Starstruk Logo MarkStarstruk

v3.0.1

tursodatabase/tursov3.0.1Jul 21, 2026by liquidsec

AI Summary

This release focuses on stability and security tooling updates. It fixes critical crashes in virtualhost handling and cloudcheck tag propagation, while also updating the underlying WAF bypass and security scanning tools (Nuclei, TruffleHog).

Key Highlights

  • Fixed virtualhost.finish() crash when baseline request is None
  • Fixed cloudcheck tag propagation to URL children
  • WAF bypass improvements including lowered neighbor CIDR default and parallelization
  • Updated Nuclei to 3.11.0 and TruffleHog to 3.95.9

New Features

  • Lowered default neighbor CIDR from /24 to /28
  • Parallelized bypass checks in finish() up to 100
  • Tooling updates: Nuclei and TruffleHog updated
  • Dependency updates for various security and utility libraries

Full Release Notes

### Fixes

- Restore cloudcheck tag propagation to URL / OPEN_TCP_PORT children (#3309). `_minimize()` was wiping `_resolved_hosts` on parent events, starving `dnsresolve` when child events reached it. Cloud tags never made it past the DNS_NAME.
- Fix `virtualhost.finish()` crash when the baseline request returned `None` (#3273).
- Escape control characters in console output so raw bytes in scan data can't garble the terminal (#3274, closes #3258).
- Fix stale `baddns` config key in the `kitchen-sink` preset; adds a test that validates every bundled preset (#3280, closes #3279).
- Fix `openssl_dev_headers` dep check to actually require the header, so minimal images (e.g. `python:3.11-slim`) no longer skip installing `libssl-dev` (#3282, closes #3272).
- Point API-key docs to `secrets.yml` in the sections that still mentioned `bbot.yml` (#3283, closes #3270).

### waf_bypass improvements

- Lower `neighbor_cidr` default from /24 to /28 (module + `waf-bypass` preset).
- Parallelize bypass checks in `finish()` up to 100 by default.
- Distinguish direct vs neighbor bypass candidates in log output.
- Demote non-IP DNS result log from warning to verbose.

### Tooling updates

- Update `nuclei` to 3.11.0 (#3275).
- Update `trufflehog` to 3.95.9 (#3276, #3295).

### Dependency bumps

`beautifulsoup4` 4.14.3→4.15.0, `cachetools` 6.2.6→7.1.4, `cryptography` 46.0.5→48.0.1, `deepdiff` 8.6.1→9.1.0, `dnspython` 2.7.0→2.8.0, `griffe` 1.15.0→2.1.0, `idna` 3.11→3.18, `lxml` 6.0.2→6.1.0, `maturin` 1.13.3→1.14.1, `mike` 2.1.3→2.2.0, `mkdocs-material` 9.7.1→9.7.7, `mkdocstrings` 0.30.1→1.0.6, `mkdocstrings-python` 2.0.2→2.0.5, `pip` 26.0.1→26.1.2, `pre-commit` 4.5.1→4.6.0, `pydantic` 2.12.5→2.13.4, `pymdown-extensions` 10.20.1→11.0.1, `pytest` 8.4.2→9.1.1, `pytest-cov` 7.0.0→7.1.0, `pytest-env` 1.1.5→1.6.0, `pytest-rerunfailures` 16.1→16.4, `regex` 2026.1.15→2026.7.10, `requests` 2.32.5→2.33.0, `ruff` 0.15.18→0.15.22, `soupsieve` 2.8.3→2.8.4, `starlette` 0.52.1→1.3.1, `tornado` 6.5.4→6.5.7, `urllib3` 2.6.3→2.7.0, `websockets` 15.0.1→16.0, `werkzeug` 3.1.5→3.1.8, `xxhash` 3.6.0→3.8.1, `ansible-runner` 2.4.2→2.4.3, plus `actions/cache` v5→v6.

**Full changelog:** https://github.com/blacklanternsecurity/bbot/compare/v3.0.0...v3.0.1