[2.0] Threatmodeling and Blueprints by stevespringett · Pull Request #678 · CycloneDX/specification

stevespringett · 2025-09-03T03:02:00Z

Initial blueprint and threat modeling support for CycloneDX v2.0.

Closes Add threat model capabilities to CycloneDX / TM-BOM #462
Closes Add support for Blueprints #463

Signed-off-by: Steve Springett <steve@springett.us>

Signed-off-by: steve.springett <steve.springett@servicenow.com>

…ling

Signed-off-by: Steve Springett <steve@springett.us>

…ling Signed-off-by: Steve Springett <steve@springett.us> # Conflicts: # schema/2.0/model/cyclonedx-common-2.0.schema.json

Signed-off-by: Steve Springett <steve@springett.us>

…tras-suggestions Signed-off-by: Steve Springett <steve@springett.us>

Issue: As discussed in ticket #731 , this PR is a review of the schema Model schema reviewed to ensure no data loss Risk schema changes done based on risk and compliance tooling taxonomies to ensure compatibility (including data classification etc) This PR is to use for discussion on the TM-BOM discussion 0 not for merging yet

Signed-off-by: Steve Springett <steve@springett.us>

. Blueprints working group will continue to iterate and validate. Signed-off-by: Steve Springett <steve@springett.us>

Signed-off-by: Basil Hess <bhe@zurich.ibm.com>

… Orders new entries alphabetically in the enum Signed-off-by: Basil Hess <bhe@zurich.ibm.com>

This PR extends the list of cryptography-related behaviors, as discussed in today's Cryptography WG meeting. The google sheet is synced with those entries.

…This currently compiles. Signed-off-by: Steve Springett <steve@springett.us>

Signed-off-by: Steve Springett <steve@springett.us>

…-dev-threatmodeling

Signed-off-by: Steve Springett <steve@springett.us>

A series of enhancements, corrections, and minor refactors of some of the schemas supporting threat modeling.

…related areas in the spec. Signed-off-by: Steve Springett <steve@springett.us>

…ehavior schema. Signed-off-by: Steve Springett <steve@springett.us>

… - and updated it to be an array. Added cadence (previously was risk assessment type) to be a noun representing temporal data. Updated test case. Signed-off-by: Steve Springett <steve@springett.us>

…ves, kill chains, and attack paths for lateral movement. Signed-off-by: Steve Springett <steve@springett.us>

Signed-off-by: Steve Springett <steve@springett.us>

…ling Signed-off-by: Steve Springett <steve@springett.us> # Conflicts: # schema/2.0/cyclonedx-2.0-bundled.min.schema.json # schema/2.0/model/cyclonedx-component-2.0.schema.json

jkowalleck · 2026-07-10T07:35:44Z

RFC notice sent on July 09, 2026

Public RFC period ends August 03, 2026

Signed-off-by: Steve Springett <steve@springett.us>

jkowalleck

started the review, have some remarks and comments, no blockers so far.

will continue review tomorrow

jkowalleck · 2026-07-29T18:05:47Z

❓ is this file path correct?
shall this not go into schema/2.0/behavior-taxonomy.schema.json?
(or even schema/2.0/taxonomies/behavior.schema.json?)

this docuemtn is linked in other documents in this very PR.
having these links fixed caused caused #992

jkowalleck · 2026-07-29T18:12:06Z

    "$schema": {
      "type": "string"
    },
+    "$comment": {


👍 out of scope, but a good addition.

jkowalleck · 2026-07-29T18:16:51Z

+    "risks": {
+      "type": "object",
+      "title": "Risks",
+      "description": "A collection of risks identified through risk analysis, together with the assessments that evaluate them. The model is framework-neutral and can document risk regardless of the risk management framework in use, including [ISO 31000](https://www.iso.org/iso-31000-risk-management.html), [NIST SP 800-30](https://csrc.nist.gov/pubs/sp/800/30/r1/final), the [NIST AI Risk Management Framework](https://www.nist.gov/itl/ai-risk-management-framework), [COSO ERM](https://www.coso.org/), [ISO/IEC 27005](https://www.iso.org/standard/80585.html), and OCTAVE. It accommodates qualitative, semi-quantitative, and quantitative assessment, and each rating records the scoring methodology used, such as [FAIR](https://www.fairinstitute.org/), [OWASP Risk Rating](https://owasp.org/www-community/OWASP_Risk_Rating_Methodology), DREAD, [FMEA](https://asq.org/quality-resources/fmea), NIST SP 800-30, or OCTAVE Allegro. Each risk separates inherent, residual, and target ratings so risk reduction is explicit.",


add some line breaks for readability.

Suggested change

"description": "A collection of risks identified through risk analysis, together with the assessments that evaluate them. The model is framework-neutral and can document risk regardless of the risk management framework in use, including [ISO 31000](https://www.iso.org/iso-31000-risk-management.html), [NIST SP 800-30](https://csrc.nist.gov/pubs/sp/800/30/r1/final), the [NIST AI Risk Management Framework](https://www.nist.gov/itl/ai-risk-management-framework), [COSO ERM](https://www.coso.org/), [ISO/IEC 27005](https://www.iso.org/standard/80585.html), and OCTAVE. It accommodates qualitative, semi-quantitative, and quantitative assessment, and each rating records the scoring methodology used, such as [FAIR](https://www.fairinstitute.org/), [OWASP Risk Rating](https://owasp.org/www-community/OWASP_Risk_Rating_Methodology), DREAD, [FMEA](https://asq.org/quality-resources/fmea), NIST SP 800-30, or OCTAVE Allegro. Each risk separates inherent, residual, and target ratings so risk reduction is explicit.",

"description": "A collection of risks identified through risk analysis, together with the assessments that evaluate them.\n The model is framework-neutral and can document risk regardless of the risk management framework in use, including [ISO 31000](https://www.iso.org/iso-31000-risk-management.html), [NIST SP 800-30](https://csrc.nist.gov/pubs/sp/800/30/r1/final), the [NIST AI Risk Management Framework](https://www.nist.gov/itl/ai-risk-management-framework), [COSO ERM](https://www.coso.org/), [ISO/IEC 27005](https://www.iso.org/standard/80585.html), and OCTAVE. It accommodates qualitative, semi-quantitative, and quantitative assessment, and each rating records the scoring methodology used, such as [FAIR](https://www.fairinstitute.org/), [OWASP Risk Rating](https://owasp.org/www-community/OWASP_Risk_Rating_Methodology), DREAD, [FMEA](https://asq.org/quality-resources/fmea), NIST SP 800-30, or OCTAVE Allegro.\n Each risk separates inherent, residual, and target ratings so risk reduction is explicit.",

jkowalleck · 2026-07-29T18:18:42Z

+      "items": {
+        "$ref": "#/$defs/control"
+      },
+      "description": "The safeguards and countermeasures that are recommended or in place. Controls may be declared on their own for governance, risk, and compliance use cases, or referenced from threats, trust boundaries, and risk responses."


add line break for readability

Suggested change

"description": "The safeguards and countermeasures that are recommended or in place. Controls may be declared on their own for governance, risk, and compliance use cases, or referenced from threats, trust boundaries, and risk responses."

"description": "The safeguards and countermeasures that are recommended or in place.\n Controls may be declared on their own for governance, risk, and compliance use cases, or referenced from threats, trust boundaries, and risk responses."

jkowalleck · 2026-07-29T18:20:01Z

+  "$id": "https://cyclonedx.org/schema/behavior-taxonomy.schema.json",
+  "type": "string",
+  "title": "CycloneDX Behavior Taxonomy",
+  "description": "An independent taxonomy of behaviours that describe actions performed by entities with security, privacy, safety, or operational implications. This taxonomy is maintained separately from the CycloneDX specification and may evolve at a different rate. The taxonomy uses a hierarchical colon-delimited naming convention with three levels: domain (e.g. security), category (e.g. security:authentication), and specific behaviour (e.g. security:authentication:authenticatesUser). Values at any level of the hierarchy are valid.",


add line-breaks for readability

Suggested change

"description": "An independent taxonomy of behaviours that describe actions performed by entities with security, privacy, safety, or operational implications. This taxonomy is maintained separately from the CycloneDX specification and may evolve at a different rate. The taxonomy uses a hierarchical colon-delimited naming convention with three levels: domain (e.g. security), category (e.g. security:authentication), and specific behaviour (e.g. security:authentication:authenticatesUser). Values at any level of the hierarchy are valid.",

"description": "An independent taxonomy of behaviours that describe actions performed by entities with security, privacy, safety, or operational implications. This taxonomy is maintained separately from the CycloneDX specification and may evolve at a different rate.\n The taxonomy uses a hierarchical colon-delimited naming convention with three levels: domain (e.g. security), category (e.g. security:authentication), and specific behaviour (e.g. security:authentication:authenticatesUser).\n Values at any level of the hierarchy are valid.",

jkowalleck · 2026-07-29T18:34:55Z

+      "description": "An ordinal version is a dot-delimited, purely numeric identifier where each segment represents an ordered level in the hierarchy. The segments have no prescribed meaning beyond numeric ordering, allowing straightforward comparison and sorting.",
+      "type": "string",
+      "pattern": "^\\d+(\\.\\d+)*$",
+      "examples": [


add a 0 example, telling people that is valid and to be expected (just as these leading zeroes in the existing example "2025.09.02")

Suggested change

"examples": [

"examples": [

"0.8.15",

jkowalleck · 2026-07-29T18:44:18Z

✔️ changes are out of scope, but welcome

jkowalleck · 2026-07-29T18:45:33Z

+    "profiles": {
+      "type": "object",
+      "title": "Profiles",
+      "description": "A registry of reusable, named characterizations of how a subject behaves or is governed within a domain. Profiles separate characterization from identity: identity describes who or what the subject is; the profile describes the durable attributes that characterize it. A profile is referenced by its bom-ref from the elements it characterizes, so a single profile can be reused by many subjects.",


add line breaks for readability

Suggested change

"description": "A registry of reusable, named characterizations of how a subject behaves or is governed within a domain. Profiles separate characterization from identity: identity describes who or what the subject is; the profile describes the durable attributes that characterize it. A profile is referenced by its bom-ref from the elements it characterizes, so a single profile can be reused by many subjects.",

"description": "A registry of reusable, named characterizations of how a subject behaves or is governed within a domain.\n Profiles separate characterization from identity: identity describes who or what the subject is; the profile describes the durable attributes that characterize it.\n A profile is referenced by its bom-ref from the elements it characterizes, so a single profile can be reused by many subjects.",

jkowalleck · 2026-07-29T18:46:37Z

+    "risks": {
+      "type": "object",
+      "title": "Risks",
+      "description": "A collection of risks identified through risk analysis, together with the assessments that evaluate them. The model is framework-neutral and can document risk regardless of the risk management framework in use, including [ISO 31000](https://www.iso.org/iso-31000-risk-management.html), [NIST SP 800-30](https://csrc.nist.gov/pubs/sp/800/30/r1/final), the [NIST AI Risk Management Framework](https://www.nist.gov/itl/ai-risk-management-framework), [COSO ERM](https://www.coso.org/), [ISO/IEC 27005](https://www.iso.org/standard/80585.html), and OCTAVE. It accommodates qualitative, semi-quantitative, and quantitative assessment, and each rating records the scoring methodology used, such as [FAIR](https://www.fairinstitute.org/), [OWASP Risk Rating](https://owasp.org/www-community/OWASP_Risk_Rating_Methodology), DREAD, [FMEA](https://asq.org/quality-resources/fmea), NIST SP 800-30, or OCTAVE Allegro. Each risk separates inherent, residual, and target ratings so risk reduction is explicit.",


add line-breaks for readability

Suggested change

"description": "A collection of risks identified through risk analysis, together with the assessments that evaluate them. The model is framework-neutral and can document risk regardless of the risk management framework in use, including [ISO 31000](https://www.iso.org/iso-31000-risk-management.html), [NIST SP 800-30](https://csrc.nist.gov/pubs/sp/800/30/r1/final), the [NIST AI Risk Management Framework](https://www.nist.gov/itl/ai-risk-management-framework), [COSO ERM](https://www.coso.org/), [ISO/IEC 27005](https://www.iso.org/standard/80585.html), and OCTAVE. It accommodates qualitative, semi-quantitative, and quantitative assessment, and each rating records the scoring methodology used, such as [FAIR](https://www.fairinstitute.org/), [OWASP Risk Rating](https://owasp.org/www-community/OWASP_Risk_Rating_Methodology), DREAD, [FMEA](https://asq.org/quality-resources/fmea), NIST SP 800-30, or OCTAVE Allegro. Each risk separates inherent, residual, and target ratings so risk reduction is explicit.",

"description": "A collection of risks identified through risk analysis, together with the assessments that evaluate them.\n The model is framework-neutral and can document risk regardless of the risk management framework in use, including [ISO 31000](https://www.iso.org/iso-31000-risk-management.html), [NIST SP 800-30](https://csrc.nist.gov/pubs/sp/800/30/r1/final), the [NIST AI Risk Management Framework](https://www.nist.gov/itl/ai-risk-management-framework), [COSO ERM](https://www.coso.org/), [ISO/IEC 27005](https://www.iso.org/standard/80585.html), and OCTAVE.\n It accommodates qualitative, semi-quantitative, and quantitative assessment, and each rating records the scoring methodology used, such as [FAIR](https://www.fairinstitute.org/), [OWASP Risk Rating](https://owasp.org/www-community/OWASP_Risk_Rating_Methodology), DREAD, [FMEA](https://asq.org/quality-resources/fmea), NIST SP 800-30, or OCTAVE Allegro. Each risk separates inherent, residual, and target ratings so risk reduction is explicit.",

jkowalleck · 2026-07-29T18:47:54Z

+    },
+    "weakness": {
+      "title": "Weakness",
+      "description": "A classification of an underlying weakness, given either by a Common Weakness Enumeration (CWE) identifier or by a free-text name with an optional description. The exploitability and the affected scope are expressed by the vulnerability or threat that references the weakness, not on the weakness itself.",


add line-breaks for readability

Suggested change

"description": "A classification of an underlying weakness, given either by a Common Weakness Enumeration (CWE) identifier or by a free-text name with an optional description. The exploitability and the affected scope are expressed by the vulnerability or threat that references the weakness, not on the weakness itself.",

"description": "A classification of an underlying weakness, given either by a Common Weakness Enumeration (CWE) identifier or by a free-text name with an optional description.\n The exploitability and the affected scope are expressed by the vulnerability or threat that references the weakness, not on the weakness itself.",

jkowalleck · 2026-07-29T18:54:11Z

+      "title": "Ordinal Version",
+      "description": "An ordinal version is a dot-delimited, purely numeric identifier where each segment represents an ordered level in the hierarchy. The segments have no prescribed meaning beyond numeric ordering, allowing straightforward comparison and sorting.",
+      "type": "string",
+      "pattern": "^\\d+(\\.\\d+)*$",


per https://json-schema.org/understanding-json-schema/reference/regular_expressions
we should use only standard escapes.

the character class \d is no such thing
lets change it to :

Suggested change

"pattern": "^\\d+(\\.\\d+)*$",

"pattern": "^[0-9]+(\\.[0-9]+)*$",

shall be fixed in #988 (comment)

jkowalleck

did another round of review.
found critical bugs - marked with ❌ .

will continue review tomorrow.

jkowalleck · 2026-07-30T19:00:01Z

+      "description": "Threat-modelling content, including the documented threats, the scenarios that realize them, the attack patterns and attack trees that describe how they are carried out, and the trust boundaries they cross.",
+      "additionalProperties": false,
+      "properties": {
+        "threats": {


this looks a bit odd...
the structure would be like $.threats.threats - a duplication in words.

jkowalleck · 2026-07-30T19:00:19Z

      "$ref": "model/cyclonedx-vulnerability-2.0.schema.json#/$defs/vulnerabilities"
    },
+    "threats": {
+      "$ref": "model/cyclonedx-threat-2.0.schema.json#/$defs/threats"


see https://github.com/CycloneDX/specification/pull/678/changes#r3685469824

jkowalleck · 2026-07-30T19:48:23Z

+          "description": "Position within a sequential graph. Required when the graph ordering is 'sequential'. Ignored when transitions define the order."
+        },
+        "behavior": {
+          "$ref": "../behavior-taxonomy.schema.json",


❌ this path does not exist.
see https://github.com/CycloneDX/specification/pull/678/changes#r3676902519

caused #992

jkowalleck · 2026-07-30T19:49:22Z

+          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType"
+        },
+        "behavior": {
+          "$ref": "../behavior-taxonomy.schema.json",


❌ this path does not exist.
see https://github.com/CycloneDX/specification/pull/678/changes#r3676902519

jkowalleck · 2026-07-30T19:57:04Z

this docuemtn is linked in other documents in this very PR.
having these links fixed caused caused #992

stevespringett added 3 commits July 9, 2025 10:05

Initial commit

9265fba

Signed-off-by: Steve Springett <steve@springett.us>

Added requirement prototype

513ef74

Signed-off-by: Steve Springett <steve@springett.us>

Initial checkin of blueprint and threat model support

83ce9d0

Signed-off-by: Steve Springett <steve@springett.us>

stevespringett added this to the 2.0 milestone Sep 3, 2025

stevespringett added proposed core enhancement prototype labels Sep 3, 2025

steve.springett and others added 24 commits October 29, 2025 09:54

Adding threat models

f4d10d4

Signed-off-by: steve.springett <steve.springett@servicenow.com>

Merge remote-tracking branch 'origin/master' into 2.0-dev-threatmodeling

833bcc1

Merge remote-tracking branch 'origin/2.0-dev' into 2.0-dev-threatmode…

e124ae5

…ling

Modified risk and model schemas

7a04e95

Added .DS_Store to ignore

1bc014f

Signed-off-by: Steve Springett <steve@springett.us>

Merge remote-tracking branch 'origin/2.0-dev' into 2.0-dev-threatmode…

21b4d38

…ling Signed-off-by: Steve Springett <steve@springett.us> # Conflicts: # schema/2.0/model/cyclonedx-common-2.0.schema.json

Minor corrections to get bundle to compile.

83e8122

Signed-off-by: Steve Springett <steve@springett.us>

chore: update bundled schemas [skip ci]

f52760a

adressed comments and reviewed further the schema

e8f7aba

fixed naming inconsistency

53cfdd1

Merge branch '2.0-dev-threatmodeling' into 2.0-dev-threat-modeling-pe…

d999fac

…tras-suggestions Signed-off-by: Steve Springett <steve@springett.us>

Fixed JSON issue

c6e1657

Signed-off-by: Steve Springett <steve@springett.us>

Initial checkin of behavior model. Should satisfy goals outlined in #670

941fa1f

. Blueprints working group will continue to iterate and validate. Signed-off-by: Steve Springett <steve@springett.us>

Extend cryptography-related behaviors

96117b4

Signed-off-by: Basil Hess <bhe@zurich.ibm.com>

A few extensions to the crypto behaviors

70de945

Signed-off-by: Basil Hess <bhe@zurich.ibm.com>

Makes sure meta:enum descrptions are available for the new behaviors.…

bb7e30e

… Orders new entries alphabetically in the enum Signed-off-by: Basil Hess <bhe@zurich.ibm.com>

Extend cryptography-related behaviors (#772)

20ee286

This PR extends the list of cryptography-related behaviors, as discussed in today's Cryptography WG meeting. The google sheet is synced with those entries.

Major changes to blueprints and other changes to supporting schemas. …

fd3b448

…This currently compiles. Signed-off-by: Steve Springett <steve@springett.us>

chore: update bundled schemas [skip ci]

e4cd7d6

Behavior and blueprint updates. Minor changes to data schema

38a2a23

Signed-off-by: Steve Springett <steve@springett.us>

chore: update bundled schemas [skip ci]

55b67ea

Updated to use cases and requirements - moving them to definitions

f730ce0

Signed-off-by: Steve Springett <steve@springett.us>

Merge remote-tracking branch 'origin/2.0-dev-threatmodeling' into 2.0…

1343aca

…-dev-threatmodeling

stevespringett added 8 commits June 7, 2026 21:06

Added qualitative-matrix

6735876

Signed-off-by: Steve Springett <steve@springett.us>

Added threat origin

f011423

Signed-off-by: Steve Springett <steve@springett.us>

2.0 dev threatmodeling staging (#951)

cc44d4b

A series of enhancements, corrections, and minor refactors of some of the schemas supporting threat modeling.

Added control as first-class citizen and expanded use of controls to …

6ec41a6

…related areas in the spec. Signed-off-by: Steve Springett <steve@springett.us>

Added test cases, comment to schema, and corrected space issue with b…

72407e7

…ehavior schema. Signed-off-by: Steve Springett <steve@springett.us>

Changed risk type to align with the kind of risk assessment performed…

10d7dd2

… - and updated it to be an array. Added cadence (previously was risk assessment type) to be a noun representing temporal data. Updated test case. Signed-off-by: Steve Springett <steve@springett.us>

Closed some gaps for PASTA, STRIDE-LM by introducing business objecti…

84e4513

…ves, kill chains, and attack paths for lateral movement. Signed-off-by: Steve Springett <steve@springett.us>

Updated test case

6f90077

Signed-off-by: Steve Springett <steve@springett.us>

stevespringett marked this pull request as ready for review June 28, 2026 23:26

stevespringett requested a review from a team as a code owner June 28, 2026 23:26

stevespringett and others added 2 commits June 28, 2026 18:37

Merge remote-tracking branch 'origin/2.0-dev' into 2.0-dev-threatmode…

e0c1a32

…ling Signed-off-by: Steve Springett <steve@springett.us> # Conflicts: # schema/2.0/cyclonedx-2.0-bundled.min.schema.json # schema/2.0/model/cyclonedx-component-2.0.schema.json

chore: update bundled schemas [skip ci]

03a8eaa

stevespringett added RFC notice sent A public RFC notice was distributed to the CycloneDX mailing list for consideration request for comment labels Jul 8, 2026

This was linked to issues Jul 8, 2026

Add threat model capabilities to CycloneDX / TM-BOM #462

Open

Add support for Blueprints #463

Open

jkowalleck changed the title ~~2.0 dev threatmodeling~~ [2.0] Threatmodeling and Blueprints Jul 10, 2026

jkowalleck added the CDX 2.0 related to release v2.0 label Jul 10, 2026

jkowalleck requested review from DarthHater, coderpatros, jkowalleck and mrutkows July 10, 2026 07:40

stevespringett and others added 2 commits July 12, 2026 14:55

Removed service in preparation for #733

253d59c

Signed-off-by: Steve Springett <steve@springett.us>

chore: update bundled schemas [skip ci]

cf0bc55

jkowalleck added the breaking-changes label Jul 29, 2026

jkowalleck reviewed Jul 29, 2026

View reviewed changes

jkowalleck requested changes Jul 29, 2026

View reviewed changes

jkowalleck mentioned this pull request Jul 29, 2026

[2.0]: dont use character classes in patterns #988

Open

jkowalleck reviewed Jul 30, 2026

View reviewed changes

	"description": "The safeguards and countermeasures that are recommended or in place. Controls may be declared on their own for governance, risk, and compliance use cases, or referenced from threats, trust boundaries, and risk responses."
	"description": "The safeguards and countermeasures that are recommended or in place.\n Controls may be declared on their own for governance, risk, and compliance use cases, or referenced from threats, trust boundaries, and risk responses."

	"description": "A classification of an underlying weakness, given either by a Common Weakness Enumeration (CWE) identifier or by a free-text name with an optional description. The exploitability and the affected scope are expressed by the vulnerability or threat that references the weakness, not on the weakness itself.",
	"description": "A classification of an underlying weakness, given either by a Common Weakness Enumeration (CWE) identifier or by a free-text name with an optional description.\n The exploitability and the affected scope are expressed by the vulnerability or threat that references the weakness, not on the weakness itself.",

	"pattern": "^\\d+(\\.\\d+)*$",
	"pattern": "^[0-9]+(\\.[0-9]+)*$",

Uh oh!

Uh oh!

Conversation

stevespringett commented Sep 3, 2025 • edited by jkowalleck Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jkowalleck commented Jul 10, 2026

Uh oh!

jkowalleck left a comment

Choose a reason for hiding this comment

Uh oh!

jkowalleck Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jkowalleck Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jkowalleck left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

stevespringett commented Sep 3, 2025 •

edited by jkowalleck

Loading

jkowalleck Jul 29, 2026 •

edited

Loading

jkowalleck Jul 29, 2026 •

edited

Loading