Starstruk Logo MarkStarstruk

v3.0.1

matrixleons/evilwafv3.0.1Jul 21, 2026by liquidsec

AI Summary

A bug fix release focusing on cloudcheck tag propagation, console output safety, and dependency checks for minimal images, along with updates to scanning tools like nuclei and trufflehog.

Key Highlights

  • Fixed cloudcheck tag propagation to URL children and resolved a crash in `virtualhost.finish()`.
  • Fixed `openssl_dev_headers` dependency check to ensure minimal images install required libraries.
  • Updated `nuclei` to version 3.11.0 and `trufflehog` to version 3.95.9.
  • Parallelized bypass checks up to 100 by default and lowered `neighbor_cidr` default to /28.

New Features

  • Parallelize bypass checks in `finish()` up to 100 by default.
  • Lower `neighbor_cidr` default from /24 to /28 (module + `waf-bypass` preset).

Full Release Notes

### Fixes

- Restore cloudcheck tag propagation to URL / OPEN_TCP_PORT children (#3309). `_minimize()` was wiping `_resolved_hosts` on parent events, starving `dnsresolve` when child events reached it. Cloud tags never made it past the DNS_NAME.
- Fix `virtualhost.finish()` crash when the baseline request returned `None` (#3273).
- Escape control characters in console output so raw bytes in scan data can't garble the terminal (#3274, closes #3258).
- Fix stale `baddns` config key in the `kitchen-sink` preset; adds a test that validates every bundled preset (#3280, closes #3279).
- Fix `openssl_dev_headers` dep check to actually require the header, so minimal images (e.g. `python:3.11-slim`) no longer skip installing `libssl-dev` (#3282, closes #3272).
- Point API-key docs to `secrets.yml` in the sections that still mentioned `bbot.yml` (#3283, closes #3270).

### waf_bypass improvements

- Lower `neighbor_cidr` default from /24 to /28 (module + `waf-bypass` preset).
- Parallelize bypass checks in `finish()` up to 100 by default.
- Distinguish direct vs neighbor bypass candidates in log output.
- Demote non-IP DNS result log from warning to verbose.

### Tooling updates

- Update `nuclei` to 3.11.0 (#3275).
- Update `trufflehog` to 3.95.9 (#3276, #3295).

### Dependency bumps

`beautifulsoup4` 4.14.3→4.15.0, `cachetools` 6.2.6→7.1.4, `cryptography` 46.0.5→48.0.1, `deepdiff` 8.6.1→9.1.0, `dnspython` 2.7.0→2.8.0, `griffe` 1.15.0→2.1.0, `idna` 3.11→3.18, `lxml` 6.0.2→6.1.0, `maturin` 1.13.3→1.14.1, `mike` 2.1.3→2.2.0, `mkdocs-material` 9.7.1→9.7.7, `mkdocstrings` 0.30.1→1.0.6, `mkdocstrings-python` 2.0.2→2.0.5, `pip` 26.0.1→26.1.2, `pre-commit` 4.5.1→4.6.0, `pydantic` 2.12.5→2.13.4, `pymdown-extensions` 10.20.1→11.0.1, `pytest` 8.4.2→9.1.1, `pytest-cov` 7.0.0→7.1.0, `pytest-env` 1.1.5→1.6.0, `pytest-rerunfailures` 16.1→16.4, `regex` 2026.1.15→2026.7.10, `requests` 2.32.5→2.33.0, `ruff` 0.15.18→0.15.22, `soupsieve` 2.8.3→2.8.4, `starlette` 0.52.1→1.3.1, `tornado` 6.5.4→6.5.7, `urllib3` 2.6.3→2.7.0, `websockets` 15.0.1→16.0, `werkzeug` 3.1.5→3.1.8, `xxhash` 3.6.0→3.8.1, `ansible-runner` 2.4.2→2.4.3, plus `actions/cache` v5→v6.

**Full changelog:** https://github.com/blacklanternsecurity/bbot/compare/v3.0.0...v3.0.1