What's New

This release expands Cranium's Public API with programmatic user and role management, adds direct yes/no answering in the Compliance Agent, and adds Continuous Monitoring support for GitLab. It also keeps vulnerability data for tracked packages current automatically and includes reliability fixes across vulnerability management and Bill of Materials exports.

Public API: User and Role Management

Cranium's Public API now includes endpoints for managing users and roles programmatically. You can create and read users, including each user's multi-factor authentication status, and read your tenant's roles and the catalog of assignable. permissions. This lets teams provision and audit access directly through the API rather than only through the interface.

Each user is assigned exactly one role. User updates and deletion, along with role creation and editing, are planned for a future release. Full endpoint details, including request and response formats and error handling, are available in the Public API reference in the Knowledge Base.

Compliance Agent Yes/No Answers

The Compliance Agent now answers yes/no questions directly. When a questionnaire includes a yes/no question, the agent searches your documentation for confirming or denying evidence and returns a definitive answer with a supporting citation. When the available evidence is not sufficient to answer either way, the agent flags the question as lacking documentation rather than forcing an answer.

Continuous Monitoring for GitLab

Continuous Monitoring now supports GitLab and GitLab Self-Managed. Cranium can automatically rescan a GitLab repository's Bill of Materials whenever code is pushed, the same way it already does for GitHub and Bitbucket. GitLab webhooks are verified with a signed signature, so Cranium can confirm each webhook genuinely originates from your GitLab instance.

New GitLab integrations require GitLab 19.1 or later.

Bug Fixes

SPDX-format Bill of Materials exports now contain correctly formatted SPDX data. Previously, and SPDX export could contain CycloneDX-formatted content despite carrying the SPDX file name.
Vulnerability Exports scoped to a specific AI System now complete successfully, where they previously failed to generate.
Bulk repository scanning and BOM creation now handle GitHup API rate limiting correctly, so large jobs no longer fail silently when a rate limit is reached.
Long-running vulnerability scans that could previously stall, repeat, and never save a resolut now complete and sotre their findings reliably.
Deleting a Bill of Materials now succeeds for tenant configurations where it previously returned an error.

Did this answer your question?