SecurityRonin · h4x0r · Aug 5, 2026 · Aug 4, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.11.0](https://github.com/SecurityRonin/forensicnomicon/compare/forensicnomicon-v1.10.0...forensicnomicon-v1.11.0) - 2026-08-04
+
+### Added
+
+- *(eventids)* GREEN — land Sysmon 21/22 and seven BITS-Client events
+- *(eventids)* GREEN — add channel-qualified lookup, document first-match
+
+### Fixed
+
+- *(ci)* pin the nightly that renders the public-api baselines
+- *(catalog)* GREEN — roll parent ATT&CK IDs up to their sub-techniques
+
 ## [1.10.0](https://github.com/SecurityRonin/forensicnomicon/compare/forensicnomicon-v1.9.0...forensicnomicon-v1.10.0) - 2026-07-30
 
 ### Added

diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -11,9 +11,9 @@ edition = "2021"
 # `forensicnomicon` is the root crate itself, declared as a path dep so the
 # in-workspace members link the local copy; the version pins it for publish.
 [workspace.dependencies]
-forensicnomicon = { path = ".", version = "1.10" }
+forensicnomicon = { path = ".", version = "1.11" }
 forensicnomicon-core = { path = "crates/core", version = "1.5" }
-forensicnomicon-data = { path = "crates/data", version = "1.3" }
+forensicnomicon-data = { path = "crates/data", version = "1.4" }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 serde_yaml = "0.9"
@@ -55,7 +55,7 @@ case_sensitive_file_extension_comparisons = { level = "allow", priority = 1 }
 
 [package]
 name = "forensicnomicon"
-version = "1.10.0"
+version = "1.11.0"
 description = "The ForensicNomicon — comprehensive DFIR artifact catalog: UserAssist, Shimcache, Amcache, Prefetch, $MFT, ShellBags, EVTX, NTDS.dit, SAM, SRUM, LNK, Jump Lists + KAPE/Velociraptor/Sigma/MITRE. Zero deps."
 edition.workspace = true
 rust-version = "1.75"

diff --git a/crates/4n6query/CHANGELOG.md b/crates/4n6query/CHANGELOG.md
@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.1.11](https://github.com/SecurityRonin/forensicnomicon/compare/forensicnomicon-cli-v0.1.10...forensicnomicon-cli-v0.1.11) - 2026-08-04
+
+### Added
+
+- *(4n6query)* GREEN — 4n6query coverage, plus the figure in the TUI about modal
+
+### Fixed
+
+- *(4n6query)* GREEN — uppercase the term before the ATT&CK catalog lookup
+- *(4n6query)* GREEN — resolve event IDs by channel in the TUI and the CLI
+- *(catalog)* GREEN — roll parent ATT&CK IDs up to their sub-techniques
+
 ## [0.1.3](https://github.com/SecurityRonin/forensicnomicon/compare/forensicnomicon-cli-v0.1.2...forensicnomicon-cli-v0.1.3) - 2026-06-29
 
 ### Documentation

diff --git a/crates/4n6query/Cargo.toml b/crates/4n6query/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "forensicnomicon-cli"
-version = "0.1.10"
+version = "0.1.11"
 edition.workspace = true
 rust-version = "1.75"
 authors = ["Albert Hui <albert@securityronin.com>"]

diff --git a/crates/core/CHANGELOG.md b/crates/core/CHANGELOG.md
@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.5.1](https://github.com/SecurityRonin/forensicnomicon/compare/forensicnomicon-core-v1.5.0...forensicnomicon-core-v1.5.1) - 2026-08-04
+
+### Fixed
+
+- *(catalog)* GREEN — roll parent ATT&CK IDs up to their sub-techniques
+
 ## [1.5.0](https://github.com/SecurityRonin/forensicnomicon/compare/forensicnomicon-core-v1.4.0...forensicnomicon-core-v1.5.0) - 2026-07-29
 
 ### Added

diff --git a/crates/core/Cargo.toml b/crates/core/Cargo.toml
@@ -4,7 +4,7 @@ name = "forensicnomicon-core"
 # are the semver-stable surface the fleet's analyzer crates pin against
 # (forensicnomicon-core = "1"). Bump majors deliberately — see
 # docs/plans/2026-06-28-knowledge-propagation-and-crate-split.md.
-version = "1.5.0"
+version = "1.5.1"
 description = "Stable engine layer of the ForensicNomicon: the normalized DFIR report model (Finding/Severity/Observation) and structural format constants. Zero deps."
 edition.workspace = true
 rust-version = "1.75"

diff --git a/crates/data/CHANGELOG.md b/crates/data/CHANGELOG.md
@@ -7,6 +7,22 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.4.0](https://github.com/SecurityRonin/forensicnomicon/compare/forensicnomicon-data-v1.3.3...forensicnomicon-data-v1.4.0) - 2026-08-04
+
+### Added
+
+- *(catalog)* regenerate with source-merging dedup
+
+### Fixed
+
+- *(catalog)* GREEN — correct evtx_bits_client event-ID mapping
+- *(catalog)* GREEN — wire the 52 orphaned fa descriptors, drop the dead_code mask
+- *(catalog)* GREEN — one EXPECTED_CATALOG_LEN, 17 count tests become presence tests
+
+### Other
+
+- *(catalog)* move assessed descriptors to hand-written homes
+
 ## [1.3.0](https://github.com/SecurityRonin/forensicnomicon/compare/forensicnomicon-data-v1.2.1...forensicnomicon-data-v1.3.0) - 2026-07-16
 
 ### Added

diff --git a/crates/data/Cargo.toml b/crates/data/Cargo.toml
@@ -3,7 +3,7 @@ name = "forensicnomicon-data"
 # The fast-moving knowledge layer; it releases frequently and independently of the
 # stable `forensicnomicon-core`. The schema is 1.0-stable; catalog content evolves
 # additively (new artifacts/IOCs are minor bumps).
-version = "1.3.3"
+version = "1.4.0"
 description = "Detection knowledge for the ForensicNomicon: the artifact descriptor catalog (the global CATALOG) and evidence/volatility lookups. The fast-moving data layer atop forensicnomicon-core."
 edition.workspace = true
 rust-version = "1.75"