publish v2026.6

.github/CODEOWNERS

@@ -31,3 +31,6 @@ mkdocs.yml @ahouseholder
 
 # github setup
 /.github/ @ahouseholder @sei-vsarvepalli
+
+# CISA-namespaced items are kept in folders named `cisa` at various depths
+**/cisa/** @j---

.github/workflows/deploy_site.yml

@@ -46,19 +46,19 @@ jobs:
           uv sync --no-dev
 
       - name: Setup Pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@v6
 
       - name: Build Site
         run: |
           export PYTHONPATH=src:$PYTHONPATH
           uv run mkdocs build --clean --config-file mkdocs.yml       
 
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v4
+        uses: actions/upload-pages-artifact@v5
         with:
           # Upload entire repository
           path: 'site'
 
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5

.github/workflows/docs_build_check.yml

@@ -0,0 +1,33 @@
+name: Docs Build Check
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["main"]
+
+permissions:
+  contents: read
+
+jobs:
+  docs-build:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Set up Python 3.12
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip uv
+          uv sync --no-dev --frozen
+
+      - name: Build docs
+        run: |
+          export PYTHONPATH=src:$PYTHONPATH
+          uv run mkdocs build --clean --config-file mkdocs.yml

.github/workflows/lint_md_changes.yml

@@ -16,12 +16,12 @@ jobs:
     - uses: actions/checkout@v6
       with:
         fetch-depth: 0
-    - uses: tj-actions/changed-files@e0021407031f5be11a464abee9a0776171c79891
+    - uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96
       id: changed-files
       with:
         files: '**/*.md'
         separator: ","
-    - uses: DavidAnson/markdownlint-cli2-action@v22
+    - uses: DavidAnson/markdownlint-cli2-action@v23
       if: steps.changed-files.outputs.any_changed == 'true'
       with:
         globs: ${{ steps.changed-files.outputs.all_changed_files }}

.github/workflows/python-app.yml

@@ -37,7 +37,7 @@ jobs:
       run: |
         uv build 
     - name: Upload Artifacts
-      uses: actions/upload-artifact@v6
+      uses: actions/upload-artifact@v7
       with:
         name: ssvc
         path: src/dist/ssvc-*.tar.gz

.github/workflows/run_doctools.yml

@@ -0,0 +1,64 @@
+name: "Run doctools on PR"
+
+on:
+  pull_request:
+    paths:
+      - 'src/ssvc/**'
+      - .github/workflows/run_doctools.yml
+
+permissions:
+  contents: write
+
+jobs:
+  run-doctools:
+    # Skip when the auto-commit from this workflow triggers a re-run
+    if: github.actor != 'github-actions[bot]'
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ github.head_ref }}
+          fetch-depth: 0
+
+      - name: Set up Python 3.12
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip uv
+          uv sync --dev --frozen
+
+      - name: Run doctools
+        run: |
+          # Remove stale decision point files so doctools generates a clean set
+          rm -rf data/json/decision_points
+          export PYTHONPATH=$(pwd)/src
+          uv run python -m ssvc.doctools --overwrite --datadir ./data
+
+      - name: Fail if fork PR has uncommitted data/ changes
+        if: github.event.pull_request.head.repo.full_name != github.repository
+        run: |
+          git add data/
+          if git diff --cached --quiet; then
+            echo "No data/ changes detected."
+          else
+            echo "::error::This PR is from a fork and data/ files need to be regenerated."
+            echo "::error::Please run 'make regenerate_json' locally and push the resulting data/ changes to your PR branch."
+            exit 1
+          fi
+
+      - name: Commit changes to data/
+        if: github.event.pull_request.head.repo.full_name == github.repository
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add data/
+          if git diff --cached --quiet; then
+            echo "No changes to commit"
+          else
+            git commit -m "chore: regenerate data files via doctools"
+            git push
+          fi

.gitignore

@@ -132,3 +132,4 @@ ssvc2-applier-wip.xlsx
 _version.py
 node_modules
 tmp
+/wip_notes/

COPYRIGHT-code.txt

@@ -0,0 +1,18 @@
+#  Copyright (c) 2026 Carnegie Mellon University.
+#  NO WARRANTY. THIS CARNEGIE MELLON UNIVERSITY AND SOFTWARE
+#  ENGINEERING INSTITUTE MATERIAL IS FURNISHED ON AN "AS-IS" BASIS.
+#  CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY KIND,
+#  EITHER EXPRESSED OR IMPLIED, AS TO ANY MATTER INCLUDING, BUT
+#  NOT LIMITED TO, WARRANTY OF FITNESS FOR PURPOSE OR
+#  MERCHANTABILITY, EXCLUSIVITY, OR RESULTS OBTAINED FROM USE
+#  OF THE MATERIAL. CARNEGIE MELLON UNIVERSITY DOES NOT MAKE
+#  ANY WARRANTY OF ANY KIND WITH RESPECT TO FREEDOM FROM
+#  PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT.
+#  Licensed under a MIT (SEI)-style license, please see LICENSE or contact
+#  permission@sei.cmu.edu for full terms.
+#  [DISTRIBUTION STATEMENT A] This material has been approved for
+#  public release and unlimited distribution. Please see Copyright notice
+#  for non-US Government use and distribution.
+#  This Software includes and/or makes use of Third-Party Software each
+#  subject to its own license.
+#  DM24-0278

LICENSE

@@ -2,47 +2,49 @@ Different directories in this repository are subject to different licenses. Plea
 
 ---
 
-The following statement applies to markdown, pdf, bib, and text files (documentation):
+Copyright 2026 Carnegie Mellon University.
+
+This material is based upon work funded and supported by the Department of Homeland Security under Contract No. FA8702-15-D-0002 with Carnegie Mellon University for the operation of the Software Engineering Institute, a federally funded research and development center sponsored by the United States Department of Defense.  
 
-Copyright 2025 Carnegie Mellon University.
-
-This material is based upon work funded and supported by the Department of Homeland Security under Contract No. FA8702-15-D-0002 with Carnegie Mellon University for the operation of the Software Engineering Institute, a federally funded research and development center sponsored by the United States Department of Defense. 
-
 The view, opinions, and/or findings contained in this material are those of the author(s) and should not be construed as an official Government position, policy, or decision, unless designated by other documentation.
- 
+
 NO WARRANTY. THIS CARNEGIE MELLON UNIVERSITY AND SOFTWARE ENGINEERING INSTITUTE MATERIAL IS FURNISHED ON AN "AS-IS" BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED, AS TO ANY MATTER INCLUDING, BUT NOT LIMITED TO, WARRANTY OF FITNESS FOR PURPOSE OR MERCHANTABILITY, EXCLUSIVITY, OR RESULTS OBTAINED FROM USE OF THE MATERIAL. CARNEGIE MELLON UNIVERSITY DOES NOT MAKE ANY WARRANTY OF ANY KIND WITH RESPECT TO FREEDOM FROM PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT.
- 
+
 [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution.  Please see Copyright notice for non-US Government use and distribution.
- 
+
 This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.  Requests for permission for non-licensed uses should be directed to the Software Engineering Institute at permission@sei.cmu.edu.
-CERT Coordination Center® is registered in the U.S. Patent and Trademark Office by Carnegie Mellon University.
 
+
+This work product was created in part using generative AI.
+CERT Coordination Center® is registered in the U.S. Patent and Trademark Office by Carnegie Mellon University.
+
 DM24-0278
 
 ---
 
 The following statement applies to py, json, csv, sh, toml files (software):
 
-Copyright 2025 Carnegie Mellon University.
- 
+Copyright 2026 Carnegie Mellon University.
+
 Licensed under a MIT (SEI)-style license, please see license.txt or contact permission@sei.cmu.edu for full terms.
- 
+
 Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
- 
+
 The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
- 
+
 This Software includes and/or can make use of certain third party software ("Third Party Software"). The Third Party Software that is used by the software is dependent upon your system configuration, but typically includes the software identified in this license.txt file, and/or described in the documentation and/or read me file. By using this software, you agree to comply with any and all relevant Third Party Software terms and conditions contained in any such Third Party Software or separate license file distributed with such Third Party Software. The parties who own the Third Party Software ("Third Party Licensors") are intended third party beneficiaries to this License with respect to the terms applicable to their Third Party Software. Third Party Software licenses only apply to the Third Party Software and not any other portion of SEI Software or this software as a whole.
- 
-This material is based upon work funded and supported by the Department of Defense under Contract No. FA8702-15-D-0002 with Carnegie Mellon University for the operation of the Software Engineering Institute, a federally funded research and development center. 
- 
-The view, opinions, and/or findings contained in this material are those of the author(s) and should not be construed as an official Government position, policy, or decision, unless designated by other documentation. 
- 
+
+This material is based upon work funded and supported by the Department of Defense under Contract No. FA8702-15-D-0002 with Carnegie Mellon University for the operation of the Software Engineering Institute, a federally funded research and development center.  
+
+The view, opinions, and/or findings contained in this material are those of the author(s) and should not be construed as an official Government position, policy, or decision, unless designated by other documentation.  
+
 References herein to any specific commercial product, process, or service by trade name, trade mark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation, or favoring by Carnegie Mellon University or its Software Engineering Institute.
- 
+
 NO WARRANTY. THIS CARNEGIE MELLON UNIVERSITY AND SOFTWARE ENGINEERING INSTITUTE MATERIAL IS FURNISHED ON AN "AS-IS" BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED, AS TO ANY MATTER INCLUDING, BUT NOT LIMITED TO, WARRANTY OF FITNESS FOR PURPOSE OR MERCHANTABILITY, EXCLUSIVITY, OR RESULTS OBTAINED FROM USE OF THE MATERIAL. CARNEGIE MELLON UNIVERSITY DOES NOT MAKE ANY WARRANTY OF ANY KIND WITH RESPECT TO FREEDOM FROM PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT.
-
+
+This work product was created in part using generative AI.
+
 [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution.  Please see Copyright notice for non-US Government use and distribution.
-
-DM24-0278
 
+DM24-0278 
 

Makefile

@@ -10,48 +10,58 @@ UV_RUN=uv run
 
 all: help
 
+
+src/ssvc/utils/namespace_patterns.py: src/ssvc/utils/ssvc_namespace_pattern.abnf COPYRIGHT-code.txt
+	@{ \
+		cat COPYRIGHT-code.txt; \
+		echo ''; \
+		echo '# AUTOGENERATED, DO NOT CHANGE manually, see Makefile'; \
+	} >$@
+	$(UV_RUN) --group codegen abnf-to-regexp --format python-nested -i $< >>$@
+
 dev:
 	@echo "Set up dev environment..."
 	uv sync --dev
+	$(MAKE) src/ssvc/utils/namespace_patterns.py
 
 mdlint_fix:
 	@echo "Running markdownlint..."
 	markdownlint --config .markdownlint.yml --fix .
 
-test:
+test: src/ssvc/utils/namespace_patterns.py
 	@echo "Running tests locally..."
 	$(UV_RUN) pytest -v
 
-docker_test:
+docker_test: src/ssvc/utils/namespace_patterns.py
 	@echo "Building the latest test image..."
 	$(DOCKER_COMPOSE) build test
 	@echo "Running tests in Docker..."
 	$(DOCKER_COMPOSE) run --rm test
 
-docs_local:
+docs_local: src/ssvc/utils/namespace_patterns.py
 	@echo "Building and running docs locally..."
 	$(UV_RUN) mkdocs serve
 
-docs:
+docs: src/ssvc/utils/namespace_patterns.py
 	@echo "Building and running docs in Docker..."
 	$(DOCKER_COMPOSE) up docs
 
-api:
+api: src/ssvc/utils/namespace_patterns.py
 	@echo "Building and running API in Docker..."
 	$(DOCKER_COMPOSE) up api
 
-api_dev:
+api_dev: src/ssvc/utils/namespace_patterns.py
 	$(UV_RUN) uvicorn ssvc.api.main:app --reload
 
-up:
+up: src/ssvc/utils/namespace_patterns.py
 	@echo "Starting Docker services..."
 	$(DOCKER_COMPOSE) up -d
 
 down:
 	@echo "Stopping Docker services..."
 	$(DOCKER_COMPOSE) down
 
-regenerate_json:
+regenerate_json: src/ssvc/utils/namespace_patterns.py
 	@echo "Regenerating JSON files..."
 	rm -rf data/json/decision_points
 	export PYTHONPATH=$(PWD)/src && ./src/ssvc/doctools.py --datadir=./data --overwrite

data/LICENSE

@@ -1,4 +1,4 @@
-Copyright 2025 Carnegie Mellon University.
+Copyright 2026 Carnegie Mellon University.
 
 Licensed under a MIT (SEI)-style license, please see license.txt or contact permission@sei.cmu.edu for full terms.
 

data/csv/cisa/cisa_bod_26_04_1_0_0.csv

@@ -0,0 +1,17 @@
+row,In KEV v1.0.0 (cisa),Publicly Exposed v1.0.0 (cisa),Automatable v2.0.0,Technical Impact v1.0.0,CISA BOD 26-04 Remediation Timelines v1.0.0 (cisa)
+0,no,no,no,partial,fix on system upgrade
+1,yes,no,no,partial,14 days
+2,no,yes,no,partial,60 days
+3,no,no,yes,partial,60 days
+4,no,no,no,total,fix on system upgrade
+5,yes,yes,no,partial,14 days
+6,yes,no,yes,partial,14 days
+7,no,yes,yes,partial,14 days
+8,yes,no,no,total,14 days
+9,no,yes,no,total,14 days
+10,no,no,yes,total,60 days
+11,yes,yes,yes,partial,3 days
+12,yes,yes,no,total,3 days & forensic investigation
+13,yes,no,yes,total,3 days & forensic investigation
+14,no,yes,yes,total,3 days
+15,yes,yes,yes,total,3 days & forensic investigation

data/json/decision_points/cisa/cisa_bod_26_04_remediation_timelines_1_0_0.json

@@ -0,0 +1,35 @@
+{
+  "namespace": "cisa",
+  "key": "BOD2604",
+  "version": "1.0.0",
+  "name": "CISA BOD 26-04 Remediation Timelines",
+  "definition": "The CISA BOD 26-04 outcome group of remediation timelines for agencies to follow.",
+  "schemaVersion": "2.0.0",
+  "values": [
+    {
+      "key": "FSU",
+      "name": "Fix on system upgrade",
+      "definition": "The vulnerability should be remediated the next time the vulnerable asset receives a scheduled major upgrade or rebuild."
+    },
+    {
+      "key": "60D",
+      "name": "60 days",
+      "definition": "Remediate within 60 days."
+    },
+    {
+      "key": "14D",
+      "name": "14 days",
+      "definition": "Remediate within 14 days."
+    },
+    {
+      "key": "3D",
+      "name": "3 days",
+      "definition": "Remediate within 3 days."
+    },
+    {
+      "key": "3DF",
+      "name": "3 days & forensic investigation",
+      "definition": "Remediate within 3 days and carry out a forensic triage of the asset to assess whether the system is compromised."
+    }
+  ]
+}

data/json/decision_points/cisa/publicly_exposed_1_0_0.json

@@ -0,0 +1,20 @@
+{
+  "namespace": "cisa",
+  "key": "PE",
+  "version": "1.0.0",
+  "name": "Publicly Exposed",
+  "definition": "Denotes whether the asset is accessible to unauthenticated or untrusted entities via public networks.",
+  "schemaVersion": "2.0.0",
+  "values": [
+    {
+      "key": "N",
+      "name": "No",
+      "definition": "The asset is not accessible to unauthenticated or untrusted entities via public networks, such as the internet, regardless of its physical or logical location."
+    },
+    {
+      "key": "Y",
+      "name": "Yes",
+      "definition": "The asset is accessible to unauthenticated or untrusted entities via public networks, such as the internet, regardless of its physical or logical location."
+    }
+  ]
+}