Changelog
Back to All

CLI 6.44.0

September 3rd, 2026

[6.44.0] - 2026-09-02

Added

  • JCAM: jcam check_config now checks the jcamAgencyDefinedDataItems mappings against what
    JCAM actually carries, naming entries configured for attributes JCAM does not have -- each of
    which demands a custom field for nothing -- and attributes JCAM does have that are mapped
    nowhere. These names are matched exactly, so a single character apart means the item silently
    does not import.
  • JCAM: Business Identifiable Information now imports without any tenant configuration. It is on
    the mapping sheet, but the sheet named an endpoint that does not carry it, so until its real
    source was confirmed it could only be mapped by hand in jcamAgencyDefinedDataItems. The
    recommended profile now carries it alongside the other attributes that endpoint feeds.
  • SARIF import accepts --regscale_ssp_id and --component_id to choose the record that receives the findings
  • jcam list_fields now also reports each field's type and, for a select, the values it accepts. That is what decides whether a value can be written at all, and it was the missing half of the picture when diagnosing a rejected import.
  • jcam list_fields reports every form field a tenant has, per module and tab, with each field's id, system name, and whether it is native or custom. check_config says what the mapping profile cannot find; this says what is there to point a jcamFieldMapping override at, which previously meant reading the Form Builder in a browser one tab at a time.

Changed

  • JCAM: jcam check_custom_fields is now jcam check_config, and jcam test_jcam is now
    jcam test_connection, matching the name eight other integrations already use. The old names
    still work. check_config answers the whole readiness question rather than the part its old
    name described: it now also names the mapping profile in use and why it was chosen, says
    whether a control catalogue can be resolved, and lists the system roles a plan will need for
    JCAM's points of contact to import. The sections that need JCAM say so when they cannot reach
    it, rather than failing the rest of the report.
  • JCAM: a tab the tenant does not have is now reported with what to do about it -- a tab of a
    similar name if one exists, and where the fields the profile wants there actually are.
    Previously each absent tab was listed bare, so a tenant that had rearranged or renamed its
    forms saw a list of separate problems rather than one cause.
  • SARIF import requires the asset to link findings to, instead of guessing one from the file
  • SARIF import prompts for the asset when it is not supplied, instead of failing after the fact
  • Assessment results that no configured status label matches now resolve to the least-compliant available status instead of whichever label is listed first

Fixed

  • JCAM: the shipped configuration template no longer causes import commands to fail with a
    traceback. Unconfigured settings now read as empty rather than as nothing at all, so a tenant
    that has no agency-defined data items, no artifact types or no framework catalogue gets a
    clear result instead of an AttributeError; jcamArtifactTypes accepts a list or a
    space-separated string as well as a mapping; and an instance with only one control catalogue
    loaded no longer takes the other one down with it.
  • JCAM: a configuration value left as a placeholder by an older version of the CLI is treated as
    unconfigured rather than as a deliberate setting, so it no longer shadows the pre-rename key it
    was meant to replace. Where an upgrade adds a settings key that differs only in capitalisation
    from one already present, the CLI now says which pair to reconcile instead of silently
    preferring the new one.
  • JCAM: the framework catalogue setting is spelled the same way in the configuration template as
    in the code that reads it. Previously 800-53R5 was written into init.yaml while 800-53r5
    was read, so filling in the placeholder as instructed had no effect.
  • JCAM: a tenant that rearranges its Security Plan forms no longer breaks the import. Native
    fields are found by their internal id, which RegScale keeps unique across a module, rather
    than by the tab the mapping profile expects them on -- writing one is an attribute assignment
    that does not care which tab displays it. Custom fields still require the tab, because a
    custom field is addressed by a name its owner chose and the same name on another tab is a
    different field. Previously, moving stock fields to a different tab made every native
    destination unresolvable, and an incomplete resolution refuses to import.
  • SARIF findings with the same rule in different files are now kept as separate vulnerabilities
  • Scanner imports no longer fail with a missing-directory error when the configured artifacts directory does not yet exist
  • SARIF findings are now titled with the rule description instead of repeating the rule or CVE identifier
  • Large scanner batches no longer run four times over when the server reports success in its streaming format
  • SARIF sync now reports when it can only run the compliance phase instead of skipping the import silently
  • SARIF import now records vulnerabilities against the security plan or component instead of duplicating them per asset
  • Vulnerability and other scanner imports no longer fall back to slow per-item processing when the server deduplicates records within a batch
  • FedRAMP import_interconnects and import_cryptography commands are now available in the CLI
  • Implementation statuses written by Wiz, CrowdStrike and compliance assessments now respect the status picklist configured on a plan's compliance settings
  • Wiz compliance sync no longer skips updating control status for controls that have no objectives
  • Compliance imports no longer fail to save control implementations that are set Not Applicable
  • Databricks query failures now report the actual database error instead of an unrelated internal error
  • JCAM no longer sends a custom field value the field cannot hold. A field's type and choice list belong to the tenant, so the profile cannot know them, and nothing was checking: free text could go to a Select and a value to a section heading, with the only objection arriving from the platform as an HTTP 500 naming neither the field nor the reason. Values outside a declared choice list, and values bound for a field type that holds no data, are now reported by field name and skipped rather than sent -- one bad value used to fail the whole batch and cost every other value on the record.