Starstruk Logo MarkStarstruk

v3.0.1

blacklanternsecurity/bbotv3.0.1Jul 21, 2026by liquidsec

AI Summary

This release addresses critical stability issues such as DNS resolution failures and crashes in virtualhost handling while improving WAF bypass detection performance. It also includes updates to core tools like Nuclei and TruffleHog, alongside a significant number of dependency upgrades.

Key Highlights

  • Fixed critical DNS resolution and cloudcheck tag propagation issues.
  • Improved WAF bypass detection with parallelization and refined logging.
  • Updated core tools including Nuclei and TruffleHog to their latest versions.
  • Enhanced security and performance through numerous dependency updates.
  • Fixed console output safety to prevent garbling from raw bytes.

New Features

  • Parallelized WAF bypass checks (up to 100 checks by default).
  • Updated Nuclei to version 3.11.0.
  • Updated TruffleHog to version 3.95.9.
  • Lowered `neighbor_cidr` default to /28 for WAF bypass.

Full Release Notes

### Fixes

- Restore cloudcheck tag propagation to URL / OPEN_TCP_PORT children (#3309). `_minimize()` was wiping `_resolved_hosts` on parent events, starving `dnsresolve` when child events reached it. Cloud tags never made it past the DNS_NAME.
- Fix `virtualhost.finish()` crash when the baseline request returned `None` (#3273).
- Escape control characters in console output so raw bytes in scan data can't garble the terminal (#3274, closes #3258).
- Fix stale `baddns` config key in the `kitchen-sink` preset; adds a test that validates every bundled preset (#3280, closes #3279).
- Fix `openssl_dev_headers` dep check to actually require the header, so minimal images (e.g. `python:3.11-slim`) no longer skip installing `libssl-dev` (#3282, closes #3272).
- Point API-key docs to `secrets.yml` in the sections that still mentioned `bbot.yml` (#3283, closes #3270).

### waf_bypass improvements

- Lower `neighbor_cidr` default from /24 to /28 (module + `waf-bypass` preset).
- Parallelize bypass checks in `finish()` up to 100 by default.
- Distinguish direct vs neighbor bypass candidates in log output.
- Demote non-IP DNS result log from warning to verbose.

### Tooling updates

- Update `nuclei` to 3.11.0 (#3275).
- Update `trufflehog` to 3.95.9 (#3276, #3295).

### Dependency bumps

`beautifulsoup4` 4.14.3→4.15.0, `cachetools` 6.2.6→7.1.4, `cryptography` 46.0.5→48.0.1, `deepdiff` 8.6.1→9.1.0, `dnspython` 2.7.0→2.8.0, `griffe` 1.15.0→2.1.0, `idna` 3.11→3.18, `lxml` 6.0.2→6.1.0, `maturin` 1.13.3→1.14.1, `mike` 2.1.3→2.2.0, `mkdocs-material` 9.7.1→9.7.7, `mkdocstrings` 0.30.1→1.0.6, `mkdocstrings-python` 2.0.2→2.0.5, `pip` 26.0.1→26.1.2, `pre-commit` 4.5.1→4.6.0, `pydantic` 2.12.5→2.13.4, `pymdown-extensions` 10.20.1→11.0.1, `pytest` 8.4.2→9.1.1, `pytest-cov` 7.0.0→7.1.0, `pytest-env` 1.1.5→1.6.0, `pytest-rerunfailures` 16.1→16.4, `regex` 2026.1.15→2026.7.10, `requests` 2.32.5→2.33.0, `ruff` 0.15.18→0.15.22, `soupsieve` 2.8.3→2.8.4, `starlette` 0.52.1→1.3.1, `tornado` 6.5.4→6.5.7, `urllib3` 2.6.3→2.7.0, `websockets` 15.0.1→16.0, `werkzeug` 3.1.5→3.1.8, `xxhash` 3.6.0→3.8.1, `ansible-runner` 2.4.2→2.4.3, plus `actions/cache` v5→v6.

**Full changelog:** https://github.com/blacklanternsecurity/bbot/compare/v3.0.0...v3.0.1