Release v.2.14.1

composer.json

@@ -58,10 +58,11 @@
         "laminas/laminas-inputfilter": "^2.10",
         "laminas/laminas-dependency-plugin": "^2.0",
         "symfony/console": "^5.0",
-        "guzzlehttp/guzzle": "^6.5",
+        "guzzlehttp/guzzle": "^7.11",
         "phpoffice/phpword": "^0.18.1",
         "laminas/laminas-mvc-middleware": "^2.2",
-        "laminas/laminas-captcha": "^2.18"
+        "laminas/laminas-captcha": "^2.18",
+        "guzzlehttp/psr7": "^2.11"
     },
     "require-dev": {
         "roave/security-advisories": "dev-latest"

migrations/db/20260505100000_add_risk_sources.php

@@ -0,0 +1,67 @@
+<?php declare(strict_types=1);
+/**
+ * @link      https://github.com/monarc-project for the canonical source repository
+ * @copyright Copyright (c) 2016-2026 Luxembourg House of Cybersecurity LHC.lu - Licensed under GNU Affero GPL v3
+ * @license   MONARC is licensed under GNU Affero General Public License version 3
+ */
+
+use Phinx\Migration\AbstractMigration;
+
+class AddRiskSources extends AbstractMigration
+{
+    public function up(): void
+    {
+        $this->execute(
+            'CREATE TABLE `risk_sources` (
+                `id` int(11) unsigned NOT NULL AUTO_INCREMENT,
+                `anr_id` int(11) unsigned NOT NULL,
+                `label` varchar(255) NOT NULL,
+                `is_default` tinyint(1) NOT NULL DEFAULT 0,
+                `is_active` tinyint(1) NOT NULL DEFAULT 1,
+                `creator` varchar(255) DEFAULT NULL,
+                `created_at` datetime DEFAULT CURRENT_TIMESTAMP,
+                `updater` varchar(255) DEFAULT NULL,
+                `updated_at` datetime DEFAULT NULL ON UPDATE CURRENT_TIMESTAMP,
+                PRIMARY KEY (`id`),
+                KEY `risk_sources_anr_id_indx` (`anr_id`),
+                KEY `risk_sources_anr_id_is_active_indx` (`anr_id`, `is_active`),
+                UNIQUE `risk_sources_anr_id_label_unq` (`anr_id`, `label`),
+                FOREIGN KEY (`anr_id`) REFERENCES `anrs` (`id`) ON DELETE CASCADE ON UPDATE RESTRICT
+            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci'
+        );
+
+        $anrIds = $this->fetchAll('SELECT id FROM anrs');
+        foreach ($anrIds as $anr) {
+            $anrId = $anr['id'];
+            $this->execute(
+                "INSERT IGNORE INTO `risk_sources` (`anr_id`, `label`, `is_default`, `is_active`, `creator`, `created_at`) VALUES
+                ({$anrId}, 'External attacker', 1, 1, 'System', NOW()),
+                ({$anrId}, 'Internal malicious user', 1, 1, 'System', NOW()),
+                ({$anrId}, 'Internal accidental user', 1, 1, 'System', NOW()),
+                ({$anrId}, 'Supplier / third party', 1, 1, 'System', NOW()),
+                ({$anrId}, 'System failure', 1, 1, 'System', NOW()),
+                ({$anrId}, 'Software defect', 1, 1, 'System', NOW()),
+                ({$anrId}, 'Natural event', 1, 1, 'System', NOW()),
+                ({$anrId}, 'Organizational or process weakness', 1, 1, 'System', NOW()),
+                ({$anrId}, 'Other', 1, 1, 'System', NOW());"
+            );
+        }
+
+        $this->table('instances_risks')
+            ->addColumn('risk_source_id', 'integer', ['null' => true, 'signed' => false, 'after' => 'asset_id'])
+            ->addIndex(['risk_source_id'], ['name' => 'risk_source_id'])
+            ->addForeignKey('risk_source_id', 'risk_sources', 'id', ['delete' => 'SET_NULL', 'update' => 'RESTRICT'])
+            ->update();
+    }
+
+    public function down(): void
+    {
+        $this->table('instances_risks')
+            ->dropForeignKey('risk_source_id')
+            ->removeIndexByName('risk_source_id')
+            ->removeColumn('risk_source_id')
+            ->update();
+
+        $this->table('risk_sources')->drop()->save();
+    }
+}

migrations/db/20260511101000_add_anr_reassessment_triggers.php

@@ -0,0 +1,40 @@
+<?php declare(strict_types=1);
+/**
+ * @link      https://github.com/monarc-project for the canonical source repository
+ * @copyright Copyright (c) 2016-2026 Luxembourg House of Cybersecurity LHC.lu - Licensed under GNU Affero GPL v3
+ * @license   MONARC is licensed under GNU Affero General Public License version 3
+ */
+
+use Phinx\Migration\AbstractMigration;
+
+class AddAnrReassessmentTriggers extends AbstractMigration
+{
+    public function up(): void
+    {
+        $this->execute(
+            'CREATE TABLE IF NOT EXISTS `anr_reassessment_triggers` (
+                `id` int(11) unsigned NOT NULL AUTO_INCREMENT,
+                `anr_id` int(11) unsigned NOT NULL,
+                `trigger_type` varchar(255) DEFAULT "",
+                `description` text NOT NULL,
+                `is_active` tinyint(1) NOT NULL DEFAULT 1,
+                `position` int(11) NOT NULL DEFAULT 0,
+                `creator` varchar(255) DEFAULT NULL,
+                `created_at` datetime DEFAULT CURRENT_TIMESTAMP,
+                `updater` varchar(255) DEFAULT NULL,
+                `updated_at` datetime DEFAULT NULL ON UPDATE CURRENT_TIMESTAMP,
+                PRIMARY KEY (`id`),
+                KEY `anr_reassessment_triggers_anr_id_indx` (`anr_id`),
+                KEY `anr_reassessment_triggers_anr_id_trigger_type_indx` (`anr_id`, `trigger_type`),
+                KEY `anr_reassessment_triggers_anr_id_position_indx` (`anr_id`, `position`),
+                CONSTRAINT `fk_anr_reassessment_triggers_anr`
+                    FOREIGN KEY (`anr_id`) REFERENCES `anrs` (`id`) ON DELETE CASCADE ON UPDATE RESTRICT
+            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;'
+        );
+    }
+
+    public function down(): void
+    {
+        $this->table('anr_reassessment_triggers')->drop()->save();
+    }
+}

migrations/db/20260515101000_add_risk_review_metadata.php

@@ -0,0 +1,35 @@
+<?php declare(strict_types=1);
+/**
+ * @link      https://github.com/monarc-project for the canonical source repository
+ * @copyright Copyright (c) 2016-2026 Luxembourg House of Cybersecurity LHC.lu - Licensed under GNU Affero GPL v3
+ * @license   MONARC is licensed under GNU Affero General Public License version 3
+ */
+
+use Phinx\Migration\AbstractMigration;
+
+class AddRiskReviewMetadata extends AbstractMigration
+{
+    public function up(): void
+    {
+        $this->table('instances_risks')
+            ->addColumn('last_review_date', 'date', ['null' => true, 'after' => 'comment_after'])
+            ->addColumn('review_frequency', 'string', ['limit' => 50, 'null' => true, 'after' => 'last_review_date'])
+            ->update();
+
+        $this->table('anr_reassessment_triggers')
+            ->addColumn('monitoring_approach', 'text', ['null' => true, 'after' => 'description'])
+            ->update();
+    }
+
+    public function down(): void
+    {
+        $this->table('instances_risks')
+            ->removeColumn('review_frequency')
+            ->removeColumn('last_review_date')
+            ->update();
+
+        $this->table('anr_reassessment_triggers')
+            ->removeColumn('monitoring_approach')
+            ->update();
+    }
+}

migrations/db/20260519101000_add_residual_risk_acceptance.php

@@ -0,0 +1,55 @@
+<?php declare(strict_types=1);
+/**
+ * @link      https://github.com/monarc-project for the canonical source repository
+ * @copyright Copyright (c) 2016-2026 Luxembourg House of Cybersecurity LHC.lu - Licensed under GNU Affero GPL v3
+ * @license   MONARC is licensed under GNU Affero General Public License version 3
+ */
+
+use Phinx\Migration\AbstractMigration;
+
+class AddResidualRiskAcceptance extends AbstractMigration
+{
+    public function up(): void
+    {
+        $this->table('instances_risks')
+            ->addColumn('residual_risk_decision', 'string', ['limit' => 20, 'null' => true, 'after' => 'review_frequency'])
+            ->addColumn('residual_risk_approved_by', 'string', ['limit' => 255, 'null' => true, 'after' => 'residual_risk_decision'])
+            ->addColumn('residual_risk_approved_at', 'date', ['null' => true, 'after' => 'residual_risk_approved_by'])
+            ->addColumn('residual_risk_justification', 'text', ['null' => true, 'after' => 'residual_risk_approved_at'])
+            ->update();
+
+        $this->table('instances_risks_op')
+            ->addColumn('last_review_date', 'date', ['null' => true, 'after' => 'mitigation'])
+            ->addColumn('review_frequency', 'string', ['limit' => 50, 'null' => true, 'after' => 'last_review_date'])
+            ->addColumn('residual_risk_decision', 'string', ['limit' => 20, 'null' => true, 'after' => 'review_frequency'])
+            ->addColumn('residual_risk_approved_by', 'string', ['limit' => 255, 'null' => true, 'after' => 'residual_risk_decision'])
+            ->addColumn('residual_risk_approved_at', 'date', ['null' => true, 'after' => 'residual_risk_approved_by'])
+            ->addColumn('residual_risk_justification', 'text', ['null' => true, 'after' => 'residual_risk_approved_at'])
+            ->addColumn('risk_source_id', 'integer', ['null' => true, 'signed' => false, 'after' => 'object_id'])
+            ->addIndex(['risk_source_id'], ['name' => 'risk_source_id'])
+            ->addForeignKey('risk_source_id', 'risk_sources', 'id', ['delete' => 'SET_NULL', 'update' => 'RESTRICT'])
+            ->update();
+    }
+
+    public function down(): void
+    {
+        $this->table('instances_risks')
+            ->removeColumn('residual_risk_justification')
+            ->removeColumn('residual_risk_approved_at')
+            ->removeColumn('residual_risk_approved_by')
+            ->removeColumn('residual_risk_decision')
+            ->update();
+
+        $this->table('instances_risks_op')
+            ->removeColumn('residual_risk_justification')
+            ->removeColumn('residual_risk_approved_at')
+            ->removeColumn('residual_risk_approved_by')
+            ->removeColumn('residual_risk_decision')
+            ->removeColumn('review_frequency')
+            ->removeColumn('last_review_date')
+            ->dropForeignKey('risk_source_id')
+            ->removeIndexByName('risk_source_id')
+            ->removeColumn('risk_source_id')
+            ->update();
+    }
+}

migrations/db/20260522101000_add_interested_parties.php

@@ -0,0 +1,33 @@
+<?php declare(strict_types=1);
+/**
+ * @link      https://github.com/monarc-project for the canonical source repository
+ * @copyright Copyright (c) 2016-2026 Luxembourg House of Cybersecurity LHC.lu - Licensed under GNU Affero GPL v3
+ * @license   MONARC is licensed under GNU Affero General Public License version 3
+ */
+
+use Phinx\Migration\AbstractMigration;
+
+class AddInterestedParties extends AbstractMigration
+{
+    public function up(): void
+    {
+        $this->table('anr_interested_parties')
+            ->addColumn('anr_id', 'integer', ['null' => false, 'signed' => false])
+            ->addColumn('stakeholder', 'string', ['limit' => 255, 'null' => false])
+            ->addColumn('requirement', 'text', ['null' => false])
+            ->addColumn('position', 'integer', ['default' => 0, 'signed' => false])
+            ->addColumn('creator', 'string', ['limit' => 255, 'null' => true])
+            ->addColumn('created_at', 'datetime', ['null' => true])
+            ->addColumn('updater', 'string', ['limit' => 255, 'null' => true])
+            ->addColumn('updated_at', 'datetime', ['null' => true])
+            ->addIndex(['anr_id'], ['name' => 'idx_anr_id'])
+            ->addIndex(['anr_id', 'position'], ['name' => 'anr_interested_parties_anr_id_position_indx'])
+            ->addForeignKey('anr_id', 'anrs', 'id', ['delete' => 'CASCADE', 'update' => 'RESTRICT'])
+            ->create();
+    }
+
+    public function down(): void
+    {
+        $this->table('anr_interested_parties')->drop()->save();
+    }
+}