Changes

This release contains the following changes 🎉. Help spread the word or leave a GitHub star if you like it 😉

🚀 Features

• Added MVP for an AWS AutoDiscovery to automatically scan images in AWS ECS @o1oo11oo (#1894, #1936)
• Added support for genorating SBOM for Container Images using new trivy-sbom-image ScanType @o1oo11oo (#1838, #1854)
• Added the dependency-track hook to upload SBOMs to OWASP Dependency-Track @o1oo11oo (#1838, #1854)

🚓 Security Scanner

• Upgraded nuclei from v2.9.14 to v2.9.15 @secureCodeBoxBot (#1967)
• Upgraded semgrep from 1.41.0 to 1.44.0 @secureCodeBoxBot (#2004, #2021)
• Upgraded trivy from 0.45.1 to 0.46.0 @secureCodeBoxBot (#2028)
• Upgraded trivy-sbom from 0.45.0 to 0.46.0 @secureCodeBoxBot (#2012, #2029)
• Upgraded wpscan from v3.8.24 to v3.8.25 @secureCodeBoxBot (#1999)
• Switch ZAP Docker images from OWASP to SSP docker hub repo @o1oo11oo (#2025)
• Upgraded zap from 2.13.0 to 2.14.0 @secureCodeBoxBot (#2022)
• Upgraded zap-advanced from 2.13.0 to 2.14.0 @secureCodeBoxBot (#2023)

⚓️ Hooks

• Add a basic SBOM workflow (closes #1838) @o1oo11oo (#1854)

🐛 Bug Fixes

• Remove interval from required properties as ScheduledScan can be defined by schedule too @Zero3141 (#1994)
• Add missing affinity and tolerations properties to hooks @Zero3141 (#1996)
• Fix path to iteratec logo in main README.md @o1oo11oo (#2027)
• Add missing licenses for SBOM workflow @o1oo11oo (#2011)
• Fix helm unit test templates @o1oo11oo (#2008)
• Fix spdx header @Weltraumschaf (#2005, #2006)

🧪 Test

• Implemented Helm Unit Tests @Ilyesbdlala (#1949)

📚 Documentation

• Move documentation to primary secureCodeBox repository @Zero3141 (#1992)
• Add architecture decision for OpenVAS integration @Zero3141 (#1957)
• Fix example secret keys for S3 api keys @1ovsss (#2036)

🔧 Maintenance

• Update NPM Dependencies @Ilyesbdlala (#2050)
• Recurring documentation maintenance @Ilyesbdlala (#2039)
• Use ZAP Docker images from SSP repo @o1oo11oo (#2025)
• Skip trivy k8 test until we fixed #1982 @Zero3141 (#1995)
• Add SPDX Header License Check To PRs @Zero3141 (#1961)

📌 Dependencies

• Bump @babel/traverse from 7.15.0 to 7.23.2 in /hooks/notification/hook @dependabot (#2038)
• Bump @types/react-helmet from 6.1.6 to 6.1.7 in /documentation @dependabot (#2015)
• Bump eslint from 8.50.0 to 8.51.0 in /documentation @dependabot (#2034)
• Bump golang.org/x/net from 0.7.0 to 0.17.0 in @dependabot (#2018, #2019, #2020, #2056)
• Bump postcss from 8.4.30 to 8.4.31 in /documentation @dependabot (#2009)
• Bump rimraf from 3.0.2 to 5.0.5 in /documentation @dependabot (#2014)
• Bump sass from 1.68.0 to 1.69.3 in /documentation @dependabot (#2013, #2032)
• Bump urllib3 from 1.26.14 to 1.26.18 in /auto-discovery/kubernetes/pull-secret-extractor @dependabot (#2000, #2053)

Distribution

Contributors

Thanks to all our contributors supporting this project 🤗
@1ovsss, @Ilyesbdlala, @Weltraumschaf, @Zero3141, @o1oo11oo and Heiko Kiesel