3.3.1 release is missing the stix schema .json files

[vEpiphyte]

Hello,

The v3.3.1 .whl files do not ship with the stix2 schema files, meaning that the library will fail to validate any files.

Using the tlp-amber.json file from https://github.com/oasis-open/cti-stix-validator/blob/master/stix2validator/test/v21/test_examples/tlp-amber.json I can parse the bundle with v3.2.0; but the bundle fails to parse in 3.3.1.

The following was tested in the python:3.14.3 docker image.

root@c9fc9f75d5d0:/# python -m pip install "stix2-validator<3.3.0"
# Snip installation output

root@c9fc9f75d5d0:/# pip freeze
antlr4-python3-runtime==4.13.2                                                          
arrow==1.4.0                                                                            
attrs==26.1.0                                                                           
certifi==2026.4.22                                                                      
charset-normalizer==3.4.7                                                               
colorama==0.4.6                                                                         
cpe==1.3.1                                                                              
fqdn==1.5.1               
idna==3.15            
isoduration==20.11.0                      
jsonpointer==3.1.1
jsonschema==4.26.0                                                                      
jsonschema-specifications==2025.9.1
lark==1.3.1 
python-dateutil==2.9.0.post0
referencing==0.37.0
requests==2.34.0         
rfc3339-validator==0.1.4
rfc3986-validator==0.1.1
rfc3987-syntax==1.1.0
rpds-py==0.30.0
simplejson==4.1.1   
six==1.17.0       
stix2-patterns==2.1.2
stix2-validator==3.2.0    # Older stix2-validator library is present         
tzdata==2026.2
uri-template==1.3.0         
urllib3==2.7.0     
webcolors==25.10.0

Validating the file has no results.

root@c9fc9f75d5d0:/# python
Python 3.14.3 (main, Feb 24 2026, 21:41:39) [GCC 14.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> from stix2validator import validate_file, print_results
...              
>>> results = validate_file("tlp-amber.json")
>>> print_results(results)
>>> exit()            

Installing 3.3.1 and parsing the file then produces errors:

root@c9fc9f75d5d0:/# python -m pip install "stix2-validator>=3.3.0"                      
Collecting stix2-validator>=3.3.0
  Downloading stix2_validator-3.3.1-py2.py3-none-any.whl.metadata (10 kB)
... snip
Downloading stix2_validator-3.3.1-py2.py3-none-any.whl (791 kB)
   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 791.2/791.2 kB 7.0 MB/s  0:00:00
Installing collected packages: stix2-validator
  Attempting uninstall: stix2-validator
    Found existing installation: stix2-validator 3.2.0
    Uninstalling stix2-validator-3.2.0:
      Successfully uninstalled stix2-validator-3.2.0
Successfully installed stix2-validator-3.3.1 

The installed libraries now show the updated validator library:

root@c9fc9f75d5d0:/# pip freeze              
antlr4-python3-runtime==4.13.2
arrow==1.4.0
attrs==26.1.0
certifi==2026.4.22
charset-normalizer==3.4.7
colorama==0.4.6
cpe==1.3.1
fqdn==1.5.1
idna==3.15
isoduration==20.11.0
jsonpointer==3.1.1
jsonschema==4.26.0
jsonschema-specifications==2025.9.1
lark==1.3.1
python-dateutil==2.9.0.post0
referencing==0.37.0
requests==2.34.0
rfc3339-validator==0.1.4
rfc3986-validator==0.1.1
rfc3987-syntax==1.1.0
rpds-py==0.30.0
simplejson==4.1.1
six==1.17.0
stix2-patterns==2.1.2
stix2-validator==3.3.1      # Newer library is present
tzdata==2026.2
uri-template==1.3.0
urllib3==2.7.0
webcolors==25.10.0

And validation now shows an error with the library missing a schema file:

root@c9fc9f75d5d0:/# python                  
Python 3.14.3 (main, Feb 24 2026, 21:41:39) [GCC 14.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> from stix2validator import validate_file, print_results
>>> results = validate_file("tlp-amber.json")
>>> print_results(results)
[X] STIX JSON: Invalid
    [X] Cannot locate a schema for the object's type, nor the base schema (cyber-observable-core.json).
>>> exit()     

This file was present in the 3.2.0 wheel.

$ grep cyber-observable-core.json  stix2_validator-3.2.0-py2.py3-none-any/stix2_validator-3.2.0.dist-info/RECORD
stix2validator/schemas-2.0/schemas/common/cyber-observable-core.json,sha256=pKhrkwZBeTTZsPNWp20ZZHjA0NmvbnixPDijWNXUjkA,1486
stix2validator/schemas-2.1/schemas/common/cyber-observable-core.json,sha256=MZanEksvd75IvORVK5zZ3IJrq2QuDf1bdmPyijfsoOA,2835

Comparing the RECORD file in the pypi .whl files, the 3.2.0 has 137 .json files; whereas the 3.3.1 has no .json files in it.

$ cat stix2_validator-3.2.0-py2.py3-none-any/stix2_validator-3.2.0.dist-info/RECORD | grep json | wc -l
137

$ cat stix2_validator-3.3.1-py2.py3-none-any/stix2_validator-3.3.1.dist-info/RECORD | grep json | wc -l
0

[vEpiphyte]

@adulau mentioning you since you were the release manager for 3.3.1.

[vEpiphyte]

@adulau Is this planned to be fixed?

[jondricek]

This is also impacting us over on the ATT&CK website git repo. We optimistically upgraded to 3.3.1, but are reverting to 3.2.0 for this same reason

[RevantVishwakarma]

Hi, I investigated this issue and was able to reproduce the packaging failure locally.

From the same v3.3.1 source revision:

• Building without initialized schema submodules succeeds, but the resulting wheel contains 0 schema JSON files.
• After running git submodule update --init --recursive, the resulting wheel contains all 137 schema JSON files.

The current GitHub Actions workflow checks out submodules, so the source-tree validation tests pass. The packaging environment builds the distributions and runs twine check, but it does not verify that required runtime schema files are present in the wheel.

I’d be interested in working on a small regression-prevention fix. Would you prefer:

1. A packaging check that inspects the built wheel and verifies representative STIX 2.0 and 2.1 schemas are present, or
2. A fail-fast build guard when the schema submodules are missing?

I can keep the change focused and include appropriate regression coverage.