wpscanteam/wpscan v4.2.0

on GitHub

What's Changed

Added

• --max-response-size MiB caps how much of any response is read (default 16 MiB, 0 disables), guarding against memory exhaustion on targets serving huge or endless responses by @gnuletik in #2091

Changed

• Responses larger than 16 MiB are now truncated by default. Use --max-response-size 0 to restore the previous unbounded behavior. by @gnuletik in #2091
• SARIF now reports aborted runs as unsuccessful, with the abort reason in toolExecutionNotifications. Consumers will show an aborted scan as a failed analysis instead of a clean run with zero alerts. The CLI exit code is unchanged. by @derekxmartin in #2094

Fixed

• Scan no longer aborts with "long too big to dump" when a response is too large to cache by @gnuletik in #2090
• JSON output no longer crashes when the WP JSON API returns users without a slug by @gnuletik in #2093
• SARIF includes parent-theme advisories by @derekxmartin in #2095

Maintenance

• Docker image now built on ruby:4.0.9-alpine (Alpine 3.24), and Dependabot tracks the base image by @Initsogar in #2101
• CLI integration tests also run with a free API token by @ArSn in #2081
• Dependency bumps: rubocop, simplecov, webmock

New Contributors

• @gnuletik made their first contribution in #2093
• @derekxmartin made their first contribution in #2094

Full Changelog: v4.1.0...v4.2.0