failing controls all span several resources now sends its issues, so like other runs it closes open "Scanner Integration" issues on the plan that it does not report, including issues for controls that now pass and those of the AWS compliance commands on the same plan

Fixed

• • Dependency lock updated so virtualenv is on its latest release
• devsecops change request-approval now reports the Change status and policy mode the platform returns, fails the job only for a rejection the platform enforced, and never leaves the JSON status empty
• JCAM imports now report records they could not import, so REGSCALE_STRICT_EXIT_CODES=1 exits 3 for those instead of 0
• The set_permissions load command now applies group permissions and public visibility on platform 6.29 and later
• regscale import assessment_linker now exits 1 with an error when RegScale returns only part of the assessment list, instead of linking a partial set and exiting 0
• The qualys diagnostics command keeps working after its supporting module has been imported
• AWS Security Hub syncs now report assets and findings they could not process, so REGSCALE_STRICT_EXIT_CODES=1 exits 3 for those instead of 0
• • A second import on the same day now closes the findings it no longer reports: integrations on the shared scanner vulnerability builder (CrowdStrike, Rapid7, Tenable.io and others), the legacy Axonius sync and the direct (non-scanner) vulnerability path of the Qualys CIS report import scope mop-up to one run instead of the date. Trivy, Grype, Nessus, Qualys VMDR and the scanner-integration path of the Qualys CIS report import keep their existing source-and-day scope
• The legacy Axonius sync sends all FISMA ids of a plan together and asks for mop-up once, on the plan's last batch, and not at all when a batch was rejected, so one FISMA id or batch no longer closes records another still reports
• Flat-file folder imports (Nexpose, Snyk, Aqua, Veracode, XRay, ECR, Inspector, Qualys file scans, etc.) are one run: every file shares one batch id and only the last file closes or retires what the import did not report, so one file no longer retires another file's assets
• gcp sync_findings no longer lands a passed control assessment for a control that an open Security Command Center finding in the same run maps to, or for a category that has an open finding; before, only the finding's own control-and-category check was withheld, so the control's other checks landed passed while gcp sync_compliance failed it. The run now logs how many passed control assessments it withheld.
• wiz vulnerabilities now imports cloud configuration findings that Wiz returns with no resource, such as Microsoft Defender for Cloud findings on AKS pods and containers, against the plan with the affected workloads listed on the finding, instead of dropping them and sometimes their whole rule without a trace
• wiz compliance_report now raises an issue for a failing control whose failing checks name several resources
• A run that reads only part of its source no longer sets the plan's other assets Inactive. Each child of an Orchestration Hub split job (--offset / --limit) of bigquery sync_assets_bq, wiz inventory or aws sync_assets, a wiz inventory --filter_by_override run, and an aws sync_assets --account_id / --tags run now leave alone the assets outside their slice or scope. A full, unscoped run still sets Inactive the assets that left the source.
• AWS sync_findings in consolidated mode now creates one vulnerability per Inspector CVE and one per GuardDuty finding type instead of merging each product's findings into a single record, and the next unscoped sync closes those old catch-all records
• The AWS compliance commands (aws sync_s3, sync_kms, sync_cloudtrail and the rest) and wiz compliance_report no longer close each other's open issues or set each other's assets Inactive on a shared plan, and aws sync_findings_and_assets no longer sets Inactive the aws sync_assets assets its findings do not name. Because these compliance commands share one source, they also no longer close their own issues for controls that now pass; close those by hand until each command gets a source of its own
• Compliance commands that run one after another on the same day and assess the same control (for example aws sync_s3 and then aws sync_kms on SC-28) no longer overwrite each other's assessment. The assessment fails when any command failed the control, its title names each command and its result, and a command that runs again that day replaces only its own result. Two commands that run at the same time can still overwrite each other.
• Fixed aws sync_cloudwatch --account_id, which collected no log groups and still reported success; it now keeps the log groups in that account, and an unexpected error while reading log groups now fails the sync instead of being logged and dropped (denied access and a log group deleted mid-run are still skipped)
• AWS sync_ssm now reads every page of each managed node's patches, so SI-2 fails when a node's missing patch is past the first 50 records
• AWS sync_cloudwatch and sync_cloudwatch_ex now fail a control when more than 20 % of log groups fail it, the same rule as the other AWS compliance commands, so AU-6, AU-9, AU-11, AU-12 and SI-4 assessments that passed only because one log group passed are rewritten as Fail on the first run after upgrading
• gcp sync_compliance no longer marks a control Pass or Fully Implemented when no SCC finding maps to it, and fails SI-2 while active CVE (SOFTWARE_VULNERABILITY) findings exist
• Wiz inventory and stig_checks now leave an asset's Disk Storage (GB) at 0 instead of filling it with the virtual machine's disk count, so existing Wiz assets show 0 after their next sync
• gcp sync_findings now imports SCC findings that map to no NIST 800-53 control, including every SOFTWARE_VULNERABILITY (CVE) finding, instead of dropping them with a DEBUG log line. CVE findings carry their CVE id and CVSS v3 base score and are keyed on their SCC finding name, so CVE findings that share a console link stay separate. CVE findings are linked to the asset for their resource, and the run reports at INFO how many findings had no control mapping. Findings SCC marks INACTIVE (remediated) now land Closed instead of Open and no longer fail their mapped control tests.
• Every aws command now exits 4 (authentication failure) when AWS refuses its credentials, none are found or the named profile does not exist, before it reads or writes anything, instead of reporting "completed successfully" and syncing an empty inventory
• Scanner syncs with issueCreation: PerAsset now create one issue per affected asset instead of one issue per CVE linked to every asset
• Nessus imports of several historical scans on one day now close findings that a newer scan no longer reports
• Qualys sync_qualys --include-was now keeps each web application finding's severity (5 Critical, 4 High, 3 Moderate, 2 and 1 Low, matching VMDR) instead of landing every one as Medium
• Qualys sync_qualys --include-was now dates each WAS vulnerability first and last seen, and its issue first detected, from the finding's firstDetectedDate / lastDetectedDate instead of the time of the run
• Tenable.io finding sync now honours the --severity option and syncs only findings of the chosen severity, without closing findings of other severities
• • Prisma Cloud sync_hosts / sync_images --use-csv no longer create a "Prisma Cloud Vulnerability" vulnerability and issue for a host or image with no vulnerability; the export's blank-CVE row now yields only the asset
• Wiz inventory no longer uses the raw lower-case provider resource type (for example microsoft.app/containerapps/containers) as the software name of a container Wiz has not classified yet; it falls back to the parent-based name until Wiz reports the technology
• Tenable.io compliance sync now marks a control as failing when any check citing it fails, not only the first check
• Prisma sync_hosts and sync_images with --enable-software-inventory now create software inventory from each asset's SBOM instead of only logging a note to run sync_sbom
• AWS asset syncs now record a Lambda function's language and its full runtime version, such as python and 3.12, instead of only the last part of the runtime
• tanium sync_compliance and tanium sync_all assess a control whose only Tanium Comply findings are not applicable (any spelling, such as NotApplicable, NOT_APPLICABLE or NA) as Not Applicable, instead of failing it for NotApplicable or passing it for NOT_APPLICABLE and NA, and tanium sync_findings no longer raises an open issue for a NotApplicable finding
• aws sync_compliance --no_use_enhanced_analyzer now assesses controls from AWS Security Hub evidence: passing checks (PASSED) count as compliant, and evidence status values match regardless of case
• wiz vulnerabilities no longer closes a Wiz rule while it is still failing on any of its resources
• A findings run that reads only part of its source (--offset / --limit, as an Orchestration Hub split job passes to each child) no longer closes the plan's vulnerabilities and issues outside that slice. Before this fix, wiz vulnerabilities --limit 1 closed every other open Wiz vulnerability on the plan along with its issue. A run with no slice, or with --offset 0 alone, still closes what the source stopped reporting.
• Tenable.sc imports now create one vulnerability per CVE for a finding that lists several CVEs, instead of one vulnerability carrying a CVE that changed from run to run
• • Tenable.sc sync_jsonl no longer lands a record below tenableMinimumSeverityFilter (such as an Info record under the default low) as a Low vulnerability; it is skipped, as query_vuln already does, and is not counted as a parse failure
• The AWS compliance commands (aws sync_s3, sync_kms, sync_iam, sync_cloudtrail, sync_cloudwatch and the rest) no longer set the plan's other assets, Off-Network ones included, to Inactive when a re-run creates an asset. They no longer retire assets at all, so an asset whose resource AWS stops reporting stays as it is: run aws sync_assets (on a schedule if needed) to retire those.
• A repeat tenable io sync_assets run no longer marks Inactive the assets Tenable has not changed since the previous sync; each run now reads the full Tenable asset inventory before retiring missing assets
• tenable io sync_findings no longer misses Tenable findings on a plan that other connectors also sync: its incremental findings export now starts from Tenable's own last sync rather than the newest scan by any connector. A run that closes findings not in the scan now exports every open finding, so findings Tenable has not re-observed since the last sync are no longer closed.
• The AWS compliance sync commands no longer update control assessments or implementation statuses when a run reads only part of the plan, scoped by --account_id, --tags, a name filter (--bucket_name_filter, --trail_name_filter, --log_group_prefix, Audit Manager --resource_tags) or an --offset/--limit slice; such a run still syncs assets, findings and evidence, and a run without those options assesses the controls as before
• Re-running a compliance command (wiz compliance_report, the AWS sync_s3, sync_kms, sync_cloudtrail, sync_iam, sync_ssm and sync_org evidence commands, and the other compliance integrations) no longer resets what a user set on its existing issues: a basis for adjustment and a due date are kept, and an issue closed as a false positive stays closed
• AWS sync_s3 now judges AU-9 only on buckets that store S3 access logs, which pass when versioned with public access blocked and a private policy, instead of passing every bucket
• AWS sync_guardduty now fails IR-5 when no GuardDuty detector is enabled instead of passing it on every run
• AU-9 results that earlier versions of aws sync_s3 recorded as Pass for buckets that do not store S3 access logs are not removed by a new sync, so review those assessments after upgrading
• Tenable.io asset sync now stores the first IPv4 address in IP Address and the first IPv6 address in IPv6 Address instead of a comma-joined list of every address
• AWS asset sync with --tags now collects the Inspector coverage and findings of the tagged resources instead of none, and an Inspector request the AWS SDK rejects now fails the run rather than ending in success
• regscale aws sync_findings and sync_findings_and_assets now honour the simple category form of aws.inventory.enabled_services (for example storage: false), which they used to ignore: findings on resources of a category turned off that way are no longer imported
• regscale aws sync_assets now honours aws.inventory.enabled_services: a category or service turned off in init.yaml is no longer collected or synced as assets, and its existing assets are kept rather than marked Inactive
• AWS asset and GuardDuty syncs run with --account_id now keep the account's GuardDuty detector instead of dropping it
• Fixed aws sync_assets --account_id and --tags, and aws sync_s3 --account_id, so S3 buckets, load balancers and ACM certificates outside the chosen account or tags are no longer imported
• AWS evidence syncs (KMS, IAM, Organizations, EC2, GuardDuty, ECR, Inspector and Directory Services) now assess the plan's controls when --framework differs from the plan's framework, and warn when no AWS check maps to a control in the plan
• Updated certifi to 2026.10.19 to remove trust in compromised root certificate authorities (GHSA-6q48-6c7w-9gw2)
• Updated pillow to 13.0.0 to fix eight security vulnerabilities, six rated high
• DRF import now matches a DR Number cell with leading spaces to its trimmed value, and reports a non-empty row whose DR Number cell is empty, not text or not a DR number as skipped (with the reason) instead of dropping it silently
• Updated virtualenv to 21.14.7 to fix two security vulnerabilities (CVE-2026-113725, CVE-2026-113726)
• • Veracode XML import now brings in the CWEs of every severity and category in the detailed report, each at its own severity, and no longer fails on a severity with two categories or a category with one CWE
• • show_mapping for aqua, aws, ecr, veracode and every other vendor registered without a file type now reports a missing --file_path as a usage error instead of failing with a TypeError
• Snyk JSON imports no longer skip a vulnerability that has no CVE
• Snyk JSON imports now carry each vulnerability's description and its upgrade and patch remediation
• Uploaded .xml files are stored as application/xml on every host and .sarif files are accepted for upload
• oscal catalog now imports the catalog on Click 8.3 and later instead of failing with "'int' object has no attribute 'strip'" before contacting RegScale when --obj_to_controls or --fedramp is left out
• FedRAMP Appendix A import now creates control implementations for catalogs whose control IDs are lowercase or zero-padded, such as OSCAL catalogs
• OpenText WebInspect import now imports the finding from a scan file that holds a single issue
• OpenText WebInspect import no longer drops an issue that has a single report section, or the issues that follow it in the same scan file
• alienvault ingest_pulses now ends with a clear error instead of a traceback when the request to AlienVault OTX fails or returns an error status, and no longer stops on an existing threat that has no notes
• • RSA Archer commands now print one error line and exit 4, 5 or 6 instead of a traceback when Archer rejects the login, a setting or mapping file is invalid, or Archer cannot be reached; upgrading now adds the archer* settings to an existing init.yaml
• SSP XML import now saves the same, complete set of catalog implementation options on every run instead of a varying number with duplicates
• Databricks pull_data now accepts read-only queries that mention words such as created_at, start with WITH or a comment, while still refusing every statement that writes, and, when no HTTPS proxy is in use, fails within seconds on a host that does not resolve or refuses the connection instead of waiting about 15 minutes
• SAP Concur Tenable import now links each issue to the asset of its row when the row has a Host ID. With issueCreation set to PerAsset, the first sync after upgrading closes the existing issues for rows with a Host ID and recreates them keyed by Host ID; these closures are a one-time re-key, not remediations.
• FedRAMP SSP imports now log a failed step and continue with the remaining steps instead of stopping with an AttributeError

[6.54.0] - 2026-10-19

Added

• The JSON run summary from --output json now reports the run duration and the CLI peak memory use
• Optional scannerPrefetch setting that fetches vendor findings and assets in the background while earlier ones are processed, speeding up scans against slow vendor APIs
• ServiceNow incidents can now carry selected RegScale issue properties, mapped to ServiceNow fields with the new snowIssuePropertyFields setting
• STIG checklist import now reads CKLB files from STIG Viewer 3 as well as CKL files
• JCAM POA&M import with the recommended mapping profile now records each milestone's JCAM status on the RegScale milestone's Status field
• Wiz vulnerability imports now send CISA KEV status, EPSS probability and internet exposure to RegScale for FedRAMP vulnerability ratings, and newly created assets with no Wiz exposure data are no longer marked as not public facing
• Tenable and Nessus imports now pass exploit availability and asset roles from scan data, and Nessus file imports also pass CISA KEV status and CVSS v3 vectors, for FedRAMP vulnerability evaluation
• Nexpose CSV import now supplies exploit availability and CVSS v3 vector data for FedRAMP VDR evaluation when the export includes those columns
• JFrog Xray import now records container image artifacts as container assets
• Axonius v2 pulls now log progress while reading devices and vulnerabilities, with a closing line giving the count and elapsed time
• DevSecOps change open can give the Change its parent record's security with --inherit-parent-security, or make it public with --public, and reports the result in its JSON output
• New wizReportWaitTimeout setting (default 3600 seconds) caps how long Wiz compliance_report waits for Wiz to build the compliance report

Changed

• Paginated RegScale GraphQL queries reuse connections across pages instead of opening a new TLS connection for every page
• The CLI now waits as long as the RegScale platform asks when it is rate-limited or temporarily unavailable, instead of giving up after a few quick retries
• The CLI no longer runs external commands through a system shell, and the Flask API debug mode now listens on the local machine only
• Large asset syncs send assets to RegScale in chunks of 5,000 as they are processed, roughly halving peak memory instead of holding the whole inventory until the end
• Reading large sets of issues and mappings from RegScale is faster and no longer stops at 500,000 records, by paging through them in record-ID order
• Faster CISA KEV due-date and KEV flag lookups during scanner imports, and lower memory use on long syncs that process many records
• Scanner integrations use about 70% less memory per finding and asset and build them more than twice as fast, so very large imports fit in less RAM
• Faster processing of large batch create and update responses from RegScale
• Faster CLI startup: regscale --help and regscale --version respond about five times sooner because heavy libraries now load only when a command needs them, and configuration loads faster by parsing init.yaml with the native YAML parser and reusing the parsed file while it is unchanged
• Customer-supplied XML files (Nessus scans, CCI lists, FedRAMP documents, file uploads and data transformer inputs) are now parsed with a hardened parser that refuses external entities and entity expansion, and Nessus files parse about twice as fast
• STIG checklist (.ckl and .cklb, including s3:// paths) findings are now imported through the platform's checklist import endpoint on RegScale 6.31 or later, which creates the issues for failed checks; older platforms keep the previous client-side .ckl import
• Burp import now records scanned targets as web applications and no longer marks newly created targets as not internet-facing, so FedRAMP VDR reachability is evaluated by the platform
• The jcam export_poams --preview help now explains that a plan whose issues could not be read completely is shown as skipped
• Axonius v2 sync commands now reject --tags and --aql-filter with --mode saved-query instead of silently ignoring them
• The FIPS container image ships pre-compiled Python bytecode, so a fresh container starts commands up to two and a half times faster
• Tanium sync_all now stops at the first step whose Tanium fetch fails, while an on-prem server without Tanium Comply still syncs with a warning
• Tanium sync_assets, sync_findings, sync_compliance and sync_all now exit 6 when fetching from Tanium fails (4 when Tanium refuses the token) instead of reporting success
• CrowdStrike and Jira commands no longer hang on a vendor that stops answering: they fail with exit code 6 after a read timeout set by the new crowdstrikeTimeout and jiraTimeout settings (300 seconds by default)
• Azure AD sync, Intune and the Splunk Entra ID proxy login no longer hang when Microsoft Entra ID stops answering a token request: they fail with exit code 6 after a read timeout set by the new entraTokenTimeout setting (300 seconds by default), and an Azure AD sync authentication failure now exits with code 4 instead of 3
• Tenable.io io commands, AWS sync_assets and sync_ssm, and Defender collect_entra_evidence now exit 6 when the vendor does not answer or fails (4 when it refuses the credentials) instead of exiting 0 as if the run had succeeded; scripts that read the exit code will now see these failures
• Wiz compliance_report now exits 6 (4 when Wiz refuses the credentials) instead of 0 when the compliance report cannot be created, fails, or does not finish in time, and exits 1 when Wiz returns no report; scripts that read the exit code will now see these failures, and no assessments are written for a report that never arrived
• Commands that read RegScale data now fail with a non-zero exit and a message naming the module when the account lacks Read permission on it, or when the server rejects the query, instead of syncing nothing or a partial set

Fixed

• Synqly connector parameter types are now resolved from a fixed list instead of being evaluated, and Prisma SBOM archives skip special files and strip unsafe permission bits on every supported Python version
• Fixed a crash on macOS when a command used the built-in cache together with BigQuery or other Arrow-based data loading
• GCP Security Command Center sync no longer omits passed control assessments for controls that failed in an earlier run within the same process
• Salesforce case and attachment queries now escape their filter values, and BigQuery table names and row limits from configuration are validated before they are placed in a query
• A Microsoft Sentinel sync that fails while writing to RegScale no longer causes the next incremental sync to skip the incidents and alerts it did not write, and entity evidence is filed only after a successful write
• Custom form field saves rejected by the network edge are now retried, the Wiz sync names the assets whose form fields were not saved, and HTTP error pages are logged as one short line instead of the full page
• Wiz sign-in messages and help text name Wiz instead of the commercial Wiz.io service, which misled Wiz for Government users
• Wiz syncs no longer reuse an empty cached result, and a run against a different Wiz server no longer reads another server's cached data
• Wiz STIG check sync now imports only hosts in the selected Wiz project, and keeps a separate cached result per project
• Wiz issue sync no longer marks a rule False Positive or Risk Accepted while Wiz still has open issues for it
• FedRAMP DRF import no longer logs a misleading schema-drift warning when it adds a DR Number property
• JCAM mappings that send text to a Facilities field are now reported by check_config and dry_run, and stop imports, instead of writing a value that matches no facility
• JCAM artifact imports summarize missing tags and explain how to create them before importing
• Missing or invalid dates no longer default to the current date
• Listing risks returned none against current RegScale versions because the risk model still requested eight fields the platform removed
• DevSecOps runs in a GitHub merge queue now use the pr stage and the queue's base and head commits, and the DevSecOps GitHub Actions install the CLI into a per-run virtual environment, keep bundle artifacts for a configurable 30 days by default and deprecate cli-version latest
• JCAM mappings that send text to a Users or Organizations field are now reported by check_config and dry_run, and stop imports, instead of writing a value that matches no user or organization
• JCAM mappings that send text to a Compliance Setting, Related Policy, Risk Model, Profile, Threat Model or Program field are now reported by check_config and dry_run, and stop imports, instead of writing a value that matches no record
• CrowdStrike incident sync now records the device serial number on the assets it creates
• SentinelOne commands that run without an API token now fail with a message that names the missing sentineloneToken secret, instead of an illegal request header error
• Workflow instance filtering in the Python models calls the API route the platform serves
• Prisma Cloud CSV-mode host sync now creates an asset for every host and attaches its findings to it, instead of creating no host assets
• Prisma Cloud syncs that upload findings in more than one chunk no longer close the earlier chunks' vulnerabilities at the end of the run
• rebuild_resolved_guidance now rebuilds exactly the resolved guidance the platform stores: it accepts the PascalCase guidanceStack keys the platform writes, labels every layer with its source name (a Baseline profile layer shows the profile name, not "Base Guidance"), skips layers with blank guidance, and appends the [Local Override]: <justification> line when given the implementation's local tailoring flag and justification
• AWS, Tenable.io and Wiz compliance report downloads no longer spend 12 to 20 minutes retrying a vendor that stopped answering: each now gives up after one read timeout, set by the new awsTimeout and tenableIoTimeout settings or the existing wizTimeout setting
• Jira task sync now logs each task that fails to create, update or close, and no longer counts it in the sync summary
• Nessus import now counts the remediation due date of STIG and compliance findings from the scan date instead of the import date
• Published Docker images are now built from the released commit, so they report the release's own version
• FedRAMP DRF import now saves decimal Adjusted CVSS Scores such as 6.1 to the deviation's Adjusted CVSS Score instead of dropping them or writing them to the Environmental Score
• FedRAMP DRF import now clears the CVSS Base Score for an empty or invalid cell instead of writing 0, keeps the stored score for the export's placeholder text, and keeps deviation fields the workbook has no column for (such as the Temporal Score) on re-import; the DevSecOps SAR publish now reads padded or signed compliance scores instead of sending 0
• FedRAMP DRF import no longer stops when a stored deviation has no DR number, and a re-import keeps a deviation field whose column the workbook does not have instead of clearing it
• FedRAMP DRF re-import updates a POA&M's only stored deviation that has no DR number, and stamps the row's DR number on it, instead of creating a second deviation on the issue
• FedRAMP DRF import no longer moves a deviation to another POA&M when its DR number belongs to a different issue, no longer adds blank or duplicate DR Number properties, and now matches against every stored deviation on a POA&M
• Axonius and legacy ServiceNow issue sync no longer fail when RegScale reports that the parent record has no readable issues
• FedRAMP DRF import no longer creates two deviations and two DR Number properties when one new DR number appears for two POA&Ms (the later row is skipped and reported), lists rows skipped for a DR-number conflict in the import report, no longer fails when no module is given, and loads every deviation of each POA&M from servers that offer it

Administration

[Action Required] Legacy service account tokens expire 30 days after upgrading to v6.35.0.0 or to v6.34.4.0

As part of ongoing security improvements to service accounts, a limited set of legacy tokens will expire 30 days after you upgrade. RegScale administrators will receive an email that lists each affected service account, the date its token stops working, and instructions to rotate it. The email repeats weekly, then daily for the last three days, until each account is addressed. If you don't receive the email, no action is needed.

Once a token expires, any integration, script, or pipeline that uses it will fail with a "401 Unauthorized" error. Rotation steps are included in the notification email and are also available from your account team. After rotating, if an integration fails with a "403 Forbidden" error, verify or reconfigure the service account role and application access.

Granular Subsystem Access in Group Permissions: Group permissions in application management now support granular access configurations to the files subsystem supporting each module. This enables more precise role-based access controls, so organizations can grant users only the access their role requires.

Preset Configuration Templates: Load relevant export templates and form-builder settings into your tenant, ensuring your users only see formatting relevant to their industry or domain across the platform.

• Relevant settings will be applied to Export Groups, Export Templates, Form Tabs, Form Fields, Form Field Dropdown Choices, and Module Rules
• Templates are provided for multiple service lines including Navy, Army, and USAF
• Option available to reset the UI to the original

Compliance Settings: Risk Accepted is now a roll up category in Compliance Settings and the Control Scorecard.

Catalogs

Versioning Update: Catalog versioning is now supported for catalogs of the same UUID. Every update to a catalog from the RegScale repository records a new version of the catalog instead of overriding the previous version.

Guidance Field: Control guidance is now stored separately from control descriptions. Base guidance from OSCAL catalogs is kept as its own field, and supplemental guidance from overlay profiles is captured alongside it. Each control implementation keeps an ordered history of its guidance layers, and the resolved guidance appears on the implementation and feeds narrative generation. Existing fields and customer data are unchanged.

Dashboards

STIG and CIS Benchmarks Reporting Dashboard: The new Compliance Dashboard gives security teams a single view of configuration compliance for a system.

• Summary cards show open findings, high-severity findings, findings without a POA&M, and average compliance, while a per-benchmark grid lets you drill into individual rules. High-severity findings are prioritized in their own list, and each one expands to show the affected hosts.
• A POA&M coverage widget includes a bulk action to create missing POA&Ms, and a severity-weighted CORA score summarizes overall risk.
• The dashboard also shows which scan feeds contributed findings, what carried forward after a benchmark revision, and which reviews have gone stale.

Workflows

Usability Enhancements: A new workflow strip on Record Forms shows progress at a glance, and the Workbench "Steps Assigned to Me" grid has been redesigned. The Alerts drawer is now action-first, so you can act directly from a notification, and a new review screen combines the record snapshot, a live stepper, and a review panel. Labels and step counts have been updated for clarity.

Governance Status Board: A new command center gives you visibility into workflow health across modules. It opens with an executive KPI row and includes a dynamic Kanban driven by each module's statuses, an SLA health matrix with an aging distribution, and SLA views by user and approver capacity and by module. Workflow steps can now be reassigned or reminded, with each action recorded in an audit trail.

Bug Fixes and General Maintenance

This version includes a RS-UI upgrade from Angular 21 to Angular 22.

This release includes security hardening, patching, and fixes that improve reliability, performance, and overall platform stability.

[6.53.0] - 2026-10-14

Added

• Added regscale trust-center evidence push to push JSON evidence to a Trust Center evidence record by its evidence ID
• eMASS commands now report failed records under REGSCALE_STRICT_EXIT_CODES, and the eMASS importers count failed saves, milestones, custom fields and role links they previously only logged
• Axonius V2 sync commands accept KEY=VALUE1|VALUE2 tags and an --aql-filter option for stricter filtering

Changed

• Incremental Wiz pulls re-baseline weekly through the new wizIncrementalRebaselineHours setting so daily syncs stay incremental, and wizFullPullLimitHours now only limits how old cached Wiz data may be
• The wizLastInventoryPull, wizLastVulnerabilityPull, wizLastIssuePull and matching FullPull keys are deprecated and replaced by wizPullWatermarks, and incremental Wiz pulls (wizIncrementalPulls) are planned to become the default in 7.0.0
• Axonius V2 --tags now takes effect by filtering on Adapter Tag values, so runs that previously returned no records or an unfiltered set can return different record counts

Fixed

• eMASS API POA&M, control test result and system mappers no longer fail on every record, and a non-compliant test result is no longer read as compliant
• eMASS POA&M bidirectional sync no longer pushes every POA&M to eMASS twice
• A JCAM URL that answers with anything other than a list of systems, such as a web or login page, an empty body or a bare JSON value, is now reported as a failed JCAM read naming the settings to check
• Incremental Wiz inventory syncs no longer mark unchanged assets Inactive
• Axonius v2 now reads device fields, aggregated values and AWS tags as Axonius 6.1 returns them, so assets sync with their names, addresses and operating systems and route by their AWS tags
• Wiz, Qualys and Tenable.sc syncs no longer hang on a vendor that stops answering: they fail with exit code 6 after a read timeout set by the new wizTimeout, qualysTimeout and tenableScTimeout settings (300 seconds by default), and Tenable.sc no longer waits about 30 minutes and then reports success
• Incremental Wiz pulls keep a separate watermark for each SSP, Wiz project and filter, and move it only after every record is saved to RegScale, never on a dry run
• Wiz Ports and Protocols are no longer skipped after a full inventory pull when incremental pulls are on
• eMASS SLCM import now stops on a security plan or catalog ID that does not exist, and no longer fails on numeric or date cells
• Axonius V2 tag filtering now returns tagged assets and vulnerabilities

Fixed

• Release container images are now cosign-signed and carry a CycloneDX SBOM attestation

This patch re-publishes the container images (the 6.52.0 images were built from an earlier commit and were unsigned); latest and latest-fips move to this build.

Added

• New regscale acunetix import_acunetix command imports Acunetix XML scan exports as assets, vulnerabilities and issues
• JCAM SSP import now logs the RegScale security plan id assigned to each newly created plan, with a count in the run summary
• CrowdStrike Spotlight sync now supplies known-exploited, internet exposure, exploit availability and CVSS vector data for FedRAMP VDR evaluation, and uses the host role to set the asset type
• Scanner integrations share one asset type lookup, so vendor terms such as server or workstation map to the platform asset types instead of defaulting to Other
• Axonius V2 get_queries command to list the saved queries defined in Axonius and save their definitions to a JSON file

Changed

• eMASS POA&M workbook import now reports failed milestone custom field saves as errors instead of reporting success
• jcam import_controls states outcomes the mapping already decided (a Control Origin or Implementation Status written under the plan's own label, or a Control Origin or applicability answer in the Status column) once per run with a count and the plans it covered, instead of once per control
• A paginated RegScale issue fetch that loses a page now stops instead of carrying on with the issues that did arrive, so nothing acts on a partial list
• A JCAM POA&M export or GitLab issue sync stopped by an incomplete RegScale issue fetch now exits with code 6 (upstream unavailable) instead of completing on a partial list, and a Wiz retention reconcile, outdated-issue closure or scanner control assessment skipped for the same reason (control assessments and statuses are then not written rather than passed) counts as a partial failure, so REGSCALE_STRICT_EXIT_CODES=1 reports it as exit 3
• Compliance syncs now explain when issues are not created because complianceCreation is set to Assessment, and AWS compliance sync help text describes when issues are created for failed controls
• AWS Security Hub commands report progress while pulling findings (pages, findings and elapsed time every 30 seconds) instead of staying silent until the pull finishes, and say how many findings a --tags filter kept
• Plan-field routing summaries list how many records each security plan received, and name only the 20 unmatched, ambiguous or shared identifiers with the most records (with a count of the rest) instead of every one; the full lists are logged at DEBUG
• Guidance now says not to import defusedxml in new code; use hardened lxml for customer-supplied XML
• Wiz commands now honor the customCaCert setting and the SSL_CERT_FILE and REQUESTS_CA_BUNDLE environment variables, and report a clear error when the named CA bundle cannot be read

Fixed

• CLI log output redirected or piped to a file is now plain, readable text instead of being polluted with color escape codes
• Progress bars no longer write redraw characters into redirected or piped log files
• jcam no longer reports a "Non-Cloud System" cloud descriptor as a value with no RegScale equivalent; it sets no cloud flags, as before, without a warning
• eMASS Control Information workbook import now reads Army and DISA-format workbooks, which have no Application, Database or Operating System Layer columns, without writing values into the wrong fields
• eMASS Control Information workbook import no longer resets a control's assessment frequency when the Frequency cell is blank
• eMASS workbook detection now recognizes Control Information workbooks by their column headers
• eMASS hardware/software inventory import no longer creates facilities during a dry run
• eMASS POA&M workbook import now finds the data sheet in Army and DISA-format workbooks that have no sheet named POA&M
• jcam check_config now reports a failed JCAM read, including an unset jcamToken or jcamURL, as a failure rather than as an empty tenant or a jcamFilter problem, and exits non-zero when JCAM cannot be read, since an import would stop on the same read
• Issue fetches by security plan no longer return each issue past the first 50 twice, and no longer return a partial list as if it were complete when a page fails, so the JCAM POA&M export, GitLab issue sync, Wiz retention and scanner control assessments stop acting on incomplete data
• eMASS system export import no longer deletes a tenant's existing information types when creating missing ones
• Information type lookups no longer fail when a type on the tenant has no description
• Nessus imports no longer close assets or findings for hosts in a file that failed to parse, report the file as an error, and leave it in place so the next run retries it
• Vulnerability mop-up now runs on the last request of an import even when the finding count is an exact multiple of the chunk size or the last chunk holds only compliance findings
• The --scan_date option is honored on Nessus imports, and each file keeps its own scan date when none is given
• Nessus vulnerabilities that carry only a CVSS v2 score now import with that score in the CVSS v2 field instead of 0
• The Tenable.io minimum severity filter now treats critical as 9.0 and accepts moderate
• Nessus software inventory is now built from the downloaded CPE dictionary, and a failed dictionary download is reported and no longer removes the existing one
• A Nessus import that finds no files now exits with a failure status
• A finding that appears in more than one Nessus file is no longer imported as a duplicate issue
• The Nessus CPE dictionary download now honors the sslVerify setting
• Flat-file imports no longer crash when the operating system column contains only numeric values
• Nexpose import now accepts the Rapid7 InsightVM CSV export headers without a manual column mapping
• Xray import now reads JFrog Xray native JSON exports that wrap findings in a top-level rows list
• eMASS POA&M sync now reports updated POA&Ms separately from newly created ones
• eMASS API full system sync with --dry-run no longer pushes controls and POA&Ms to eMASS
• The CLI's log file now records a timestamp and level on every log record, so a long run can be diagnosed from the file afterwards
• Routed Security Hub syncs (sync_securityhub_by_plan_field, sync_securityhub_by_component_map) run without --fallback_ssp_id now keep only the findings that reach a security plan while reading, instead of holding every finding in memory first, so a multi-account pull where most findings route to no plan stays small; with a fallback plan, unmatched and untagged findings are still held because the fallback receives them
• Axonius V2 saved-query sync now works against Axonius 6.1.67
• Qualys sync no longer changes the status or due date of vulnerabilities and issues that were marked accepted, excepted or otherwise set by a person
• Scanner imports that merge several findings into one record now keep any internet exposure, known-exploited and exploit flags, the highest EPSS score and severity, and the earliest first-seen date from every finding instead of only the first
• eMASS POA&M pushes no longer update an unrelated eMASS POA&M when a RegScale issue has no exact match
• The AWS evidence commands (sync_s3, sync_cloudtrail, sync_ssm, sync_cloudwatch, sync_cloudwatch_ex, sync_guardduty, sync_iam, sync_kms, sync_ec2, sync_org, sync_ecr, sync_inspector, sync_directory_services) and wiz compliance_report and wiz sync_compliance now fail the run when RegScale does not accept the evidence record or its file, with exit code 4 for a permission refusal and 6 when RegScale cannot be reached
• Evidence created by connector commands such as Entra ID evidence collection, the Wiz compliance report, and the AWS and GCP evidence commands is no longer rejected on instances with evidence approval enabled, because the CLI no longer sets the running user as the evidence approver
• Listing threats by parent and reading, updating or deleting privacy records no longer fail with a KeyError
• Mock service settings in init.yaml are now applied to Tenable, Microsoft Defender, AWS and BigQuery requests
• Updated Python and OpenSSL in the FIPS container image to patched versions
• Fixed AWS Systems Manager compliance totals, which were always reported as zero compliant and zero non-compliant
• Wiz host configuration findings recorded their first-seen date as the sync time instead of the date Wiz first saw them
• Entra ID evidence collection for the authentication evidence type now saves the authentication methods policy instead of failing with a missing key error
• The Threat model's record count endpoint template now points to the route the API serves
• Tanium sync now records each consolidated vulnerability against the same host on every run instead of a randomly chosen affected host
• Workflow action, workflow instance and workflow template models can be imported again
• Tenable.sc JSONL sync now stores a finding whose plugin name is empty but that carries a CVE or plugin id, under a title derived from the CVE and synopsis
• Tenable.sc JSONL sync now logs a warning naming the file and line of a finding it skips because the finding has no plugin name, CVE or plugin id, or is missing a required field, instead of dropping it silently
• The API-call summary logged at the end of a scanner sync is now emitted at DEBUG instead of INFO
• A vulnerability batch chunk the server refuses over one bad record no longer loses the issues and asset links of the records it retries one at a time; they go through the same batch route as the rest
• A Tanium vulnerability consolidated from several records now reports the earliest first-detected and the latest last-detected date across those records
• defender collect_entra_evidence, gcp collect_evidence and gcp sync_findings --generate-evidence now fail the run (exit code 1, 4 for a permission refusal, or 6 when RegScale cannot be reached) when RegScale does not accept an evidence record or its file, after finishing the remaining evidence, and the error line for a refused evidence record now names the record and gives RegScale's reason

Added

• Wiz syncs can skip vulnerability and end-of-life findings on container images that exist only in a registry and that no workload runs, by setting wizDropUndeployedRegistryImages to true
• Wiz vulnerabilities now show, in their plugin output, how many Wiz issues each finding contributes to by severity and whether a container image was scanned from its registry or a running workload
• eMASS system export import now accepts the eMASS export .zip directly, including its artifact files
• Plan-field routing can match a plan field that lists several identifiers, such as every ComponentID of a system, with --plan-match-multi-value, and can treat named prefixes such as COMP- as not part of an identifier with --ignore-id-prefix; aws sync_findings_by_plan_field supports both
• Axonius v2 can route assets and findings to security plans by a plan field that lists several identifiers, such as a system's Component IDs, with the new sync_assets_by_plan_field and sync_findings_by_plan_field commands, which sync an identifier that two plans list to both and close records that left a plan unless --suppress-mop-up is given
• Scanner integrations can now pass KEV, internet reachability and EPSS data through to vulnerabilities for FedRAMP VDR evaluation
• Evidence, Change and AppGroup models include the new platform fields externalKey, canApproveChanges and canRequestChangeApproval

Changed

• eMASS system export import now exits with an error status when the import records any error, so scheduled runs no longer report a failed import as successful
• eMASS CAC authentication now uses the OpenSSL 3 PKCS#11 provider instead of the deprecated OpenSSL engine interface, and works through a tunnelling proxy
• Asset syncs run their per-asset follow-up lookups in parallel for faster imports
• Faster vulnerability imports by leaving vulnerability-to-asset links to the platform instead of creating them a second time from the CLI
• Security Hub compliance runs routed by plan field now report how many finding resources were left out of every plan's control assessments

Fixed

• Re-importing an eMASS system export no longer duplicates control tests and test results
• eMASS system export import now assigns new controls to the Security Plan's System Owner or ISSO and new assessments to the matched eMASS tester, ISSO, or System Owner instead of the importing user
• eMASS system export import no longer reads artifact files from outside the export folder
• Imports that run past midnight no longer risk closing findings that the same import had just created
• Importing the same eMASS system into more than one Security Plan no longer moves POA&Ms from one plan to another
• eMASS system export import now sets POA&M statuses the tenant actually offers, no longer blanks a POA&M's Identification on re-import, and keeps the system acronym on tenants without a DoD package
• eMASS system export import now imports POA&Ms on DoW tenants, with their due dates, owners, status and severity, and records control narratives, statuses and Not Applicable results correctly
• JCAM information types now match RegScale information types whose titles carry SP 800-60 section numbers or spell "and" as "&", re-importing no longer detaches information types from their plan, and a plan whose information types match none is reported as failed