Starstruk Logo MarkStarstruk

v3.0.1

Tencent-Hunyuan/HY-Motion-1.0v3.0.1Jul 21, 2026by liquidsec

AI Summary

This release focuses on critical bug fixes, specifically addressing DNS resolution failures and improving WAF bypass performance, while also updating core dependencies and tools.

Key Highlights

  • Fixed Cloudcheck tag propagation to restore DNS resolution functionality that was previously broken by a `_minimize()` bug
  • Improved WAF bypass performance with parallel checks and lowered CIDR defaults
  • Ensured minimal Docker images work correctly by fixing OpenSSL dependency checks
  • Updated core tools (Nuclei and TruffleHog) to their latest versions

New Features

  • Parallelized WAF bypass checks (up to 100 concurrent)
  • Lowered default neighbor CIDR mask to /28 for WAF bypass
  • Enhanced log output to distinguish direct vs neighbor bypass candidates

Full Release Notes

### Fixes

- Restore cloudcheck tag propagation to URL / OPEN_TCP_PORT children (#3309). `_minimize()` was wiping `_resolved_hosts` on parent events, starving `dnsresolve` when child events reached it. Cloud tags never made it past the DNS_NAME.
- Fix `virtualhost.finish()` crash when the baseline request returned `None` (#3273).
- Escape control characters in console output so raw bytes in scan data can't garble the terminal (#3274, closes #3258).
- Fix stale `baddns` config key in the `kitchen-sink` preset; adds a test that validates every bundled preset (#3280, closes #3279).
- Fix `openssl_dev_headers` dep check to actually require the header, so minimal images (e.g. `python:3.11-slim`) no longer skip installing `libssl-dev` (#3282, closes #3272).
- Point API-key docs to `secrets.yml` in the sections that still mentioned `bbot.yml` (#3283, closes #3270).

### waf_bypass improvements

- Lower `neighbor_cidr` default from /24 to /28 (module + `waf-bypass` preset).
- Parallelize bypass checks in `finish()` up to 100 by default.
- Distinguish direct vs neighbor bypass candidates in log output.
- Demote non-IP DNS result log from warning to verbose.

### Tooling updates

- Update `nuclei` to 3.11.0 (#3275).
- Update `trufflehog` to 3.95.9 (#3276, #3295).

### Dependency bumps

`beautifulsoup4` 4.14.3→4.15.0, `cachetools` 6.2.6→7.1.4, `cryptography` 46.0.5→48.0.1, `deepdiff` 8.6.1→9.1.0, `dnspython` 2.7.0→2.8.0, `griffe` 1.15.0→2.1.0, `idna` 3.11→3.18, `lxml` 6.0.2→6.1.0, `maturin` 1.13.3→1.14.1, `mike` 2.1.3→2.2.0, `mkdocs-material` 9.7.1→9.7.7, `mkdocstrings` 0.30.1→1.0.6, `mkdocstrings-python` 2.0.2→2.0.5, `pip` 26.0.1→26.1.2, `pre-commit` 4.5.1→4.6.0, `pydantic` 2.12.5→2.13.4, `pymdown-extensions` 10.20.1→11.0.1, `pytest` 8.4.2→9.1.1, `pytest-cov` 7.0.0→7.1.0, `pytest-env` 1.1.5→1.6.0, `pytest-rerunfailures` 16.1→16.4, `regex` 2026.1.15→2026.7.10, `requests` 2.32.5→2.33.0, `ruff` 0.15.18→0.15.22, `soupsieve` 2.8.3→2.8.4, `starlette` 0.52.1→1.3.1, `tornado` 6.5.4→6.5.7, `urllib3` 2.6.3→2.7.0, `websockets` 15.0.1→16.0, `werkzeug` 3.1.5→3.1.8, `xxhash` 3.6.0→3.8.1, `ansible-runner` 2.4.2→2.4.3, plus `actions/cache` v5→v6.

**Full changelog:** https://github.com/blacklanternsecurity/bbot/compare/v3.0.0...v3.0.1