v4.6.0-alpha.1 #2548

J12934 · 2024-06-28T13:21:28Z

J12934
Jun 28, 2024
Maintainer

Changes

This is the first alpha release for secureCodeBox 4.6.0.
If everything goes smoothly the proper 4.6.0 release should follow this soon.

This release contains the following changes 🎉. Help spread the word or leave a GitHub star if you like it 😉

📜 Deprecations

Deprecated zap and zap-advanced ScanTypes in favor of the now standalone zap-automation-framework ScanType.
The Zap Automation Framework has now been around for a while and supports all features of the zap advanced tool.
This drastically reduces the amount of maintenance we have to do to support zap-advanced while allowing users to the official ZAP documentation regarding the ZAP Automation Framework.
zap and zap-advanced will still be around for future 4.x releases but will be removed with the 5.x release.
For more information and guidance on how to migrate to the zap-automation-framework see: Migration to ZAP Automation Framework
@Ilyesbdlala (Migrate to ZAP Automation Framework #2387)
With 4.6.0, the recommended installation method of the secureCodeBox Helm Charts is by using the OCI registry charts.
These charts are published to the GitHub Container registry, which will allow us to decommission our self-hosted charts.securecodebox.io registry in the future. With 4.6.0, the installation instructions for all components in the secureCodeBox documentation have been changed to use the OCI helm registry.
The old charts.securecodebox.io registry will be shut down at the end of the year.
All remaining 4.x releases will be published to both the old and new registry.
Users are advised to migrate to the OCI helm charts right away.
For more information and guidance on how to migrate see Blog Post: Migrating our Helm Charts to OCI registries
@Ilyesbdlala & @J12934 (Added GitHub Actions workflow for releasing Helm charts to GHCR #2108, Replace Helm Install Instructions to use our OCI Based Helm Charts #2541, Fix Missed Instructions Still Using the old Helm Registry #2543)

🚀 Features

Added an experimental Command Line Client scbctl. Currently, the scbctl supports easily starting a new scan via a single command. @Freedisch (Feature: Add New Command Line Client scbctl #2514)
Added new standalone zap-automation-framework scan. See the related point in the deprecations section. @Ilyesbdlala (Migrate to ZAP Automation Framework #2387)

🚓 Security Scanner

Upgraded gitleaks from v8.18.2 to v8.18.4 @secureCodeBoxBot ([SCB-Bot] Upgraded gitleaks from v8.18.3 to v8.18.4 #2522, [SCB-Bot] Upgraded gitleaks from v8.18.2 to v8.18.3 #2502)
Upgraded nuclei from v3.1.10 to v3.2.9 @secureCodeBoxBot ([SCB-Bot] Upgraded nuclei from v3.2.8 to v3.2.9 #2526, [SCB-Bot] Upgraded nuclei from v3.2.6 to v3.2.8 #2497, [SCB-Bot] Upgraded nuclei from v3.2.5 to v3.2.6 #2477, [SCB-Bot] Upgraded nuclei from v3.2.4 to v3.2.5 #2472, [SCB-Bot] Upgraded nuclei from v3.2.2 to v3.2.4 #2425, [SCB-Bot] Upgraded nuclei from v3.2.1 to v3.2.2 #2378, [SCB-Bot] Upgraded nuclei from v3.1.10 to v3.2.1 #2367)
Upgraded semgrep from 1.65.0 to 1.77.0 @secureCodeBoxBot ([SCB-Bot] Upgraded semgrep from 1.76.0 to 1.77.0 #2537, [SCB-Bot] Upgraded semgrep from 1.75.0 to 1.76.0 #2529, [SCB-Bot] Upgraded semgrep from 1.74.0 to 1.75.0 #2506, [SCB-Bot] Upgraded semgrep from 1.73.0 to 1.74.0 #2496, [SCB-Bot] Upgraded semgrep from 1.72.0 to 1.73.0 #2488, [SCB-Bot] Upgraded semgrep from 1.71.0 to 1.72.0 #2482, [SCB-Bot] Upgraded semgrep from 1.70.0 to 1.71.0 #2474, [SCB-Bot] Upgraded semgrep from 1.69.0 to 1.70.0 #2470, [SCB-Bot] Upgraded semgrep from 1.68.0 to 1.69.0 #2453, [SCB-Bot] Upgraded semgrep from 1.67.0 to 1.68.0 #2424, [SCB-Bot] Upgraded semgrep from 1.66.2 to 1.67.0 #2408, [SCB-Bot] Upgraded semgrep from 1.66.1 to 1.66.2 #2405, [SCB-Bot] Upgraded semgrep from 1.66.0 to 1.66.1 #2400, [SCB-Bot] Upgraded semgrep from 1.65.0 to 1.66.0 #2388)
Upgraded trivy from 0.49.1 to 0.52.2 @secureCodeBoxBot ([SCB-Bot] Upgraded trivy from 0.52.1 to 0.52.2 #2518, [SCB-Bot] Upgraded trivy from 0.50.4 to 0.52.1 #2510, [SCB-Bot] Upgraded trivy from 0.50.2 to 0.50.4 #2469, [SCB-Bot] Upgraded trivy from 0.50.1 to 0.50.2 #2464, [SCB-Bot] Upgraded trivy from 0.50.0 to 0.50.1 #2406, [SCB-Bot] Upgraded trivy from 0.49.1 to 0.50.0 #2385)
Upgraded zap from 2.14.0 to 2.15.0 @secureCodeBoxBot ([SCB-Bot] Upgraded zap from 2.14.0 to 2.15.0 #2481)
Changed ZAP Documentation from OWASP to Software Security Project @Reet00 (Changed ZAP Documentation from OWASP to Software Security Project #2447)
Upgraded nmap from 7.93-r1 to 7.95-r0 @J12934 (Update to nmap 7.95-r0 #2544)

🐛 Bug Fixes

Fixed mapping of Trivy ScanTypes to DefectDojo to use native DefectDojo Trivy imports for findings @Ilyesbdlala (Fixes mapping of Trivy Scantypes to Defectfdojo #2390)