ZAP Updates for September:
The AJAX Spider and DOM XSS add-ons have now been fully retired from ZAP's nightly and weekly releases, and Phase 1 of the new Global Scan Policy Manager has landed behind a dev-mode flag.
zaproxy.org/blog/2026-10-0…#zaproxy#appsec
The latest weekly release does not include the AJAX Spider and DOM XSS add-ons.
You can install them via the Marketplace as usual, but we recommend you using the Client Spider and OWASP PTK add-ons instead.
For more details see zaproxy.org/blog/2026-09-0…#zaproxy#appsec
ZAP updates for August.
We’re removing 2 add-ons from the nightly and weekly releases, so if you use those then make sure you read it to understand the implications.
zaproxy.org/blog/2026-09-0…#zaproxy#appsec