v0.4.0 Release Notes¶

Release Date: 2026-04-18

This release introduces comprehensive security lifecycle support with versioned specifications following the OpenAPI pattern.

Highlights¶

Versioned specification structure (versions/v0.4.0/) following OpenAPI pattern
Comprehensive security lifecycle: mitigations, detections, and response actions
Attack tree diagrams with AND/OR logic gates for hierarchical threat decomposition
LINDDUN privacy threat framework with D2 rendering
Control framework mappings: NIST CSF, CIS Controls v8, ISO 27001
Compliance framework references: SOC 2, PCI-DSS, HIPAA, GDPR, FedRAMP, and more

What's New¶

Security Lifecycle Types¶

New types for comprehensive threat modeling:

Type	Description
`ThreatActor`	Adversary profiles with sophistication, motivation, and resources
`Assumption`	Security assumptions with type categorization
`Mitigation`	Countermeasures with status lifecycle (planned, implemented, partial, accepted)
`Detection`	Detection capabilities with coverage levels and data sources
`ResponseAction`	Incident response workflows
`ThreatEntry`	Threat tracking with status

Attack Tree Diagrams¶

New diagram type attack-tree with AND/OR logic gates:

{
  "type": "attack-tree",
  "attackTree": {
    "goal": "Compromise System",
    "root": {
      "id": "root",
      "label": "Compromise System",
      "gate": "OR",
      "children": [
        {"id": "c1", "label": "Exploit Vulnerability", "gate": "AND", "children": [...]},
        {"id": "c2", "label": "Social Engineering"}
      ]
    }
  }
}

Privacy Framework: LINDDUN¶

Seven privacy threat categories with D2 legend rendering:

Category	Description
L - Linkability	Linking items of interest
I - Identifiability	Identifying data subjects
N - Non-repudiation	Unable to deny actions
D - Detectability	Detecting item existence
Di - Disclosure	Information disclosure
U - Unawareness	Lack of awareness
Nc - Non-compliance	Regulatory non-compliance

Control Frameworks¶

Framework	Description
NIST CSF	5 functions: Identify, Protect, Detect, Respond, Recover
CIS Controls v8	Safeguards with implementation groups
ISO 27001	Control domains

Compliance Frameworks¶

SOC 2, PCI-DSS, HIPAA, GDPR, CCPA, FedRAMP, NIST SP 800-53, StateRAMP, ITAR, CMMC

STIX 2.1 Export Enhancements¶

CVE mappings exported as Vulnerability objects
OWASP mappings exported as AttackPattern objects
Mitigations exported as CourseOfAction objects

Versioned Specification¶

Following OpenAPI's versioning pattern:

Specification: versions/v0.4.0/specification.md
Schema: versions/v0.4.0/threat-model.schema.json
Schema URL: https://github.com/grokify/threat-model-spec/docs/versions/v0.4.0/threat-model.schema.json

Installation¶

Go Library¶

go get github.com/grokify/threat-model-spec@v0.4.0

CLI Tool¶

go install github.com/grokify/threat-model-spec/cmd/tms@v0.4.0

Requirements¶

Go 1.24+
D2 v0.6+ (for SVG rendering)