Changes

This release contains the following changes 🎉. Help spread the word or leave a GitHub star if you like it 😉

🚀 Features

• Added MVP for an AWS AutoDiscovery to automatically scan images in AWS ECS @o1oo11oo (Cloud AutoDiscovery MVP #1894, Add MVP of AWS AutoDiscovery #1936)
• Added support for generatoring SBOM for Container Images using new trivy-sbom ScanType @o1oo11oo (Generate SBOMs #1838, Add a basic SBOM workflow (closes #1838) #1854)

🚓 Security Scanner

• Upgraded nuclei from v2.9.14 to v2.9.15 @secureCodeBoxBot ([SCB-Bot] Upgraded nuclei from v2.9.14 to v2.9.15 #1967)
• Upgraded semgrep from 1.41.0 to 1.44.0 @secureCodeBoxBot ([SCB-Bot] Upgraded semgrep from 1.41.0 to 1.43.0 #2004, [SCB-Bot] Upgraded semgrep from 1.43.0 to 1.44.0 #2021)
• Upgraded trivy from 0.45.1 to 0.46.0 @secureCodeBoxBot ([SCB-Bot] Upgraded trivy from 0.45.1 to 0.46.0 #2028)
• Upgraded trivy-sbom from 0.45.0 to 0.46.0 @secureCodeBoxBot ([SCB-Bot] Upgraded trivy-sbom from 0.45.0 to 0.45.1 #2012, [SCB-Bot] Upgraded trivy-sbom from 0.45.1 to 0.46.0 #2029)
• Upgraded wpscan from v3.8.24 to v3.8.25 @secureCodeBoxBot ([SCB-Bot] Upgraded wpscan from v3.8.24 to v3.8.25 #1999)
• Switch ZAP Docker images from OWASP to SSP docker hub repo @o1oo11oo (Use ZAP Docker images from SSP repo #2025)
• Upgraded zap from 2.13.0 to 2.14.0 @secureCodeBoxBot ([SCB-Bot] Upgraded zap from 2.13.0 to 2.14.0 #2022)
• Upgraded zap-advanced from 2.13.0 to 2.14.0 @secureCodeBoxBot ([SCB-Bot] Upgraded zap-advanced from 2.13.0 to 2.14.0 #2023)

⚓️ Hooks

• Add a basic SBOM workflow (closes Generate SBOMs #1838) @o1oo11oo (Add a basic SBOM workflow (closes #1838) #1854)

🐛 Bug Fixes

• Remove interval from required properties as ScheduledScan can be defined by schedule too @Zero3141 (Remove 'interval' from required properties as ScheduledScan can be defined by 'schedule' too #1994)
• Add missing affinity and tolerations properties to hooks @Zero3141 (Add missing affinity and tolerations properties to hooks #1996)
• Fix path to iteratec logo in main README.md @o1oo11oo (Fix path to iteratec logo in main README.md #2027)
• Add missing licenses for SBOM workflow @o1oo11oo (Add missing licenses for SBOM workflow #2011)
• Fix helm unit test templates @o1oo11oo (Fix helm unit test templates #2008)
• Fix spdx header @Weltraumschaf (Build Pipeline Fails Due to Bad SPDX Tags #2005, 2005 fix spdx header #2006)

🧪 Test

• Implemented Helm Unit Tests @Ilyesbdlala (Implemented Helm Unit Tests  #1949)

📚 Documentation

• Move documentation to primary secureCodeBox repository @Zero3141 (Delete old files from documentation repository for Monorepo #1992)
• Add architecture decision for OpenVAS integration @Zero3141 (Add architecture decision for OpenVAS integration #1957)
• Fix example secret keys for S3 api keys @1ovsss (fix secret example in values.yaml #2036)

🔧 Maintenance

• Update NPM Dependencies @Ilyesbdlala (npm audit fix #2050)
• Recurring documentation maintenance @Ilyesbdlala (Recurring documentation maintenance #2039)
• Use ZAP Docker images from SSP repo @o1oo11oo (Use ZAP Docker images from SSP repo #2025)
• Skip trivy k8 test until we fixed Trivy K8s Scans fail due to parser (wrapper) issues #1982 @Zero3141 (Skip trivy k8 test until we fixed #1982 #1995)
• Add SPDX Header License Check To PRs @Zero3141 (Add SPDX Header License Check To PRs #1961)

📌 Dependencies

• Bump @babel/traverse from 7.15.0 to 7.23.2 in /hooks/notification/hook @dependabot (Bump @babel/traverse from 7.15.0 to 7.23.2 in /hooks/notification/hook #2038)
• Bump @types/react-helmet from 6.1.6 to 6.1.7 in /documentation @dependabot (Bump @types/react-helmet from 6.1.6 to 6.1.7 in /documentation #2015)
• Bump eslint from 8.50.0 to 8.51.0 in /documentation @dependabot (Bump eslint from 8.50.0 to 8.51.0 in /documentation #2034)
• Bump golang.org/x/net from 0.7.0 to 0.17.0 in @dependabot (Bump golang.org/x/net from 0.7.0 to 0.17.0 in /auto-discovery/kubernetes #2018, Bump golang.org/x/net from 0.7.0 to 0.17.0 in /lurker #2019, Bump golang.org/x/net from 0.7.0 to 0.17.0 in /operator #2020, Bump golang.org/x/net from 0.15.0 to 0.17.0 in /auto-discovery/cloud-aws #2056)
• Bump postcss from 8.4.30 to 8.4.31 in /documentation @dependabot (Bump postcss from 8.4.30 to 8.4.31 in /documentation #2009)
• Bump rimraf from 3.0.2 to 5.0.5 in /documentation @dependabot (Bump rimraf from 3.0.2 to 5.0.5 in /documentation #2014)
• Bump sass from 1.68.0 to 1.69.3 in /documentation @dependabot (Bump sass from 1.68.0 to 1.69.0 in /documentation #2013, Bump sass from 1.69.0 to 1.69.3 in /documentation #2032)
• Bump urllib3 from 1.26.14 to 1.26.18 in /auto-discovery/kubernetes/pull-secret-extractor @dependabot (Bump urllib3 from 1.26.14 to 1.26.17 in /auto-discovery/kubernetes/pull-secret-extractor #2000, Bump urllib3 from 1.26.17 to 1.26.18 in /auto-discovery/kubernetes/pull-secret-extractor #2053)

Distribution

Contributors

Thanks to all our contributors supporting this project 🤗
@1ovsss, @Ilyesbdlala, @Weltraumschaf, @Zero3141, @o1oo11oo and Heiko Kiesel