OASIS Cyber Threat Intelligence (CTI) TC

 View Only
  • 1.  STIX 2.1 Python Library Not Updating

    Posted 08-13-2025 10:35

    The PyPi repo for the STIX 2.1 library has not been updated since 2021 https://pypi.org/project/stix2/#history.  However the actual library continues to be updated on GitHub with the last update to the main branch being 5 months ago https://github.com/oasis-open/cti-python-stix2/.  On GitHub no tags were made which I think is what was previously pushing these patches to PyPi.

    This wouldn't be an issue, but I believe updates have been made to it to better support extensions.  Is anyone able to tag this and get PyPi updated so that we can push these fixes to the wider community easily instead of asking folks to mirror the GitHub code directly?



    ------------------------------
    Jeffrey Mates
    US Department of Defense (DoD)
    ------------------------------


  • 2.  RE: STIX 2.1 Python Library Not Updating

    Posted 05-08-2026 13:24

    Hi Jeffrey,

    I think I mentioned it during the last CTI TC Meeting, but just to have the situation clarified here in the discussion, the latest update of the library has been published on PyPi earlier this year.

    Thank you for bringing this topic onto the table, PyPi was indeed missing a lot of the recent updates to the library.



    ------------------------------
    Christian Studer
    Security Researcher
    CIRCL
    ------------------------------



  • 3.  RE: STIX 2.1 Python Library Not Updating

    Posted 05-12-2026 07:42

    Thanks, it's great to hear updates have resumed.  Will stix2-validator also be updated in PyPi?  It still lists the latest version as April 5, 2024 but on GitHub I see changes have been made this year.

     

    //SIGNED//

     

    Jeffrey Mates, Civ DC3/XT

    Computer Scientist

    Information Technology

    jeffrey.mates@us.af.mil

     






  • 4.  RE: STIX 2.1 Python Library Not Updating

    Posted 05-12-2026 11:30

    Yes you are right, I was focused on releasing the `cti-python-stix2` dependencies, including `cti-pattern-validator` which was released at the same time, but forgot the pending changes on the validator.

    We just released it today both on github and PyPi: https://pypi.org/project/stix2-validator/3.3.1/



    ------------------------------
    Christian Studer
    Security Researcher
    CIRCL
    ------------------------------