✨ Highlights
This release updates the core framework to metaschema-java 3.0.0.M3 and fixes CI/CD issues with scheduled builds and security scanning.
metaschema-java 3.0.0.M3
Updated the core Metaschema framework dependency to 3.0.0.M3, which brings several significant features and fixes (#253):
- Unmodeled content support (
<any/>) — Assemblies can now capture unmodeled XML elements and JSON/YAML properties during deserialization and write them back with full fidelity, with corresponding code generation support. - Date/time formatting functions — Implements
fn:format-dateTime,fn:format-date,fn:format-time, andfn:format-integerper XPath Functions 3.1 with full picture string parsing. - JSON Schema
json-value-keyfix — Resolves a bug where fields using static<json-value-key>labels produced invalid nested JSON Schema, which was blocking the OSCAL build system migration from XSLT to oscal-cli.
Scheduled Build and Guide CSS Fixes
Added required workflow permissions that were preventing nightly scheduled builds from starting, and inlined custom CSS in site configuration to fix broken styles in guides subdirectory pages. (#251)
Trivy Security Scan Fix
Excluded the maven2/ artifact repository checkout from Trivy security scanning. This transient directory is used only during deployment, and its dependencies (e.g., fast-xml-parser) were triggering false CVE findings (CVE-2026-25128) that should be scanned in the maven2 repository instead. (#252)
🐛 Bug Fixes
- Resolve scheduled build startup failure and missing CSS in guides (#251) by @david-waltermire
🔧 Build & CI Improvements
- Exclude maven2 artifact repo checkout from Trivy scan (#252) by @david-waltermire
Other Changes
- Update to metaschema-java 3.0.0-SNAPSHOT (#250) by @david-waltermire
- Update metaschema-java to 3.0.0.M3 (#253) by @david-waltermire