Changelog
Back to All

CLI

August 13th, 2026

[6.40.0] - 2026-08-13

Added

  • Configurable base directory for scanner and integration output files via the artifactsDir setting
  • Optional Wiz data-retention reconciliation that closes issues whose findings have aged out of Wiz's retention window, enabled with wizRetentionReconciliation and tuned with wizDataRetentionDays

Changed

  • Changelog entries are now added as changelog.d fragment files per PR instead of editing CHANGELOG.md directly
  • Historical changelog entries are now organized into one file per minor release under changelog/, with the root file holding only an index
  • JCAM POA&M imports now warn when a POA&M's criticality is missing or unrecognized instead of silently importing it with no severity

Fixed

  • Repeated asset syncs no longer add a duplicate copy of every software inventory record to each asset
  • Software inventory no longer records a package twice when a scanner reports the same name and version more than once for one asset
  • Wiz report generation now retries rate-limited and transient gateway responses instead of failing the run
  • Wiz syncs now warn when the server caps or truncates a result set, so a partial pull is no longer mistaken for a complete one
  • Wiz vulnerability findings now carry CVSS v2 and v3 vectors and a known-exploit flag, with EPSS scores, CISA KEV listing, detection method, container layer provenance, and lifecycle dates recorded in the plugin output
  • Wiz assets now record their Wiz resource id on the asset's Wiz ID field, so an asset can be traced back to its record in the Wiz console and matched on later imports
  • AWS assets now honor the setting that copies the asset identifier into the Other Identifier field, so findings link to the correct asset instead of an unknown one
  • Wiz sync now closes findings that were resolved at the source; a failing excessive-access query had been disabling stale-finding closure for the entire run
  • Wiz cloud configuration findings are now scoped to the selected project instead of being pulled tenant-wide
  • Wiz compliance report is now reused after it has been renamed in the Wiz console instead of a duplicate being created on every run
  • Wiz consolidated issues no longer close automatically when Wiz reports a status the CLI does not recognize
  • Wiz network exposures that have no matching asset in RegScale are now logged, instead of being dropped silently
  • Wiz policy compliance now fetches assessments scoped to the selected Wiz project instead of the entire tenant, and warns when a tenant rejects every project filter and the fetch falls back to tenant-wide
  • Asset and component mapping lookups, along with issue, link, assessment, risk, threat, and other GraphQL queries, no longer fail with a server field error caused by an internal constant leaking into the request
  • AWS EC2 instance, Lambda function, and ECS cluster inventory now honor the configured account ID and tag filters instead of returning every resource in the region
  • AWS CloudTrail log metadata collection now honors the configured account ID filter instead of collecting metadata for trails owned by other accounts