CLI 6.45.10

[6.45.10] - 2026-09-11

Added

• jcamPositionRoleNames and jcamAgencyDefinedDataItems now accept @drop, so a tenant can record that a point of contact or an agency-defined attribute deliberately does not import, rather than expressing that decision by leaving it out.

Changed

• The recommended JCAM profile now writes the JCAM-computed POA&M criticality to a custom field named Derived Severity Level, and writes the human-set value only to RegScale's native severity rather than duplicating it into a second custom field. The legacy profile is unchanged.

Fixed

• AWS Inspector command help no longer lists CM-6 among the controls it assesses
• Fixed intermittent HTTP/2 connection errors and silent vulnerability-mapping data loss during concurrent scanner syncs
• Scanner runs of more than 1000 issues now close stale records again instead of silently skipping mop-up
• A JCAM import no longer refuses to run because a custom field named by an older version of the importer is absent, and jcam check_config no longer reports those fields as missing. What an import needs is now derived from the mapping profile in use, so the readiness report and the import cannot disagree.
• A JCAM import no longer refuses to run because a point-of-contact custom field is missing where a system role already carries that position, or where the position is declared as @drop. A position with none of the three still stops the import.
• A JCAM value bound for a RegScale checkbox is now written as a boolean the platform accepts, rather than as the word "Yes" or "No", which it answered with an unexplained server error that stopped the import.
• License check failures now name the actual cause, such as a rejected session or an unreachable host, instead of always reporting an Enterprise license problem
• Credentials written as quoted JSON keys are now redacted from log output
• Retry after re-authentication now uses the refreshed token instead of the rejected one
• Axonius pull_data command now reports the actual API error instead of a generic failure when credentials or the connection are invalid
• Axonius v2 now distinguishes a permissions error from other API errors so operators can tell an unauthorized key apart from a malformed request
• Axonius v1 and v2 commands now accept either set of credential key names, with a one-time notice pointing to the preferred key name
• Azure AD App sync now reads group membership, administrator, and pending statuses from the correct App Management endpoints, matches Entra users to existing RegScale accounts instead of re-creating them, and leaves users with open access requests for manual review