Changes

This release contains the following changes 🎉. Help spread the word or leave a GitHub star if you like it 😉

📜 Deprecations

• Deprecated zap and zap-advanced ScanTypes in favor of the now standalone zap-automation-framework ScanType.
  The Zap Automation Framework has now been around for a while and supports all features of the zap advanced tool.
  This drastically reduces the amount of maintenance we have to do to support zap-advanced while allowing users to the official ZAP documentation regarding the ZAP Automation Framework.
  zap and zap-advanced will still be around for future 4.x releases but will be removed with the 5.x release.
  For more information and guidance on how to migrate to the zap-automation-framework see: Migration to ZAP Automation Framework
  @Ilyesbdlala (Migrate to ZAP Automation Framework #2387)
• With 4.6.0, the recommended installation method of the secureCodeBox Helm Charts is by using the OCI registry charts.
  These charts are published to the GitHub Container registry, which will allow us to decommission our self-hosted charts.securecodebox.io registry in the future. With 4.6.0, the installation instructions for all components in the secureCodeBox documentation have been changed to use the OCI helm registry.
  The old charts.securecodebox.io registry will be shut down at the end of the year.
  All remaining 4.x releases will be published to both the old and new registry.
  Users are advised to migrate to the OCI helm charts right away.
  For more information and guidance on how to migrate see Blog Post: Migrating our Helm Charts to OCI registries
  @Ilyesbdlala & @J12934 (Added GitHub Actions workflow for releasing Helm charts to GHCR #2108, Replace Helm Install Instructions to use our OCI Based Helm Charts #2541, Fix Missed Instructions Still Using the old Helm Registry #2543)

🚀 Features

• Added an experimental Command Line Client scbctl. Currently, the scbctl supports easily starting a new scan via a single command. Right now the cli is still experimental but will be extended upon in future releases. Documentation and instructions on how to install & use it coming up soon. (https://github.com/secureCodeBox/secureCodeBox/tree/main/scbctl) @Freedisch (Feature: Add New Command Line Client scbctl #2514)
• Added new standalone zap-automation-framework scan. See the related point in the deprecations section. @Ilyesbdlala (Migrate to ZAP Automation Framework #2387)

🚓 Security Scanner

• Upgraded gitleaks from v8.18.2 to v8.18.4 @secureCodeBoxBot ([SCB-Bot] Upgraded gitleaks from v8.18.3 to v8.18.4 #2522, [SCB-Bot] Upgraded gitleaks from v8.18.2 to v8.18.3 #2502)
• Upgraded nuclei from v3.1.10 to v3.2.9 @secureCodeBoxBot ([SCB-Bot] Upgraded nuclei from v3.2.8 to v3.2.9 #2526, [SCB-Bot] Upgraded nuclei from v3.2.6 to v3.2.8 #2497, [SCB-Bot] Upgraded nuclei from v3.2.5 to v3.2.6 #2477, [SCB-Bot] Upgraded nuclei from v3.2.4 to v3.2.5 #2472, [SCB-Bot] Upgraded nuclei from v3.2.2 to v3.2.4 #2425, [SCB-Bot] Upgraded nuclei from v3.2.1 to v3.2.2 #2378, [SCB-Bot] Upgraded nuclei from v3.1.10 to v3.2.1 #2367)
• Upgraded semgrep from 1.65.0 to 1.77.0 @secureCodeBoxBot ([SCB-Bot] Upgraded semgrep from 1.76.0 to 1.77.0 #2537, [SCB-Bot] Upgraded semgrep from 1.75.0 to 1.76.0 #2529, [SCB-Bot] Upgraded semgrep from 1.74.0 to 1.75.0 #2506, [SCB-Bot] Upgraded semgrep from 1.73.0 to 1.74.0 #2496, [SCB-Bot] Upgraded semgrep from 1.72.0 to 1.73.0 #2488, [SCB-Bot] Upgraded semgrep from 1.71.0 to 1.72.0 #2482, [SCB-Bot] Upgraded semgrep from 1.70.0 to 1.71.0 #2474, [SCB-Bot] Upgraded semgrep from 1.69.0 to 1.70.0 #2470, [SCB-Bot] Upgraded semgrep from 1.68.0 to 1.69.0 #2453, [SCB-Bot] Upgraded semgrep from 1.67.0 to 1.68.0 #2424, [SCB-Bot] Upgraded semgrep from 1.66.2 to 1.67.0 #2408, [SCB-Bot] Upgraded semgrep from 1.66.1 to 1.66.2 #2405, [SCB-Bot] Upgraded semgrep from 1.66.0 to 1.66.1 #2400, [SCB-Bot] Upgraded semgrep from 1.65.0 to 1.66.0 #2388)
• Upgraded trivy from 0.49.1 to 0.52.2 @secureCodeBoxBot ([SCB-Bot] Upgraded trivy from 0.52.1 to 0.52.2 #2518, [SCB-Bot] Upgraded trivy from 0.50.4 to 0.52.1 #2510, [SCB-Bot] Upgraded trivy from 0.50.2 to 0.50.4 #2469, [SCB-Bot] Upgraded trivy from 0.50.1 to 0.50.2 #2464, [SCB-Bot] Upgraded trivy from 0.50.0 to 0.50.1 #2406, [SCB-Bot] Upgraded trivy from 0.49.1 to 0.50.0 #2385)
• Upgraded zap from 2.14.0 to 2.15.0 @secureCodeBoxBot ([SCB-Bot] Upgraded zap from 2.14.0 to 2.15.0 #2481)
• Changed ZAP Documentation from OWASP to Software Security Project @Reet00 (Changed ZAP Documentation from OWASP to Software Security Project #2447)
• Upgraded nmap from 7.93-r1 to 7.95-r0 @J12934 (Update to nmap 7.95-r0 #2544)

🐛 Bug Fixes

• Fixed mapping of Trivy ScanTypes to DefectDojo to use native DefectDojo Trivy imports for findings @Ilyesbdlala (Fixes mapping of Trivy Scantypes to Defectfdojo #2390)

🧪 Test

• Slightly refactored scbctl code setup to avoid issues with flags during testing @J12934 (Slighly Refactor scbctl Code Setup To Avoid Issues With Flags During Testing #2533)
• Moved helpers.js to tests/integration @Ilyesbdlala (Moved helpers.js to tests/integration #2452)

📚 Documentation

• Changed ZAP documentation from OWASP to Software Security Project @Reet00 (Changed ZAP Documentation from OWASP to Software Security Project #2447)
• Replaced Helm install instructions to use our OCI-based Helm Charts @J12934 (Replace Helm Install Instructions to use our OCI Based Helm Charts #2541)
• Added blog post from Łukasz Mieczkowski @Weltraumschaf (Add Post from Łukasz Mieczkowski #2467)
• Added an old talk from Sven held at VKSI @Weltraumschaf (Add an Old Talk I Gave at VKSI #2519)
• Added interview w/ RadioTux @Weltraumschaf (Add Interview w/ RadioTux #2473)
• Removed mega outdated screenshot @Weltraumschaf (Remove Ultra Mega Outdated Screenshot #2458)
• Minor documentation enhancements @tbrixen (Minor documentation enhancements #2399)
• Added an overview picture of our contributors to the README @Weltraumschaf (Add Our Awesome Contributors #2418)
• Fixed some links @Weltraumschaf (Fix the Markdown Links #2468)

🔧 Maintenance

• Upgraded to latest Kubebuilder (v4) and Go (1.22) @J12934 (Update to latest Kubebuilder (v4) and Go (1.22) #2542)
• Upgraded Node.js versions to 22 @J12934 (Upgrade Node.js Versions to 22 #2539)
• Dependabot bundles PRs @Ilyesbdlala (Dependabot bundles PRs #2448)
• Fixed Kubernetes client-java being upgraded to legacy version @Ilyesbdlala (Fix kubernetes client-java being upgraded to legacy version #2456)
• Pinned setup-envtest version @Ilyesbdlala (Pinned setup-envtest version #2401)
• Removed ESLint and related packages as dependencies @Ilyesbdlala (Removed ESLint and related packages as dependencies #2454)

📌 Dependencies

Distribution

Contributors

Thanks to all our contributors supporting this project 🤗
@Freedisch, @Ilyesbdlala, @J12934, @Reet00, @Weltraumschaf and @tbrixen