Changes

This is the first alpha release for secureCodeBox 4.6.0.
If everything goes smoothly the proper 4.6.0 release should follow this soon.

This release contains the following changes 🎉. Help spread the word or leave a GitHub star if you like it 😉

📜 Deprecations

• Deprecated zap and zap-advanced ScanTypes in favor of the now standalone zap-automation-framework ScanType.
  The Zap Automation Framework has now been around for a while and supports all features of the zap advanced tool.
  This drastically reduces the amount of maintenance we have to do to support zap-advanced while allowing users to the official ZAP documentation regarding the ZAP Automation Framework.
  zap and zap-advanced will still be around for future 4.x releases but will be removed with the 5.x release.
  For more information and guidance on how to migrate to the zap-automation-framework see: Migration to ZAP Automation Framework
  @Ilyesbdlala (#2387)
• With 4.6.0, the recommended installation method of the secureCodeBox Helm Charts is by using the OCI registry charts.
  These charts are published to the GitHub Container registry, which will allow us to decommission our self-hosted charts.securecodebox.io registry in the future. With 4.6.0, the installation instructions for all components in the secureCodeBox documentation have been changed to use the OCI helm registry.
  The old charts.securecodebox.io registry will be shut down at the end of the year.
  All remaining 4.x releases will be published to both the old and new registry.
  Users are advised to migrate to the OCI helm charts right away.
  For more information and guidance on how to migrate see Blog Post: Migrating our Helm Charts to OCI registries
  @Ilyesbdlala & @J12934 (#2108, #2541, #2543)

🚀 Features

• Added an experimental Command Line Client scbctl. Currently, the scbctl supports easily starting a new scan via a single command. @Freedisch (#2514)
• Added new standalone zap-automation-framework scan. See the related point in the deprecations section. @Ilyesbdlala (#2387)

🚓 Security Scanner

• Upgraded gitleaks from v8.18.2 to v8.18.4 @secureCodeBoxBot (#2522, #2502)
• Upgraded nuclei from v3.1.10 to v3.2.9 @secureCodeBoxBot (#2526, #2497, #2477, #2472, #2425, #2378, #2367)
• Upgraded semgrep from 1.65.0 to 1.77.0 @secureCodeBoxBot (#2537, #2529, #2506, #2496, #2488, #2482, #2474, #2470, #2453, #2424, #2408, #2405, #2400, #2388)
• Upgraded trivy from 0.49.1 to 0.52.2 @secureCodeBoxBot (#2518, #2510, #2469, #2464, #2406, #2385)
• Upgraded zap from 2.14.0 to 2.15.0 @secureCodeBoxBot (#2481)
• Changed ZAP Documentation from OWASP to Software Security Project @Reet00 (#2447)
• Upgraded nmap from 7.93-r1 to 7.95-r0 @J12934 (#2544)

🐛 Bug Fixes

• Fixed mapping of Trivy ScanTypes to DefectDojo to use native DefectDojo Trivy imports for findings @Ilyesbdlala (#2390)

🧪 Test

• Slightly refactored scbctl code setup to avoid issues with flags during testing @J12934 (#2533)
• Moved helpers.js to tests/integration @Ilyesbdlala (#2452)

📚 Documentation

• Changed ZAP documentation from OWASP to Software Security Project @Reet00 (#2447)
• Replaced Helm install instructions to use our OCI-based Helm Charts @J12934 (#2541)
• Added blog post from Łukasz Mieczkowski @Weltraumschaf (#2467)
• Added an old talk from Sven held at VKSI @Weltraumschaf (#2519)
• Added interview w/ RadioTux @Weltraumschaf (#2473)
• Removed mega outdated screenshot @Weltraumschaf (#2458)
• Minor documentation enhancements @tbrixen (#2399)
• Added an overview picture of our contributors to the README @Weltraumschaf (#2418)
• Fixed some links @Weltraumschaf (#2468)

🔧 Maintenance

• Upgraded to latest Kubebuilder (v4) and Go (1.22) @J12934 (#2542)
• Upgraded Node.js versions to 22 @J12934 (#2539)
• Dependabot bundles PRs @Ilyesbdlala (#2448)
• Fixed Kubernetes client-java being upgraded to legacy version @Ilyesbdlala (#2456)
• Pinned setup-envtest version @Ilyesbdlala (#2401)
• Removed ESLint and related packages as dependencies @Ilyesbdlala (#2454)

📌 Dependencies

Distribution

Contributors

Thanks to all our contributors supporting this project 🤗
@Freedisch, @Ilyesbdlala, @J12934, @Reet00, @Weltraumschaf and @tbrixen