feat: add NIST OSCAL 1.2.3 assessment-results output format

.github/workflows/01-powerpipe-release.yaml

@@ -191,7 +191,7 @@ jobs:
           path: pipe-fittings
 
       - name: Set up Docker
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
       - name: Install Docker (if needed)
         run: |
@@ -226,7 +226,7 @@ jobs:
       # this is required, check golangci-lint-action docs
       - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
         with:
-          go-version: "1.26"
+          go-version: "1.26.5"
           cache: false # setup-go v4 caches by default, do not change this parameter, check golangci-lint-action doc: https://github.com/golangci/golangci-lint-action/pull/704
 
       - name: Download Dashboard UI Assets Artifact

.github/workflows/10-test-lint.yaml

@@ -32,13 +32,13 @@ jobs:
       # this is required, check golangci-lint-action docs
       - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
         with:
-          go-version: '1.26'
+          go-version: '1.26.5'
           cache: false # setup-go v4 caches by default, do not change this parameter, check golangci-lint-action doc: https://github.com/golangci/golangci-lint-action/pull/704
 
       - name: golangci-lint
         uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
         with:
-          version: latest
+          version: v2.11.4
           args: --timeout=10m
           working-directory: powerpipe
           skip-cache: true

.github/workflows/11-test-acceptance.yaml

@@ -66,7 +66,7 @@ jobs:
           go test -timeout 30s ./... -test.v
 
       - name: Set up Docker
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
 
       - name: Install Docker (if needed)
         run: |
@@ -82,7 +82,7 @@ jobs:
        # this is required, check golangci-lint-action docs
       - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
         with:
-          go-version: '1.26'
+          go-version: '1.26.5'
           cache: false # setup-go v4 caches by default, do not change this parameter, check golangci-lint-action doc: https://github.com/golangci/golangci-lint-action/pull/704
 
       - name: Build
@@ -149,7 +149,7 @@ jobs:
 
       - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
         with:
-          go-version: 1.26
+          go-version: 1.26.5
           cache: false
 
       - name: Prepare for downloads

.golangci.yml

@@ -71,6 +71,12 @@ linters:
       - std-error-handling    # errcheck: unchecked Close/Remove/print calls
       - common-false-positives # gosec: G103, G204, G304 false positives
       - legacy                 # gosec: G104, G301, G302, G307
+    rules:
+      # G118 (cancel fn not called / goroutine context misuse) was added in golangci-lint v2.11.
+      # These two files have intentional G118 suppression that older local versions see as unused.
+      - linters: [nolintlint]
+        text: "unused for linter \"gosec\""
+        path: "internal/cmdconfig/cmd_hooks\\.go|internal/db_client/db_client_execute\\.go"
     paths:
       - "tests/acceptance"
 

CHANGELOG.md

@@ -1,3 +1,24 @@
+## v1.5.3 [2026-08-10]
+_Dependencies_
+- Compiled with Go 1.26.5 to remediate CVE-2026-27143 and other Go standard-library CVEs.
+- Bump `golang.org/x/crypto` from v0.46.0 to v0.52.0 to remediate CVE-2026-39830 through CVE-2026-39834, CVE-2026-42508 and CVE-2026-46595.
+- Bump `github.com/go-git/go-git/v5` from v5.16.5 to v5.19.1 to remediate CVE-2026-45022, CVE-2026-34165 and CVE-2026-41506.
+- Bump `github.com/containerd/containerd` from v1.7.29 to v1.7.33 to remediate CVE-2026-46680 and CVE-2026-53488.
+- Bump `github.com/go-git/go-billy/v5` from v5.8.0 to v5.9.0 to remediate CVE-2026-44973.
+- Bump `oras.land/oras-go/v2` from v2.5.0 to v2.6.2 to remediate CVE-2026-50151.
+- Bump `github.com/hashicorp/go-getter` from v1.7.9 to v1.8.6 to remediate CVE-2026-4660.
+- Bump `pipe-fittings/v2` from v2.9.1 to v2.9.2.
+- Refresh dashboard UI dependency pins to remediate published npm CVEs (lodash, uuid, echarts, ws, webpack-dev-server, js-yaml, qs, tar, react-router, postcss, brace-expansion, fast-uri, form-data, and others).
+
+## v1.5.2 [2026-05-19]
+_What's new_
+- Compiled with Go 1.26.1.
+
+_Dependencies_
+- Bump `github.com/jackc/pgx/v5` to v5.9.2 to remediate CVE-2026-41889 (GHSA-j88v-2chj-qfwx).
+- Bump `github.com/go-jose/go-jose/v4` to v4.1.4 to remediate security vulnerabilities.
+- Bump `go.opentelemetry.io/otel/sdk` to v1.43.0 to remediate security vulnerabilities.
+
 ## v1.5.0 [2026-02-27]
 _What's new_
 - Compiled with Go 1.26.