build(deps): Bump @mitre/hdf-converters from 2.13.0 to 3.5.0

[dependabot]

Bumps @mitre/hdf-converters from 2.13.0 to 3.5.0.

Release notes

Sourced from @​mitre/hdf-converters's releases.

v3.5.0

Changes

d781c91 chore(release): bump workspace from 3.4.4 to 3.5.0 (#198) cffbf2a docs(adr): ADR-0005 — HDF continuous-monitoring delta-event stream (#161) 13a80fd docs(adr): add ADR-0006 for STIX CTI integration (#162) 4d31f68 Puxy/converter source field audit (#197) 4e45cf3 Feat/schema helpers amendment vuln (#196) 750c2e1 Feat/poam deadline and version flag (#195) 9a9e139 Fix/oscal sar characterization origin actor (#194) e56f92f Fix/converter output schema validation (#191) 544ef26 refactor: unify worst-wins roll-up and effective-status into one shared helper (#193) 1184601 fix(converters): tool.format names formats, never serialization structures (#192) 6eda025 fix(legacyhdf): emit document timestamp, generator, and InSpec tool identity (#189) 05e5382 fix(hdfversion): restore the profile sha256 fingerprint on v3->v2 downgrade (#188)

Installation

# TypeScript/Node.js — install the packages you need
npm install @mitre/hdf-converters   # converters + schema + parsers + utilities + mappings
npm install @mitre/hdf-validators    # schema validation
npm install @mitre/hdf-diff          # structural diff engine
npm install @mitre/hdf-generators    # InSpec profile generation
Go libraries
go get github.com/mitre/hdf-libs/hdf-converters/v3@v3.5.0
Go CLI — download a binary for your platform from the assets below, then:
chmod +x hdf && sudo mv hdf /usr/local/bin/

Schema Files

Bundled JSON schemas are attached as release assets and hosted at: https://mitre.github.io/hdf-libs/schemas/

v3.4.4

Changes

bd84031 Release/v3.4.4 prep (#187) 00917c0 fix(hdfversion): flatten amendments into the v2 downgrade (#181) 2c37034 fix(grype-to-hdf): set requirement title and anchor result start_time to the scan timestamp (#185) 3043854 build: make the pre-commit hook work in git worktrees (#183) 56d7861 chore(deps-dev): bump the dev-dependencies group with 2 updates (#182)

Installation

# TypeScript/Node.js — install the packages you need
</tr></table> 

... (truncated)

Changelog

Sourced from @​mitre/hdf-converters's changelog.

[3.5.0] - 2026-08-02

Schema minor: $id URLs move from v3.4.0 to v3.5.0 across all seven assessment schemas, and a new eighth document type — the continuous-monitoring change-event stream — joins the family.

Added

• Requirement change-event stream — hdf events derive|fold|apply (ADR-0005). A new hdf-requirement-change-event document type and a stateless, deterministic kernel in hdf-diff (changeEventFromPrevious, foldChangeEventsIntoComparison, applyChangeEvents, Go + TS) for continuous monitoring. derive emits an NDJSON stream of per-requirement events (new/absent/updated/fixed/regressed) between two same-target scans; fold materializes a batch into a systemDrift comparison; apply replays events onto a seed to reassemble a reconciled results document (parity law: applyChangeEvents(A, derive(A→B)) ≡ B at requirement level). Events are keyed by (systemRef, componentId, requirementId) with a per-key integer sequence as the sole ordering authority, eventId as a UUIDv5 dedup identity, and a priorChecksum chain. Batch subcommands accept multiple event files and stdin.
• effectiveChecksum on Evaluated_Requirement. A sha256 over the resolved effective posture ({status, impact, disposition}) — a change-detection fingerprint that flips only when the operative posture changes and is stable under all other document churn. Stamped by tooling; the anchor for change-event derivation.
• STIX 2.1 CTI enrichment — hdf enrich (ADR-0006). A new enrichment pass overlays a STIX 2.1 bundle onto an existing HDF results document: a CVE-bearing STIX object attaches to the finding whose requirement ID is that CVE (rel: investigate), everything else attaches to the results root (rel: reference) — each as an External_Reference enrichment envelope carrying the raw STIX object losslessly in document. Informational by default: it authors no overrides and changes no status or impact. Source format is auto-detected (--from stix to assert). Dual Go + TS.
• External_Reference primitive + broad externalReferences[] wiring. A generalized, purpose-agnostic reference (modeled on the STIX 2.1 external_references common property): required sourceName plus at least one of externalId/href/description, open rel and kind tokens, optional mediaType/checksum/addedBy/addedAt, and an optional lossless embedded document. Wired onto the results root, the inline Status_Override, and across the HDF schemas.
• CVSS scoring engine in hdf-utilities (Go + TS). Base + Threat score computation for CVSS 3.1 (computeCvssScore) and CVSS 4.0 (computeCvss40Score — the FIRST MacroVector algorithm with max-vector severity-distance interpolation, validated exact against FIRST reference vectors across 0.0–10.0). No third-party dependency; Go and TS produce byte-identical scores.
• Opt-in CVSS Threat recompute — hdf enrich --recompute-cvss. When a matched STIX object shows active exploitation and the finding carries a CVSS 3.1 base vector, applies Exploit Maturity E:H, recomputes the Threat score, and authors an auditable inline riskAdjustment (with the cvss block, impact.value = computedScore/10, a review-horizon expiresAt, and an externalReferences[] back to the STIX source). Findings with no base vector — or a CVSS 4.0 base vector — are left unchanged.
• roundImpact / RoundImpact in hdf-utilities (Go + TS). Canonical rounding of a computed impact to its natural 0.01 grid, eliminating binary-float representation noise. Consumed by the enrich recompute.
• Change_Reason gains dispositionChanged and effectiveImpactChanged. The diff engine's amendment-axis change reasons are now part of the comparison vocabulary (previously the engine emitted values the schema's enum rejected).
• hdf --version flag alongside the existing hdf version command. (#195)
• Extended create* schema test helpers. createRequirement title is now optional and the helpers model amendment and vulnerability fields (code, effectiveStatus/effectiveImpact/disposition/statusOverrides/poams, cwe/cvss/refs/affectedPackages/epss/kev), removing hand-spread boilerplate from tests. (#196)
• Two new convert --from sources surfaced: oscal-profile → HDF Baseline (requires --catalog) and oscal-assessment-plan → HDF Plan.

Breaking Changes

• POA&M expiresAt is now required. A POA&M is a time-boxed acceptance of an open finding; with expiresAt optional a failing requirement could duck remediation indefinitely. The field is now required on the POA&M $defs (Evaluated_Requirement.poams[] and the amendments POA&M object). HDF documents carrying a deadline-less POA&M now fail schema validation — add a real remediation/vendor-fix deadline (never a wall-clock default). All other override types are unaffected. (#195)

Notable behavior changes

• tool.format now names formats, never serialization structures. The field carries a named format specification — an interchange format emitted by many tools (SARIF, XCCDF, ARF, OSCAL) or one of several named outputs a single tool produces (FVDL, exec-json, FPF) — and is omitted for a tool's native output. Twenty-three converters that stamped bare JSON/XML/CSV serialization labels no longer emit tool.format, deptrack-to-hdf now emits FPF instead of JSON, and checkov-to-hdf moves scan scope out of tool.format into a per-requirement tags.check_type array (e.g. ["terraform"]). Consumers pinning exact output will see the key disappear or change; tool name and version are unchanged. Go/TS in lockstep, goldens regenerated. (#192)
• ionchannel-to-hdf: non-dependency scan summaries are now converted. Previously only the dependency scan summary was emitted; each scan_summaries[] entry now yields its own baseline, and the analysis verdict (risk/passed/ruleset) is surfaced on the primary baseline. Consumers see additional baselines. (#197)
• zap-to-hdf: every site is converted, not just the busiest. A multi-site ZAP report now emits one baseline + Application component per site (linked via labels.component); findings on previously-dropped hosts now appear. (#197)
• checkov-to-hdf: requirement.code is populated from the source code_block (previously parsed then dropped), so Heimdall's CODE tab renders. (#197)
• legacyhdf-to-hdf: converted documents now carry a top-level timestamp, a generator, and InSpec tool identity ({name: "InSpec", ...} when the source is detected as exec-json, instead of an unconditional "Heimdall Data Format v1" label). The missing timestamp previously blocked deterministic change-event derivation on freshly-converted scans. (#189)
• hdf-to-oscal-sar emits schema-valid OSCAL 1.1.2 Assessment Results. A v3.4.0 regression produced documents that failed the NIST AR schema (missing reviewed-controls, finding description, risk-characterization origin; an empty-string prop value). Output now validates against the vendored NIST schema. (#194, #191)
• hdf convert --to hdf@2: the downgraded InSpec profile sha256 fingerprint is restored, sourced from the baseline integrity hash so Heimdall matches the fingerprint (previously emitted empty → "No fingerprint match"). (#188)

Architecture Changes

• Schema version bumped from v3.4.0 to v3.5.0 across all $id/$ref URLs; the site archive gains a v3.5.0 snapshot per document type.
• Unified worst-wins roll-up and effective-status computation into one canonical implementation in hdf-utilities (Go + TS), with all previously-divergent copies (hdf-diff, hdfversion, exportmap, legacyhdf, the CLI status derivation, and the hdf-schema helper roll-up) delegating to it. Reconciles to the published precedence (error > failed > passed > notApplicable > notReviewed), governing-override selection (most-recent-by-appliedAt), and uniform impact==0 handling — fixing hdfversion's downgrade path. No golden output changed. (#193)
• Converter output is validated against its target schema in tests where a published schema exists (OSCAL SAR/POA&M, CSAF-VEX, CycloneDX-VEX, OpenVEX), with vendored schemas + provenance — so schema-invalid output can no longer ship behind a golden that merely encodes it. (#191)

Internal

• Pre-release swarm review remediation: routed the remaining classifyChangeReasons timestamp parsing (Go + TS) and hdf-diff/amend expiry parsing through the shared parseTimestamp helpers; hardened hdf enrich to use the security-gated input pipeline (size/symlink/BOM), schema-validate its results input, and honor --max-size; fixed a multi-CVE STIX vulnerability dropping all but the last CVE (Go + TS); made the events-kernel timestamp emission host-independent (TS parity with Go); hardened STIX bundle parsing against non-object elements; added --start-sequence boundary validation; guarded a zero-expiry override in the v2 waiver_data breadcrumb. Deferred findings filed as beads (enrich fan-out cap, RoundImpact migration, guard-scope extension, and others). ADR-0005 and ADR-0006 marked Accepted.

Compatibility

• v3.4.x documents validate cleanly under v3.5.0 with one exception: a document carrying a deadline-less POA&M is now rejected (add expiresAt). All other additions are additive and optional (External_Reference, externalReferences[], effectiveChecksum, the two new Change_Reason values, the change-event document type). Converter-output consumers that pin exact bytes should review the Notable behavior changes above.

[3.4.4] - 2026-07-30

Fixes

... (truncated)

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by wdower, a new releaser for @​mitre/hdf-converters since your current version.

Attestation changes

This version has no provenance attestation, while the previous version (2.13.0) was attested. Review the package versions before updating.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud