CLI 7.0.0

[7.0.0] - 2026-10-30

Added

• Optional OpenTelemetry and Datadog observability across all CLI commands, outbound HTTP/GraphQL requests, sync item counters and secret-redacted structured logs over OTLP/gRPC, installed with the telemetry extra (also part of all) and configured only through REGSCALE_OTEL_*, OTEL_* and DD_* environment variables, never init.yaml
• ServiceNow PySNC SDK support is now installed with regscale-cli[all]
• New regscale appdetectivepro import_appdetectivepro command imports AppDetectivePRO XML database scan exports as assets, vulnerabilities and issues
• Jira Cloud evidence mode for regscale jira tasks --to-evidence that syncs Jira Tasks with Security Plan Evidence records, including attachments and comments, in both directions
• Qualys sync_qualys options --tc-tag-by and --tc-tag-include-selector, with the init.yaml keys totalCloudTagSetBy and totalCloudTagIncludeSelector, to select Total Cloud tags by name or by tag ID and to match any or all of the include tags
• Orchestration Hub can run the Microsoft Defender sync commands and Entra ID evidence collection through a new defender command group
• Tenable SC JSONL sync accepts --no-skip-validation to check that the security plan can be read before syncing
• Wiz finding family filters for wiz vulnerabilities: --finding-families imports only the named families and --exclude-finding-families imports all others (for example --exclude-finding-families network_exposure); all eight families (vulnerability, configuration, host, data, secret, network exposure, end-of-life and excessive access findings) still import by default as before; a run with a filter warns that mop-up may close the findings of skipped families already in RegScale as no longer reported; and an option that names no family, such as ' , ', is a usage error
• Published GraphQL usage manifest, scripts/model_sync/graphql_usage_manifest.json, which lists the platform GraphQL types and fields the CLI uses (its mapped models' fields plus the root fields, collection envelopes and navigations its own queries select) and the fields whose CLI models reject null, so platform PR CI can flag a breaking schema change that would break the CLI before it merges; regenerate it with python -m scripts.model_sync.usage_manifest (also run by make regen-model-fields)
• axoniusRebaselineHours setting that forces a full Axonius sync, which closes what Axonius no longer reports, once the last full sync is 168 hours old by default

Changed

• Files encrypted with this release cannot be decrypted by earlier regscale-cli releases, so upgrade every installation that reads a shared encrypted file before encrypting it with this release
• Scripts that run regscale change_passkey must now pass --file once per encrypted file
• regscale encrypt, decrypt and change_passkey now replace the file instead of writing into it, so they need write access to its folder and do not keep its hard links or its owner when someone else owns it
• Files encrypted by earlier releases will not decrypt while the key files in .secrets are writable by their group or by others, and the error now names the chmod 600 command that fixes it
• regscale-cli 7.0 now needs RegScale platform 6.35.1.0 or newer with the Client API enabled, instead of 6.36.0.0
• The regscale-rest Flask REST API server and the regscale-cli[server] install extra are removed; run CLI commands through the regscale executable instead
• CrowdStrike integration no longer carries a BETA label in its help text and documentation
• HTTP error messages and HTTP client log lines for requests to your RegScale instance now keep their query string (paging, filters and flags), while credential-shaped values and other hosts' query strings stay redacted
• jcam import_controls reports a JCAM status it cannot read once per run at WARNING, with a count and the jcamValueMapping key that maps it, instead of once per control
• Newly generated and upgraded init.yaml files no longer carry the deprecated per-integration TLS verification keys, so a deprecation warning now appears only when your own configuration still sets one; existing configurations keep loading and are still warned
• Nessus import treats every severity 0 item as informational, so an item with no risk factor no longer becomes a Low vulnerability and Low vulnerabilities that earlier imports created from such items are closed on the next import
• Nessus import leaves the CVSS v3 score of a vulnerability empty when the plugin has no v3 score instead of storing 0.0
• Nessus vulnerabilities show the Nessus plugin name as their plugin name instead of the CVE, which stays in the CVE field
• Nessus import reads large scan files faster and uses far less memory
• Aqua imports use less memory on large reports
• RegScale API request errors and the API call summary now appear in the CLI's console output and log file instead of only on stderr
• A configured customCaCert now keeps TLS verification on even when sslVerify is false, with a warning, and the Microsoft Sentinel integration, remote jobs configuration and GraphQL client now resolve sslVerify, customCaCert, SSL_CERT_FILE and REQUESTS_CA_BUNDLE the same way as the rest of the CLI
• regscale nist sort_control_ids now asks the platform to normalize a catalog's control sort ids in one request (POST /api/SecurityControls/sortByCatalog/{catalogId}, RegScale 6.34.5.0 or newer) and reports the per-control outcome, saving the server's result object as regscale-catalog-{catalogId}-sort-results.json in the artifacts directory in place of the former regscale-catalog-{id}-controls.json, catalog-{id}-sorted-control-ids.json and failed-/retry-*-controls.json files, instead of re-deriving the sort ids client-side and updating every control one PUT at a time
• Scanner asset and issue syncs now check that the RegScale platform is 6.34.1.0 or newer (the release that ships the Client API asset and issue batch endpoints) before the first request, and a 404/405 from an older platform reports the required release instead of a bare HTTP error
• CLI version line moved to 7.0.0; this major line requires the RegScale Client API to be deployed and enabled on the target instance
• Asset and Issue records no longer carry client-side audit stamps (dateCreated, dateLastUpdated, createdById, lastUpdatedById) or a client-side isPublic default on Issue: the RegScale platform stamps every create and update itself, so the values the CLI used to compute were never persisted
• Links, component mappings, milestones, tasks, comments, asset mappings, data records, evidence mappings, properties and components are now created or updated through the RegScale Client API, which matches existing records on the server instead of the CLI listing and comparing a parent's records locally; the get-or-create paths (the GitHub and GitLab project components and their plan mappings) send only the fields the CLI set, so an existing component keeps the status, owner and compliance settings it has on the server instead of taking the CLI's defaults for them, as in 6.x
• Scanner integrations now create and update assets through the RegScale Client API, so the CLI and direct API callers produce the same assets from the same data
• An asset's explicitly supplied tracking number is now kept instead of being replaced by the integration's identifier
• Assets missing from a scan are marked Off-Network, and assets the server rejects are reported individually with the reason
• regscale aws sync_assets now warns when init.yaml still sets ingestBackend: grpc, naming the removed gRPC ingest keys, since asset sync always writes through the RegScale API
• The gRPC asset ingest option for AWS (ingestBackend: grpc and its ingestTarget, ingestInsecure and ingestToken settings) has been removed; AWS asset sync always uses the RegScale API
• Scanner integrations now attach assets to components through the RegScale Client API, which finds or creates each component in the security plan and links it to the plan and the asset in one request per batch instead of one call per asset
• Scanner integrations now create and update issues through the RegScale Client API issue batch endpoint, which applies the platform's defaults for status, owner, identification, organization and risk rating and normalizes severity aliases server-side
• Severity values a scanner reports that RegScale does not recognise are stored as "IV - Not Assigned" and listed once per value in the sync log, instead of being silently defaulted
• Issue titles, descriptions and compliance references are no longer truncated by the CLI before upload; the platform's own limits apply and an over-long value is reported per issue
• Issues reported by scanners now carry their affected controls and asset identifiers directly in the batch upload
• Issues created in bulk from scanner findings are now linked to the control implementations the finding named, as issues created one at a time already were
• Syncing issues requires the RegScale Client API to be enabled on the instance; when it is not, the sync stops with a message naming it instead of falling back to the legacy endpoints
• Issues created or updated one at a time now go through the RegScale Client API, which applies the platform's defaults for status, owner, identification, organization and risk rating, normalizes severity and status aliases, and reports in the CLI log any field the instance's form configuration stopped the platform from storing; this requires a RegScale platform at or above 6.34.1.0 with the Client API enabled
• Scanner integrations now send a finding's control labels, control implementation ids and CCI reference on each issue and let the RegScale Client API resolve and link them to the security plan's controls, instead of resolving labels and CCIs client-side and re-applying fields with a second update pass
• Scanner integrations no longer compute issue due dates client-side: an issue is sent without a due date unless the scanner supplied one, and the per-severity day counts, useKev and kevDueDate under issues.<integration> in init.yaml (merged over the same defaults as before, so every severity carries a count) travel with the batch and RegScale dates every undated issue from them (the CISA KEV date first, then the configured count) while the security plan's remediation SLA is not consulted for scanner-created issues; noPastDueDates is honored as the batch option of the same name
• Wiz retention reconciliation lets the RegScale platform close the issues whose findings aged out of the retention window when the run's findings are posted in a single final vulnerability batch request (same protections, audit note and control-status refresh; the sync logs "Closed N outdated issues." from the platform's count), and keeps closing them from the CLI as before on an older platform or when a run is posted in several flushes or requests
• Scanner integrations now let the RegScale Client API close issues that are absent from a scan (once per run, on the final request, skipping issues protected from automatic closure and recording an audit note on each issue it closes) instead of closing them client-side; preventAutoClose in init.yaml keeps its 6.x meaning and does not affect that server-side mop-up
• Vulnerability descriptions and plug-in text are no longer cut at 4000 characters by the CLI: the full text is stored up to the RegScale column, any free text the platform does shorten is reported in the sync log as "normalized", and the Qualys VMDR and CIS report imports create vulnerabilities through the RegScale Client API like every other scanner
• Scanner integrations now create and update vulnerabilities through the RegScale Client API, which validates every record and reports each rejected or adjusted one, and require a RegScale platform at or above 6.35.0.0 with the Client API enabled
• Compliance integrations now record control assessment results and control test results through the RegScale Client API, which keeps one assessment per control per day and derives each control's implementation status from the plan's compliance settings server-side, so the CLI and direct API callers write the same assessments and statuses from the same results (requires a RegScale platform that ships the Client API control-result routes with the Client API enabled; an older platform is refused with guidance naming the required release)
• Issue descriptions, remediation text and other free-text fields are sent to RegScale exactly as the scanner produced them: the platform's Client API wrappers now own length handling, report every truncation per record (surfaced in the sync log as "normalized"), and reject an over-long identifier by name instead of the CLI silently cutting Issue descriptions at 4000 characters
• Issues, assets, control objectives, controls and links under a security plan or component now load completely and in fewer requests, so large plans no longer stop at the first page or time out while syncing
• These reads now require RegScale platform 6.35 or newer; against an older platform they stop with an upgrade message naming the required release instead of returning nothing
• Security plan creates and updates now go through the RegScale Client API, which drops any field disabled by the instance's form configuration server-side and reports each dropped field in the CLI log, replacing the CLI's silent retry without those fields and its FedRAMP deployment-flag pre-zeroing, and require a RegScale platform at or above 6.34.5.0 with the Client API enabled
• Scripts that call Api.graph() directly now receive a GraphQLQueryError when a query fails instead of an empty or partial result, and paginated fetches raise IncompleteFetchError instead of returning a short list; see docs/upgrade-to-7.0.md
• Jira tasks and issues sync now exits with code 5 instead of 0 when the issue type is not available in the Jira project, or cannot be confirmed because the project's issue types cannot be read
• The single issue that an earlier version created for a whole AWS compliance run (or, in PerAsset issue mode, for each resource, unless an AWS S3, KMS, IAM, Systems Manager or GuardDuty sync finds that resource still failing) is no longer updated by later runs and can be closed by hand
• jira tasks now maps To Do and every other open Jira status as jira issues does, to the issues.jira.status setting when it is Backlog or Open and to Open otherwise, instead of Backlog or Open by status name
• Deprecated the --use_security_hub and --no_use_security_hub options of regscale aws sync_config_compliance because they change nothing, with removal planned for 8.0.0 and regscale aws sync_securityhub_compliance as the command for Security Hub compliance data
• Removed the jiraDefaultIssueType and jiraDefaultPriority settings, which the Jira commands never read; delete them from init.yaml, because config validate now reports them
• The ingestClosedIssues init.yaml key is deprecated because no integration reads it, and setting it now logs a warning; delete the key, because it will be removed in 8.0.0
• The CLI now asks the RegScale platform for its version once per command and reuses that answer for every version check in the run, instead of each check resolving it on its own
• regscale nist sort_control_ids again writes the artifact files every 6.x release wrote (regscale-catalog-{id}-controls.json, catalog-{id}-sorted-control-ids.json and, when a control is rejected, the failed/retry control files) alongside the new regscale-catalog-{id}-sort-results.json, logs the 6.x summary lines and exits with the 6.x messages when the catalog cannot be read
• A scanner integration reads the per-severity day counts, useKev and kevDueDate from its issues.<integration> block in init.yaml again and sends them with each issue batch, and warns once per run about a value that is not a positive whole number of days (the 6.x default is used in its place)
• Scanner asset, issue and vulnerability syncs and compliance assessments log the same summary lines as CLI 6.x (Successfully submitted N ... in batch, Sending N assets to RegScale via batch API, Issue batch results: N items returned, Successfully created N control assessments), with the per-outcome breakdown appended
• Scanner and compliance integrations send and print what 6.x did: issues are marked public, a closed issue is completed when its finding was last seen, a vulnerability's plug-in name is its CVE when it has one, long Azure resource-path asset names are shortened to their meaningful parts, preventAutoClose no longer turns off the platform's issue mop-up, control assessments carry the source control id in their title and the run's date stamps, get_or_create never rewrites a record it finds, insert_issue/update_issue use the Client API once the platform accepts the custom-field switch, and the "Closed N outdated issues", per-control test-result and bulk update/creation log lines are back; scanner issue syncs, compliance assessment recording and get_or_create now require RegScale platform 6.35.0.0 or newer and stop with an upgrade message on an older platform
• Scanner syncs on RegScale 7 log the same INFO lines as 6.x for every batch submission (assets, vulnerabilities with their id range, issues and their asset mappings, the plan's remediation SLAs and the compliance cache summary); the Client API's per-batch breakdown moved to DEBUG
• Scanner syncs such as Tenable SC vulnerability queries save large asset batches as quickly as earlier releases again instead of taking several times longer
• Scanner syncs such as Tenable SC vulnerability queries send their asset and vulnerability batches to RegScale concurrently again, restoring the sync speed of earlier releases
• Microsoft Defender sync commands (365 alerts, 365 recommendations, Cloud alerts and Cloud recommendations) now name each record they could not map to an issue, exit 1 when they retrieve records but none can be compared or mapped to issues or RegScale creates none of the mapped issues, and report item-level failures under REGSCALE_STRICT_EXIT_CODES
• Microsoft Defender sync commands treat resolved and dismissed alerts and healthy Defender for Cloud assessments as no longer reported, so they close the matching open issues and create no new ones
• Qualys import_total_cloud now imports nothing and exits 1 when a page of the host detection list fails, cannot be requested, or is truncated without a continuation URL, and exits 6 on a Qualys timeout, as sync_qualys with --include-total-cloud now does too
• Qualys sync_qualys now exits 2 when an asset group is combined with Total Cloud tags, from the command line, init.yaml or the environment, under --include-total-cloud or when --tc-exclude-tags (or init.yaml exclude-only tags) is used without --include-total-cloud, and skips Total Cloud containers on asset group runs and on runs whose exclude tags are applied client-side
• Rapid7 InsightVM requests now follow the CLI-wide proxy rule, so proxy environment variables such as HTTPS_PROXY apply to them only when REGSCALE_USE_PROXY_ENV is set
• regscale-cli 7.x requires RegScale platform 6.35.1.0 or later
• When the platform's catalog migrator is enabled, the catalog update command (catalog update_via_platform) uses the platform's tracked background update and waits for it, reporting whether a new catalog version was created, the catalog was already up to date, or the update failed; otherwise it updates synchronously as before
• Qualys syncs whose host list stops early, because of an API error or because it exceeds 500 pages, now sync the hosts they read and close nothing, with a warning
• AWS Config compliance syncs file new issues under the source AWS Config, so issues filed by earlier syncs under Scanner Integration are no longer closed automatically and the next failing sync files a new issue beside each, which must be closed by hand
• Tanium sync_cis_benchmarks stores a CIS benchmark title or rule id that holds <, > or quotes whole, with those characters in their fullwidth forms (＜Level 1＞), so RegScale no longer cuts it at a tag and two CIS profiles named inside a tag keep separate checklists; a checklist an earlier run stored with a cut title is left as it is and the next run adds it once with its full title
• Wiz syncs that find another Wiz sync still running on the same plan now wait up to one hour for it to finish instead of stopping at once
• Wiz vulnerability syncs on a plan with no assets now exit 1 and name the count and the missing assets when findings stay skipped, instead of reporting success with nothing written
• When a vulnerability's own IP address or DNS name is one of the assets left out over maxAssetIdentifiersPerVulnerability, the vulnerability now records one of its linked assets there instead, or no IP address when none of them has one, so it links no more than that many assets
• When RegScale refuses to map an evidence record to its security plan or a control implementation, the error now names each refused target, found with RegScale's read-only access check, and lists every id the check could not answer for
• AWS sync_directory_services exits with an authentication failure when its AWS credential cannot be resolved, instead of returning cached data
• Control IDs from QRadar, JCAM, CI/CD pipeline scans, CrowdStrike evidence, Tenable control compliance and the Wiz STIG control flip are now matched to security plan controls by the RegScale platform, which also resolves AC-2-1 to AC-2(1) (previously read as AC-2) and AC.2.1 (previously matched only as a CMMC practice)
• Scanner syncs with incrementPoamIdentifier now let RegScale assign POA&M ids per security plan or component, so two runs no longer give the same id to different issues
• Scanner syncs now report each run to RegScale as one sync run, so stale records and Wiz findings past their retention window are closed once by the server when the run ends, and a sync whose batches failed exits with status 1 instead of closing records it could not confirm
• Integrations that save evidence now keep one evidence record per security plan and source, refreshing its status and due date and adding each run's file to it, instead of creating a new record on every run
• Jira, Jira Data Center, ServiceNow, Salesforce, Archer, GitLab, Microsoft Defender and Synqly ticketing syncs now let RegScale match each ticket to its issue by the ticket's id, taking over the issues earlier versions synced instead of creating new ones, and the ticket id is no longer stored in Other Identifier
• Control implementations are now created through the server's create-or-update route, which fills status, responsibility, owner, implementation, source, status flags and the Planned and Not Applicable fields with one platform policy; a control implementation the server refuses counts as an item-level failure, and a request that fails makes the command exit 1
• Checklist results are now created or updated by the server, which matches them on asset, tool and vulnerability ID and fills blank fields itself; checklists it refuses count as item-level failures, and a checklist request that fails makes the command exit 1
• cisa ingest_cisa_kev, scanner kevList and the FedRAMP POA&M v5 KEV due dates now use the RegScale platform's CISA KEV store instead of a catalog the CLI downloads or bundles, KEV Threats are stored with Source "CISA KEV" instead of "Open Source", the cisaKev init.yaml key is no longer read, and each exits 1 when the KEV store cannot answer
• Removed the standalone FedRAMP parameter ID migration script, which called API routes the platform does not serve
• Removed the unused Issue.set_is_poam SDK method and the ISO_DATETIME_FORMAT constant in the issue model module
• Removed the unused internal.workflow.create_workflow SDK function; use create_regscale_workflow_from_template instead
• Removed the unused ComplianceIssueHandler methods for updating existing issues, since compliance issues are now updated by server-side deduplication
• Removed the unused catalog_utils.update_catalog and update_catalog_v2 SDK modules; use update_catalog_v3.import_catalog instead
• regscale model new, generate and load now use the RegScale Client API for assessments, control implementations, issues, assets and components, send only the cells changed since generate, report each row or cell that was not applied with its spreadsheet row number wherever RegScale identifies the row, and exit non-zero when any row or cell is not applied or the pre-change workbook is missing
• regscale model load for assessments, control implementations, issues, assets and components no longer exits non-zero when the edit workbook is unchanged, and still logs the totals for rows created from the new workbook
• regscale model load no longer sends edits to read-only columns such as CreatedBy, and reports each one with its spreadsheet row number and exits non-zero
• regscale model load keeps the existing differences.txt when no existing record was changed
• regscale model generate greys out the read-only columns of the edit workbook and notes on their header that load does not send changes to them
• regscale model new no longer adds an Id column to the new-records workbook, and load refuses a new-records row with an Id filled in, naming its row number, instead of creating a duplicate record
• catalog sync_security_plans now syncs plan controls, objectives and parameters on the RegScale platform instead of in the CLI
• catalog sync_security_plans --all syncs every plan in one platform job that keeps going past a plan that fails, reports each failed plan and the number of skipped plans, and exits non-zero when any plan fails
• catalog sync_security_plans --all keeps waiting for the platform job through up to three consecutive connection or server errors while checking its status
• cve-cleanup fix --confirm now runs on the RegScale platform and always keeps the first valid CVE in the field, and discover and fix --dry-run list each issue's CVEs in that same order
• cve-cleanup fix --confirm now applies the whole repair as one all-or-nothing change
• cve-cleanup fix --confirm now names the missing Issue Update permission when RegScale refuses the repair
• cve-cleanup discover and fix now reject a --parent-id below 1 as a usage error, where 0 previously ran unfiltered across every issue and a negative id silently reported no issues
• cve-cleanup fix --confirm now exits non-zero when a repair errors or a split copy is not created, while issues skipped for having no valid CVE still exit zero
• evidence start now has RegScale evaluate the evidence rules and create each project's child assessment from that project's own evidence folder, stops before sending anything when a config.json rule or score cannot be read, skips a list.json project whose id or folder name cannot be read, skips with a warning a project that has no evidence folder, and exits non-zero when any readable project with evidence does not get an assessment or any list.json entry cannot be read
• evidence build_package now downloads the evidence package RegScale assembles for the security plan and exits non-zero when the plan does not exist or the package cannot be built, instead of logging and exiting successfully
• The issue_linker, assessment_linker and risk_linker commands now link record lineage in a single pass on the RegScale server, report how many records were linked and how many have no parent record, and exit non-zero when the server does not confirm the pass completed
• When the issue_linker, assessment_linker or risk_linker command gets no answer, or a gateway error, from the RegScale server, it now says the server may still have completed the pass and that re-running the command is safe
• The deprecated migrations process_data helper works again when called directly, without the progress and counter globals the linker commands no longer create
• The issuelinker, assessment_linker and risk_linker commands now log the real module and path of the RegScale.json file they write, instead of always naming a risk list file that was never written
• cleanup delete_issues, delete_assets and delete_vulnerabilities now delete through the RegScale platform in one request, check before the prompt and again before deleting that the platform would delete exactly the records listed, delete nothing and exit non-zero when it would not, and exit non-zero when the number deleted differs from the number confirmed
• cleanup delete_issues now deletes only the issues whose parent is the security plan or component, and reports issues only linked to it through another record (such as an asset or a mapped component) as left in place
• cleanup delete_vulnerabilities with --include-scans now deletes the linked scan history records that belong to the same security plan or component and that nothing outside it still uses, and keeps and reports the rest
• cleanup delete_vulnerabilities --no-mappings now stops before deleting anything when the vulnerabilities still have mappings, because a vulnerability that still has mappings cannot be deleted
• cleanup delete_issues, delete_assets and delete_vulnerabilities --dry-run and --preview still print their listing when the platform does not confirm it, and then exit 1
• cleanup delete_vulnerabilities now keeps scan history records by default, and deletes them only when --include-scans is passed
• set_permissions load now applies spreadsheet permissions through the RegScale Client API instead of the record permission routes the platform has retired
• set_permissions load now reports each row that was skipped, forbidden or failed with its spreadsheet row number
• set_permissions load and --preview now reject a row whose id is not a whole number or whose visibility is blank or unrecognized or whose R/RU value is unrecognized instead of applying it as public or no-access, and read R/RU in any case
• set_permissions load now exits non-zero when any row is not applied
• cve-cleanup discover and fix --dry-run now run on the RegScale platform with only Issue Read permission, and name the missing permission when RegScale refuses a run
• regscale model load writes what RegScale applied back into the workbooks, putting each created record's id on its row, so re-running it sends only what is still to apply, sends later edits to created rows as updates, and no longer skips or duplicates rows when rows are inserted, deleted or sorted between runs
• regscale model load puts back an Id cleared from an otherwise unchanged edit-workbook row instead of refusing the workbook's new rows, and names the missing Ids when it still refuses them
• Control results, control test results, CVE cleanup and security plan writes now use the platform's final Client API routes and mop-up counts, which require RegScale 6.35.1.0 or newer
• Checklist scanner results are rolled up into control and objective status by the server, where a failing check lowers a control to In Remediation and a passing check no longer marks it Fully Implemented
• STIG mapper rules are now applied by the RegScale platform in one request, existing rules files that name a stig keep working, and stig_mapper run exits 1 when the rules are refused or not confirmed
• cleanup delete_issues, delete_assets and delete_vulnerabilities now send the confirmed record ids with the delete, so when the records under the security plan or component change after the prompt the RegScale platform deletes nothing and the command prints the ids on each side and exits 1
• In PerAsset issue mode, the AWS S3, KMS, IAM, Systems Manager and GuardDuty syncs now close the per-resource issue a 6.x release left open once the resource has one issue per failing control, and that closed issue keeps its due date, basis for adjustment and false-positive status, which the new per-control issues do not inherit
• An aws sync-config-compliance run with --tags or --conformance-pack-name no longer closes the findings of controls that pass on those rules, because the controls can still fail on other rules
• aws sync_findings now reads the findings below issues.amazon.minimumSeverity from Security Hub before dropping them, so a high setting no longer shortens the read, and the setting now also applies when the CLI falls back to its basic Security Hub read
• Compliance syncs and imports adopt the v3 compliance bulk endpoints on RegScale 6.36+ (control implementation bundles, bulk patch, objective batch updates, bulk inheritance provider models, multi-parent properties/links/comments/assessments, evidence batchUpsert, and OSCAL catalog child batches) with automatic fallback on older servers

Fixed

• jcam import_artifacts records an artifact RegScale refused, or whose local copy is missing, as a failure instead of a success, so the run summary and strict exit codes see it
• regscale encrypt on a file that is already encrypted, regscale decrypt on a file that is not encrypted and regscale change_passkey with a wrong passkey now exit with status 1 and leave the file unchanged, instead of exiting with status 0
• Encrypted files no longer depend on keys stored on disk: regscale encrypt now derives the key from a passkey of at least 12 characters that you enter, regscale encrypt refuses files already encrypted by earlier releases, those files still decrypt and can be upgraded with regscale change_passkey --file (then delete the old .secrets folder), and change_passkey now asks for the file to re-key
• set_permissions load now sets each group's grant as 6.x did: an R row over RU lowers the group to read, and a blank R/RU cell in an otherwise filled row removes the group's grant (requires RegScale platform 6.35.1.0 or newer)
• Commands that re-read configuration mid-run, such as secret migration, no longer fail later RegScale requests with "Cannot send a request, as the client has been closed"
• Scanner syncs stopped with SIGTERM, such as a scheduled job that times out, now let their in-flight batches finish (normally a few seconds), close their open sync run and then end by the signal as before, instead of blocking the next sync of the same plan for up to 7 days; a sender that escalates to SIGKILL first, as regscale jobs run-due does after 10 seconds, still leaves the run open
• Acunetix import keeps each scanned host as its own asset when the export lists the start URL without https://
• regscale tenable nessus import_nessus now fills the Azure identifier on Azure hosts with the Azure resource ID (falling back to the VM ID), matching the Defender and Wiz integrations, and records the VM ID, subscription, resource group and instance name in the asset notes
• regscale sarif import now keeps a rule's remediation guidance as the finding's recommendation (the solution OWASP ZAP writes, or the SARIF help text from other tools) along with the rule's reference links; previously the recommendation held the rule description instead
• Scanner syncs refused because another sync of the same plan and source is still open now stop at once and report the refusal a single time, instead of reading the whole vendor inventory, logging an error per batch and ending with advice to run the sync again
• jcam import_controls leaves a new control's Implementation Status and Control Origin unset when JCAM gives none, so RegScale fills the plan's defaults instead of the importer writing Not Implemented
• aws commands no longer exit 1 with a traceback when STS answers the credential check with something other than its own response, such as a proxy page; the check warns and the command goes on
• The "PySNC SDK not installed" warning now appears only when the ServiceNow use_sdk option is enabled
• Tanium Cloud vulnerability sync now uses a descriptive title instead of the CVE ID and populates last seen date, remediation, CISA KEV, EPSS score and exploit availability
• Nessus import no longer moves a scan file to the processed folder before its upload and compliance issue sync finish, so a file whose upload failed is imported again on the next run
• Nessus import no longer fails the run when the processed folder is read-only
• Nessus import no longer closes the existing record of a finding it could not read and now reports that finding as an error
• Nessus findings now include their port and protocol
• Nessus STIG and CIS check findings each get their own plugin name instead of sharing the scan plugin's name
• Tenable findings no longer put the CVE in the title, so the platform no longer shows it twice; the title is the synopsis, else the plugin name
• The sync_compliance commands and the AWS evidence commands built on them, such as aws sync_inspector and aws sync_guardduty, now refuse a security plan or component that does not exist before anything is read or written, in one ERROR line; a --dry-run warns and still counts
• aws sync_findings_and_assets now refuses a security plan that does not exist before AWS is read, aws sync_findings reports that refusal in one ERROR line instead of a traceback, and crowdstrike sync_incidents / query_incidents and jira warn when their --regscale_module parent cannot be checked
• Comparing two security controls, or looking one up in a list or set, no longer fails with an AttributeError
• Grype, Trivy, SAP Concur Tenable, Wiz and flat-file imports now log a warning naming the date field when a scan date cannot be read instead of silently substituting the current time, and a Wiz issue with an unreadable creation date no longer counts as its earliest creation date
• Scanner syncs now check the Assets and Issues forms for required custom fields on every tenant, so a required field is reported before the sync writes instead of the check being skipped
• Log redaction no longer rewrites the log lines of an application that loads the CLI as a library, apart from its HTTP client request lines, whose URL query strings are now always redacted
• A STIG or compliance checklist result with no CCI, from a .nessus file or a .ckl checklist, no longer changes the CCI-000366 (CM-6) control objective, and the issue for a failing one names no CCI; the checklist row and the finding's external id keep CCI-000366 as before, so existing records still match
• tenable sync_vulns (Tenable Security Center) and tenable io sync_findings (Tenable Vulnerability Management) now send each DISA STIG result's CCI and pass or fail to the RegScale control objective roll-up, as the Nessus and checklist imports do, while still creating its vulnerability and issue; a STIG result with no CCI changes no objective, and a passing STIG check from Tenable Security Center is no longer dropped by the severity filter
• tenable sc sync_jsonl now sends each DISA STIG result's CCI and pass or fail to the RegScale control objective roll-up, as tenable sync_vulns does, and no longer drops a passing STIG check at the severity filter; Tenable STIG results sent to the roll-up are now dated by their scan rather than by the STIG content
• Orchestration Hub can run the Tanium ports and protocols sync and the Tanium CIS benchmark sync
• Microsoft Defender alert and recommendation syncs run with --offset or --limit no longer close RegScale issues outside the selected range
• Tanium ports and protocols dry run reports the number of endpoints, the same unit --offset and --limit select, so split runs cover every endpoint
• RegScale platform version checks now require the release that actually contains each server-side change, so a 6.35.0.0 platform is no longer offered Client API behaviour that first ships in a later release
• Issues whose asset identifier is an IP address, ARN, or hostname that differs from the asset name are now linked to their assets instead of being silently dropped from scanner imports
• GraphQL-backed queries now report server-side query errors instead of silently returning partial results, and every paginated collection is fetched to completion
• Importing the observability package no longer reconfigures the CLI logger as an import side effect; callers that want structured JSON logging call configure_logging() explicitly
• Synqly integrations no longer stop fetching partway through paginated results when the provider's numeric cursor does not match the number of records returned
• Single-object lookups no longer error when the platform reports a missing record with an empty response body
• Jira tasks and issues sync checks the issue type against the Jira project's own issue types on Jira Cloud, so a type the project has is no longer rejected
• Tenable.io and Tenable SC CIS checklist sync now records each run as an assessment on the security plan, with the counts of passed, failed, not reviewed and not applicable checks and an overall result, instead of finishing with no CIS record, and a refused assessment counts as a partial failure, so the sync exits with code 3 when REGSCALE_STRICT_EXIT_CODES is set
• aws sync_assets now records the real diskStorage of every EC2 instance when one attached volume no longer exists, instead of giving every volume in the batch the 8 GB floor because AWS refused the whole batch of 200 volumes
• aws sync_findings, sync_findings_and_assets and the ten AWS compliance commands (sync_s3, sync_kms, sync_cloudtrail, sync_cloudwatch, sync_iam, sync_guardduty, sync_ssm, sync_org, sync_config_compliance, sync_compliance) accepted --dry-run but synced anyway, so an Orchestration Hub split job wrote everything twice (in the count run and again in the children); a dry run now only counts and echoes the splitter's JSON summary; the findings commands count the raw Security Hub findings that --offset/--limit slice and parse nothing; and a compliance dry run stops before the scan history and writes no assets, assessments, issues or evidence
• Compliance commands for AWS, GCP, Tanium, CrowdStrike, Qualys CIS, PAN-OS and QRadar now create one issue for each failing control instead of one issue per run
• The AWS compliance commands that write a bucket, KMS key, GuardDuty detector or account asset (sync_s3, sync_kms, sync_iam, sync_ssm, sync_guardduty, sync_config_compliance, sync_compliance and sync_securityhub_compliance) now send those assets under sync_assets' source with their region recorded, and sync_assets on a plan that holds assets in more than one region keeps other regions' assets active while still marking Inactive the regional resources deleted from the region it ran in (on such plans, global assets such as IAM roles and assets with no recorded region are not marked Inactive; compliance reruns reactivate any mopped-up Inactive assets)
• AWS sync_assets on plans with assets in more than one region now marks a deleted resource as not in the latest scan and keeps edits made to it during the run, and the AWS compliance commands keep an Inactive status a user set and give S3 buckets the Cloud Storage type without replacing their description
• AWS load balancers from Security Hub findings now get the Load Balancer asset type and name that aws sync_assets gives them, instead of Other
• aws and gcp asset syncs type each component from its assets' category, and a re-sync retypes an existing Hardware or Software component when all its assets agree, so a GCP service account, firewall rule, service or bucket component an earlier version made Hardware becomes Software and the aws "AWS Account" component becomes Hardware to match its asset
• GCP sync_findings and sync_compliance now map a finding to the same NIST controls, so sync_findings no longer writes a passed row for a control that sync_compliance fails: both commands read NIST 800-53 tags however Security Command Center spells the standard and ignore tags of other NIST standards such as CSF and 800-171; both map an untagged finding by one shared category table and an untagged CVE finding to SI-2; and sync_compliance also assesses a tagged control that its framework table does not list
• gcp sync_compliance and gcp collect_evidence no longer add a second project asset when Resource Manager refuses the project lookup or when gcpSccUrl overrides the endpoint, because the compliance pass now reads the project number from Cloud Asset Inventory with the same endpoint and credentials as gcp sync_assets
• jira issues and jira tasks now sync the remaining attachments of a Jira issue when one attachment fails to download, instead of stopping the attachment sync for the whole issue, and name that attachment in a warning; while that attachment fails to download, they hold back the RegScale files they would send to that Jira issue, so that they add no duplicates, and name each file they hold back
• jira issues now reports how many Jira issues RegScale did not save in its summary line, instead of reporting only "created 0, updated 0" when RegScale refuses the issues
• jira issues now dates a Done, Closed or Cancelled issue from Jira's status-change date, else its resolution date, else its created date, as jira tasks does, and a malformed Jira date no longer stops the other issues from syncing
• jira tasks gives a task created closed and a task closed on a later run the same close date when Jira's status change date is missing or unreadable, using the resolution or creation date instead, and keeps a closed task's close date when other fields change
• BigQuery asset sync no longer reports success when rows have no assetId value, and fails when no row has one
• AWS S3, CloudTrail, CloudWatch and Systems Manager syncs now accept an --account_id with surrounding spaces and treat a blank one as no account filter
• AWS S3, CloudTrail, CloudWatch and Systems Manager syncs no longer reuse cached data from a run with a different AWS credential or different filters, and keep that cache in the artifacts directory instead of the shared temporary directory
• Jira task syncs no longer create a RegScale task or Jira attachment twice when RegScale answers slowly or with a gateway error, and the run summary counts only the tasks RegScale stored
• With REGSCALE_STRICT_EXIT_CODES, an asset sync no longer exits 3 for a row RegScale merged into a later row with the same identifier in the same request
• Scanner and BigQuery asset syncs no longer send an asset batch a second time after a gateway error, timeout or dropped connection, and fail the run so that a rerun lands the batch (except with REGSCALE_USE_LEGACY_REQUESTS)
• BigQuery asset sync dry run in table mode counts the rows of a table whose metadata has no row count instead of failing
• GCP sync_findings help and the GCP page now say that findings land as vulnerabilities, and the page lists the extra control mappings sync_compliance applies
• Wiz issue sync now asks Wiz for open, in-progress, resolved and rejected issues when the filter names no status, instead of leaving the statuses to Wiz
• Corrected the Wiz documentation for the default inventory entity types and the default issue status filter
• On a RegScale platform that supports it, aws sync-config-compliance updates and closes the issues an earlier version opened instead of adding a second issue per failing control, and closes the duplicate issues those versions left
• Asset syncs now name each asset RegScale refused beside the reason RegScale gave, and say an asset came back with no reason only when none was given
• Nessus and other scanner imports no longer fail with an empty HTTP 400 when creating issues through the Client API
• A compliance batch response (POST /api/client/v1/assessments/control-results, POST /api/client/v1/control-test-results/batch) whose saved entry names no submitted index is now reported as a Client API contract error, with the earlier chunks attached as the partial result, instead of being silently credited to the first submitted row
• Scanner syncs split large vulnerability submissions by the number of affected assets again, so imports with many hosts per finding are not lost to a timed-out request
• Tanium vulnerability sync now picks the same representative endpoint for a consolidated finding on every run, so the issue description, asset identifiers, DNS and IP address no longer change between syncs of the same data
• Vulnerability batches again send an empty plugInText, as 6.x did, when a finding has neither plug-in text nor observations, instead of omitting the field
• CLI v7 prints the 6.x log lines a Nessus import and the AWS compliance syncs printed (issue-asset mapping count, records-cache summary) and moves the lines 6.x never printed (nothing closed by mop-up, control-reference link notes, the per-scan vulnerability success line) to DEBUG
• Issues created from scanner findings again carry the Current/Planned milestone note that the 6.x releases wrote
• CLI v7 reports the wrapper normalizations that store exactly what 6.x stored (a defaulted placeholder, a value accepted as sent, a dns stored as 6.x's own "unknown") at DEBUG, worded for what happened; a truncation still warns
• CLI v7 prints the plan's remediation-SLA line only on the commands 6.x printed it on (Nessus imports and Wiz issues), not on the Wiz vulnerability, Qualys and Tenable syncs that dated their own findings in 6.x
• Findings that --skip-assets leaves out because no matching asset exists are no longer closed as remediated
• Prisma sync_hosts and sync_images with --skip-assets no longer create or update assets
• aws sync_assets skips AWS services that the target region does not offer, such as App Runner, Lightsail, AppSync, CloudFront, Global Accelerator and Audit Manager in GovCloud and Rekognition, Comprehend and Timestream in us-gov-east-1, with an INFO line instead of retrying and logging each at ERROR
• Microsoft Defender 365 recommendations with no severity score are created as Moderate issues instead of being dropped, and reopening an issue from such a recommendation keeps its severity and due date
• Microsoft Defender sync commands now close issues Defender no longer reports and reopen closed issues it reports again, keeping their control links, and a Defender for Cloud sync closes an issue whose record it no longer receives only when the issue's other identifier is an Azure resource id in the subscription it reads, and warns about issues without one
• Microsoft Defender for Cloud recommendation issues for a resource with no resource details are no longer titled with a trailing "on"
• Tanium Cloud vulnerability and compliance syncs no longer stop with a pagination data limit error, reducing the request size automatically when the Tanium API Gateway rejects it
• Tanium Cloud vulnerability, compliance, ports and SBOM syncs no longer stop early when a page of endpoints has no matching data
• Qualys Total Cloud sync now reads every page of the host detection list instead of only the first, and a run that stops early on a later page no longer closes assets or findings it did not read
• Qualys sync_qualys no longer fails when Qualys truncates the host detection list without a continuation URL, and closes nothing it did not read on that run
• Qualys Total Cloud sync now scopes hosts to the asset group, excludes tagged hosts when only exclude tags are given, accepts numeric tag IDs, and keeps the asset group or tag filter when it falls back to VMDR
• Rapid7 findings with an InsightVM risk score above 10 are no longer rejected by the Client API, and the risk score is no longer saved as the VPR score; a VPR score already stored on an existing vulnerability is kept
• aws sync_iam now exits 4 (authentication failure) when AWS refuses its credentials, checking them before it writes anything to RegScale, instead of reporting "completed successfully" having read nothing
• Tenable SC query_vuln and sync_vulns now exit with a non-zero status when the import fails, instead of reporting success
• Tenable SC query and sync commands now import every vulnerability a query returns, instead of importing nothing for small queries and dropping the last results of larger ones
• Tanium sync_compliance --dry-run now honors --offset and --limit, and a dry run of sync_compliance or sync_all fails when the Tanium Comply fetch fails instead of reporting 0 items
• Tanium sync_all --dry-run no longer writes compliance assets and assessments to RegScale; it logs how many compliance items, one per finding and mapped control, it would sync
• Tanium sync-all in security plan mode now links compliance results to the endpoint's existing asset instead of creating a duplicate, and the compliance step of sync-all and sync-compliance no longer marks endpoint assets Inactive
• Qualys fetch-vm-report, import-vm-report and import-cis-report now exit non-zero instead of 0 when the report cannot be fetched or parsed, the CIS report has no results, the security plan is not accessible, or no report option is given
• Tenable SC JSONL sync now fails when the Tenable SC login or query download fails, instead of syncing nothing and reporting success
• Tenable SC JSONL sync accepts a query id of 0 instead of reporting that no query id was provided
• Tenable SC JSONL sync now fails when neither a query id nor a file path is given or when the sync itself fails, instead of reporting success
• Qualys vulnerabilities now carry the CVSS v3 and v2 base scores and vectors from the Qualys knowledge base, and each sync fills in or updates them on existing vulnerabilities
• Slow start-up of every command, most noticeable on short AWS, Microsoft Defender and Wiz runs
• Scanner syncs that return no findings, or whose findings exactly fill the last batch, now close the findings and issues the vendor no longer reports, which previously stayed open after such a sync, while Nessus imports close only what the reports they contain no longer list
• Asset syncs that return no assets now mark the assets the vendor no longer lists, which previously stayed active after such a sync
• OpenSCAP syncs whose run produced no issues now close the compliance issues the vendor no longer reports, which previously stayed open after such a sync
• Nessus imports of a named scan whose every host was fully scanned now close the findings and issues that scan no longer reports, even when the scan has no findings, which previously stayed open after such an import
• Prisma Cloud sync_hosts and sync_images runs no longer retire each other's assets or close each other's vulnerabilities and issues when both use the standard API mode: each run now tells the RegScale server which asset type it covers so its clean-up touches only those records (assets written by a CSV download-mode run share one type, so a plan that has used CSV mode for either command is still not separated)
• Compliance syncs store the issue's organisation on the first run; the RegScale Client API issue wrapper resolves it from the issue owner, the plan owner or the plan, where earlier releases left it empty until the next run
• A Rapid7 sync now retries a brief connection drop and stops with the host named if Rapid7 stays unreachable, and a console sync whose asset load fails now stops instead of finishing with missing findings
• SentinelOne sync commands now check the URL, token, timeout and page size before they contact RegScale, print a configuration error that names the setting without a traceback, and trim leading or trailing whitespace from a token instead of sending it as is, so the token no longer appears in an error
• CrowdStrike incident syncs now record the device serial number on each asset they create for an alert's device
• Qualys vulnerabilities whose knowledge-base record carries no CVSS v2 or v3 vector are stored with an empty vector, as they were before, instead of a null one
• Prisma Cloud host and container image syncs no longer overwrite each other's record for a CVE found on both: each command keeps its own vulnerability and issue
• aws sync_iam again caches its IAM data in artifacts/aws/iam_data.json and stores its account asset's scanning tool and its issues' source as 6.x did, so existing records are updated rather than duplicated
• The AWS compliance commands sync_s3, sync_org, sync_cloudtrail, sync_kms, sync_ssm, sync_cloudwatch, sync_directory_services and sync_compliance again store their account asset's scanning tool and their issues' source as 6.x did, so the existing account asset is updated rather than duplicated and issue due dates again follow the issues.scanner integration block of init.yaml
• Scanner integrations once again send each asset's type exactly as the scanner reported it; the RegScale platform now resolves vendor terms such as Server, Workstation and Virtual Machine to the same asset types the 6.52 CLI stored, so the saved asset types do not change
• A vulnerability, asset or issue batch chunk the RegScale server could not process is retried item by item through the same Client API route, as 6.x did, instead of being reported as rejected and dropped
• CrowdStrike compliance sync no longer warns that partially supported controls read as a full pass; the platform records them with the framework's partial implementation status
• crowdstrike sync_compliance now keeps the exit code and message of a usage error or a CrowdStrike timeout instead of reporting every failure as exit 1
• Qualys syncs of an account with no hosts, or with hosts that report no detections, now complete instead of failing and close the findings, issues and assets Qualys no longer reports
• AWS Security Hub, AWS Config compliance and AWS Inspector syncs that report no failing control, no failing rule or no active finding now close the findings and issues an earlier sync created, unless the sync was filtered, AWS returned an error, every result was inconclusive, or a Security Hub compliance-only sync ran with --no-collect-evidence
• Scan file imports whose file holds only the expected header row are now accepted as a report with no findings and close the findings, issues and assets an earlier import created, instead of being rejected as invalid
• Intune, Splunk, Axonius plan-field and full Synqly vulnerability syncs that report no devices, alerts or vulnerabilities now close the findings and issues an earlier sync created, and an Intune sync with no devices also retires the Intune assets it created
• AWS Config compliance syncs now close the issues of the findings they close, and a sync filtered by account or tags no longer closes findings outside the filter
• Prisma sync_images now attaches the findings of an image whose name the Prisma API reports as empty or null to that image's asset, instead of skipping them
• Prisma sync_hosts now reports the findings --skip-assets skipped, and the assets it created or updated, in the --output json run summary, and its failed records count toward REGSCALE_STRICT_EXIT_CODES
• A platform refusal that stops a vulnerability, asset or issue batch now reports every record the server already saved, however the batch's parallel requests completed
• Tanium sync_all in components mode now assesses the component's controls and files its ports roll-up on the component
• Wiz vulnerabilities resolved in Wiz now record the date Wiz resolved them as their close date, instead of the date of the sync that first saw them closed
• Commands now stop with an error naming the module when RegScale refuses to let the account read it, instead of continuing as if no records existed
• GraphQL responses that carry an empty or null errors value alongside their data are no longer treated as failed pages, and a malformed errors value is reported as the query error it is instead of crashing the error summary
• Qualys Total Cloud and VMDR host detection pagination now preserves tag and asset group filters across continuation pages
• Scanner findings with an unassigned severity are stored as Low vulnerabilities with Low issues again, instead of Informational vulnerabilities with Not Assigned issues
• Microsoft Defender for Cloud recommendation syncs no longer raise an issue for an assessment Defender marks not applicable to the resource, and close the open issue of one
• Tanium CIS benchmark and ports/protocols syncs now stop with a clear error when RegScale refuses or fails the asset lookup, instead of treating the assets they could not read as missing and creating duplicates
• The Policies Tested table of a compliance assessment report now shows Not Applicable, Inconclusive or No Result for a policy whose checks did not pass or fail, instead of Pass with a passing count of zero
• Tanium sync_cis_benchmarks now writes its CIS checklists, updates them on a rerun instead of adding copies, and exits with an error when none of its checklists could be written
• Qualys sync_qualys now reads every page of the Container Security container list instead of the first page only, and closes no hosts, containers or findings in a run that could not read the container list or a container's vulnerabilities in full
• Tanium sync_cis_benchmarks no longer adds a copy of a CIS checklist on every rerun when its benchmark title or rule holds an HTML-like tag such as <Level 1>
• DRF imports now read every column correctly when the header row has blank cells, no longer fail on an issue whose DR Number is empty, and log a missing column once instead of on every row
• tanium sync_compliance on a plan last synced with CLI 6.x no longer leaves each endpoint with two Active assets: the endpoint asset 6.x created is set Off-Network once the endpoint's current asset is on the plan
• aws sync_guardduty --create_vulnerabilities now writes a vulnerability for each GuardDuty finding that names a CVE, and --create_issues a record for each finding without one; both are vulnerability records, and the server makes each one's issue; these records close when GuardDuty archives the finding, not by mop-up, because each region's run shares the "AWS GuardDuty" source
• aws sync_assets and aws sync_cloudtrail no longer hang when AWS returns the same page of CloudTrail trails twice; they log an error instead
• Wiz syncs on a plan that a killed Wiz sync left held now close that sync's run after 4 hours and continue, instead of waiting for it until the server releases it after 7 days
• Wiz vulnerability syncs run at the same time as a Wiz inventory sync on one plan now wait until the inventory sync has written its assets before they skip the findings on assets that are not in the plan
• Microsoft Defender 365 recommendation syncs no longer raise or reopen an issue for a recommendation with an exception (risk accepted) in Defender, and close the open issue of one
• Nessus STIG and other compliance issues whose due date has already passed are saved as POA&Ms again, as 6.x saves them: the CLI asks RegScale to mark a past-due issue as a POA&M when RegScale computes its due date (not in IssueOnly mode)
• Scanner syncs now send a vulnerability that affects thousands of assets in several smaller requests, so a slow server no longer drops the request and every asset up to maxAssetIdentifiersPerVulnerability is linked
• A vulnerability found on more assets than maxAssetIdentifiersPerVulnerability now links at most that many assets in a sync, with a warning that says how many it left out
• aws sync_findings --generate-evidence now refuses an empty --control-ids value, or a part that is not a whole number from 1 to 2147483647, before it reads AWS or writes evidence, and without --generate-evidence the command logs that it ignores --control-ids
• AWS sync_directory_services no longer reuses Directory Services data cached by another credential or region
• AWS sync_directory_services now keys its account asset and evidence record by the AWS account its credentials belong to and the region, and renames an existing ds-service asset to that key in place, so each account and region keeps its own asset and record
• AWS sync_directory_services with --account-id or --tags now updates control assessments, and its --help and logs no longer say those options filter its data; AWS sync_compliance --help no longer lists account ID among its filters
• AWS evidence commands now link evidence to the controls named by --evidence_control_ids when a run skips the control assessment step, such as with --no_update_control_status, --account_id, --tags, or --offset and --limit, and on every run a NIST control id given to --evidence_control_ids also links on a plan of another framework, such as SOC2, through that framework's crosswalk
• Flat-file scan imports, such as Aqua, now send each asset once instead of once per row and keep the values of its last row, so rows that repeat an asset are no longer rejected as duplicates
• The file comparison command now names the supported file types, CSV, XLSX or XLS, when it refuses a pair of files
• regscale model generate now exports every assessment and control implementation linked to the parent instead of only the first 50
• regscale model load exits non-zero and warns that the import may already be committed when RegScale returns a record id that is not a number, instead of showing a traceback
• regscale model dropdowns whose values join to exactly 256 characters now use a lookup sheet, since Excel rejects an inline list longer than 255 characters
• regscale model load exits non-zero with "no workbook found" when neither the new nor the edit workbook is in the given path, instead of reporting that files were uploaded
• regscale model load no longer sends a new row whose only filled cells are read-only, which could create a blank record, and reports it with its row number
• regscale model load refuses the edit workbook's new rows, naming each row number, when an Id from the pre-change copy was removed, instead of risking a duplicate record
• regscale model load skips new rows that an earlier load already created, using the workbook's Ids sheet, so re-running it after a partial failure no longer creates duplicate records
• cve-cleanup discover --output now writes the CSV export instead of failing after the header row
• evidence start signature checks now read each PDF from its program folder, so a signed document in a program sub-folder no longer fails the signature-required test
• evidence start now reads config.json and list.json when evidenceFolder is a relative path such as the default ./evidence, instead of falling back to default rules and creating no assessments
• fedramp import-drf treats a cell as the export's empty-value text only in the column the export writes it to, as the platform's DRF import does: the same text in another column is stored as written, "N/A" in Remediation Level Explanation keeps the stored value, a Risk Adjustment row no longer needs a Justification, and a new deviation with an empty or placeholder Operational Impact Statement or Justification is created without one instead of "N/A" or "Unknown Justification"
• Scanner syncs now exit 1 and hold back closing findings when RegScale saves a batch but cannot finish applying it, and count records RegScale refuses as item-level failures under REGSCALE_STRICT_EXIT_CODES
• Saving a single issue no longer warns that a control label it could not link was changed to an empty value, since the label is stored as sent
• Trivy, Grype, OpenText WebInspect, SAP Concur Tenable, Sicura, Splunk, STIG, Acunetix and Synqly vulnerabilities imports no longer log the security plan remediation SLAs, which they do not use to date their findings
• Scan history after a Snyk import no longer counts twice two findings that RegScale stores as one vulnerability
• Orca commands now report that the Orca host could not be reached, naming the host, instead of saying the API token was rejected, and exit without a traceback
• The cisa ingest_cisa_alerts command now reports that it could not reach the CISA site and exits with an error, instead of crashing with an AttributeError, when www.cisa.gov is unreachable
• Evidence that Wiz sync_compliance, the eMASS importers and other integrations write is now created, owned by the signed-in user, on tenants whose Evidence form requires an Evidence Owner instead of failing for the missing owner, and on those tenants a refreshed evidence record also becomes the signed-in user's
• Scanner imports into a security plan date new issues from the plan's compliance-setting remediation SLAs again, ahead of init.yaml's issues.<integration> day counts, as 6.x did, so a high OpenSCAP issue under the RegScale Default Setting is due 30 days after it is first detected rather than 60
• regscale gitlab sync_issues reports that it could not connect to GitLab, naming the host, and exits with an error instead of ending with a connection-error traceback
• Salesforce sync now reports that the Salesforce login failed, with the reason, and exits with an error when the connection is refused or a credential is rejected, instead of stopping with a traceback
• Microsoft Sentinel sync_content now names the content type that failed to load, such as watchlists or bookmarks, instead of reporting every failed read as an incident page
• AWS sync commands save their evidence records and link them to the security plan instead of exiting with an Evidence Owner is required error
• When one checklist is empty or damaged, stig sync_assets now syncs the hosts of every other checklist and sync_assets_and_findings and process_checklist now import every other checklist, naming each unreadable checklist in one error line and exiting 1, instead of stopping at that file with a traceback
• stig sync_assets, sync_findings, sync_assets_and_findings and process_checklist now reject a --stig_directory that does not exist with a usage error (exit 2), instead of reporting success and exiting 0
• regscale qualys get_asset_groups, export_scans, save_results, sync_qualys, list_policies and export_policy now end with one error line and exit 6 when Qualys cannot be reached, instead of a traceback
• regscale qualys export_scans now exits 6, or 4 when Qualys refuses the credentials, when Qualys answers with an HTTP error, instead of failing with a traceback while reading the error as scan data
• regscale qualys save_results now exits 6, or 4 when Qualys refuses the credentials, when Qualys answers every scan list with an HTTP error, instead of failing with a traceback
• Qualys get_asset_groups and list_scans now exit with an error when Qualys refuses, fails or does not answer a request, instead of reporting an empty result, and list_scans honours qualysTimeout
• Qualys save_results now saves the scan results as a .json file in the given directory, keeps the scans of every scan list, and handles a scan list with no scan or one scan
• Qualys VM report import now saves a vulnerability for a finding without a CVE, and its issue stays open
• wiz sync_benchmarks exiting 0 when Wiz refused the framework or rule query or a benchmark import failed; it now exits 4 when Wiz refuses the token, 6 on another HTTP or connection failure, 1 on a GraphQL error or a failed import, and reports a malformed --framework_id as a usage error
• A second scanner import on the same day, for example a Tanium findings sync, now closes the findings it no longer reports: each run tags its vulnerability batch with its own id instead of the date
• When the evidence form requires an Evidence Owner and the signed-in user cannot be read from the login token, integration evidence records are owned by the userId in init.yaml instead of failing for the missing owner
• Scanner asset syncs no longer reset an asset status set in RegScale, such as Off-Network or Decommissioned, back to Active (On Network) on RegScale 6.35.1.0 and later
• AWS Security Hub findings now name a CloudWatch log group asset by its full log group name, including any "/" path, instead of "" or a shortened name such as "api:"
• AWS Lambda assets named by a version or alias ARN now take the function name and link to the function's console page
• aws sync_assets now resolves the AWS account ID via STS (or the collector's configured account) for Redshift clusters whose DescribeClusters response omits ClusterNamespaceArn, keeping the account segment in the cluster ARN and preserving the cluster when --account_id matches
• AWS findings and assets sync now renames assets an earlier version named by their full ARN, fixing their name, description and console link (requires RegScale 6.35.1.0 or later, not on a dry run; versioned or aliased Lambda functions, Lambda layer versions and log groups ending in ":*" keep their ARN name for now)
• regscale aws sync_guardduty now keeps GuardDuty findings read before or around a failed ListFindings page or GetFindings chunk and leaves IR-4 unassessed with a warning instead of passing IR-4 on an incomplete findings read
• The pre-release workflow's extract-version step now receives the workflow_dispatch tag_name input through env instead of inline ${{ }} expansion and rejects multi-line values before the tag format check, so a crafted dispatch tag cannot break out of quotes or bypass validation
• jira issues now syncs RegScale attachments to a linked Jira issue even when that Jira issue has no attachments of its own yet
• gcp sync_compliance now classifies a Cloud SQL instance (//cloudsql.googleapis.com/projects/<p>/instances/<i>) as Hardware, matching gcp sync_assets (sqladmin.googleapis.com/Instance)
• The jira tasks command no longer creates two RegScale tasks, and the jira issues command no longer counts a ticket twice, when the Jira search returns the ticket on more than one result page
• AWS sync_guardduty and sync_assets no longer create a second asset for a GuardDuty detector when the account lookup fails on one run and succeeds on a later one; detector assets that earlier versions keyed without an account are not yet merged
• aws sync_config_compliance now closes the record an earlier version kept under the bare account id, so an account keeps one open record per failing control, and the remaining record keeps the original first-seen date
• aws sync-config-compliance no longer closes the findings and issues of another AWS account synced into the same plan
• regscale aws sync_config_compliance --conformance_pack_name no longer closes the findings and issues of controls that pass, so the findings and issues of failing rules outside the conformance pack stay open
• Asset syncs no longer name an asset refused, or fail the run, when RegScale merged it into a later row of the same request whose identifier differs only in letter case
• Repeat Axonius syncs no longer close vulnerabilities and issues, or mark assets Inactive, that Axonius still reports
• prisma sync_hosts and panw sync_hosts now refuse a security plan that does not exist and exit 1 naming it, before they read Prisma Cloud or write to RegScale
• aws sync_findings_by_plan_field and the aws Security Hub pipeline commands (sync_securityhub, sync_securityhub_by_plan_field, sync_securityhub_by_component_map) now log, for each security plan, how many findings below issues.aws.minimumSeverity they dropped
• aws sync_findings now logs how many findings issues.amazon.minimumSeverity left out, as it already did for issues.aws.minimumSeverity
• The http2 setting now takes its value from the REGSCALE_HTTP2 environment variable, and reads 0 as off
• An empty environment variable named like a configuration key no longer overwrites the value saved in init.yaml
• maxAssetIdentifiersPerBatch now takes its value from the REGSCALE_MAX_ASSET_IDENTIFIERS_PER_BATCH environment variable, as maxAssetIdentifiersPerVulnerability does
• Wiz compliance report evidence attachment is now skipped with a warning when --regscale_module components is used, instead of failing the run after writing assessments, issues, and assets
• Wiz sync_compliance now rejects an unsupported --regscale_module value, naming the module, instead of silently running as securityplans
• AWS sync_assets no longer creates a duplicate Athena workgroup asset with an empty account ARN (::workgroup/) when sts:GetCallerIdentity fails on one run and succeeds (or --account_id is supplied) on another
• AWS Security Hub findings sync now names a CloudWatch log group asset by its log group name, matching the CloudWatch sync
• AWS Security Hub findings now name an ECR repository asset and build its console URI from the full repository name, including any "/" path, instead of only the segment after the last "/"
• aws sync_securityhub, aws sync_securityhub_by_plan_field and aws sync_securityhub_by_component_map no longer rename inventory assets or rewrite their description, notes and asset type: assets the plan already holds keep what aws sync_assets wrote, and only resources the inventory lacks (or rows an earlier build named by their full ARN) are written
• AWS sync_assets and sync_guardduty re-key GuardDuty detector assets that releases up to 6.55.0 stored with an empty account (arn:aws:guardduty:<region>::detector/<id>) to the full detector ARN instead of creating a second asset on upgrade
• A folder import of several scan files (for example snyk import_snyk or veracode import_veracode with a folder) no longer closes the findings of every file but the last: the whole folder now reports to one RegScale sync run per record type, closed once after the last file
• Control implementation imports (eMASS, FedRAMP) no longer wipe a control implementation's approval workflow state (approval status, date, notes, version and workflow instance) or other stored columns the CLI does not model when they write fields the create-or-update route does not carry
• FedRAMP CIS/CRM imports update control implementations created by applying a profile again: an update now sends "N/A" when the stored implementation statement is blank, instead of being refused with HTTP 400 "Implementation Statement is required", and a failed implementation update makes the command exit non-zero instead of 0
• STIG CCI assessments record a test result for each CCI instead of failing on plans with control implementations
• Dated evidence file names now keep a compressed file's full type: findings.jsonl.gz is stored as findings_<timestamp>.jsonl.gz instead of findings.jsonl_<timestamp>.gz
• defender import_alerts now stores every CVE of a multi-CVE alert row as its own vulnerability instead of keeping only the first; single-CVE rows keep their existing identity
• ControlImplementation.save() preserves nextAssessmentDueDate instead of clearing it to null on PUT /api/controlImplementation/{id}
• aws sync_findings stops with exit code 6 when a Security Hub page fails partway through the pull, instead of reporting success and closing findings it never read
• AWS Security Hub pipeline commands (sync_securityhub, sync_securityhub_by_plan_field and sync_securityhub_by_component_map) now sync active non-control findings and their assets instead of skipping every one
• A folder import of several scan files (for example snyk import_snyk or veracode import_veracode with a folder, or a Qualys file folder) no longer fails on the second file with "Another ... sync is still open" and exit code 1: every file now reports its assets to the folder's one asset sync run, as the first file does, so the second file's assets and findings are written
• FedRAMP OSCAL SSP import (fedramp import_oscal and fedramp ssp import-oscal) no longer stops with "Object of type PortsProtocol is not JSON serializable" when the platform rejects a component port and protocol; it logs the rejected record and continues
• Fixed an error when syncing ServiceNow change requests for a specific parent record
• jira issues again dates a Jira issue with no due date by its Jira priority as 6.x did (Highest 7, High 30, Medium 90, Low 180, Lowest 365 days by default) instead of the severity policy, and the issue description names its due date on the Due Date line again, including the stored date on a re-sync
• jira issues and jira tasks fall back to the medium count with a warning, instead of failing, when an issues.jira day count is not a positive whole number
• fedramp export_poam_v5 and fedramp poam export no longer stop with exit 1 when the RegScale platform's KEV catalog is empty or unreadable; as in 6.x they warn once, write N/A in the KEV Due Date column and finish the workbook
• Jira task sync no longer fails when updating a task whose Jira issue has no due date
• Compliance syncs such as aws sync_config_compliance, sync_ec2 and sync_ecr record a scan history again when their run saves no vulnerability, as 6.x did; 7.0 recorded no scan history for such a run
• Fixed ServiceNow change sync: change requests map onto the RegScale change fields, reruns update the synced change instead of creating duplicates, and a request with no planned dates no longer gets 0001-01-01 written into them
• wiz vulnerabilities exits 1 and names the findings it did not write when the plan holds no asset that wiz inventory wrote, instead of reporting success after a wiz inventory started too late
• aws sync_guardduty now writes a finding's CVE to its vulnerability and issue, and keys an EC2 instance or account-level finding the way aws sync_assets keys that asset (arn:aws:ec2:<region>:<account>:instance/<id>, AWS::::Account:<id>), so the record links to the inventory asset
• aws sync_assets now records a load balancer listener's port with its transport protocol (TCP, UDP, TCP/UDP or Other) and puts the listener protocol, such as HTTPS, in the port's service, instead of storing HTTP or HTTPS as the protocol
• The RegScale API client's SSL verification is DISABLED warning is logged once per command even when several threads build their client at the same time (for example qualys list_scans --module all), where it could print twice
• Prisma CSV import with software inventory now creates inventory for each host from the files it imported, and exits with an error when no file was imported or the inventory could not be created
• Prisma software inventory now reads the security plan's assets, and exits with an error when they cannot be fetched
• JFrog Xray imports send one asset per impacted artifact, so rows sharing an artifact are no longer refused as duplicates
• ServiceNow change sync no longer creates a change made in RegScale again as a new change request on every run
• AWS asset sync no longer reuses an inventory cached for another region, account ID, tag filter, profile or credential, which wrote other assets into the plan and set its own assets inactive
• AWS sync_findings no longer closes the open issues of a service turned off in aws.inventory.enabled_services while their findings are still active, and logs how many findings each turned-off service skipped
• regscale aws inventory collect now honours aws.inventory.enabled_services in init.yaml and collects the same services as regscale aws sync_assets
• AWS asset sync removes a load balancer's old AwsElbv2LoadBalancers component mapping once the asset is mapped to Load Balancers
• Jira attachment download warnings now show the whole file name, so two failed attachments with similar long names can be told apart
• Compliance syncs that create control tests, such as wiz sync_compliance, save their control test results again on platforms that do not yet create those control tests themselves
• Updated the pyasn1 dependency to a release that fixes known security vulnerabilities