foxxcyber/docsAbout These Release Notes
What this changelog covers, how Bedrock is versioned, and which application is in production.
This changelog covers production releases of the Bedrock platform. It's curated: each entry describes what changed for you as a user, not every internal commit. The engineering-level changelogs live with the source and are available to assessors and partners on request.
How Bedrock is versioned
- Releases follow semantic versioning (
v1.2.0). The hosted platform's backend and web application version independently but ship together as one product — entries on the Bedrock CMMC Platform page are grouped by release date and describe the combined change. - Every release deploys to a staging environment first and reaches production only through a tagged, reviewed release. Database changes are additive — upgrades don't break in-flight work.
- Bedrock C3PAO is distributed as a container image to partners; its release notes describe image generations rather than semver tags.
- Bedrock RMF is open source and ships as semver-tagged container images;
its release notes track the
public repository's
CHANGELOG.md.
Security fixes
Dependency and security patches are included in these notes when they affect the shipped product. If you believe you've found a vulnerability, see our vulnerability disclosure policy.
Bedrock CMMC v2 is what's in production
The current web application — Bedrock CMMC v2 — has been the production application at app.bedrock-cmmc.com since August 25, 2026, when it replaced the original v1 web app (v1 is retired; the assessor portal followed on August 26). v2 is a new application line, so its own version numbers start at v1.x — entries on the platform page show both the web app version and the API version. Development continues on v2: features appear in this changelog when they ship to production — we don't document unreleased work here.