diff --git a/CHANGELOG.md b/CHANGELOG.md index 2fbc42f..4d8d600 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,6 @@ # Changelog -## Unreleased +## 1.35.0 — 2026-10-31 - **An outage across a cut-off no longer decides by default** (`plans/CONTINUITY_PLAN.md` BC1). When OpenClear comes back after being down longer than its sweep interval, the items whose diff --git a/docs/compliance/security-metrics.md b/docs/compliance/security-metrics.md index d85fd62..165ebe8 100644 --- a/docs/compliance/security-metrics.md +++ b/docs/compliance/security-metrics.md @@ -2,11 +2,11 @@ -For OpenClear 1.34.0, released 2026-10-31: part of the due-diligence pack ([third-party risk](tprm.md)). Each release's notes on GitHub carry the same figures for that release. +For OpenClear 1.35.0, released 2026-10-31: part of the due-diligence pack ([third-party risk](tprm.md)). Each release's notes on GitHub carry the same figures for that release. - **ASVS 5.0:** 215 of 242 applicable requirements met (88%), 7 partly, 5 not met, 15 the service provider's ([crosswalk](https://github.com/chaffed/OpenClear/blob/main/docs/compliance/asvs.md)). - **Advisories fixed:** none. - **Dependencies:** 109 pinned at runtime; their releases' median age is 51 days; 21 are over a year old; 18 have a newer release (Dependabot and the weekly lock refresh propose them; one with a known vulnerability fails the build). -- **SBOMs** (CycloneDX): [openclear-1.34.0.cdx.json](https://github.com/chaffed/OpenClear/releases/download/v1.34.0/openclear-1.34.0.cdx.json), the Python packages and vendored files; [openclear-1.34.0-image.cdx.json](https://github.com/chaffed/OpenClear/releases/download/v1.34.0/openclear-1.34.0-image.cdx.json), the built image with its system packages. Every component's license: [third-party components](https://github.com/chaffed/OpenClear/blob/main/docs/compliance/third-party.md). +- **SBOMs** (CycloneDX): [openclear-1.35.0.cdx.json](https://github.com/chaffed/OpenClear/releases/download/v1.35.0/openclear-1.35.0.cdx.json), the Python packages and vendored files; [openclear-1.35.0-image.cdx.json](https://github.com/chaffed/OpenClear/releases/download/v1.35.0/openclear-1.35.0-image.cdx.json), the built image with its system packages. Every component's license: [third-party components](https://github.com/chaffed/OpenClear/blob/main/docs/compliance/third-party.md). Every change also passes CodeQL, Bandit, gitleaks, `pip-audit` and an OWASP ZAP baseline scan; ZAP's active scan runs weekly. How vulnerabilities are reported and how fast they're fixed: [SECURITY.md](../../SECURITY.md). diff --git a/migrations/version_history.py b/migrations/version_history.py index 7524eb0..9dc4f04 100644 --- a/migrations/version_history.py +++ b/migrations/version_history.py @@ -50,6 +50,7 @@ "1.32.0": "e7a3b9d5c2f1", "1.33.0": "e7a3b9d5c2f1", "1.34.0": "c9d5e3f7a2b4", + "1.35.0": "f7a1b5c9d3e2", } diff --git a/plans/MASTER_PLAN.md b/plans/MASTER_PLAN.md index d023a86..85b9e06 100644 --- a/plans/MASTER_PLAN.md +++ b/plans/MASTER_PLAN.md @@ -178,3 +178,4 @@ zone, M7 is still built and tested, against a stub edge; only the final confirma - 2026-10-31 Released 1.34.0: REVIEW_1_33_PLAN.md RV1–RV8 (#69): a check paid by a decision is paid, so reverse positive pay can't pay it twice; the teller answer gives nothing the caller didn't send; a late check gets a look before a default; bank deletion clears every storage area, freezes the bank and reports failure; a customer's service ends at midnight everywhere and a sync can't bring it back; custom fields by the letter of their messages; the Redis limiter holds per instance; incident contacts' fallback; refusals as sentences for people. pyasn1 0.6.5 for two CVEs. No security advisories of OpenClear's own. - 2026-10-31 CONTINUITY_PLAN.md written: what OpenClear does across an outage at the cut-off (today: defaults everything when it returns), backups measured instead of attested (a manifest, a freshness check, a restore drill), storage reconciled after a restore, a maintenance mode, a daily open-items snapshot for the bank's own plan, `/ready`, the runbook's recovery procedure, a SQLite copy (BC1–BC6). Waiting for decisions BC-D1 to BC-D8. - 2026-10-31 CONTINUITY_PLAN.md BC1–BC6 built on `bc1-gap`: an outage across a cut-off decides nothing by default; `/ready`; backups measured from the host's manifest and a SQLite copy; the restore drill and the nightly files-and-rows reconciliation; maintenance mode and the bank's daily open-items file; the runbook's recovery procedure. Waiting: the suites on the branch head, then a pull request. +- 2026-10-31 Released 1.35.0: CONTINUITY_PLAN.md BC1–BC6 (#71): an outage across a cut-off decides nothing by default; `/ready` and `openclear_component_up`; backups measured from the host's manifest, and a SQLite copy nightly; the restore drill and the nightly files-and-rows reconciliation; maintenance mode; the bank's hourly open-items file for its own plan; the runbook's "Recovering the installation". Waiting: the sandbox tabletop of the recovery procedure. No security advisories. diff --git a/pyproject.toml b/pyproject.toml index 0076f2d..9884e66 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,6 +1,6 @@ [project] name = "openclear" -version = "1.34.0" +version = "1.35.0" description = "Multi-tenant, multi-network positive pay platform (checks, ACH) with pluggable OCR and ML-assisted exception review." license = "AGPL-3.0-or-later" requires-python = ">=3.11"