Tags

v1.2.0

v1.2.0 — preparation for real-life usage

Epic #10: admin feature toggles, SCTM export (XLSX/CSV), continuous PPSM
and HW/SW sync from Nessus, Visio import and preview, Common Controls
Provider, Nessus compliance into the STIG pipeline, Security Operations,
Reports (in-house PDF), the packages overview and the Audit Center.
Migrations 0017-0024 (additive); roles seed adds secops, report and
audit_center.

v1.1.0

v1.1.0 — vulnerability management

Nessus/ACAS scan import: findings with their own lifecycle across scans, a
network-discovery record of every host observed, and reviewed proposals into
the hardware/software list and PPSM. Nothing reaches the boundary without a
person accepting it.

A Vulnerability Center reads across every package you can reach: estate
posture, every scanned host worst-first, open findings grouped by plugin so one
flaw on forty hosts is one thing to patch, and scan coverage — the only view in
which a package nobody has scanned looks different from a clean one.

Also: the sidebar's app-wide menu collapses so a package's own menu fits
without scrolling; code-scan imports report the real database error and refuse
on a schema behind the build; four transitive advisories cleared.

Upgrading from 1.0.2 applies migrations 0014 and 0015 and re-seeds role
permissions via the bootstrap image — no manual step.

v1.0.2

v1.0.2 — bootstrap image without node_modules

The bootstrap image is now esbuild bundles + migrations + seed data on the
patched Alpine base (187 MB, down from 899 MB) and its Trivy scan is a hard
gate (#7).

v1.0.1

v1.0.1 — fixes from the docs capture

Milestone status persists (#1); date-only values no longer render a day
early (#3); POA&M lists wrap long weakness text (#4); clearer Network Device
label (#5); bootstrap image drops npm, runs tsx directly, and its entrypoint
runs any given command (#6).

v1.0.0

v1.0.0 — first public release (GNU AGPL v3)

Bedrock RMF is now open source. Same code Foxx Cyber runs for its own ATO
packages: NIST SP 800-53 Rev 5 control implementations to the CCI, POA&Ms,
evidence, HW/SW inventory, PPSM, STIG Center, cloud inheritance, Code
Security. One-command self-hosted install from published images.

v0.3.2

v0.3.2 — software asset identity index + duplicate collapse

v0.3.1

v0.3.1 — SQL-aggregated STIG summaries; import binds only live hardware

v0.3.0

v0.2.0

STIG Center metrics + UI workspace polish

v0.1.0

v0.1.0 — zero-config docker compose stack

v0.0.6

v0.0.6 — audit CCI response changes

v0.0.5

v0.0.5 — consistent membership roles

v0.0.4

v0.0.4 — single role model

v0.0.3

v0.0.3 — SCTM/CCI persistence, stylesheet 404, PPSM a11y

v0.0.2

v0.0.2 — fix first-run package creation

Fixes a first-run blocker: on a fresh install with no teams, creating
the first ATO package failed with 'Cannot read properties of undefined
(reading id)'. createPackage now creates a Default Team when none
exists.

v0.0.1

v0.0.1 — first beta

Initial beta release of Bedrock RMF as a container image.

Not yet exercised in production. Known gaps:
- No automated deploy; pull and run the image manually.
- noUncheckedIndexedAccess is off, so Drizzle row guards carry lint
  suppressions (see CLAUDE.md).