Starstruk Logo MarkStarstruk

v3.0.2

blacklanternsecurity/bbotv3.0.2Aug 24, 2026by liquidsec

AI Summary

bbot v3.0.2 introduces a new JavaScript audit preset, updates core dependencies like blasthttp and trufflehog, and parallelizes the test suite. The release also includes fixes for Docker registry interactions and YARA rule matching.

Key Highlights

  • Bumped blasthttp to 0.10.0, surfacing decode errors on HTTP_RESPONSE events and fixing redirect cookie handling.
  • Added a new `js-audit` preset for trufflehog that includes source URLs in findings.
  • Parallelized the test suite using pytest-xdist for improved test execution speed.
  • Fixed a crash in `docker_pull` when encountering failed registry requests.
  • Increased process pool `max_tasks_per_child` from 25 to 250 to handle larger workloads.

New Features

  • New `js-audit` preset for JavaScript auditing.
  • Enhanced HTTP response handling in blasthttp.
  • Parallel test execution.

Full Release Notes

# Release 3.0.2

## Highlights

- blasthttp bumped to 0.10.0 (#3385). `Response.decode_error` is surfaced on `HTTP_RESPONSE` events and tagged `decode-error`, so an undecoded body is never treated as content. `redirect_cookies` now passes through `WebHelper.request()`.
- New `js-audit` preset (`bbot/presets/web/js-audit.yml`). trufflehog streams HTTP bodies via stdin and includes the source URL on findings; its `_module_threads` is bumped to 2.
- Test suite parallelized with pytest-xdist (#3353).
- Fix: custom YARA rules matching but emitting nothing (#3374).
- Fix: `docker_pull` crash on a failed registry request.
- Reinstall module deps when they're missing from the environment (#3338). Adds `packaging` as a runtime dependency.
- Raise process pool `max_tasks_per_child` from 25 to 250 (#3375).
- CI: pass benchmark refs through env and quote them (#3354).
- nuclei 3.11.0 to 3.11.1 (#3367); trufflehog 3.95.9 to 3.97.0 (#3376).

## Maintenance

- Dependabot bumps across the uv and github-actions groups: xxhash 4.0.0, ruff 0.16.2, pre-commit 4.6.2, fastapi 0.141.1, uvicorn 0.52.1, lxml 6.1.1, pip 26.2.1, packaging 26.3, tldextract 5.3.2, websockets 16.1.1, mmh3 5.2.1, orjson 3.11.9, regex 2026.7.19, cachetools 7.1.7, pytest-env 1.7.0, pytest-httpserver 1.1.5, actions/setup-python 7.