Skip to content

Release 1.33.0 #67

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
chaffed merged 1 commit into from
Oct 30, 2026
Merged

Release 1.33.0 #67

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Changelog

## Unreleased
## 1.33.0 — 2026-10-30

- **Third-party components** (`plans/THIRD_PARTY_PLAN.md`). A page listing everything OpenClear
is built from, with each component's version, license and purpose: the Python packages in the
Expand Down
8 changes: 4 additions & 4 deletions docs/compliance/security-metrics.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,11 +2,11 @@

<!-- Generated by scripts/release_metrics.py at each release. -->

For OpenClear 1.32.0, released 2026-10-29: part of the due-diligence pack ([third-party risk](tprm.md)). Each release's notes on GitHub carry the same figures for that release.
For OpenClear 1.33.0, released 2026-10-30: part of the due-diligence pack ([third-party risk](tprm.md)). Each release's notes on GitHub carry the same figures for that release.

- **ASVS 5.0:** 214 of 242 applicable requirements met (88%), 8 partly, 5 not met, 15 the service provider's ([crosswalk](https://github.com/chaffed/OpenClear/blob/main/docs/compliance/asvs.md)).
- **ASVS 5.0:** 215 of 242 applicable requirements met (88%), 7 partly, 5 not met, 15 the service provider's ([crosswalk](https://github.com/chaffed/OpenClear/blob/main/docs/compliance/asvs.md)).
- **Advisories fixed:** none.
- **Dependencies:** 109 pinned at runtime; their releases' median age is 51 days; 21 are over a year old; 12 have a newer release (Dependabot and the weekly lock refresh propose them; one with a known vulnerability fails the build).
- **SBOM:** [openclear-1.32.0.cdx.json](https://github.com/chaffed/OpenClear/releases/download/v1.32.0/openclear-1.32.0.cdx.json) (CycloneDX).
- **Dependencies:** 109 pinned at runtime; their releases' median age is 52 days; 21 are over a year old; 18 have a newer release (Dependabot and the weekly lock refresh propose them; one with a known vulnerability fails the build).
- **SBOMs** (CycloneDX): [openclear-1.33.0.cdx.json](https://github.com/chaffed/OpenClear/releases/download/v1.33.0/openclear-1.33.0.cdx.json), the Python packages and vendored files; [openclear-1.33.0-image.cdx.json](https://github.com/chaffed/OpenClear/releases/download/v1.33.0/openclear-1.33.0-image.cdx.json), the built image with its system packages. Every component's license: [third-party components](https://github.com/chaffed/OpenClear/blob/main/docs/compliance/third-party.md).

Every change also passes CodeQL, Bandit, gitleaks, `pip-audit` and an OWASP ZAP baseline scan; ZAP's active scan runs weekly. How vulnerabilities are reported and how fast they're fixed: [SECURITY.md](../../SECURITY.md).
1 change: 1 addition & 0 deletions migrations/version_history.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,7 @@
"1.30.1": "b3f1c7a9e2d5",
"1.31.0": "d6f2a8c4e1b9",
"1.32.0": "e7a3b9d5c2f1",
"1.33.0": "e7a3b9d5c2f1",
}


Expand Down
1 change: 1 addition & 0 deletions plans/MASTER_PLAN.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -170,5 +170,6 @@ zone, M7 is still built and tested, against a stub edge; only the final confirma
- 2026-10-29 Released 1.31.0: custom fields (plans/CUSTOM_FIELDS_PLAN.md CF1–CF7): a bank's own fields on customers and accounts, the service provider's on banks, bulk updates by file, drop folder and API, values with decisions where a destination names them, and a control check for required fields. No security advisories.
- 2026-10-29 Released 1.32.0: replacing a SAML connection's signing key without an outage (issue #21; RSA-2048 keys from before 1.22.1 are flagged and swapped for RSA-3072). The GitHub Pages docs site is kept out of search in favour of openclear.org. No security advisories.
- 2026-10-30 THIRD_PARTY_PLAN.md complete on `main` (#63–#65): the components page, the notices in the app and the image, the image SBOM on each release. HOUSEKEEPING_PLAN.md written: CodeQL #176, ASVS 2.3.4, TS4, the main checkout and branches, the image's size (HK1–HK5). Waiting for decisions.
- 2026-10-30 Released 1.33.0: the third-party inventory (THIRD_PARTY_PLAN.md: the components page, the notices in the app and the image, an image SBOM on each release); housekeeping (HOUSEKEEPING_PLAN.md: CodeQL #176 fixed, ASVS 2.3.4 met, the image 1.4 GB instead of 2.4). No security advisories.
- 2026-10-22 REGULATORY_PLAN.md written: the payments law and guidance not yet evaluated (UCC 3/4, Regulation CC, Check 21 and ECCHO, Regulation E, Nacha's 2026 fraud monitoring, two more FFIEC booklets, the CRI Profile, GLBA, NYDFS, FinCEN, WCAG, the AI RMF, CFPB 1033, OFAC), how each is evaluated, and stages RG1–RG6.

2 changes: 1 addition & 1 deletion pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
[project]
name = "openclear"
version = "1.32.0"
version = "1.33.0"
description = "Multi-tenant, multi-network positive pay platform (checks, ACH) with pluggable OCR and ML-assisted exception review."
license = "AGPL-3.0-or-later"
requires-python = ">=3.11"
Expand Down
Loading