Changelog
Back to All

CLI 6.55.0

October 22nd, 2026

[6.55.0] - 2026-10-22

Added

  • DevSecOps release and deploy Change records can now be completed directly, sent for policy approval, or always routed to the CCB per change type with change.approval_by_type or --approval-mode
  • Added Python 3.15 support and updated CI test matrices and wheel bounds
  • otxUrl setting (environment variable REGSCALE_OTX_URL) that points alienvault ingest_pulses at another AlienVault OTX server, defaulting to https://otx.alienvault.com

Changed

    • Packaging and dependency management migrated from Poetry (poetry-core and poetry.lock) to uv (hatchling and uv.lock) for faster dependency resolution and container builds
  • DevSecOps Emergency release and deploy Change records now go to the CCB by default (change.approval_by_type.Emergency: ccb), where a policy reject is reported but does not fail the job; set it to request to keep the policy engine's decision
  • Removed the unused regscale-dev update_docs command, which pushed per-integration markdown to readme.io and Confluence
  • Behavior change: set_permissions load now exits with an error after trying every row when the platform rejects a row or a row holds an invalid value, where it previously logged a warning and exited 0
  • The set_permissions load command now keeps a record's current visibility when its public | private cell is blank and rejects rows with an unrecognized visibility, access level or ID, where a blank or mistyped visibility previously made the record public
  • A wiz compliance_report run whose failing controls all span several resources now sends its issues, so like other runs it closes open "Scanner Integration" issues on the plan that it does not report, including issues for controls that now pass and those of the AWS compliance commands on the same plan

Fixed

    • Dependency lock updated so virtualenv is on its latest release
  • devsecops change request-approval now reports the Change status and policy mode the platform returns, fails the job only for a rejection the platform enforced, and never leaves the JSON status empty
  • JCAM imports now report records they could not import, so REGSCALE_STRICT_EXIT_CODES=1 exits 3 for those instead of 0
  • The set_permissions load command now applies group permissions and public visibility on platform 6.29 and later
  • regscale import assessment_linker now exits 1 with an error when RegScale returns only part of the assessment list, instead of linking a partial set and exiting 0
  • The qualys diagnostics command keeps working after its supporting module has been imported
  • AWS Security Hub syncs now report assets and findings they could not process, so REGSCALE_STRICT_EXIT_CODES=1 exits 3 for those instead of 0
    • A second import on the same day now closes the findings it no longer reports: integrations on the shared scanner vulnerability builder (CrowdStrike, Rapid7, Tenable.io and others), the legacy Axonius sync and the direct (non-scanner) vulnerability path of the Qualys CIS report import scope mop-up to one run instead of the date. Trivy, Grype, Nessus, Qualys VMDR and the scanner-integration path of the Qualys CIS report import keep their existing source-and-day scope
  • The legacy Axonius sync sends all FISMA ids of a plan together and asks for mop-up once, on the plan's last batch, and not at all when a batch was rejected, so one FISMA id or batch no longer closes records another still reports
  • Flat-file folder imports (Nexpose, Snyk, Aqua, Veracode, XRay, ECR, Inspector, Qualys file scans, etc.) are one run: every file shares one batch id and only the last file closes or retires what the import did not report, so one file no longer retires another file's assets
  • gcp sync_findings no longer lands a passed control assessment for a control that an open Security Command Center finding in the same run maps to, or for a category that has an open finding; before, only the finding's own control-and-category check was withheld, so the control's other checks landed passed while gcp sync_compliance failed it. The run now logs how many passed control assessments it withheld.
  • wiz vulnerabilities now imports cloud configuration findings that Wiz returns with no resource, such as Microsoft Defender for Cloud findings on AKS pods and containers, against the plan with the affected workloads listed on the finding, instead of dropping them and sometimes their whole rule without a trace
  • wiz compliance_report now raises an issue for a failing control whose failing checks name several resources
  • A run that reads only part of its source no longer sets the plan's other assets Inactive. Each child of an Orchestration Hub split job (--offset / --limit) of bigquery sync_assets_bq, wiz inventory or aws sync_assets, a wiz inventory --filter_by_override run, and an aws sync_assets --account_id / --tags run now leave alone the assets outside their slice or scope. A full, unscoped run still sets Inactive the assets that left the source.
  • AWS sync_findings in consolidated mode now creates one vulnerability per Inspector CVE and one per GuardDuty finding type instead of merging each product's findings into a single record, and the next unscoped sync closes those old catch-all records
  • The AWS compliance commands (aws sync_s3, sync_kms, sync_cloudtrail and the rest) and wiz compliance_report no longer close each other's open issues or set each other's assets Inactive on a shared plan, and aws sync_findings_and_assets no longer sets Inactive the aws sync_assets assets its findings do not name. Because these compliance commands share one source, they also no longer close their own issues for controls that now pass; close those by hand until each command gets a source of its own
  • Compliance commands that run one after another on the same day and assess the same control (for example aws sync_s3 and then aws sync_kms on SC-28) no longer overwrite each other's assessment. The assessment fails when any command failed the control, its title names each command and its result, and a command that runs again that day replaces only its own result. Two commands that run at the same time can still overwrite each other.
  • Fixed aws sync_cloudwatch --account_id, which collected no log groups and still reported success; it now keeps the log groups in that account, and an unexpected error while reading log groups now fails the sync instead of being logged and dropped (denied access and a log group deleted mid-run are still skipped)
  • AWS sync_ssm now reads every page of each managed node's patches, so SI-2 fails when a node's missing patch is past the first 50 records
  • AWS sync_cloudwatch and sync_cloudwatch_ex now fail a control when more than 20 % of log groups fail it, the same rule as the other AWS compliance commands, so AU-6, AU-9, AU-11, AU-12 and SI-4 assessments that passed only because one log group passed are rewritten as Fail on the first run after upgrading
  • gcp sync_compliance no longer marks a control Pass or Fully Implemented when no SCC finding maps to it, and fails SI-2 while active CVE (SOFTWARE_VULNERABILITY) findings exist
  • Wiz inventory and stig_checks now leave an asset's Disk Storage (GB) at 0 instead of filling it with the virtual machine's disk count, so existing Wiz assets show 0 after their next sync
  • gcp sync_findings now imports SCC findings that map to no NIST 800-53 control, including every SOFTWARE_VULNERABILITY (CVE) finding, instead of dropping them with a DEBUG log line. CVE findings carry their CVE id and CVSS v3 base score and are keyed on their SCC finding name, so CVE findings that share a console link stay separate. CVE findings are linked to the asset for their resource, and the run reports at INFO how many findings had no control mapping. Findings SCC marks INACTIVE (remediated) now land Closed instead of Open and no longer fail their mapped control tests.
  • Every aws command now exits 4 (authentication failure) when AWS refuses its credentials, none are found or the named profile does not exist, before it reads or writes anything, instead of reporting "completed successfully" and syncing an empty inventory
  • Scanner syncs with issueCreation: PerAsset now create one issue per affected asset instead of one issue per CVE linked to every asset
  • Nessus imports of several historical scans on one day now close findings that a newer scan no longer reports
  • Qualys sync_qualys --include-was now keeps each web application finding's severity (5 Critical, 4 High, 3 Moderate, 2 and 1 Low, matching VMDR) instead of landing every one as Medium
  • Qualys sync_qualys --include-was now dates each WAS vulnerability first and last seen, and its issue first detected, from the finding's firstDetectedDate / lastDetectedDate instead of the time of the run
  • Tenable.io finding sync now honours the --severity option and syncs only findings of the chosen severity, without closing findings of other severities
    • Prisma Cloud sync_hosts / sync_images --use-csv no longer create a "Prisma Cloud Vulnerability" vulnerability and issue for a host or image with no vulnerability; the export's blank-CVE row now yields only the asset
  • Wiz inventory no longer uses the raw lower-case provider resource type (for example microsoft.app/containerapps/containers) as the software name of a container Wiz has not classified yet; it falls back to the parent-based name until Wiz reports the technology
  • Tenable.io compliance sync now marks a control as failing when any check citing it fails, not only the first check
  • Prisma sync_hosts and sync_images with --enable-software-inventory now create software inventory from each asset's SBOM instead of only logging a note to run sync_sbom
  • AWS asset syncs now record a Lambda function's language and its full runtime version, such as python and 3.12, instead of only the last part of the runtime
  • tanium sync_compliance and tanium sync_all assess a control whose only Tanium Comply findings are not applicable (any spelling, such as NotApplicable, NOT_APPLICABLE or NA) as Not Applicable, instead of failing it for NotApplicable or passing it for NOT_APPLICABLE and NA, and tanium sync_findings no longer raises an open issue for a NotApplicable finding
  • aws sync_compliance --no_use_enhanced_analyzer now assesses controls from AWS Security Hub evidence: passing checks (PASSED) count as compliant, and evidence status values match regardless of case
  • wiz vulnerabilities no longer closes a Wiz rule while it is still failing on any of its resources
  • A findings run that reads only part of its source (--offset / --limit, as an Orchestration Hub split job passes to each child) no longer closes the plan's vulnerabilities and issues outside that slice. Before this fix, wiz vulnerabilities --limit 1 closed every other open Wiz vulnerability on the plan along with its issue. A run with no slice, or with --offset 0 alone, still closes what the source stopped reporting.
  • Tenable.sc imports now create one vulnerability per CVE for a finding that lists several CVEs, instead of one vulnerability carrying a CVE that changed from run to run
    • Tenable.sc sync_jsonl no longer lands a record below tenableMinimumSeverityFilter (such as an Info record under the default low) as a Low vulnerability; it is skipped, as query_vuln already does, and is not counted as a parse failure
  • The AWS compliance commands (aws sync_s3, sync_kms, sync_iam, sync_cloudtrail, sync_cloudwatch and the rest) no longer set the plan's other assets, Off-Network ones included, to Inactive when a re-run creates an asset. They no longer retire assets at all, so an asset whose resource AWS stops reporting stays as it is: run aws sync_assets (on a schedule if needed) to retire those.
  • A repeat tenable io sync_assets run no longer marks Inactive the assets Tenable has not changed since the previous sync; each run now reads the full Tenable asset inventory before retiring missing assets
  • tenable io sync_findings no longer misses Tenable findings on a plan that other connectors also sync: its incremental findings export now starts from Tenable's own last sync rather than the newest scan by any connector. A run that closes findings not in the scan now exports every open finding, so findings Tenable has not re-observed since the last sync are no longer closed.
  • The AWS compliance sync commands no longer update control assessments or implementation statuses when a run reads only part of the plan, scoped by --account_id, --tags, a name filter (--bucket_name_filter, --trail_name_filter, --log_group_prefix, Audit Manager --resource_tags) or an --offset/--limit slice; such a run still syncs assets, findings and evidence, and a run without those options assesses the controls as before
  • Re-running a compliance command (wiz compliance_report, the AWS sync_s3, sync_kms, sync_cloudtrail, sync_iam, sync_ssm and sync_org evidence commands, and the other compliance integrations) no longer resets what a user set on its existing issues: a basis for adjustment and a due date are kept, and an issue closed as a false positive stays closed
  • AWS sync_s3 now judges AU-9 only on buckets that store S3 access logs, which pass when versioned with public access blocked and a private policy, instead of passing every bucket
  • AWS sync_guardduty now fails IR-5 when no GuardDuty detector is enabled instead of passing it on every run
  • AU-9 results that earlier versions of aws sync_s3 recorded as Pass for buckets that do not store S3 access logs are not removed by a new sync, so review those assessments after upgrading
  • Tenable.io asset sync now stores the first IPv4 address in IP Address and the first IPv6 address in IPv6 Address instead of a comma-joined list of every address
  • AWS asset sync with --tags now collects the Inspector coverage and findings of the tagged resources instead of none, and an Inspector request the AWS SDK rejects now fails the run rather than ending in success
  • regscale aws sync_findings and sync_findings_and_assets now honour the simple category form of aws.inventory.enabled_services (for example storage: false), which they used to ignore: findings on resources of a category turned off that way are no longer imported
  • regscale aws sync_assets now honours aws.inventory.enabled_services: a category or service turned off in init.yaml is no longer collected or synced as assets, and its existing assets are kept rather than marked Inactive
  • AWS asset and GuardDuty syncs run with --account_id now keep the account's GuardDuty detector instead of dropping it
  • Fixed aws sync_assets --account_id and --tags, and aws sync_s3 --account_id, so S3 buckets, load balancers and ACM certificates outside the chosen account or tags are no longer imported
  • AWS evidence syncs (KMS, IAM, Organizations, EC2, GuardDuty, ECR, Inspector and Directory Services) now assess the plan's controls when --framework differs from the plan's framework, and warn when no AWS check maps to a control in the plan
  • Updated certifi to 2026.10.19 to remove trust in compromised root certificate authorities (GHSA-6q48-6c7w-9gw2)
  • Updated pillow to 13.0.0 to fix eight security vulnerabilities, six rated high
  • DRF import now matches a DR Number cell with leading spaces to its trimmed value, and reports a non-empty row whose DR Number cell is empty, not text or not a DR number as skipped (with the reason) instead of dropping it silently
  • Updated virtualenv to 21.14.7 to fix two security vulnerabilities (CVE-2026-113725, CVE-2026-113726)
    • Veracode XML import now brings in the CWEs of every severity and category in the detailed report, each at its own severity, and no longer fails on a severity with two categories or a category with one CWE
    • show_mapping for aqua, aws, ecr, veracode and every other vendor registered without a file type now reports a missing --file_path as a usage error instead of failing with a TypeError
  • Snyk JSON imports no longer skip a vulnerability that has no CVE
  • Snyk JSON imports now carry each vulnerability's description and its upgrade and patch remediation
  • Uploaded .xml files are stored as application/xml on every host and .sarif files are accepted for upload
  • oscal catalog now imports the catalog on Click 8.3 and later instead of failing with "'int' object has no attribute 'strip'" before contacting RegScale when --obj_to_controls or --fedramp is left out
  • FedRAMP Appendix A import now creates control implementations for catalogs whose control IDs are lowercase or zero-padded, such as OSCAL catalogs
  • OpenText WebInspect import now imports the finding from a scan file that holds a single issue
  • OpenText WebInspect import no longer drops an issue that has a single report section, or the issues that follow it in the same scan file
  • alienvault ingest_pulses now ends with a clear error instead of a traceback when the request to AlienVault OTX fails or returns an error status, and no longer stops on an existing threat that has no notes
    • RSA Archer commands now print one error line and exit 4, 5 or 6 instead of a traceback when Archer rejects the login, a setting or mapping file is invalid, or Archer cannot be reached; upgrading now adds the archer* settings to an existing init.yaml
  • SSP XML import now saves the same, complete set of catalog implementation options on every run instead of a varying number with duplicates
  • Databricks pull_data now accepts read-only queries that mention words such as created_at, start with WITH or a comment, while still refusing every statement that writes, and, when no HTTPS proxy is in use, fails within seconds on a host that does not resolve or refuses the connection instead of waiting about 15 minutes
  • SAP Concur Tenable import now links each issue to the asset of its row when the row has a Host ID. With issueCreation set to PerAsset, the first sync after upgrading closes the existing issues for rows with a Host ID and recreates them keyed by Host ID; these closures are a one-time re-key, not remediations.
  • FedRAMP SSP imports now log a failed step and continue with the remaining steps instead of stopping with an AttributeError