v4.5.2 Changelog
-
Features or Enhancements
- Updated Android certificate analysis with apksigner from build-tools 37.0.0 and apktool 3.x support for more robust, version-agnostic cert parsing
- Added high-confidence known secret format detection in Android/iOS string analysis (GitHub, Slack, Stripe, OpenAI, PEM keys, and more)
- Migrated VirusTotal integration to API v3 with large-file upload support (up to 650MB)
- CI/Docker supply-chain hardening: SBOM attestations, Actions updates, Postgres 18 compose layout, and PyPI publishing via OIDC Trusted Publishing
-
Bug Fixes
- Fixed CSRF "null origin" error during SAML SSO login (e.g. Keycloak)
- Fixed formatting in
SKIP_CLASS_PATHlist - Fixed Android rule to match the literal mode argument in
getSharedPreferences
What's Changed
- Update: certificate analysis (apksigner) by @AdrienHutinel in #2630
- fix csrf error by @Antiksec in #2633
- Fix formatting in SKIP_CLASS_PATH list by @Zen1th53 in #2634
- fix(rules): match the literal mode argument in getSharedPreferences by @Eljees in #2638
- ci: bump docker workflow actions and add SBOM attestations by @kobihikri in #2639
- Detect known secret formats in Android/iOS string analysis by @mmmugh in #2640
- ci/docker: supply-chain Actions updates and Postgres 18 compose layout by @ajinabraham in #2643
- Migrate VirusTotal integration to API v3 by @ajinabraham in #2644
- chore: bump Python dependencies by @ajinabraham in #2645
- ci: publish to PyPI with OIDC Trusted Publishing by @ajinabraham in #2646
New Contributors
- @AdrienHutinel made their first contribution in #2630
- @Zen1th53 made their first contribution in #2634
- @Eljees made their first contribution in #2638
- @kobihikri made their first contribution in #2639
- @mmmugh made their first contribution in #2640
Full Changelog: v4.5.1...v4.5.2