All pull requests

Pull requests

• Added RDX risk alignment. Add safety. Minor refactor

  proposed core enhancementrequest for commentRFC notice sent
  #1120·stevespringett opened Sep 21, 2026Member·

  ·

  · 2.0
  2

  

• chore(deps): bump zizmorcore/zizmor-action from 0.6.3 to 0.6.4

  dependencies
  #1119·dependabot[bot] opened Sep 19, 2026Bot·

  ·

• chore(deps): bump actions/setup-java from 5.6.0 to 6.0.1

  dependencies
  #1118·dependabot[bot] opened Sep 19, 2026Bot·

  ·

• Add EPSS and other scoring systems that leverage measurements rather than scores.

  proposed core enhancementrequest for commentRFC notice sent
  #1117·stevespringett opened Sep 18, 2026Member·

  ·

  · 2.0
  1

  

• fix(proto): remove stale CPE deprecation comment (1.4-1.7)

  #1116·yusuke-koyoshi opened Sep 18, 2026·

  ·

• Changed bom-ref to refId. Title and description updated. Updated test…

  breaking-changesproposed core enhancementrequest for commentRFC notice sent
  #1113·stevespringett opened Sep 17, 2026Member·

  ·

  · 2.0
  1

  5

  

• chore(deps): bump lib.slf4j.api from 2.0.16 to 2.0.19 in /tools

  dependencies
  #1102·dependabot[bot] opened Sep 12, 2026Bot·

  ·

• chore(deps-dev): bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.2 to 3.6.0 in /tools

  dependencies
  #1101·dependabot[bot] opened Sep 12, 2026Bot·

  ·

• [WIP] harmonize actors with party model

  breaking-changesproposed core enhancement
  #1100·jkowalleck opened Sep 10, 2026Member·

  ·

  · 2.0

• Add EAX to cryptography registry

  #1099·jvdsn opened Sep 10, 2026Contributor·

  ·
  1

• streamline bom-ref descriptions

  documentationready for review
  #1091·jkowalleck opened Sep 8, 2026Member·

  ·

  · 2.0

• remove metadata.supplier

  breaking-changesready for review
  #1090·jkowalleck opened Sep 8, 2026Member·

  ·

  · 2.0

• formulation environmentVars as system-independent key-value

  breaking-changescap: formulationproposed core enhancementrequest for commentRFC notice sent
  #1088·jkowalleck opened Sep 8, 2026Member·

  ·

  · 2.0
  3

  6

• specFormat as const

  ready for review
  #1087·jkowalleck opened Sep 8, 2026Member·

  ·

  · 2.0

• docs: streamline descriptions - literals, references, code

  CDX 2.0documentationready for review
  #1084·jkowalleck opened Sep 7, 2026Member·

  ·

  · 2.0
  1

  15

• 2.0 dev fix links

  CDX 2.0documentationready for review
  #1080·jkowalleck opened Sep 3, 2026Member·

  ·

  · 2.0
  1

• Inventory refactor and definitions registry

  breaking-changesproposed core enhancementrequest for commentRFC notice sent
  #1075·stevespringett opened Sep 2, 2026Member·

  ·

  · 2.0
  1

  4

  

• Introduce pre-defined perspectives

  CDX 2.0proposed core enhancementrequest for commentRFC notice sent
  #1067·taleodor opened Aug 29, 2026·

  ·

  · 2.0
  37

  

• chore(deps-dev): bump com.networknt:json-schema-validator from 1.5.5 to 3.0.7 in /tools

  dependencies
  #1065·dependabot[bot] opened Aug 29, 2026Bot·

  ·

• Add ATLAS threat taxonomy support

  #1054·devashridatta-dotcom opened Aug 27, 2026·

  ·

  · 2.0
  1

• fix module naming convention for JSS

  CDX 2.0defect
  #1052·jkowalleck opened Aug 26, 2026Member·

  ·

  · 2.0

• Add safety integrity level schema support

  CDX 2.0
  #1041·devashridatta-dotcom opened Aug 24, 2026·

  ·

  · 2.0
  3

  

• [2.0] docs: update model readme

  CDX 2.0documentationready for review
  #1036·jkowalleck opened Aug 21, 2026Member·

  ·

  · 2.0

• feat: Add OWASP Threat Model Library parity

  CDX 2.0request for commentRFC notice sent
  #1034·P3tra-WP opened Aug 21, 2026·

  ·

  · 2.0
  20

  

• fix: LMOTS pattern, add HSS variant (LMS family)

  cap: cryptography-registry
  #1029·Mehrn0ush opened Aug 16, 2026Contributor·

  ·
  1

  4