v4.0.0-rc.1 #1696

Changes

This is the very first release candidate for the upcoming v4 release. All of the features should already be in it but we are still working on some documentation improvements. Any feedback or bugs found are as always very much appreciated 🙌

This release contains breaking changes. The changes are listed in the "💣 Breaking Changes" section below and in the Upgrading from 3.x - 4.x notes.

🚀 Features

• Add Cluster Wide Custom Resources (ClusterScanType, ClusterParseDefinition & ClusterScanCompletionHook) @J12934 (Feature ADR 12 - Cluster Wide Custom Resources #1662): See more in ADR-12
• Enable Container AutoDiscovery to scan images from private repos @the-simmon (ADR 17: Enable container autodiscovery to scan images from private repos #1374, Enable ContainerAutodiscovery to scan images from private repos (ADR 17)(closes #1189) #1557): See more in ADR-17
• Allow multiple scanTypes to be used in the Service and Container AutoDiscovery @Ilyesbdlala (Allow multiple scantypes to be used in the service and container autodiscovery (closes #1384) #1447)
• Added new references attribute to the finding format with unified references to CVEs, CWEs and other external references @Ilyesbdlala (Added references attribute to findings #1676)
• Added optional identified at parameter to findings (for all scanners which include this info in their results) @Ilyesbdlala (Added optional identified at parameter to findings #1434)
• Added new DNS Scanner: Doggo @rseedorff (Added new DNS Scanner: Doggo #1446)

💣 Breaking Changes

You can find detailed upgrade notes on these braking changes in the upgrading documentation: Upgrading from 3.x - 4.x

Note some breaking changes are missing here and are only referenced in the linked upgrading notes.

• Improve Nmap Parser to handle multiple / ipv6 addresses and verbose output @J12934 (Improve Nmap Parser to handle multiple / ipv6 addresses and verbose output #1679)
• Allow multiple scanTypes to be used in the Service and Container AutoDiscovery @Ilyesbdlala (Allow multiple scantypes to be used in the service and container autodiscovery (closes #1384) #1447)
• Added optional mitigation attribute to findings @Ilyesbdlala (Added optional mitigation attribute to findings #1639)
• Remove AngularCSTI Integration @J12934 (Remove AngularCSTI Integration #1649)
• Renamed Amass attributes.name to attributes.hostname @Ilyesbdlala (maintenance: renamed Amass attributes.name to attributes.hostname #1605)

🚓 Security Scanner

• Added new DNS Scanner: Doggo @rseedorff (Added new DNS Scanner: Doggo #1446)
• Remove AngularCSTI Scanner Integration @J12934 (Remove AngularCSTI Integration #1649)
• Added optional identified at parameter to findings @Ilyesbdlala (Added optional identified at parameter to findings #1434)
• Added zap-advanced configuration option to change reportType @rseedorff (Added zap-advancedconfiguration option to change reportType #1632)
• Upgraded amass from v3.21.2 to v3.22.2 @secureCodeBoxBot ([SCB-Bot] Upgraded amass from v3.21.2 to v3.22.0 #1634, [SCB-Bot] Upgraded amass from v3.22.0 to v3.22.1 #1641, [SCB-Bot] Upgraded amass from v3.22.1 to v3.22.2 #1652)
• Upgraded ffuf from v1.5.0 to v2.0.0 @secureCodeBoxBot ([SCB-Bot] Upgraded ffuf from v1.5.0 to v2.0.0 #1579)
• Upgraded gitleaks from v8.15.2 to v8.16.2 @secureCodeBoxBot ([SCB-Bot] Upgraded gitleaks from v8.15.2 to v8.15.3 #1559, [SCB-Bot] Upgraded gitleaks from v8.15.3 to v8.15.4 #1614, [SCB-Bot] Upgraded gitleaks from v8.15.4 to v8.16.0 #1615, [SCB-Bot] Upgraded gitleaks from v8.16.0 to v8.16.1 #1643, [SCB-Bot] Upgraded gitleaks from v8.16.1 to v8.16.2 #1665)
• Upgraded kubeaudit from 0.21.0 to 0.22.0 @secureCodeBoxBot ([SCB-Bot] Upgraded kubeaudit from 0.21.0 to 0.22.0 #1654)
• Upgraded nuclei from v2.8.3 to v2.9.1 @secureCodeBoxBot ([SCB-Bot] Upgraded nuclei from v2.8.3 to v2.8.5 #1527, [SCB-Bot] Upgraded nuclei from v2.8.5 to v2.8.6 #1544, [SCB-Bot] Upgraded nuclei from v2.8.6 to v2.8.8 #1561, [SCB-Bot] Upgraded nuclei from v2.8.8 to v2.8.9 #1590, [SCB-Bot] Upgraded nuclei from v2.8.9 to v2.9.0 #1648, [SCB-Bot] Upgraded nuclei from v2.9.0 to v2.9.1 #1671)
• Upgraded semgrep from 1.1.0 to 1.17.1 @secureCodeBoxBot ([SCB-Bot] Upgraded semgrep from 1.1.0 to 1.2.0 #1517, [SCB-Bot] Upgraded semgrep from 1.10.0 to 1.11.0 #1591, [SCB-Bot] Upgraded semgrep from 1.11.0 to 1.12.0 #1596, [SCB-Bot] Upgraded semgrep from 1.12.0 to 1.12.1 #1602, [SCB-Bot] Upgraded semgrep from 1.12.1 to 1.13.0 #1612, [SCB-Bot] Upgraded semgrep from 1.13.0 to 1.14.0 #1616, [SCB-Bot] Upgraded semgrep from 1.14.0 to 1.15.0 #1646, [SCB-Bot] Upgraded semgrep from 1.15.0 to 1.16.0 #1667, [SCB-Bot] Upgraded semgrep from 1.16.0 to 1.17.0 #1675, [SCB-Bot] Upgraded semgrep from 1.17.0 to 1.17.1 #1677, [SCB-Bot] Upgraded semgrep from 1.2.0 to 1.2.1 #1518, [SCB-Bot] Upgraded semgrep from 1.2.1 to 1.3.0 #1545, [SCB-Bot] Upgraded semgrep from 1.3.0 to 1.5.1 #1558, [SCB-Bot] Upgraded semgrep from 1.5.1 to 1.6.0 #1565, [SCB-Bot] Upgraded semgrep from 1.6.0 to 1.8.0 #1569, [SCB-Bot] Upgraded semgrep from 1.8.0 to 1.9.0 #1578, [SCB-Bot] Upgraded semgrep from 1.9.0 to 1.10.0 #1583)
• Upgraded sslyze from 5.0.6 to 5.1.3 @secureCodeBoxBot ([SCB-Bot] Upgraded sslyze from 5.0.6 to 5.1.1 #1555, [SCB-Bot] Upgraded sslyze from 5.1.1 to 5.1.2 #1637, [SCB-Bot] Upgraded sslyze from 5.1.2 to 5.1.3 #1670)
• Upgraded trivy from 0.35.0 to 0.39.1 @secureCodeBoxBot ([SCB-Bot] Upgraded trivy from 0.35.0 to 0.36.1 #1546, [SCB-Bot] Upgraded trivy from 0.36.1 to 0.37.1 #1572, [SCB-Bot] Upgraded trivy from 0.37.1 to 0.37.2 #1587, [SCB-Bot] Upgraded trivy from 0.37.2 to 0.37.3 #1599, [SCB-Bot] Upgraded trivy from 0.37.3 to 0.38.0 #1617, [SCB-Bot] Upgraded trivy from 0.38.0 to 0.38.1 #1622, [SCB-Bot] Upgraded trivy from 0.38.1 to 0.38.2 #1636, [SCB-Bot] Upgraded trivy from 0.38.2 to 0.38.3 #1644, [SCB-Bot] Upgraded trivy from 0.38.3 to 0.39.0 #1668, [SCB-Bot] Upgraded trivy from 0.39.0 to 0.39.1 #1681)
• Upgraded typo3scan from v1.1.1 to v1.1.2 @secureCodeBoxBot ([SCB-Bot] Upgraded typo3scan from v1.1.1 to v1.1.2 #1653)

⚓️ Hooks

• Add Apikey in generic webhook @srburton (Add Apikey in generic webhook #1526)
• Make userid optional for defectdojo @the-simmon (Make userid optional for defectdojo #1412)

🐛 Bug Fixes

• Renames the hook.image.repository of update-field hook @Ilyesbdlala (Renames the hook.image.repository of update-field hook #1685)
• Improve Nmap Parser to handle multiple / ipv6 addresses and verbose output @J12934 (Improve Nmap Parser to handle multiple / ipv6 addresses and verbose output #1679)
• Fixed Generic WebHook API Key not working correctly @Ilyesbdlala (Fixed Generic WebHook API Key not working correctly #1673)
• Updated snapshot of typo3scan after upgrade @Ilyesbdlala (Updated snapshot of typo3scan after upgrade #1655)
• Added a check for empty Trivy .Results @Ilyesbdlala (Added a check for empty Trivy .Results #1640)
• Fix the link in ADR-0017 in order to fix the Netlify build @Ilyesbdlala (Fix the link in ADR-0017 in order to fix the Netlify build #1631)
• Includes minio authentication in operator makefile @Ilyesbdlala (fix(minio): includes minio authentication in operator makefile #1577)
• Adds error handling to remote version fetching for the scb-bot @Ilyesbdlala (fix(scb-bot): Adds error handling to remote version fetching #1509)

📚 Documentation

• Add Upgrading Notes for Nuclei Findings @J12934 (Add Upgrading Notes for Nuclei Findings #1502)
• Added/fixed missing scantypes @rseedorff (Maintenance - added/fixed missing scantypes #1628)
• Change ADR-0007 State to DRAFT @Weltraumschaf (#1460 Change ADR-0007 State to DRAFT #1548)
• Enforced the use of the node version in .nvmrc @Ilyesbdlala (Enforced the use of the node version in .nvmrc #1645)
• Fix that ADR 17 Breaks Documentation @Weltraumschaf (Fix that ADR 17 Breaks Documentation #1580)
• One failing matrix job no longer stops other version compare jobs @Ilyesbdlala (maitenance(scb-bot): One failing matrix job no longer stops other version compare jobs #1570)
• Remove codeclimate from contributing docs @Weltraumschaf (Remove codeclimate from contributing docs #1464)
• Removed unnecessary dependencies @Ilyesbdlala (Removed unnecessary dependencies #1690)
• Removed unnecessary intializing of scannerVersions in scanner Dockerfiles @Ilyesbdlala (Removed unnecessary intializing of scannerVersions in scanner Dockerfiles #1625)
• The DRAFT status does not have a link, only the SUPERSEDES does @Weltraumschaf (The DRAFT status does not have a link, only the SUPERSEDES does #1638)
• Multiple minor fixes @rseedorff (Maintenance - multiple minor fixes #1627)

📌 Dependencies

• Bump cacheable-request and @kubernetes/client-node in /hooks/cascading-scans/hook @dependabot (build(deps): bump cacheable-request and @kubernetes/client-node in /hooks/cascading-scans/hook #1593, build(deps): bump cacheable-request and @kubernetes/client-node in /hooks/notification/hook #1594, build(deps): bump cacheable-request and @kubernetes/client-node in /scanners #1595, build(deps): bump cacheable-request and @kubernetes/client-node in /tests/integration #1592)
• Bump github.com/emicklei/go-restful to 2.16.0+incompatible @dependabot (build(deps): bump github.com/emicklei/go-restful from 2.15.0+incompatible to 2.16.0+incompatible in /operator #1584, build(deps): bump github.com/emicklei/go-restful from 2.9.5+incompatible to 2.16.0+incompatible in /auto-discovery/kubernetes #1585, build(deps): bump github.com/emicklei/go-restful from 2.9.5+incompatible to 2.16.0+incompatible in /lurker #1586)
• Bump golang.org/x/crypto to 0.1.0 @dependabot (build(deps): bump golang.org/x/crypto from 0.0.0-20220214200702-86341886e292 to 0.1.0 in /auto-discovery/kubernetes #1620)
• Bump golang.org/x/net 0.7.0 @dependabot (build(deps): bump golang.org/x/net from 0.0.0-20220127200216-cd36cc0744dd to 0.7.0 in /lurker #1618, build(deps): bump golang.org/x/net from 0.0.0-20220412020605-290c469a71a5 to 0.7.0 in /auto-discovery/kubernetes #1621, build(deps): bump golang.org/x/net from 0.0.0-20220516133312-45b265872317 to 0.7.0 in /operator #1619)
• Bump golang.org/x/text 0.3.8 @dependabot (build(deps): bump golang.org/x/text from 0.3.7 to 0.3.8 in /auto-discovery/kubernetes #1609, build(deps): bump golang.org/x/text from 0.3.7 to 0.3.8 in /lurker #1608, build(deps): bump golang.org/x/text from 0.3.7 to 0.3.8 in /operator #1611)
• Bump http-cache-semantics from 4.1.0 to 4.1.1 @dependabot (Bump http-cache-semantics from 4.1.0 to 4.1.1 in /hooks/cascading-scans/hook #1575, Bump http-cache-semantics from 4.1.0 to 4.1.1 in /hooks/notification/hook #1576, Bump http-cache-semantics from 4.1.0 to 4.1.1 in /scanners #1573, Bump http-cache-semantics from 4.1.0 to 4.1.1 in /tests/integration #1574)
• Bump json5 to 2.2.3 @dependabot (Bump json5 from 2.2.0 to 2.2.3 #1531, Bump json5 from 2.2.0 to 2.2.3 in /hooks/finding-post-processing/hook #1533, Bump json5 from 2.2.0 to 2.2.3 in /hooks/generic-webhook/hook #1535, Bump json5 from 2.2.0 to 2.2.3 in /hooks/notification/hook #1534, Bump json5 from 2.2.0 to 2.2.3 in /hooks/persistence-azure-monitor/hook #1536, Bump json5 from 2.2.0 to 2.2.3 in /hooks/persistence-elastic/hook #1537, Bump json5 from 2.2.0 to 2.2.3 in /hooks/update-field-hook/hook #1538, Bump json5 from 2.2.0 to 2.2.3 in /scanners #1532, Bump json5 from 2.2.0 to 2.2.3 in /tests/integration #1530, Bump json5 from 2.2.1 to 2.2.3 in /hooks #1539, Bump json5 from 2.2.1 to 2.2.3 in /hooks/cascading-scans/hook #1540, Bump json5 from 2.2.1 to 2.2.3 in /scanners/ffuf/parser #1543)
• Bump luxon from 2.0.2 to 2.5.2 in /hooks/persistence-elastic/hook @dependabot (Bump luxon from 2.0.2 to 2.5.2 in /hooks/persistence-elastic/hook #1542, Bump xml2js from 0.4.23 to 0.5.0 in /scanners/nmap/parser #1688, Bump xml2js from 0.4.23 to 0.5.0 in /scanners/zap/parser #1686, [Snyk] Security upgrade xml2js from 0.4.23 to 0.5.0 #1682)
• Upgrade @kubernetes/client-node from 0.17.1 to 0.18.1 @snyk-bot ([Snyk] Upgrade @kubernetes/client-node from 0.17.1 to 0.18.0 #1550, [Snyk] Upgrade @kubernetes/client-node from 0.17.1 to 0.18.0 #1529, [Snyk] Upgrade @kubernetes/client-node from 0.17.1 to 0.18.0 #1547, [Snyk] Upgrade @kubernetes/client-node from 0.18.0 to 0.18.1 #1597, [Snyk] Upgrade @kubernetes/client-node from 0.18.0 to 0.18.1 #1589, [Snyk] Upgrade @kubernetes/client-node from 0.18.0 to 0.18.1 #1604)
• Upgrade ajv from 8.11.2 to 8.12.0 @snyk-bot ([Snyk] Upgrade ajv from 8.11.2 to 8.12.0 #1560)
• Upgrade axios from 1.1.2 to 1.3.4 @snyk-bot ([Snyk] Upgrade axios from 1.1.2 to 1.2.0 #1524)
• Upgrade axios from 1.1.2 to 1.2.0 @snyk-bot ([Snyk] Upgrade axios from 1.1.2 to 1.2.0 #1523, [Snyk] Upgrade axios from 1.1.3 to 1.2.0 #1508, [Snyk] Upgrade axios from 1.2.0 to 1.2.2 #1556, [Snyk] Upgrade axios from 1.2.0 to 1.2.2 #1562, [Snyk] Upgrade axios from 1.2.0 to 1.2.2 #1564, [Snyk] Upgrade axios from 1.2.2 to 1.2.3 #1582, [Snyk] Upgrade axios from 1.2.2 to 1.2.3 #1588, [Snyk] Upgrade axios from 1.2.2 to 1.3.0 #1606, [Snyk] Upgrade axios from 1.2.3 to 1.2.5 #1601, [Snyk] Upgrade axios from 1.2.3 to 1.2.5 #1603, [Snyk] Upgrade axios from 1.2.5 to 1.3.1 #1610, [Snyk] Upgrade axios from 1.2.5 to 1.3.3 #1635, [Snyk] Upgrade axios from 1.3.0 to 1.3.2 #1623, [Snyk] Upgrade axios from 1.3.1 to 1.3.2 #1624, [Snyk] Upgrade axios from 1.3.2 to 1.3.3 #1630, [Snyk] Upgrade axios from 1.3.2 to 1.3.3 #1633, [Snyk] Upgrade axios from 1.3.3 to 1.3.4 #1650, [Snyk] Upgrade axios from 1.3.3 to 1.3.4 #1647, [Snyk] Upgrade axios from 1.3.3 to 1.3.4 #1651)
• Upgrade ws from 8.11.0 to 8.13.0 @snyk-bot ([Snyk] Upgrade ws from 8.11.0 to 8.12.0 #1566, [Snyk] Upgrade ws from 8.11.0 to 8.12.0 #1568, [Snyk] Upgrade ws from 8.12.0 to 8.13.0 #1669, [Snyk] Upgrade ws from 8.12.0 to 8.13.0 #1672)
• Upgrading jest to 29.3.1 @Ilyesbdlala (maintenance(jest): Upgrading jest to 29.3.1 #1567)

Distribution

Contributors

Thanks to all our contributors supporting this project 🤗
@Ilyesbdlala, @J12934, @Weltraumschaf, @fphoer, @malexmave, @srburton, @the-simmon and @rseedorff