use preview versions of oscal tools

.github/workflows/run-tests.yml

@@ -8,6 +8,7 @@ on:
     branches:
       - master
       - develop
+      - canary
       - 'feature/**'  # This will match any branch starting with "feature"
 
   pull_request:

.tool-versions

@@ -1,2 +1,2 @@
-oscal-cli 2.4.0
+oscal-cli 2.5.0-SNAPSHOT
 oscal-server v1.0.0-SNAPSHOT-6363f60-20241202160440

package.json

@@ -28,7 +28,7 @@
     "inquirer": "^10.1.8",
     "js-yaml": "^4.1.0",
     "jsdom": "^25.0.0",
-    "oscal": "2.0.7",
+    "oscal": "2.0.8-rc5",
     "ts-node": "^10.9.2",
     "xml-formatter": "^3.6.3",
     "xml2js": "^0.6.2"

src/validations/constraints/fedramp-external-constraints.xml

@@ -667,6 +667,7 @@
                 <formal-name>Inventory Item Has Software Name</formal-name>
                 <prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/ssp/5-attachments/#system-inventory-approach"/>
                 <message>In a FedRAMP SSP, each inventory item MUST include the software name in the inventory item itself or within the linked component.</message>
+            </expect>
             <expect id="inventory-item-has-software-version" target=".[prop[@name='asset-type' and @value=('operating-system', 'container', 'image')] or ../component[uuid=$component-uuid and type='software']]" test="count(prop[@name=('software-version', 'os-version')]) = 1 or count(../component[@uuid=$component-uuid]/prop[@name=('software-version', 'os-version')]) = 1" level="ERROR">
                 <formal-name>Inventory Item Has Software Version</formal-name>
                 <prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/ssp/5-attachments/#system-inventory-approach"/>