ROH 6.34.3.2 Release

Release Overview

• Release Name: ROH Hotfix Release.
• Release Type: Hotfix.
• Release Number: 6.34.3.2.

Purpose

RegScale Orchestration Hub (ROH) enables organizations to automate the import and export of data between RegScale and external systems through configurable integrations and commands.

This hotfix release is for customers who stay on the 6.34.3 line. It updates the web server and the Python dependencies in Orchestration Hub to versions that fix known vulnerabilities. It does not change how Orchestration Hub works.

Maintenance and Updates

• Updated web server. The application image now ships nginx 1.30.6 from nginx.org. The earlier image shipped nginx 1.20.1, which contains known vulnerabilities that its operating system vendor does not fix.
• Updated Python dependencies. This release updates several Python dependencies, including PyJWT, aiohttp, pillow, urllib3, tornado, graphql-core and OpenTelemetry, to versions that fix known vulnerabilities.

Deployment Notes

This release has the same platform requirement as 6.34.3.0: RegScale 6.34.3.0 or newer.

• Upgrade all Orchestration Hub containers. The dependency updates are in both the application image and the worker image. Upgrade every Orchestration Hub container to 6.34.3.2.
• Upgrading from 6.34.2.0 or 6.34.2.1 includes 6.34.3.0. Read the 6.34.3.0 Deployment Notes before you upgrade.

No other configuration change is required.

[6.55.0] - 2026-10-22

Added

• DevSecOps release and deploy Change records can now be completed directly, sent for policy approval, or always routed to the CCB per change type with change.approval_by_type or --approval-mode
• Added Python 3.15 support and updated CI test matrices and wheel bounds
• otxUrl setting (environment variable REGSCALE_OTX_URL) that points alienvault ingest_pulses at another AlienVault OTX server, defaulting to https://otx.alienvault.com

Changed

• • Packaging and dependency management migrated from Poetry (poetry-core and poetry.lock) to uv (hatchling and uv.lock) for faster dependency resolution and container builds
• DevSecOps Emergency release and deploy Change records now go to the CCB by default (change.approval_by_type.Emergency: ccb), where a policy reject is reported but does not fail the job; set it to request to keep the policy engine's decision
• Removed the unused regscale-dev update_docs command, which pushed per-integration markdown to readme.io and Confluence
• Behavior change: set_permissions load now exits with an error after trying every row when the platform rejects a row or a row holds an invalid value, where it previously logged a warning and exited 0
• The set_permissions load command now keeps a record's current visibility when its public | private cell is blank and rejects rows with an unrecognized visibility, access level or ID, where a blank or mistyped visibility previously made the record public
• A wiz compliance_report run whose failing controls all span several resources now sends its issues, so like other runs it closes open "Scanner Integration" issues on the plan that it does not report, including issues for controls that now pass and those of the AWS compliance commands on the same plan

Fixed

• • Dependency lock updated so virtualenv is on its latest release
• devsecops change request-approval now reports the Change status and policy mode the platform returns, fails the job only for a rejection the platform enforced, and never leaves the JSON status empty
• JCAM imports now report records they could not import, so REGSCALE_STRICT_EXIT_CODES=1 exits 3 for those instead of 0
• The set_permissions load command now applies group permissions and public visibility on platform 6.29 and later
• regscale import assessment_linker now exits 1 with an error when RegScale returns only part of the assessment list, instead of linking a partial set and exiting 0
• The qualys diagnostics command keeps working after its supporting module has been imported
• AWS Security Hub syncs now report assets and findings they could not process, so REGSCALE_STRICT_EXIT_CODES=1 exits 3 for those instead of 0
• • A second import on the same day now closes the findings it no longer reports: integrations on the shared scanner vulnerability builder (CrowdStrike, Rapid7, Tenable.io and others), the legacy Axonius sync and the direct (non-scanner) vulnerability path of the Qualys CIS report import scope mop-up to one run instead of the date. Trivy, Grype, Nessus, Qualys VMDR and the scanner-integration path of the Qualys CIS report import keep their existing source-and-day scope
• The legacy Axonius sync sends all FISMA ids of a plan together and asks for mop-up once, on the plan's last batch, and not at all when a batch was rejected, so one FISMA id or batch no longer closes records another still reports
• Flat-file folder imports (Nexpose, Snyk, Aqua, Veracode, XRay, ECR, Inspector, Qualys file scans, etc.) are one run: every file shares one batch id and only the last file closes or retires what the import did not report, so one file no longer retires another file's assets
• gcp sync_findings no longer lands a passed control assessment for a control that an open Security Command Center finding in the same run maps to, or for a category that has an open finding; before, only the finding's own control-and-category check was withheld, so the control's other checks landed passed while gcp sync_compliance failed it. The run now logs how many passed control assessments it withheld.
• wiz vulnerabilities now imports cloud configuration findings that Wiz returns with no resource, such as Microsoft Defender for Cloud findings on AKS pods and containers, against the plan with the affected workloads listed on the finding, instead of dropping them and sometimes their whole rule without a trace
• wiz compliance_report now raises an issue for a failing control whose failing checks name several resources
• A run that reads only part of its source no longer sets the plan's other assets Inactive. Each child of an Orchestration Hub split job (--offset / --limit) of bigquery sync_assets_bq, wiz inventory or aws sync_assets, a wiz inventory --filter_by_override run, and an aws sync_assets --account_id / --tags run now leave alone the assets outside their slice or scope. A full, unscoped run still sets Inactive the assets that left the source.
• AWS sync_findings in consolidated mode now creates one vulnerability per Inspector CVE and one per GuardDuty finding type instead of merging each product's findings into a single record, and the next unscoped sync closes those old catch-all records
• The AWS compliance commands (aws sync_s3, sync_kms, sync_cloudtrail and the rest) and wiz compliance_report no longer close each other's open issues or set each other's assets Inactive on a shared plan, and aws sync_findings_and_assets no longer sets Inactive the aws sync_assets assets its findings do not name. Because these compliance commands share one source, they also no longer close their own issues for controls that now pass; close those by hand until each command gets a source of its own
• Compliance commands that run one after another on the same day and assess the same control (for example aws sync_s3 and then aws sync_kms on SC-28) no longer overwrite each other's assessment. The assessment fails when any command failed the control, its title names each command and its result, and a command that runs again that day replaces only its own result. Two commands that run at the same time can still overwrite each other.
• Fixed aws sync_cloudwatch --account_id, which collected no log groups and still reported success; it now keeps the log groups in that account, and an unexpected error while reading log groups now fails the sync instead of being logged and dropped (denied access and a log group deleted mid-run are still skipped)
• AWS sync_ssm now reads every page of each managed node's patches, so SI-2 fails when a node's missing patch is past the first 50 records
• AWS sync_cloudwatch and sync_cloudwatch_ex now fail a control when more than 20 % of log groups fail it, the same rule as the other AWS compliance commands, so AU-6, AU-9, AU-11, AU-12 and SI-4 assessments that passed only because one log group passed are rewritten as Fail on the first run after upgrading
• gcp sync_compliance no longer marks a control Pass or Fully Implemented when no SCC finding maps to it, and fails SI-2 while active CVE (SOFTWARE_VULNERABILITY) findings exist
• Wiz inventory and stig_checks now leave an asset's Disk Storage (GB) at 0 instead of filling it with the virtual machine's disk count, so existing Wiz assets show 0 after their next sync
• gcp sync_findings now imports SCC findings that map to no NIST 800-53 control, including every SOFTWARE_VULNERABILITY (CVE) finding, instead of dropping them with a DEBUG log line. CVE findings carry their CVE id and CVSS v3 base score and are keyed on their SCC finding name, so CVE findings that share a console link stay separate. CVE findings are linked to the asset for their resource, and the run reports at INFO how many findings had no control mapping. Findings SCC marks INACTIVE (remediated) now land Closed instead of Open and no longer fail their mapped control tests.
• Every aws command now exits 4 (authentication failure) when AWS refuses its credentials, none are found or the named profile does not exist, before it reads or writes anything, instead of reporting "completed successfully" and syncing an empty inventory
• Scanner syncs with issueCreation: PerAsset now create one issue per affected asset instead of one issue per CVE linked to every asset
• Nessus imports of several historical scans on one day now close findings that a newer scan no longer reports
• Qualys sync_qualys --include-was now keeps each web application finding's severity (5 Critical, 4 High, 3 Moderate, 2 and 1 Low, matching VMDR) instead of landing every one as Medium
• Qualys sync_qualys --include-was now dates each WAS vulnerability first and last seen, and its issue first detected, from the finding's firstDetectedDate / lastDetectedDate instead of the time of the run
• Tenable.io finding sync now honours the --severity option and syncs only findings of the chosen severity, without closing findings of other severities
• • Prisma Cloud sync_hosts / sync_images --use-csv no longer create a "Prisma Cloud Vulnerability" vulnerability and issue for a host or image with no vulnerability; the export's blank-CVE row now yields only the asset
• Wiz inventory no longer uses the raw lower-case provider resource type (for example microsoft.app/containerapps/containers) as the software name of a container Wiz has not classified yet; it falls back to the parent-based name until Wiz reports the technology
• Tenable.io compliance sync now marks a control as failing when any check citing it fails, not only the first check
• Prisma sync_hosts and sync_images with --enable-software-inventory now create software inventory from each asset's SBOM instead of only logging a note to run sync_sbom
• AWS asset syncs now record a Lambda function's language and its full runtime version, such as python and 3.12, instead of only the last part of the runtime
• tanium sync_compliance and tanium sync_all assess a control whose only Tanium Comply findings are not applicable (any spelling, such as NotApplicable, NOT_APPLICABLE or NA) as Not Applicable, instead of failing it for NotApplicable or passing it for NOT_APPLICABLE and NA, and tanium sync_findings no longer raises an open issue for a NotApplicable finding
• aws sync_compliance --no_use_enhanced_analyzer now assesses controls from AWS Security Hub evidence: passing checks (PASSED) count as compliant, and evidence status values match regardless of case
• wiz vulnerabilities no longer closes a Wiz rule while it is still failing on any of its resources
• A findings run that reads only part of its source (--offset / --limit, as an Orchestration Hub split job passes to each child) no longer closes the plan's vulnerabilities and issues outside that slice. Before this fix, wiz vulnerabilities --limit 1 closed every other open Wiz vulnerability on the plan along with its issue. A run with no slice, or with --offset 0 alone, still closes what the source stopped reporting.
• Tenable.sc imports now create one vulnerability per CVE for a finding that lists several CVEs, instead of one vulnerability carrying a CVE that changed from run to run
• • Tenable.sc sync_jsonl no longer lands a record below tenableMinimumSeverityFilter (such as an Info record under the default low) as a Low vulnerability; it is skipped, as query_vuln already does, and is not counted as a parse failure
• The AWS compliance commands (aws sync_s3, sync_kms, sync_iam, sync_cloudtrail, sync_cloudwatch and the rest) no longer set the plan's other assets, Off-Network ones included, to Inactive when a re-run creates an asset. They no longer retire assets at all, so an asset whose resource AWS stops reporting stays as it is: run aws sync_assets (on a schedule if needed) to retire those.
• A repeat tenable io sync_assets run no longer marks Inactive the assets Tenable has not changed since the previous sync; each run now reads the full Tenable asset inventory before retiring missing assets
• tenable io sync_findings no longer misses Tenable findings on a plan that other connectors also sync: its incremental findings export now starts from Tenable's own last sync rather than the newest scan by any connector. A run that closes findings not in the scan now exports every open finding, so findings Tenable has not re-observed since the last sync are no longer closed.
• The AWS compliance sync commands no longer update control assessments or implementation statuses when a run reads only part of the plan, scoped by --account_id, --tags, a name filter (--bucket_name_filter, --trail_name_filter, --log_group_prefix, Audit Manager --resource_tags) or an --offset/--limit slice; such a run still syncs assets, findings and evidence, and a run without those options assesses the controls as before
• Re-running a compliance command (wiz compliance_report, the AWS sync_s3, sync_kms, sync_cloudtrail, sync_iam, sync_ssm and sync_org evidence commands, and the other compliance integrations) no longer resets what a user set on its existing issues: a basis for adjustment and a due date are kept, and an issue closed as a false positive stays closed
• AWS sync_s3 now judges AU-9 only on buckets that store S3 access logs, which pass when versioned with public access blocked and a private policy, instead of passing every bucket
• AWS sync_guardduty now fails IR-5 when no GuardDuty detector is enabled instead of passing it on every run
• AU-9 results that earlier versions of aws sync_s3 recorded as Pass for buckets that do not store S3 access logs are not removed by a new sync, so review those assessments after upgrading
• Tenable.io asset sync now stores the first IPv4 address in IP Address and the first IPv6 address in IPv6 Address instead of a comma-joined list of every address
• AWS asset sync with --tags now collects the Inspector coverage and findings of the tagged resources instead of none, and an Inspector request the AWS SDK rejects now fails the run rather than ending in success
• regscale aws sync_findings and sync_findings_and_assets now honour the simple category form of aws.inventory.enabled_services (for example storage: false), which they used to ignore: findings on resources of a category turned off that way are no longer imported
• regscale aws sync_assets now honours aws.inventory.enabled_services: a category or service turned off in init.yaml is no longer collected or synced as assets, and its existing assets are kept rather than marked Inactive
• AWS asset and GuardDuty syncs run with --account_id now keep the account's GuardDuty detector instead of dropping it
• Fixed aws sync_assets --account_id and --tags, and aws sync_s3 --account_id, so S3 buckets, load balancers and ACM certificates outside the chosen account or tags are no longer imported
• AWS evidence syncs (KMS, IAM, Organizations, EC2, GuardDuty, ECR, Inspector and Directory Services) now assess the plan's controls when --framework differs from the plan's framework, and warn when no AWS check maps to a control in the plan
• Updated certifi to 2026.10.19 to remove trust in compromised root certificate authorities (GHSA-6q48-6c7w-9gw2)
• Updated pillow to 13.0.0 to fix eight security vulnerabilities, six rated high
• DRF import now matches a DR Number cell with leading spaces to its trimmed value, and reports a non-empty row whose DR Number cell is empty, not text or not a DR number as skipped (with the reason) instead of dropping it silently
• Updated virtualenv to 21.14.7 to fix two security vulnerabilities (CVE-2026-113725, CVE-2026-113726)
• • Veracode XML import now brings in the CWEs of every severity and category in the detailed report, each at its own severity, and no longer fails on a severity with two categories or a category with one CWE
• • show_mapping for aqua, aws, ecr, veracode and every other vendor registered without a file type now reports a missing --file_path as a usage error instead of failing with a TypeError
• Snyk JSON imports no longer skip a vulnerability that has no CVE
• Snyk JSON imports now carry each vulnerability's description and its upgrade and patch remediation
• Uploaded .xml files are stored as application/xml on every host and .sarif files are accepted for upload
• oscal catalog now imports the catalog on Click 8.3 and later instead of failing with "'int' object has no attribute 'strip'" before contacting RegScale when --obj_to_controls or --fedramp is left out
• FedRAMP Appendix A import now creates control implementations for catalogs whose control IDs are lowercase or zero-padded, such as OSCAL catalogs
• OpenText WebInspect import now imports the finding from a scan file that holds a single issue
• OpenText WebInspect import no longer drops an issue that has a single report section, or the issues that follow it in the same scan file
• alienvault ingest_pulses now ends with a clear error instead of a traceback when the request to AlienVault OTX fails or returns an error status, and no longer stops on an existing threat that has no notes
• • RSA Archer commands now print one error line and exit 4, 5 or 6 instead of a traceback when Archer rejects the login, a setting or mapping file is invalid, or Archer cannot be reached; upgrading now adds the archer* settings to an existing init.yaml
• SSP XML import now saves the same, complete set of catalog implementation options on every run instead of a varying number with duplicates
• Databricks pull_data now accepts read-only queries that mention words such as created_at, start with WITH or a comment, while still refusing every statement that writes, and, when no HTTPS proxy is in use, fails within seconds on a host that does not resolve or refuses the connection instead of waiting about 15 minutes
• SAP Concur Tenable import now links each issue to the asset of its row when the row has a Host ID. With issueCreation set to PerAsset, the first sync after upgrading closes the existing issues for rows with a Host ID and recreates them keyed by Host ID; these closures are a one-time re-key, not remediations.
• FedRAMP SSP imports now log a failed step and continue with the remaining steps instead of stopping with an AttributeError

[6.54.0] - 2026-10-19

Added

• The JSON run summary from --output json now reports the run duration and the CLI peak memory use
• Optional scannerPrefetch setting that fetches vendor findings and assets in the background while earlier ones are processed, speeding up scans against slow vendor APIs
• ServiceNow incidents can now carry selected RegScale issue properties, mapped to ServiceNow fields with the new snowIssuePropertyFields setting
• STIG checklist import now reads CKLB files from STIG Viewer 3 as well as CKL files
• JCAM POA&M import with the recommended mapping profile now records each milestone's JCAM status on the RegScale milestone's Status field
• Wiz vulnerability imports now send CISA KEV status, EPSS probability and internet exposure to RegScale for FedRAMP vulnerability ratings, and newly created assets with no Wiz exposure data are no longer marked as not public facing
• Tenable and Nessus imports now pass exploit availability and asset roles from scan data, and Nessus file imports also pass CISA KEV status and CVSS v3 vectors, for FedRAMP vulnerability evaluation
• Nexpose CSV import now supplies exploit availability and CVSS v3 vector data for FedRAMP VDR evaluation when the export includes those columns
• JFrog Xray import now records container image artifacts as container assets
• Axonius v2 pulls now log progress while reading devices and vulnerabilities, with a closing line giving the count and elapsed time
• DevSecOps change open can give the Change its parent record's security with --inherit-parent-security, or make it public with --public, and reports the result in its JSON output
• New wizReportWaitTimeout setting (default 3600 seconds) caps how long Wiz compliance_report waits for Wiz to build the compliance report

Changed

• Paginated RegScale GraphQL queries reuse connections across pages instead of opening a new TLS connection for every page
• The CLI now waits as long as the RegScale platform asks when it is rate-limited or temporarily unavailable, instead of giving up after a few quick retries
• The CLI no longer runs external commands through a system shell, and the Flask API debug mode now listens on the local machine only
• Large asset syncs send assets to RegScale in chunks of 5,000 as they are processed, roughly halving peak memory instead of holding the whole inventory until the end
• Reading large sets of issues and mappings from RegScale is faster and no longer stops at 500,000 records, by paging through them in record-ID order
• Faster CISA KEV due-date and KEV flag lookups during scanner imports, and lower memory use on long syncs that process many records
• Scanner integrations use about 70% less memory per finding and asset and build them more than twice as fast, so very large imports fit in less RAM
• Faster processing of large batch create and update responses from RegScale
• Faster CLI startup: regscale --help and regscale --version respond about five times sooner because heavy libraries now load only when a command needs them, and configuration loads faster by parsing init.yaml with the native YAML parser and reusing the parsed file while it is unchanged
• Customer-supplied XML files (Nessus scans, CCI lists, FedRAMP documents, file uploads and data transformer inputs) are now parsed with a hardened parser that refuses external entities and entity expansion, and Nessus files parse about twice as fast
• STIG checklist (.ckl and .cklb, including s3:// paths) findings are now imported through the platform's checklist import endpoint on RegScale 6.31 or later, which creates the issues for failed checks; older platforms keep the previous client-side .ckl import
• Burp import now records scanned targets as web applications and no longer marks newly created targets as not internet-facing, so FedRAMP VDR reachability is evaluated by the platform
• The jcam export_poams --preview help now explains that a plan whose issues could not be read completely is shown as skipped
• Axonius v2 sync commands now reject --tags and --aql-filter with --mode saved-query instead of silently ignoring them
• The FIPS container image ships pre-compiled Python bytecode, so a fresh container starts commands up to two and a half times faster
• Tanium sync_all now stops at the first step whose Tanium fetch fails, while an on-prem server without Tanium Comply still syncs with a warning
• Tanium sync_assets, sync_findings, sync_compliance and sync_all now exit 6 when fetching from Tanium fails (4 when Tanium refuses the token) instead of reporting success
• CrowdStrike and Jira commands no longer hang on a vendor that stops answering: they fail with exit code 6 after a read timeout set by the new crowdstrikeTimeout and jiraTimeout settings (300 seconds by default)
• Azure AD sync, Intune and the Splunk Entra ID proxy login no longer hang when Microsoft Entra ID stops answering a token request: they fail with exit code 6 after a read timeout set by the new entraTokenTimeout setting (300 seconds by default), and an Azure AD sync authentication failure now exits with code 4 instead of 3
• Tenable.io io commands, AWS sync_assets and sync_ssm, and Defender collect_entra_evidence now exit 6 when the vendor does not answer or fails (4 when it refuses the credentials) instead of exiting 0 as if the run had succeeded; scripts that read the exit code will now see these failures
• Wiz compliance_report now exits 6 (4 when Wiz refuses the credentials) instead of 0 when the compliance report cannot be created, fails, or does not finish in time, and exits 1 when Wiz returns no report; scripts that read the exit code will now see these failures, and no assessments are written for a report that never arrived
• Commands that read RegScale data now fail with a non-zero exit and a message naming the module when the account lacks Read permission on it, or when the server rejects the query, instead of syncing nothing or a partial set

Fixed

• Synqly connector parameter types are now resolved from a fixed list instead of being evaluated, and Prisma SBOM archives skip special files and strip unsafe permission bits on every supported Python version
• Fixed a crash on macOS when a command used the built-in cache together with BigQuery or other Arrow-based data loading
• GCP Security Command Center sync no longer omits passed control assessments for controls that failed in an earlier run within the same process
• Salesforce case and attachment queries now escape their filter values, and BigQuery table names and row limits from configuration are validated before they are placed in a query
• A Microsoft Sentinel sync that fails while writing to RegScale no longer causes the next incremental sync to skip the incidents and alerts it did not write, and entity evidence is filed only after a successful write
• Custom form field saves rejected by the network edge are now retried, the Wiz sync names the assets whose form fields were not saved, and HTTP error pages are logged as one short line instead of the full page
• Wiz sign-in messages and help text name Wiz instead of the commercial Wiz.io service, which misled Wiz for Government users
• Wiz syncs no longer reuse an empty cached result, and a run against a different Wiz server no longer reads another server's cached data
• Wiz STIG check sync now imports only hosts in the selected Wiz project, and keeps a separate cached result per project
• Wiz issue sync no longer marks a rule False Positive or Risk Accepted while Wiz still has open issues for it
• FedRAMP DRF import no longer logs a misleading schema-drift warning when it adds a DR Number property
• JCAM mappings that send text to a Facilities field are now reported by check_config and dry_run, and stop imports, instead of writing a value that matches no facility
• JCAM artifact imports summarize missing tags and explain how to create them before importing
• Missing or invalid dates no longer default to the current date
• Listing risks returned none against current RegScale versions because the risk model still requested eight fields the platform removed
• DevSecOps runs in a GitHub merge queue now use the pr stage and the queue's base and head commits, and the DevSecOps GitHub Actions install the CLI into a per-run virtual environment, keep bundle artifacts for a configurable 30 days by default and deprecate cli-version latest
• JCAM mappings that send text to a Users or Organizations field are now reported by check_config and dry_run, and stop imports, instead of writing a value that matches no user or organization
• JCAM mappings that send text to a Compliance Setting, Related Policy, Risk Model, Profile, Threat Model or Program field are now reported by check_config and dry_run, and stop imports, instead of writing a value that matches no record
• CrowdStrike incident sync now records the device serial number on the assets it creates
• SentinelOne commands that run without an API token now fail with a message that names the missing sentineloneToken secret, instead of an illegal request header error
• Workflow instance filtering in the Python models calls the API route the platform serves
• Prisma Cloud CSV-mode host sync now creates an asset for every host and attaches its findings to it, instead of creating no host assets
• Prisma Cloud syncs that upload findings in more than one chunk no longer close the earlier chunks' vulnerabilities at the end of the run
• rebuild_resolved_guidance now rebuilds exactly the resolved guidance the platform stores: it accepts the PascalCase guidanceStack keys the platform writes, labels every layer with its source name (a Baseline profile layer shows the profile name, not "Base Guidance"), skips layers with blank guidance, and appends the [Local Override]: <justification> line when given the implementation's local tailoring flag and justification
• AWS, Tenable.io and Wiz compliance report downloads no longer spend 12 to 20 minutes retrying a vendor that stopped answering: each now gives up after one read timeout, set by the new awsTimeout and tenableIoTimeout settings or the existing wizTimeout setting
• Jira task sync now logs each task that fails to create, update or close, and no longer counts it in the sync summary
• Nessus import now counts the remediation due date of STIG and compliance findings from the scan date instead of the import date
• Published Docker images are now built from the released commit, so they report the release's own version
• FedRAMP DRF import now saves decimal Adjusted CVSS Scores such as 6.1 to the deviation's Adjusted CVSS Score instead of dropping them or writing them to the Environmental Score
• FedRAMP DRF import now clears the CVSS Base Score for an empty or invalid cell instead of writing 0, keeps the stored score for the export's placeholder text, and keeps deviation fields the workbook has no column for (such as the Temporal Score) on re-import; the DevSecOps SAR publish now reads padded or signed compliance scores instead of sending 0
• FedRAMP DRF import no longer stops when a stored deviation has no DR number, and a re-import keeps a deviation field whose column the workbook does not have instead of clearing it
• FedRAMP DRF re-import updates a POA&M's only stored deviation that has no DR number, and stamps the row's DR number on it, instead of creating a second deviation on the issue
• FedRAMP DRF import no longer moves a deviation to another POA&M when its DR number belongs to a different issue, no longer adds blank or duplicate DR Number properties, and now matches against every stored deviation on a POA&M
• Axonius and legacy ServiceNow issue sync no longer fail when RegScale reports that the parent record has no readable issues
• FedRAMP DRF import no longer creates two deviations and two DR Number properties when one new DR number appears for two POA&Ms (the later row is skipped and reported), lists rows skipped for a DR-number conflict in the import report, no longer fails when no module is given, and loads every deviation of each POA&M from servers that offer it

Administration

[Action Required] Legacy service account tokens expire 30 days after upgrading to v6.35.0.0 or to v6.34.4.0

As part of ongoing security improvements to service accounts, a limited set of legacy tokens will expire 30 days after you upgrade. RegScale administrators will receive an email that lists each affected service account, the date its token stops working, and instructions to rotate it. The email repeats weekly, then daily for the last three days, until each account is addressed. If you don't receive the email, no action is needed.

Once a token expires, any integration, script, or pipeline that uses it will fail with a "401 Unauthorized" error. Rotation steps are included in the notification email and are also available from your account team. After rotating, if an integration fails with a "403 Forbidden" error, verify or reconfigure the service account role and application access.

Granular Subsystem Access in Group Permissions: Group permissions in application management now support granular access configurations to the files subsystem supporting each module. This enables more precise role-based access controls, so organizations can grant users only the access their role requires.

Preset Configuration Templates: Load relevant export templates and form-builder settings into your tenant, ensuring your users only see formatting relevant to their industry or domain across the platform.

• Relevant settings will be applied to Export Groups, Export Templates, Form Tabs, Form Fields, Form Field Dropdown Choices, and Module Rules
• Templates are provided for multiple service lines including Navy, Army, and USAF
• Option available to reset the UI to the original

Compliance Settings: Risk Accepted is now a roll up category in Compliance Settings and the Control Scorecard.

Catalogs

Versioning Update: Catalog versioning is now supported for catalogs of the same UUID. Every update to a catalog from the RegScale repository records a new version of the catalog instead of overriding the previous version.

Guidance Field: Control guidance is now stored separately from control descriptions. Base guidance from OSCAL catalogs is kept as its own field, and supplemental guidance from overlay profiles is captured alongside it. Each control implementation keeps an ordered history of its guidance layers, and the resolved guidance appears on the implementation and feeds narrative generation. Existing fields and customer data are unchanged.

Dashboards

STIG and CIS Benchmarks Reporting Dashboard: The new Compliance Dashboard gives security teams a single view of configuration compliance for a system.

• Summary cards show open findings, high-severity findings, findings without a POA&M, and average compliance, while a per-benchmark grid lets you drill into individual rules. High-severity findings are prioritized in their own list, and each one expands to show the affected hosts.
• A POA&M coverage widget includes a bulk action to create missing POA&Ms, and a severity-weighted CORA score summarizes overall risk.
• The dashboard also shows which scan feeds contributed findings, what carried forward after a benchmark revision, and which reviews have gone stale.

Workflows

Usability Enhancements: A new workflow strip on Record Forms shows progress at a glance, and the Workbench "Steps Assigned to Me" grid has been redesigned. The Alerts drawer is now action-first, so you can act directly from a notification, and a new review screen combines the record snapshot, a live stepper, and a review panel. Labels and step counts have been updated for clarity.

Governance Status Board: A new command center gives you visibility into workflow health across modules. It opens with an executive KPI row and includes a dynamic Kanban driven by each module's statuses, an SLA health matrix with an aging distribution, and SLA views by user and approver capacity and by module. Workflow steps can now be reassigned or reminded, with each action recorded in an audit trail.

Bug Fixes and General Maintenance

This version includes a RS-UI upgrade from Angular 21 to Angular 22.

This release includes security hardening, patching, and fixes that improve reliability, performance, and overall platform stability.

[6.53.0] - 2026-10-14

Added

• Added regscale trust-center evidence push to push JSON evidence to a Trust Center evidence record by its evidence ID
• eMASS commands now report failed records under REGSCALE_STRICT_EXIT_CODES, and the eMASS importers count failed saves, milestones, custom fields and role links they previously only logged
• Axonius V2 sync commands accept KEY=VALUE1|VALUE2 tags and an --aql-filter option for stricter filtering

Changed

• Incremental Wiz pulls re-baseline weekly through the new wizIncrementalRebaselineHours setting so daily syncs stay incremental, and wizFullPullLimitHours now only limits how old cached Wiz data may be
• The wizLastInventoryPull, wizLastVulnerabilityPull, wizLastIssuePull and matching FullPull keys are deprecated and replaced by wizPullWatermarks, and incremental Wiz pulls (wizIncrementalPulls) are planned to become the default in 7.0.0
• Axonius V2 --tags now takes effect by filtering on Adapter Tag values, so runs that previously returned no records or an unfiltered set can return different record counts

Fixed

• eMASS API POA&M, control test result and system mappers no longer fail on every record, and a non-compliant test result is no longer read as compliant
• eMASS POA&M bidirectional sync no longer pushes every POA&M to eMASS twice
• A JCAM URL that answers with anything other than a list of systems, such as a web or login page, an empty body or a bare JSON value, is now reported as a failed JCAM read naming the settings to check
• Incremental Wiz inventory syncs no longer mark unchanged assets Inactive
• Axonius v2 now reads device fields, aggregated values and AWS tags as Axonius 6.1 returns them, so assets sync with their names, addresses and operating systems and route by their AWS tags
• Wiz, Qualys and Tenable.sc syncs no longer hang on a vendor that stops answering: they fail with exit code 6 after a read timeout set by the new wizTimeout, qualysTimeout and tenableScTimeout settings (300 seconds by default), and Tenable.sc no longer waits about 30 minutes and then reports success
• Incremental Wiz pulls keep a separate watermark for each SSP, Wiz project and filter, and move it only after every record is saved to RegScale, never on a dry run
• Wiz Ports and Protocols are no longer skipped after a full inventory pull when incremental pulls are on
• eMASS SLCM import now stops on a security plan or catalog ID that does not exist, and no longer fails on numeric or date cells
• Axonius V2 tag filtering now returns tagged assets and vulnerabilities

Fixed

• Release container images are now cosign-signed and carry a CycloneDX SBOM attestation

This patch re-publishes the container images (the 6.52.0 images were built from an earlier commit and were unsigned); latest and latest-fips move to this build.

Added

• New regscale acunetix import_acunetix command imports Acunetix XML scan exports as assets, vulnerabilities and issues
• JCAM SSP import now logs the RegScale security plan id assigned to each newly created plan, with a count in the run summary
• CrowdStrike Spotlight sync now supplies known-exploited, internet exposure, exploit availability and CVSS vector data for FedRAMP VDR evaluation, and uses the host role to set the asset type
• Scanner integrations share one asset type lookup, so vendor terms such as server or workstation map to the platform asset types instead of defaulting to Other
• Axonius V2 get_queries command to list the saved queries defined in Axonius and save their definitions to a JSON file

Changed

• eMASS POA&M workbook import now reports failed milestone custom field saves as errors instead of reporting success
• jcam import_controls states outcomes the mapping already decided (a Control Origin or Implementation Status written under the plan's own label, or a Control Origin or applicability answer in the Status column) once per run with a count and the plans it covered, instead of once per control
• A paginated RegScale issue fetch that loses a page now stops instead of carrying on with the issues that did arrive, so nothing acts on a partial list
• A JCAM POA&M export or GitLab issue sync stopped by an incomplete RegScale issue fetch now exits with code 6 (upstream unavailable) instead of completing on a partial list, and a Wiz retention reconcile, outdated-issue closure or scanner control assessment skipped for the same reason (control assessments and statuses are then not written rather than passed) counts as a partial failure, so REGSCALE_STRICT_EXIT_CODES=1 reports it as exit 3
• Compliance syncs now explain when issues are not created because complianceCreation is set to Assessment, and AWS compliance sync help text describes when issues are created for failed controls
• AWS Security Hub commands report progress while pulling findings (pages, findings and elapsed time every 30 seconds) instead of staying silent until the pull finishes, and say how many findings a --tags filter kept
• Plan-field routing summaries list how many records each security plan received, and name only the 20 unmatched, ambiguous or shared identifiers with the most records (with a count of the rest) instead of every one; the full lists are logged at DEBUG
• Guidance now says not to import defusedxml in new code; use hardened lxml for customer-supplied XML
• Wiz commands now honor the customCaCert setting and the SSL_CERT_FILE and REQUESTS_CA_BUNDLE environment variables, and report a clear error when the named CA bundle cannot be read

Fixed

• CLI log output redirected or piped to a file is now plain, readable text instead of being polluted with color escape codes
• Progress bars no longer write redraw characters into redirected or piped log files
• jcam no longer reports a "Non-Cloud System" cloud descriptor as a value with no RegScale equivalent; it sets no cloud flags, as before, without a warning
• eMASS Control Information workbook import now reads Army and DISA-format workbooks, which have no Application, Database or Operating System Layer columns, without writing values into the wrong fields
• eMASS Control Information workbook import no longer resets a control's assessment frequency when the Frequency cell is blank
• eMASS workbook detection now recognizes Control Information workbooks by their column headers
• eMASS hardware/software inventory import no longer creates facilities during a dry run
• eMASS POA&M workbook import now finds the data sheet in Army and DISA-format workbooks that have no sheet named POA&M
• jcam check_config now reports a failed JCAM read, including an unset jcamToken or jcamURL, as a failure rather than as an empty tenant or a jcamFilter problem, and exits non-zero when JCAM cannot be read, since an import would stop on the same read
• Issue fetches by security plan no longer return each issue past the first 50 twice, and no longer return a partial list as if it were complete when a page fails, so the JCAM POA&M export, GitLab issue sync, Wiz retention and scanner control assessments stop acting on incomplete data
• eMASS system export import no longer deletes a tenant's existing information types when creating missing ones
• Information type lookups no longer fail when a type on the tenant has no description
• Nessus imports no longer close assets or findings for hosts in a file that failed to parse, report the file as an error, and leave it in place so the next run retries it
• Vulnerability mop-up now runs on the last request of an import even when the finding count is an exact multiple of the chunk size or the last chunk holds only compliance findings
• The --scan_date option is honored on Nessus imports, and each file keeps its own scan date when none is given
• Nessus vulnerabilities that carry only a CVSS v2 score now import with that score in the CVSS v2 field instead of 0
• The Tenable.io minimum severity filter now treats critical as 9.0 and accepts moderate
• Nessus software inventory is now built from the downloaded CPE dictionary, and a failed dictionary download is reported and no longer removes the existing one
• A Nessus import that finds no files now exits with a failure status
• A finding that appears in more than one Nessus file is no longer imported as a duplicate issue
• The Nessus CPE dictionary download now honors the sslVerify setting
• Flat-file imports no longer crash when the operating system column contains only numeric values
• Nexpose import now accepts the Rapid7 InsightVM CSV export headers without a manual column mapping
• Xray import now reads JFrog Xray native JSON exports that wrap findings in a top-level rows list
• eMASS POA&M sync now reports updated POA&Ms separately from newly created ones
• eMASS API full system sync with --dry-run no longer pushes controls and POA&Ms to eMASS
• The CLI's log file now records a timestamp and level on every log record, so a long run can be diagnosed from the file afterwards
• Routed Security Hub syncs (sync_securityhub_by_plan_field, sync_securityhub_by_component_map) run without --fallback_ssp_id now keep only the findings that reach a security plan while reading, instead of holding every finding in memory first, so a multi-account pull where most findings route to no plan stays small; with a fallback plan, unmatched and untagged findings are still held because the fallback receives them
• Axonius V2 saved-query sync now works against Axonius 6.1.67
• Qualys sync no longer changes the status or due date of vulnerabilities and issues that were marked accepted, excepted or otherwise set by a person
• Scanner imports that merge several findings into one record now keep any internet exposure, known-exploited and exploit flags, the highest EPSS score and severity, and the earliest first-seen date from every finding instead of only the first
• eMASS POA&M pushes no longer update an unrelated eMASS POA&M when a RegScale issue has no exact match
• The AWS evidence commands (sync_s3, sync_cloudtrail, sync_ssm, sync_cloudwatch, sync_cloudwatch_ex, sync_guardduty, sync_iam, sync_kms, sync_ec2, sync_org, sync_ecr, sync_inspector, sync_directory_services) and wiz compliance_report and wiz sync_compliance now fail the run when RegScale does not accept the evidence record or its file, with exit code 4 for a permission refusal and 6 when RegScale cannot be reached
• Evidence created by connector commands such as Entra ID evidence collection, the Wiz compliance report, and the AWS and GCP evidence commands is no longer rejected on instances with evidence approval enabled, because the CLI no longer sets the running user as the evidence approver
• Listing threats by parent and reading, updating or deleting privacy records no longer fail with a KeyError
• Mock service settings in init.yaml are now applied to Tenable, Microsoft Defender, AWS and BigQuery requests
• Updated Python and OpenSSL in the FIPS container image to patched versions
• Fixed AWS Systems Manager compliance totals, which were always reported as zero compliant and zero non-compliant
• Wiz host configuration findings recorded their first-seen date as the sync time instead of the date Wiz first saw them
• Entra ID evidence collection for the authentication evidence type now saves the authentication methods policy instead of failing with a missing key error
• The Threat model's record count endpoint template now points to the route the API serves
• Tanium sync now records each consolidated vulnerability against the same host on every run instead of a randomly chosen affected host
• Workflow action, workflow instance and workflow template models can be imported again
• Tenable.sc JSONL sync now stores a finding whose plugin name is empty but that carries a CVE or plugin id, under a title derived from the CVE and synopsis
• Tenable.sc JSONL sync now logs a warning naming the file and line of a finding it skips because the finding has no plugin name, CVE or plugin id, or is missing a required field, instead of dropping it silently
• The API-call summary logged at the end of a scanner sync is now emitted at DEBUG instead of INFO
• A vulnerability batch chunk the server refuses over one bad record no longer loses the issues and asset links of the records it retries one at a time; they go through the same batch route as the rest
• A Tanium vulnerability consolidated from several records now reports the earliest first-detected and the latest last-detected date across those records
• defender collect_entra_evidence, gcp collect_evidence and gcp sync_findings --generate-evidence now fail the run (exit code 1, 4 for a permission refusal, or 6 when RegScale cannot be reached) when RegScale does not accept an evidence record or its file, after finishing the remaining evidence, and the error line for a refused evidence record now names the record and gives RegScale's reason

Added

• Wiz syncs can skip vulnerability and end-of-life findings on container images that exist only in a registry and that no workload runs, by setting wizDropUndeployedRegistryImages to true
• Wiz vulnerabilities now show, in their plugin output, how many Wiz issues each finding contributes to by severity and whether a container image was scanned from its registry or a running workload
• eMASS system export import now accepts the eMASS export .zip directly, including its artifact files
• Plan-field routing can match a plan field that lists several identifiers, such as every ComponentID of a system, with --plan-match-multi-value, and can treat named prefixes such as COMP- as not part of an identifier with --ignore-id-prefix; aws sync_findings_by_plan_field supports both
• Axonius v2 can route assets and findings to security plans by a plan field that lists several identifiers, such as a system's Component IDs, with the new sync_assets_by_plan_field and sync_findings_by_plan_field commands, which sync an identifier that two plans list to both and close records that left a plan unless --suppress-mop-up is given
• Scanner integrations can now pass KEV, internet reachability and EPSS data through to vulnerabilities for FedRAMP VDR evaluation
• Evidence, Change and AppGroup models include the new platform fields externalKey, canApproveChanges and canRequestChangeApproval

Changed

• eMASS system export import now exits with an error status when the import records any error, so scheduled runs no longer report a failed import as successful
• eMASS CAC authentication now uses the OpenSSL 3 PKCS#11 provider instead of the deprecated OpenSSL engine interface, and works through a tunnelling proxy
• Asset syncs run their per-asset follow-up lookups in parallel for faster imports
• Faster vulnerability imports by leaving vulnerability-to-asset links to the platform instead of creating them a second time from the CLI
• Security Hub compliance runs routed by plan field now report how many finding resources were left out of every plan's control assessments

Fixed

• Re-importing an eMASS system export no longer duplicates control tests and test results
• eMASS system export import now assigns new controls to the Security Plan's System Owner or ISSO and new assessments to the matched eMASS tester, ISSO, or System Owner instead of the importing user
• eMASS system export import no longer reads artifact files from outside the export folder
• Imports that run past midnight no longer risk closing findings that the same import had just created
• Importing the same eMASS system into more than one Security Plan no longer moves POA&Ms from one plan to another
• eMASS system export import now sets POA&M statuses the tenant actually offers, no longer blanks a POA&M's Identification on re-import, and keeps the system acronym on tenants without a DoD package
• eMASS system export import now imports POA&Ms on DoW tenants, with their due dates, owners, status and severity, and records control narratives, statuses and Not Applicable results correctly
• JCAM information types now match RegScale information types whose titles carry SP 800-60 section numbers or spell "and" as "&", re-importing no longer detaches information types from their plan, and a plan whose information types match none is reported as failed

[6.50.0] - 2026-10-06

Added

• Wiz asset syncs now fill the public-facing FQDN, IP address and URL fields from the application endpoints Wiz confirmed, and network exposure vulnerabilities now carry their port and protocol
• AWS Audit Manager sync now filters assessments with --tags and scopes evidence to tagged resources with --resource_tags
• AWS Security Hub compliance sync commands assess controls from Security Hub standards, route results to one or many security plans by plan field or ComponentID mapping file, and record the unmodified Security Hub findings as evidence by default
• CLI options now accept both snake_case and kebab-case spellings everywhere, with kebab-case shown in --help, and unambiguous Security Plan ID options accept a friendly --ssp-id alias
• Opt-in REGSCALE_STRICT_EXIT_CODES=1 makes scanner syncs that finish with item-level failures exit 3 instead of 0, and the CLI exit-code contract is now documented
• Optional machine-readable output via regscale --output json (or REGSCALE_OUTPUT=json), including a standard run summary and JSON records for supporting commands
• New --preview flag on cleanup deletes, JCAM and eMASS push commands and set_permissions load lists every record that would be created, updated or deleted without writing anything
• New configurations store integration secrets in the RegScale secret store by default, and existing configurations can move theirs with the reversible regscale config migrate-secrets command
• Automated secret scanning on every source change to keep credentials out of published releases
• regscale config validate checks init.yaml for unknown, deprecated, missing and mistyped keys and leftover placeholders, with JSON output and a non-zero exit on errors
• Read-only config mode (REGSCALE_CONFIG_READONLY=1 or --no-write-config) never creates or writes init.yaml, and every setting can also be supplied as a REGSCALE_<NAME> environment variable
• Set REGSCALE_USE_PROXY_ENV=1 to route RegScale API and integration traffic through HTTPS_PROXY, HTTP_PROXY and NO_PROXY, and custom CA bundles now apply to proxied and GraphQL connections
• Trust Center, QRadar and Prisma Cloud CSPM requests now retry automatically with bounded backoff when the vendor API throttles or is briefly unavailable
• Releases now include signed build provenance for the wheel and sdist, keyless cosign signatures and SBOM attestations on the Docker images, and a CycloneDX SBOM attached to each GitHub release, with verification steps in the release verification guide
• Deprecated commands, options and settings now print a warning naming their replacement and the release they will be removed in, following a published deprecation policy
• Shell tab completion for bash, zsh, fish and PowerShell (regscale completion), a regscale integrations list command showing each integration's category, description and docs link, and a regscale --help grouped by category
• Usage examples in the --help of the most-used commands, and corrected command examples in the documentation and in several AWS command help pages
• Opt-in structured JSON logging via regscale --log-format json or REGSCALE_LOG_FORMAT=json, with a run ID shared with the run summary and secret values redacted from every log line
• Added a --force-refresh option to Axonius v2 sync commands to re-pull every record instead of only recently changed ones
• make help now lists the model schema and Azure AD sync regeneration commands
• regscale devsecops run validates the full .regscale-devsecops.yml configuration (change, approval, targets, mapping, SAR, policy, assess, schedule and module settings) and reports each problem with its field path, line number and accepted values
• regscale devsecops ssp snapshot command that exports a Security Plan's control IDs, catalogs and evidence-type mapping coverage to a credential-free file for offline control resolution
• Pipeline readiness check with regscale devsecops doctor, reporting TLS, service-account identity and expiry, missing or excess permissions, configured SSP and component, mapping coverage and schedules
• Pipeline Change records with typed trace links to work items, pull requests, approvals, builds and artifacts via regscale devsecops change open|update|close
• regscale devsecops evidence collect and publish commands that capture branch protection, pull request approvals, CODEOWNERS and JUnit test results as evidence mapped to the security plan and its controls
• regscale devsecops sbom generate, diff and publish commands that produce SBOMs from the GitHub dependency graph or syft, compare them with the previous release and publish them as inventory, evidence and change trace links
• regscale devsecops scan import command that imports SARIF, Trivy, Grype and Wiz CLI results as vulnerabilities and records them as control assurance on the target Security Plan, whatever framework it uses
• regscale devsecops openssf scan and sync publish results to Security Plans without OSPS Baseline controls as a summary assessment and evidence record mapped to the plan's own controls, record them in the run ledger, and weigh AI-assessed observations as added risk only
• regscale devsecops schedule show and apply set the OpenSSF drift-monitor cadence as a RegScale Orchestration Hub job or a scheduled GitHub Actions or GitLab workflow, choosing between the Scorecard API and a fresh scan for each repository
• regscale devsecops assess command that rolls a pipeline run's evidence up to findings for the Security Plan's own controls, publishes them as assurance results, raises issues for failing tool-observed results and closes them once they pass, without changing implementation status unless asked
• regscale devsecops sar build and sar validate commands that produce the run's OSCAL Security Assessment Results and assessment plan from the run ledger and validate them against the pinned NIST OSCAL schema, failing closed when no schema is available
• regscale devsecops sar merge builds a release SAR from the run SARs between two release tags, and sar publish attaches a run or release SAR as a CI artifact, SSP file, SSP child assessment or Evidence record
• regscale devsecops attest writes an in-toto attestation over the run ledger, SAR and policy decision, optionally Sigstore-signs it (never in FIPS mode), attaches it as Evidence and has the platform verify it
• regscale devsecops gate, policy evaluate and policy pull commands that evaluate the digest-locked OPA gate bundle against the run's policy input without RegScale credentials, map the decision to a CI exit code, and skip credentialed steps on fork pull requests
• regscale devsecops policy init command that locks a framework-neutral default gate policy, deciding on evidence types, change categories and per-check OpenSSF Scorecard thresholds, without a RegScale connection
• regscale devsecops change request-approval and change verify commands that submit a Change to the platform's tolerance-policy approval and gate deployments on approved artifact digests, with change close always recording the deployment
• regscale devsecops change shadow-report command that compares shadow-mode Change approval decisions with CCB outcomes, reports agreement, false auto-approval rate, auto-approval share and approval wait time, and checks each component against configurable readiness thresholds before enforcement
• Opt-in regscale devsecops review impact command that reviews a change against the SSP's own controls with a pluggable AI provider (Anthropic, Amazon Bedrock, Azure OpenAI or RegML via the ai extra), records an advisory AI-assessed result and writes the Change's impact analysis section
• regscale devsecops scan import --offline records a scan in the run ledger without RegScale credentials
• regscale devsecops run --stage pr|build|release|deploy|scheduled runs the modules the manifest enables for each pipeline stage, split into a credential-free collect job that writes a verifiable run bundle and a trusted publish job that publishes it
• OpenSSF OSPS Baseline assurance commands (regscale devsecops openssf sync and scan) that run or ingest Scorecard, OSV-Scanner, Privateer, Security Insights, OpenVEX and SLSA provenance results and report per-requirement test results, control assessments, issues and evidence against an OSPS Security Plan
• Signed OSPS conformance attestations (regscale devsecops openssf attest and verify) packaging verdicts as in-toto statements with optional Sigstore keyless signing via the regscale-cli[attest] extra
• Scheduled OSPS drift detection (regscale devsecops openssf monitor) that compares published Scorecard results with the Security Plan and flags regressed controls without running scans
• Evidence tier (Declared, Observed or Verified) recorded on OSPS assessments and control test results
• Reusable GitHub Action that runs OSPS Baseline assurance, with an optional signed attestation, in a pipeline
• Self-contained HTML OSPS conformance report that pipeline runs can publish as an artifact
• QRadar compliance assessment minimum event threshold is now configurable through min_events in the qradar config block
• regscale devsecops change open|update options for the Change's title, description, case notes, test results, outage summary, type, priority, owner, change window and test date, --change-id with --adopt for existing records, a change attach command for files and URL links, --output json on the change, evidence and SBOM publish commands, and sbom publish --parent-asset --name

Changed

• AWS Security Hub tag filtering is now applied server-side so fewer findings are pulled over the wire
• Command reference documentation now covers every CLI command, with a complete generated command index and corrected command, option, and configuration examples across the user guides
• Dependency versions are now capped below their next major release so a new major version of a third-party package can no longer break a fresh pip install
• eMASS client reads and writes the eMASS API v3.31 field names for systems, POA&Ms, milestones and hardware, still reads the older names from earlier eMASS versions, and now sends the required POA&M source field under its correct name
• QRadar assess-compliance now runs through the standard compliance sync, creating a QRadar SIEM asset and scan history, and attaches the recommended fix to issues for failed controls
• Scanner asset syncs no longer look up or store raw source data per asset, which makes large asset imports faster
• FedRAMP SSP XML import no longer calls the retired OSCAL validation service or attaches an OSCAL validation report

Fixed

• License-gated commands now honour the platform's 5-day grace period after the RegScale license expires, warning on each command with the expiry date and grace days left, and after it ends report that the license expired on that date
• jcam import_ssp no longer stops partway through creating plans when JCAM reports a system with no categorization or system type, a new plan now gets its organization at creation, and one organization that cannot be read no longer stops the import
• JCAM control inheritance import again writes the plan lineage and inherited control records the RegScale inheritance views read
• FedRAMP CIS/CRM import now sets the inheritance model on control objectives and rolls it up to the control implementation
• Control matching now skips a missing, blank or non-text control ID instead of crashing the import
• Help text for the Axonius combine_data_parts and file_stats commands, and corrected descriptions for pull_data and pull_data_axonius
• Negated CLI flags (--no-x) now accept both snake_case and kebab-case spellings
• Settings supplied through environment variables are no longer written into init.yaml, so a secret in the environment can no longer overwrite a secret-store reference on disk
• A secret passed to regscale config --param is no longer written to the debug log
• Prisma Cloud imports no longer drop vulnerabilities whose published or fix dates are millisecond timestamps
• Issues whose asset identifier list is too long for the field now say how many identifiers were left out
• Scanner imports no longer silently drop every vulnerability when the RegScale tenant lookup fails
• GitHub SBOM sync no longer fails when the security plan already has component mappings, and the client-side outdated-issue closure and control objective lookup by catalogue no longer fail on every call
• JCAM import no longer stops when a FISMA rollup would move a security plan under a different parent; that plan is skipped and reported in the run summary
• Axonius v2 sync no longer fails on Axonius 6.1, and synced assets and findings now include hostname, IP, OS, CVE, severity and other details
• Fixed debug log issue in login and api modules.
• JCAM inheritance import no longer resets provider controls to not inheritable, and skips inheritances that name a plan as its own provider
• Updating an existing Security Plan no longer fails when the instance has disabled plan fields; those fields are skipped with a warning
• Asset imports, including Nessus, no longer fall back to slow one-by-one uploads when the same host appears more than once in a file
• QRadar compliance assessments now state why each control passed or failed and recommend how to fix it, instead of only the result
• Trivy and Grype imports now link vulnerabilities to their scanned assets
• DevSecOps hints, example manifests and the regscale-devsecops GitHub Action now match the commands and configuration keys the CLI actually reads, and unread module keys log a warning
• An invalid RegScale token no longer appears in login error messages, and devsecops run collect jobs no longer create an init.yaml in the working directory or refuse to publish a bundle whose configuration file differs only in line endings
• QRadar assess-compliance now creates issues for failed controls when complianceCreation is set to Issue or POAM
• Wiz inventory sync no longer fails when no project ID is supplied, and several integrations no longer fail on null values returned for optional fields
• Microsoft Defender for Cloud resource sync no longer fails on subscriptions with more than about 96,000 resources
• Microsoft Defender syncs now follow relative pagination links from the Defender API instead of sending them to the RegScale server
• Records queued for batch saving, such as Splunk Data records and Jira or SonarCloud issue updates, are no longer dropped when disableCache is enabled
• GCP runs now warn when a configured service account credential is invalid, name the rejected setting and the reason, and stop with an error when no configured credential is valid instead of continuing on a different credential
• regscale evidence start now creates the assessment for each project listed in list.json, instead of stopping with an error or attaching one program's results to another project
• Platform version checks now treat an internal build of the RegScale platform (one that reports a build number and date instead of a release version) as a development build rather than as a very new release. Features that stay off on development builds, such as linking one issue to multiple controls, are no longer switched on against these servers, and a server that reports an unrecognized version no longer causes a version-parsing error.
• Updating an existing task under a parent record that already has tasks no longer fails
• Installing the CLI now requires a PyJWT release free of the known critical and high severity vulnerabilities

Bug Fixes and Usability Enhancements

This release includes security hardening, patching, and fixes that improve reliability, performance, and overall platform stability.

[Action Required] Legacy service account tokens expire 30 days after upgrading to 6.34.4.0

As part of ongoing security improvements to service accounts, a limited set of legacy tokens will expire 30 days after you upgrade to 6.34.4.0. After the upgrade, RegScale administrators will receive an email that lists each affected service account, the date its token stops working, and instructions to rotate it. The email repeats weekly, then daily for the last three days, until each account is addressed. If you don't receive the email, no action is needed.

Once a token expires, any integration, script, or pipeline that uses it will fail with a "401 Unauthorized" error. Rotation steps are included in the notification email and are also available from your account team. After rotating, if an integration fails with a "403 Forbidden" error, check that service account's roles and application access.

Rich Text Editor Upgrade: The Rich Text Editor has been replaced to provide more reliable formatting. Bulleted and numbered lists, tables, links, and text copied from Word now behave more consistently. Content you've already saved in these fields will not be modified.

Preset Configurations: When profile layering is disabled, the preview now clearly shows which catalogs and profiles will be excluded from the install.