From 10cb869c06dce15d223dbfcd57113cf5e640b41d Mon Sep 17 00:00:00 2001 From: Chaffed Date: Fri, 30 Oct 2026 15:03:51 -0700 Subject: [PATCH] Release 1.33.0 Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 2 +- docs/compliance/security-metrics.md | 8 ++++---- migrations/version_history.py | 1 + plans/MASTER_PLAN.md | 1 + pyproject.toml | 2 +- 5 files changed, 8 insertions(+), 6 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 4ad492e9..1f6af602 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,6 @@ # Changelog -## Unreleased +## 1.33.0 — 2026-10-30 - **Third-party components** (`plans/THIRD_PARTY_PLAN.md`). A page listing everything OpenClear is built from, with each component's version, license and purpose: the Python packages in the diff --git a/docs/compliance/security-metrics.md b/docs/compliance/security-metrics.md index 8ff2d190..fbc97514 100644 --- a/docs/compliance/security-metrics.md +++ b/docs/compliance/security-metrics.md @@ -2,11 +2,11 @@ -For OpenClear 1.32.0, released 2026-10-29: part of the due-diligence pack ([third-party risk](tprm.md)). Each release's notes on GitHub carry the same figures for that release. +For OpenClear 1.33.0, released 2026-10-30: part of the due-diligence pack ([third-party risk](tprm.md)). Each release's notes on GitHub carry the same figures for that release. -- **ASVS 5.0:** 214 of 242 applicable requirements met (88%), 8 partly, 5 not met, 15 the service provider's ([crosswalk](https://github.com/chaffed/OpenClear/blob/main/docs/compliance/asvs.md)). +- **ASVS 5.0:** 215 of 242 applicable requirements met (88%), 7 partly, 5 not met, 15 the service provider's ([crosswalk](https://github.com/chaffed/OpenClear/blob/main/docs/compliance/asvs.md)). - **Advisories fixed:** none. -- **Dependencies:** 109 pinned at runtime; their releases' median age is 51 days; 21 are over a year old; 12 have a newer release (Dependabot and the weekly lock refresh propose them; one with a known vulnerability fails the build). -- **SBOM:** [openclear-1.32.0.cdx.json](https://github.com/chaffed/OpenClear/releases/download/v1.32.0/openclear-1.32.0.cdx.json) (CycloneDX). +- **Dependencies:** 109 pinned at runtime; their releases' median age is 52 days; 21 are over a year old; 18 have a newer release (Dependabot and the weekly lock refresh propose them; one with a known vulnerability fails the build). +- **SBOMs** (CycloneDX): [openclear-1.33.0.cdx.json](https://github.com/chaffed/OpenClear/releases/download/v1.33.0/openclear-1.33.0.cdx.json), the Python packages and vendored files; [openclear-1.33.0-image.cdx.json](https://github.com/chaffed/OpenClear/releases/download/v1.33.0/openclear-1.33.0-image.cdx.json), the built image with its system packages. Every component's license: [third-party components](https://github.com/chaffed/OpenClear/blob/main/docs/compliance/third-party.md). Every change also passes CodeQL, Bandit, gitleaks, `pip-audit` and an OWASP ZAP baseline scan; ZAP's active scan runs weekly. How vulnerabilities are reported and how fast they're fixed: [SECURITY.md](../../SECURITY.md). diff --git a/migrations/version_history.py b/migrations/version_history.py index 43eee6d9..d7a4d6c4 100644 --- a/migrations/version_history.py +++ b/migrations/version_history.py @@ -48,6 +48,7 @@ "1.30.1": "b3f1c7a9e2d5", "1.31.0": "d6f2a8c4e1b9", "1.32.0": "e7a3b9d5c2f1", + "1.33.0": "e7a3b9d5c2f1", } diff --git a/plans/MASTER_PLAN.md b/plans/MASTER_PLAN.md index 00173697..3c1e914d 100644 --- a/plans/MASTER_PLAN.md +++ b/plans/MASTER_PLAN.md @@ -170,5 +170,6 @@ zone, M7 is still built and tested, against a stub edge; only the final confirma - 2026-10-29 Released 1.31.0: custom fields (plans/CUSTOM_FIELDS_PLAN.md CF1–CF7): a bank's own fields on customers and accounts, the service provider's on banks, bulk updates by file, drop folder and API, values with decisions where a destination names them, and a control check for required fields. No security advisories. - 2026-10-29 Released 1.32.0: replacing a SAML connection's signing key without an outage (issue #21; RSA-2048 keys from before 1.22.1 are flagged and swapped for RSA-3072). The GitHub Pages docs site is kept out of search in favour of openclear.org. No security advisories. - 2026-10-30 THIRD_PARTY_PLAN.md complete on `main` (#63–#65): the components page, the notices in the app and the image, the image SBOM on each release. HOUSEKEEPING_PLAN.md written: CodeQL #176, ASVS 2.3.4, TS4, the main checkout and branches, the image's size (HK1–HK5). Waiting for decisions. +- 2026-10-30 Released 1.33.0: the third-party inventory (THIRD_PARTY_PLAN.md: the components page, the notices in the app and the image, an image SBOM on each release); housekeeping (HOUSEKEEPING_PLAN.md: CodeQL #176 fixed, ASVS 2.3.4 met, the image 1.4 GB instead of 2.4). No security advisories. - 2026-10-22 REGULATORY_PLAN.md written: the payments law and guidance not yet evaluated (UCC 3/4, Regulation CC, Check 21 and ECCHO, Regulation E, Nacha's 2026 fraud monitoring, two more FFIEC booklets, the CRI Profile, GLBA, NYDFS, FinCEN, WCAG, the AI RMF, CFPB 1033, OFAC), how each is evaluated, and stages RG1–RG6. diff --git a/pyproject.toml b/pyproject.toml index 02588f84..616faa2f 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,6 +1,6 @@ [project] name = "openclear" -version = "1.32.0" +version = "1.33.0" description = "Multi-tenant, multi-network positive pay platform (checks, ACH) with pluggable OCR and ML-assisted exception review." license = "AGPL-3.0-or-later" requires-python = ">=3.11"