v1.2.2

[1.2.2] - 2026-04-27

Fixed

• TopN config fallback path now correctly logs via ctx.logger.print_warning under non-strict semantic failures instead of raising AttributeError on ctx.print_warning.
• TopN inference allow_predicates normalization is now additive over supported defaults to prevent bundled rule invalidation during partial predicate overrides.
• EPSS online stream ingestion now fails closed on HTTPS downgrade redirects and enforces response-size guardrails from Content-Length before decompression.
• NVD SQLite security policy now reads runtime validated global config from services.global_config, with compatibility fallback for legacy ctx.config callers.
• Webhook delivery now honors webhook.max_retries and retries transient failures before marking endpoint delivery failed/spooled.
• CSV export on Windows no longer emits doubled CRLF row separators; CSV writer now opens text output with newline="".

Added

• Regression tests for TopN non-strict fallback behavior, EPSS redirect/size hardening, NVD runtime SQLite policy wiring, webhook retry semantics, and Windows CSV newline behavior.

Full Changelog: v1.2.1...v1.2.2

v1.2.1

What's Changed

This hotfix fixes a release packaging issue with the global config.yaml -> nvd start year feeds being at a year that NVD technically does not keep a record of that was introduced in v1.2.0.

It's highly recommended to install from v.12.1.

Full Changelog: v1.2.0...v1.2.1

v1.2.0

🚀 VulnParse-Pin v1.2.0

NOTICE

This release may introduce a problem where there is an invalid year in the global config(.yaml) in feeds -> nvd -> start year. This causes a runtime failure. You may install v1.2.1 or check out this quick fix here:

• Set the value feed_cache.feeds.nvd.start_year -> 2002 in the config from %USERAPPDATA%/VulnParse-Pin/versions/1.2.1/config/config.yaml

The Environmental and Attack Surface Contextualization Update

VulnParse-Pin v1.2.0 transforms vulnerability scanner output into a ranked, explainable remediation plan based on real-world exploitability with emphasis on more realistic asset context.

This release introduces production-grade decision support, combining exploit signals, contextual reasoning, and full auditability.

---

🔥 Highlights

🧠 Attack Capability Inference (ACI)

• Infers real-world attacker capabilities (RCE, lateral movement, privilege escalation)
• Detects potential exploit chains across findings

📊 Whole-of-CVEs Scoring

• Scores findings across all associated CVEs (not just one)
• Bounded decay aggregation for realistic risk modeling
• Full score_trace for explainability

🧪 Ingestion Trust Layer

• Detect degraded or low-quality scanner input
• Confidence scoring + strict ingestion modes
• Decision ledger events for ingestion outcomes

🧠 GHSA Enrichment (Production-Ready)

• Signed + quarantined SQLite cache
• Online + offline modes
• Package-level fallback matching

🌐 Nmap Attack Surface Context

• Incorporates real open-port data into prioritization
• Influences ranking without mutating source findings

🔗 Webhook Delivery

• HMAC-SHA256 signed events
• Replay protection (timestamp + nonce)
• OAL filtering for pipeline integration

---

v1.1.1

What's Changed

• Governance and Architecture Hardening by @QT-Ashley in #20
• Governance and Architecture Hardening Docs Build Fix by @QT-Ashley in #21
• Release/v1.1.1 by @QT-Ashley in #22
• Release/v1.1.1 by @QT-Ashley in #23

Full Changelog: v1.1.0...v1.1.1

v1.1.0

What's Changed

• Auditability and Provenance Update by @QT-Ashley in #19

Full Changelog: v1.0.3...v1.1.0

v1.0.3

What's Changed

• Release/v1.0.2 by @QT-Ashley in #14
• Potential fix for code scanning alert no. 2: Workflow does not contain permissions by @QT-Ashley in #15
• Technical Docs Updates by @QT-Ashley in #16
• Release/v1.0.3 by @QT-Ashley in #17
• Release/v1.0.3 by @QT-Ashley in #18

Full Changelog: v1.0.2...v1.0.3

v1.0.2

What's Changed

• Added Issue Templates by @QT-Ashley in #6
• Release 1.0.2 Changes and Improvements by @QT-Ashley in #9
• Release 1.0.2 Changes and Improvements by @QT-Ashley in #10
• Release/v1.0.2 by @QT-Ashley in #11
• Release/v1.0.2 by @QT-Ashley in #12
• Release/v1.0.2 by @QT-Ashley in #13

Full Changelog: v1.0.1...v1.0.2

v1.0.1

What's Changed

• • ADDED: by @QT-Ashley in #3
• Fix link format for Shodan enrichment by @QT-Ashley in #4

Full Changelog: v1.0.0-rc4...v1.0.1

v1.0.0-rc4

Full Changelog: https://github.com/QT-Ashley/VulnParse-Pin/commits/v1.0.0-rc4