What's Changed
Security Fixes
- JS: Respect
allow-local-file-accessinrequireby @dwisiswant0 (#7332) - Expressions: Only evaluate template-authored expressions by @dwisiswant0 (#7221)(#7321)
Bug Fixes
- HTTP: Respect
annotationsinunsafemode by @dwisiswant0 (#7044) - HTTP: Isolate project cache keys by scheme & host by @dwisiswant0 (#7043)
- Expressions: Propagate unresolved variable markers through encoding functions by @dogancanbakir (#7033)
- SDK: Respect
WithOptionsrate limit by @dwisiswant0 (#7342) - Fuzz: Prevent path mutation across sequential
Rebuildcalls by @promisingcoder (#7253) - Fuzz: Use actual parameter for frequency deduplication by @Godzilla675 (#7037)
- Fuzz: Fix concurrent map writes in multipart form parsing by @Mzack9999 (#7291)
- Fuzz: Propagate custom headers to
time_delayanalyzer follow-up requests by @usernametooshort (#7125) - JS: Fix watchdog and propagate context to all JS library network calls by @Mzack9999 (#7299)
- JS: Interrupt goja runtime on context cancel by @mikhail5555 (#7343)
- WebSocket: Fix path handling when merging template & target URLs by @Mzack9999 (#7290)
- Runner: Stop spawning template goroutines in host-spray when host is unresponsive by @usernametooshort (#7129)
- Input: Optimize
removeTargetsto prevent hang on large exclusions by @JawsKim (#6760) - Installer: Prevent unnecessary update checks by @dahezhiquan (#7337)
- Utils: Normalize unbracketed IPv6 literals for probing by @dwisiswant0 (#7045)
- Client pool: Replace global variable with local scoping by @mikhail5555 (#7294)
- Fix
InFlightmap race condition viaSnapshotmethod by @n3integration (#7026) - Fix race condition in
Dynamic.Fetchand always prefetch secrets by @hussain-alsaibai (#6976) - Fix nil interface set in
createEphemeralObjectsto prevent panic by @maxwolf8852 (#6944) - Fix DAST skipping URLs with
part: requestandmode: multipleby @dogancanbakir (#7326) - Fix headless JS loading with
-tlsiandaddheader/setheaderby @dogancanbakir (#7325) - Fix flow execution with auth by @Mzack9999 (#7298)
- Fix redirect handling by @Mzack9999 (#7286)
- Fix Elastic export by @Mzack9999 (#7287)
- Use
crypto/randinstead ofmath/randin JS global functions by @sandiyochristan (#7215)
New Features
- Fuzz: Add XSS reflection context analyzer by @ZachL111 (#7164)
- Reporting: Add PDF export option for scan results by @Gengyscan (#7254)
- Network templates: Support service names in port field by @dogancanbakir (#7303)
- Add honeypot detection to reduce scan noise by @HarshadaGawas05 (#7277)
- Add inline targets and secrets to template profiles by @SaurabhCodesAI (#6858)
Performance & Improvements
- Runner: Fast path for tag listing by @dwisiswant0 (#7143)
- Runner: Use
Printinstead forlistAvailableStoreTagsby @dwisiswant0 (#7145) - Resume state: Refactored as cache data by @dwisiswant0 (#7042)
- Capture stderr output by @Mzack9999 (#7292)
Tests & CI
- Add fuzz tests by @dwisiswant0 (#7311)
- Add request condition tests for multi-raw-request flow templates by @Mzack9999 (#7300)
- Refactor native tests by @dwisiswant0 (#7307)
- Add
GITHUB_TOKENto workflows for authenticated template updates by @dwisiswant0 (#7119) - Integrate typos spell checker into CI by @telewin95 (#7158)
Documentation
- Update outdated documentation links across all translations by @Pitrat-wav (#7020)
New Contributors
- @usernametooshort made their first contribution in #7129
- @Pitrat-wav made their first contribution in #7020
- @n3integration made their first contribution in #7026
- @JawsKim made their first contribution in #6760
- @sandiyochristan made their first contribution in #7215
- @telewin95 made their first contribution in #7158
- @Gengyscan made their first contribution in #7254
- @hussain-alsaibai made their first contribution in #6976
- @promisingcoder made their first contribution in #7253
- @Godzilla675 made their first contribution in #7037
- @SaurabhCodesAI made their first contribution in #6858
- @ZachL111 made their first contribution in #7164
- @HarshadaGawas05 made their first contribution in #7277
- @mikelolasagasti made their first contribution in #7282
- @maxwolf8852 made their first contribution in #6944
- @mikhail5555 made their first contribution in #7294
- @dahezhiquan made their first contribution in #7337
Full Changelog: v3.7.1...v3.8.0