opnDossier v1.6.0 — Capability discovery, SNMPv3 key redaction, and CVE remediation

v1.6.0 adds a machine-readable list command group for capability discovery, closes a cleartext SNMPv3 encryption-key leak in the sanitize command, and remediates a batch of Go stdlib CVEs. It is a drop-in upgrade from v1.5.0 — no breaking changes and no public Go API changes.

Highlights

New list command group for capability discovery. opndossier list plugins, opndossier list devices, and opndossier list formats enumerate what the running binary supports — compliance plugins (built-in, plus dynamic ones when --plugin-dir is set), supported device-config parsers, and available output formats. Each subcommand emits one entry per line for shell pipelines and accepts --json for structured output, so AI agents and automation can enumerate capabilities without scraping --help text. (#623)

# Plain text (one name per line)
opndossier list formats

# Structured output for automation
opndossier list plugins --json

SNMPv3 encryption keys are now redacted. opnDossier sanitize walks raw XML element names — <password> was caught by the generic pass match, but <enckey>, the SNMPv3 privacy/encryption key, was leaking to output in cleartext. It is now redacted. The same change deduplicated the two divergent SNMP ServiceDetails redaction paths (processor and converter) behind a single non-mutating analysis.RedactServiceDetails primitive, with a convergence test pinning that both paths redact identically. (NATS-163, #667)

Go stdlib CVE remediation. The Go toolchain was bumped to 1.26.5 to pick up the fix for GO-2026-5856, and a govulncheck crash was resolved alongside remediation of outstanding stdlib CVEs — unblocking Dependabot coverage. (#656, #683)

Also in this release

• Performance: converter allocation and memoization improvements — NAT-heavy conversion benchmarks, firewall-row allocation cut ~41%, multi-format export statistics memoized, and the CoreProcessor serialization mutex removed. (#598, #601, #604, #608)
• Project housekeeping: modernized issue templates, added SUPPORT.md and FUNDING.yml (#676), removed the tessl integration (#665), plus routine dependency and GitHub Actions bumps.

Upgrade notes

Drop-in upgrade from v1.5.0. No config changes, no breaking changes, no public Go API changes.

Full changelog

Full Changelog: v1.5.0...v1.6.0

Security Information

This release includes:

• SBOM (Software Bill of Materials) generated with CycloneDX-gomod
• SLSA Level 3 provenance attestation
• Cosign keyless signatures (Sigstore)

Verify Signatures

# Download the checksum file and its signature
wget https://github.com/EvilBit-Labs/opnDossier/releases/download/v1.6.0/opnDossier_checksums.txt
wget https://github.com/EvilBit-Labs/opnDossier/releases/download/v1.6.0/opnDossier_checksums.txt.sigstore.json

# Verify with cosign v3
cosign verify-blob \
  --certificate-identity "https://github.com/EvilBit-Labs/opnDossier/.github/workflows/release.yml@refs/tags/v1.6.0" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  --bundle opnDossier_checksums.txt.sigstore.json \
  opnDossier_checksums.txt

Installation

Package Managers

Debian/Ubuntu (.deb):

wget https://github.com/EvilBit-Labs/opnDossier/releases/download/v1.6.0/opndossier_1.6.0_amd64.deb
sudo dpkg -i opndossier_1.6.0_amd64.deb

Red Hat/CentOS/Fedora (.rpm):

wget https://github.com/EvilBit-Labs/opnDossier/releases/download/v1.6.0/opndossier-1.6.0-1.x86_64.rpm
sudo rpm -i opndossier-1.6.0-1.x86_64.rpm

Alpine (.apk):

wget https://github.com/EvilBit-Labs/opnDossier/releases/download/v1.6.0/opndossier_1.6.0_x86_64.apk
sudo apk add --allow-untrusted opndossier_1.6.0_x86_64.apk

Arch Linux:

wget https://github.com/EvilBit-Labs/opnDossier/releases/download/v1.6.0/opndossier-1.6.0-1-x86_64.pkg.tar.zst
sudo pacman -U opndossier-1.6.0-1-x86_64.pkg.tar.zst

Note: For pre-release versions (e.g., 1.4.0-rc.1), package filenames
use format-specific version transforms (~ for deb/rpm, _ for apk,
concatenated for archlinux). Check the release assets list for exact filenames.

Download Binary

Download the appropriate binary for your platform from the assets below.

Verify Checksums

sha256sum -c opnDossier_checksums.txt