Stable release. The package surface has been stable for a long time; 1.0.0 makes that explicit.

⚠ BREAKING CHANGES

• voice: silenceTailBytes removed from ElevenLabsAgentAdapterOptions — no longer needed after the ElevenLabs SDK migration; remove from any adapter config.
• voice: ELEVENLABS_CONVAI_URL_TEMPLATE constant removed from public exports — construct the URL directly or read it from the SDK.
• voice: .url getter removed from public exports.

Features

• graduate to 1.0.0 (6379130)
• 1.0 release prep, stable classifiers and unstuck langwatch pins (#842) (616c506)

Code Refactoring

• voice: #707 follow-up cleanup bundle (#716) (e018d76)

Stable release. The package surface has been stable for a long time; 1.0.0 makes that explicit. The langwatch dependency floor moves to >=1.0.0,<2 (older caps resolved a June 2025 langwatch on every install).

Features

• graduate to 1.0.0 (24feea2)
• 1.0 release prep, stable classifiers and unstuck langwatch pins (#842) (616c506)

Bug Fixes

• judge: protect unbounded judge transcript for non-litellm agents (#837) (6604334)
• voice: bring recv_audio's keepalive hard-ceiling to Python (JS parity) (#832) (d61027c)

Code Refactoring

• voice: #707 follow-up cleanup bundle (#716) (e018d76)

• [INS-355] Added Hashicorp vault token detector by @MuneebUllahKhan222 in #4819
• Tighten JiraToken v1 verification by @shahzadhaider1 in #5122
• [INT-718] Add TargetNotFoundError for targeted scan targets missing from the source by @bill-rich in #5123
• Fix GitLab project metadata cache and switch to LRU by @kashifkhan0771 in #4727
• Log analyze errors for Anthropic Analyzer by @kashifkhan0771 in #5120
• Add metrics for chunks and results by @mcastorina in #5128
• Update Cloudflare detectors for 2026+ prefixed credential formats (include upstream PR changes) by @kashifkhan0771 in #5111
• [INS-312] Duo API Secret Key Detector by @MuneebUllahKhan222 in #4771
• [Feature] Added SonarQube Cloud "Scoped Organization Token" Detector by @nabeelalam in #4739
• [INS-255] Updated datadog detector to set verificationError in case of a verification error by @MuneebUllahKhan222 in #4661
• Log analyze errors for Postgres analyzer by @kashifkhan0771 in #5131
• Log analyze errors for HuggingFace analyzer by @kashifkhan0771 in #5130
• Engine - Config.SourceManager doc by @amanfcp in #5002
• Update module github.com/go-git/go-git/v5 to v5.19.1 [SECURITY] by @renovate[bot] in #5034
• Retry git clone on transient network errors by @shahzadhaider1 in #5132
• Fix scan_all_installations Rejecting Org Member Personal Repos by @shahzadhaider1 in #5142
• updated detector to include underscore char by @mattbrady-1 in #5121
• [chore] Change job_id in metric to source_type by @mcastorina in #5149
• Posthog regex update by @mattbrady-1 in #5133
• fix(handlers): apk handler now doesnt check for apk extension since json-enumerator and other byte stream methods wouldnt have it by @johannestaas-trufflesec in #5151

New Contributors

• @mattbrady-1 made their first contribution in #5121

Full Changelog: v3.95.9...v3.96.0

• [NDB PERMISSION_DENIED error] Fix trusty stacktrace on ANDROID_EMULATOR by @IvanBM18 in #5375
• Fix engine fuzzers blobstore downloads by @dylanjew in #5386

Full Changelog: v2.35.4...v2.35.5

• Gracefully handle invalid ghost fuzzer configurations by @dylanjew in #5380
• [Adroid v4 API] Add Android Build API V4 REST client and tests by @IvanBM18 in #5370

Full Changelog: v2.35.2...v2.35.3

• symbolizer: Fix args for the default symbolizer by @g-ortuno in #5379

Full Changelog: v2.35.3...v2.35.4

• Remove .exe on targets before appending .runtime_deps by @notvictorl in #5372
• symbolizer: Temporarily increase llvm-symbolizer cache size on macOS by @g-ortuno in #5374

Full Changelog: v2.35.1...v2.35.2

New shutdown procedure

Tails now uses the standard shutdown procedure from GNOME.

The standard shutdown procedure is a bit slower, but better prevents data loss.

For example, the Power Off confirmation dialog informs you if an application needs to be closed or an open document needs to be saved before shutting down.

Even without confirming or saving the open documents, Tails will shut down after 60 seconds.

You can still use the faster emergency shutdown as before.

Celluloid video player

We replaced GNOME Videos with Celluloid, a more modern and reliable video player.

Changes and updates

• Update Tor Browser to 15.0.19.

• Update some firmware packages. This improves support for newer hardware: graphics, Wi-Fi, and so on.

For more details, read our changelog.

Get Tails 7.10

To upgrade your Tails USB stick and keep your Persistent Storage

• Automatic upgrades are available from Tails 7.0 or later to 7.10.

• If you cannot do an automatic upgrade or if Tails fails to start after an automatic upgrade, please try to do a manual upgrade.

To install Tails 7.10 on a new USB stick

Follow our installation instructions.

To download only

If you don't need installation or upgrade instructions, you can download Tails 7.10 directly:

• For USB sticks (USB image)

• For DVDs and virtual machines (ISO image)

### Added

• Added support for the OpenTofu .tofu file extension. Because OpenTofu uses the same HCL grammar as Terraform, .tofu files are now automatically detected and scanned as Terraform, so they are picked up by recursive scans and Terraform rulesets (e.g. p/terraform) with no extra configuration. (ENGINE-2884)

### Changed

• The window for collecting git contributor information during semgrep ci has been extended from the last 30 days to the last 90 days, to match the updated usage policy. (contributor-window-90-days)

### Fixed

• Fixed a source of rare, nondeterministic crashes and incorrect results caused
  by an OCaml compiler bug. Semgrep now builds against a compiler fork that
  backports the upstream fix. (ocaml_codegen_fix)
• Fixed excessive heap growth after explicit major garbage collections. Semgrep
  now builds against an OCaml compiler that improves garbage collection duty
  cycle pacing. (ocaml_gc_pacing_fix)
• Improved the Scan Status output when no code rules will run (e.g. a
  Secrets-only or Supply-Chain-only scan). The summary line no longer reports a
  confusing "0 Code rules", and the "Code Rules" section now states explicitly
  either that code scanning is not enabled or that there are no code rules to run,
  instead of printing an empty table. (ENGINE-2878)
• Fixed lockfileless Gradle dependency resolution failing with "Parsing
  dependency output failed (Resolve_gradle.gradle_resolved_dependency)". The
  github-dependency-graph-gradle-plugin used during resolution was fetched
  unpinned, and its 1.4.2 release renamed keys in its JSON output. The plugin is
  now pinned to 1.4.1. (sc-3738)

Changes and updates

• Update Tor Browser to 15.0.9, which fixes several vulnerabilities in Firefox 140.9.0.

  We are not aware of these vulnerabilities being exploited in practice.

• Update the Tor client to 0.4.9.6.

• Update Thunderbird to 140.9.0.

• Update some firmware packages. This improves support for newer hardware: graphics, Wi-Fi, and so on.

For more details, read our changelog.

Get Tails 7.6.1

To upgrade your Tails USB stick and keep your Persistent Storage

• Automatic upgrades are available from Tails 7.0 or later to 7.6.1.

• If you cannot do an automatic upgrade or if Tails fails to start after an automatic upgrade, please try to do a manual upgrade.

To install Tails 7.6.1 on a new USB stick

Follow our installation instructions:

• Install from Windows

• Install from macOS

• Install from Linux

• Install from Debian or Ubuntu using the command line and GnuPG

To download only

If you don't need installation or upgrade instructions, you can download Tails 7.6.1 directly:

• For USB sticks (USB image)

• For DVDs and virtual machines (ISO image)

Changes and updates

• Update Flatpak to 1.16.6, which fixes CVE-2026-34078, a major sandbox escape vulnerability. Using this vulnerability, an attacker could break the security confinement of Tor Browser and access all files that don't require an administration password, including in the Persistent Storage.

  This vulnerability can only be exploited by a powerful attacker who has already exploited another vulnerability to take control of Tor Browser.

For more details, read our changelog.

Get Tails 7.6.2

To upgrade your Tails USB stick and keep your Persistent Storage

• Automatic upgrades are available from Tails 7.0 or later to 7.6.2.

• If you cannot do an automatic upgrade or if Tails fails to start after an automatic upgrade, please try to do a manual upgrade.

To install Tails 7.6.2 on a new USB stick

Follow our installation instructions.

To download only

If you don't need installation or upgrade instructions, you can download Tails 7.6.2 directly:

• For USB sticks (USB image)

• For DVDs and virtual machines (ISO image)

Detection of outdated Secure Boot certificates

Since 2023, Microsoft has started replacing the Secure Boot certificates originally issued in 2011. These older certificates begin expiring in June 2026.

Tails now notifies you if the computer that you are using has outdated Secure Boot certificates and needs an update.

Changes and updates

• Update Tor Browser to 15.0.10.

• Update Thunderbird to 140.9.1.

Fixed problems

• Make the /root folder only readable by the root user. (#21514)

For more details, read our changelog.

Get Tails 7.7

To upgrade your Tails USB stick and keep your Persistent Storage

• Automatic upgrades are available from Tails 7.0 or later to 7.7.

• If you cannot do an automatic upgrade or if Tails fails to start after an automatic upgrade, please try to do a manual upgrade.

To install Tails 7.7 on a new USB stick

Follow our installation instructions.

To download only

If you don't need installation or upgrade instructions, you can download Tails 7.7 directly:

• For USB sticks (USB image)

• For DVDs and virtual machines (ISO image)

Changes and updates

• Update Tor Browser to 15.0.11, which fixes several vulnerabilities in Firefox 140.10.1.

  We are not aware of these vulnerabilities being exploited in practice until now.

• Update Thunderbird to 140.10.0.

• Stop making it possible to start our ISO images from a USB stick.

  Since 2019, we recommend USB images to start Tails from a USB stick, which is by far the most common way of running Tails.

  We still distribute ISO images to start Tails from a DVD or in a virtual machine. Until now, these ISO images worked on USB sticks as well, but provided a degraded experience without automatic upgrades or Persistent Storage.

  Our ISO images no longer work on USB sticks to save a few megabytes and prevent confusion for people who use USB sticks.

For more details, read our changelog.

Get Tails 7.7.1

To upgrade your Tails USB stick and keep your Persistent Storage

• Automatic upgrades are available from Tails 7.0 or later to 7.7.1.

• If you cannot do an automatic upgrade or if Tails fails to start after an automatic upgrade, please try to do a manual upgrade.

To install Tails 7.7.1 on a new USB stick

Follow our installation instructions.

To download only

If you don't need installation or upgrade instructions, you can download Tails 7.7.1 directly:

• For USB sticks (USB image)

• For DVDs and virtual machines (ISO image)

Changes and updates

• Update the Linux kernel to 6.12.85, which fixes Copy Fail, a vulnerability that could allow an application in Tails to gain administration privileges.

  For example, if an attacker was able to exploit other unknown security vulnerabilities in an application included in Tails, they might then use Copy Fail to take full control of your Tails and deanonymize you.

  We are not aware of this vulnerability being used in practice until now.

Fixed problems

For more details, read our changelog.

Get Tails 7.7.2

To upgrade your Tails USB stick and keep your Persistent Storage

• Automatic upgrades are available from Tails 7.0 or later to 7.7.2.

• If you cannot do an automatic upgrade or if Tails fails to start after an automatic upgrade, please try to do a manual upgrade.

To install Tails 7.7.2 on a new USB stick

Follow our installation instructions.

To download only

If you don't need installation or upgrade instructions, you can download Tails 7.7.2 directly:

• For USB sticks (USB image)

• For DVDs and virtual machines (ISO image)

Changes and updates

• Update the Linux kernel to 6.12.86, which fixes Dirty Frag, a vulnerability that could allow an application in Tails to gain administration privileges.

  For example, if an attacker was able to exploit other unknown security vulnerabilities in an application included in Tails, they might then use Dirty Frag to take full control of your Tails and deanonymize you.

  We are not aware of this vulnerability being used in practice until now.

• Update Tor Browser to 15.0.12.

• Update the Tor client to 0.4.9.8.

• Update Thunderbird to 140.10.1.

Fixed problems

For more details, read our changelog.

Get Tails 7.7.3

To upgrade your Tails USB stick and keep your Persistent Storage

• Automatic upgrades are available from Tails 7.0 or later to 7.7.3.

• If you cannot do an automatic upgrade or if Tails fails to start after an automatic upgrade, please try to do a manual upgrade.

To install Tails 7.7.3 on a new USB stick

Follow our installation instructions.

To download only

If you don't need installation or upgrade instructions, you can download Tails 7.7.3 directly:

• For USB sticks (USB image)

• For DVDs and virtual machines (ISO image)

• Update Tor Browser to 15.0.14.

• Remove Thunderbird.

  You can still install Thunderbird as additional software.

  If you have both the Thunderbird Email Client and Additional Software features of the Persistent Storage turned on, Tails automatically adds Thunderbird to your list of additional software.

  A new version of Thunderbird is released in Debian shortly after each Tails release, because both Tails and Thunderbird follow the release calendar of Firefox. As a consequence, until Tails 7.5 (February 2026), the version of Thunderbird in Tails was almost always outdated, with known security vulnerabilities.

  By installing Thunderbird as additional software, the latest version of Thunderbird is installed automatically from your Persistent Storage each time you start Tails.

Fixed problems

• Fix multiple security vulnerabilities in the Linux kernel and haveged, that could allow an application in Tails to gain administration privileges.

  For example, if an attacker was able to exploit other unknown security vulnerabilities in an application included in Tails, they might then use one of these vulnerabilities to take full control of your Tails and deanonymize you.

For more details, read our changelog.

Get Tails 7.8

To upgrade your Tails USB stick and keep your Persistent Storage

• Automatic upgrades are available from Tails 7.0 or later to 7.8.

• If you cannot do an automatic upgrade or if Tails fails to start after an automatic upgrade, please try to do a manual upgrade.

To install Tails 7.8 on a new USB stick

Follow our installation instructions:

• Install from Windows

• Install from macOS

• Install from Linux

• Install from Debian or Ubuntu using the command line and GnuPG

To download only

If you don't need installation or upgrade instructions, you can download Tails 7.8 directly:

• For USB sticks (USB image)

• For DVDs and virtual machines (ISO image)

Changes and updates

• Update the Tor client to 0.4.9.9, which fixes several security vulnerabilities.

• Update the Linux kernel to 6.12.90-2, which fixes CVE-2026-43503, a vulnerability that could allow an application in Tails to gain administration privileges.

  For example, if an attacker was able to exploit other unknown security vulnerabilities in an application included in Tails, they might then use this vulnerability to take full control of your Tails and deanonymize you.

  This attack is very unlikely, but could be performed by a strong attacker, such as a government or a hacking firm. We are not aware of this vulnerability being used in practice until now.

Fixed problems

• Fix a fingerprinting issue in the Unsafe Browser. (#21617)

Get Tails 7.8.1

To upgrade your Tails USB stick and keep your Persistent Storage

• Automatic upgrades are available from Tails 7.0 or later to 7.8.1.

• If you cannot do an automatic upgrade or if Tails fails to start after an automatic upgrade, please try to do a manual upgrade.

To install Tails 7.8.1 on a new USB stick

Follow our installation instructions.

To download only

If you don't need installation or upgrade instructions, you can download Tails 7.8.1 directly:

• For USB sticks (USB image)

• For DVDs and virtual machines (ISO image)

• Update Tor Browser to 15.0.16.

• Update some firmware packages. This improves support for newer hardware: graphics, Wi-Fi, and so on.

Fixed problems

• Stop notifying about outdated Secure Boot certificates in rare cases where the certificates are already up to date. (#21643)

For more details, read our changelog.

Get Tails 7.9

To upgrade your Tails USB stick and keep your Persistent Storage

• Automatic upgrades are available from Tails 7.0 or later to 7.9.

• If you cannot do an automatic upgrade or if Tails fails to start after an automatic upgrade, please try to do a manual upgrade.

To install Tails 7.9 on a new USB stick

Follow our installation instructions.

To download only

If you don't need installation or upgrade instructions, you can download Tails 7.9 directly:

• For USB sticks (USB image)

• For DVDs and virtual machines (ISO image)

• Update Tor Browser to 15.0.17.

• Update the Tor client to 0.4.9.11.

• Update the Linux kernel to 6.12.94, which fixes CVE-2026-43503 (DirtyClone) and CVE-2026-46331 (PACKET_EDIT_MEME), vulnerabilities that could allow an application in Tails to gain administration privileges.

  For example, if an attacker was able to exploit other unknown security vulnerabilities in an application included in Tails, they might then use CVE-2026-46331 to take full control of your Tails and deanonymize you.

  This attack is unlikely, but could be performed by a strong attacker, such as a government or a hacking firm. We are not aware of this vulnerability being used in practice until now.

Fixed problems

For more details, read our changelog.

Get Tails 7.9.1

To upgrade your Tails USB stick and keep your Persistent Storage

• Automatic upgrades are available from Tails 7.0 or later to 7.9.1.

• If you cannot do an automatic upgrade or if Tails fails to start after an automatic upgrade, please try to do a manual upgrade.

To install Tails 7.9.1 on a new USB stick

Follow our installation instructions.

To download only

If you don't need installation or upgrade instructions, you can download Tails 7.9.1 directly:

• For USB sticks (USB image)

• For DVDs and virtual machines (ISO image)

• Type GitHub release metadata by @JamieMagee in #15597
• Make GitCommitChecker strongly typed by @JamieMagee in #15598
• Retry corepack prepare and install on signature metadata errors from private registries by @kbukum1 in #15606
• Fix UV DependencyGrapher to detect nested uv.lock in monorepos by @thavaahariharangit with @Copilot in #15520
• Bump library/rust from 1.95.0-bookworm to 1.97.0-bookworm in /cargo by @dependabot[bot] in #15560
• Bump @sigstore/core from 3.1.0 to 3.2.1 in /npm_and_yarn/helpers by @dependabot[bot] in #15455
• Bump maven from 3.9.14 to 3.9.16 in /maven by @dependabot[bot] in #15127
• Support Bundler source cooldown in Dependabot cooldown flow by @robaiken in #15517
• Type shared release metadata by @JamieMagee in #15607
• Make Job strongly typed by @JamieMagee in #15608
• Type Job wire models by @JamieMagee in #15610
• Type Service and ApiClient by @JamieMagee in #15614
• Add support for calendar-based versions for Maven and Gradle by @yeikel in #14114
• Type error reporting by @JamieMagee in #15615
• Type updater dependency helpers by @JamieMagee in #15617
• ensure proper formatting when patching element attributes by @brettfo in #15629
• Bump ws from 8.18.3 to 8.21.1 in /npm_and_yarn/helpers/test/npm/fixtures/vulnerability-auditor/update-needed-across-two-versions by @dependabot[bot] in #15329
• Bump lodash from 4.17.23 to 4.18.1 in /bun/helpers/test/yarn/fixtures/conflicting-dependency-parser/deeply-nested by @dependabot[bot] in #14608
• Bump lodash from 4.17.23 to 4.18.1 in /npm_and_yarn/helpers/test/yarn/fixtures/conflicting-dependency-parser/deeply-nested by @dependabot[bot] in #14609
• Bump lodash from 4.17.23 to 4.18.1 in /npm_and_yarn/helpers/test/npm6/fixtures/conflicting-dependency-parser/deeply-nested by @dependabot[bot] in #14610
• Bump the dev-dependencies group across 1 directory with 2 updates by @dependabot[bot] in #14694
• Bump pip from 26.1.1 to 26.1.2 in /python/helpers in the pip group across 1 directory by @dependabot[bot] in #11830
• Bump yaml from 2.3.1 to 2.9.0 in /bun/helpers by @dependabot[bot] in #14535
• npm_and_yarn: group vulnerability auditor blocking-dependency messages by top-level ancestor by @thavaahariharangit in #15627
• Bump ip-address and socks in /bun/helpers by @dependabot[bot] in #14924
• Bump brace-expansion from 1.1.13 to 1.1.16 in /bun/helpers/test/yarn/fixtures/conflicting-dependency-parser/deeply-nested by @dependabot[bot] in #15634
• Bump brace-expansion from 1.1.13 to 1.1.16 in /npm_and_yarn/helpers/test/yarn/fixtures/conflicting-dependency-parser/deeply-nested by @dependabot[bot] in #15633
• Bump sigstore/cosign/cosign from v3.1.1 to v3.1.2 in /docker in the regclient group across 1 directory by @dependabot[bot] in #15621
• Bump lodash from 4.17.23 to 4.18.1 in /bun/helpers/test/npm6/fixtures/conflicting-dependency-parser/deeply-nested by @dependabot[bot] in #14606
• Bump @tootallnate/once from 2.0.0 to 2.0.1 in /bun/helpers by @dependabot[bot] in #15107
• Bump the "uv-ecosystem" group with 1 update across multiple ecosystems by @dependabot[bot] in #14969
• Bump ip-address and socks in /npm_and_yarn/helpers by @dependabot[bot] in #14923
• Bump yaml from 2.3.1 to 2.9.0 in /npm_and_yarn/helpers by @dependabot[bot] in #14533
• Bump golang.org/x/mod from 0.37.0 to 0.38.0 in /go_modules/helpers by @dependabot[bot] in #15559
• Bump @sigstore/verify from 3.1.0 to 3.1.1 in /npm_and_yarn/helpers by @dependabot[bot] in #15477
• julia: don't propose compat updates for workspace packages or synthesize member compat entries by @IanButterworth in #15643
• fix: guard against unparseable versions in cooldown fallback by @currantw in #15632
• Type dependency requirement readers by @JamieMagee in #15646
• v0.388.0 by @dependabot-core-action-automation[bot] in #15623

New Contributors

• @currantw made their first contribution in #15632

Full Changelog: v0.387.0...v0.388.0

Added

• SNI scanner (Scanner → SNI Scanner). Finds SNI/front hosts that work on your network via real TLS handshakes. Domain mode tests a list of candidate domains as SNI on :443; Range mode tests one SNI across an IPv4 CIDR range (bounded). Working hosts can be applied as your custom SNI hosts (used by fronted webtunnel/meek/snowflake bridges) or saved to the library. Green = handshake completed (usable), red = blocked/reset.
• Saved-bridges library (Scanner → Saved). Bridges from the bridge scanner and hosts from the SNI scanner can be saved to a persistent library, then labelled, re-applied or removed later - scan results are no longer lost when the scan finishes. Both scanners gained a Save to Library action.
• Current Bridge tab: per-row copy + sortable columns (#69). Each bridge row has a one-tap copy button, and the Type / Address / Status headers sort on click (click again to reverse); the bridge currently in use stays pinned to the top.
• Bridge copy/export refinement (#56). Copy on the Current Bridge tab now returns only the bridge Tor is actually using (not the whole supplemented list), and Export writes a CSV with Type, Address, Status, Fingerprint and the raw line.
• CLI scan <type> --use. After probing, the reachable bridges are saved as your custom list and selected as the source, so the next connect uses exactly those - the command-line equivalent of the GUI scanner's Apply button.

Fixed

• Custom bridge source ignored under Smart Connect (#70). Smart Connect (on by default) reset the source to Auto and dropped your custom bridge list while racing its own transports, so a pasted obfs4 bridge could end up connecting via a webtunnel bridge you never added. Smart Connect now honors an explicit Custom source and uses exactly those bridges.

Thanks to @Airuop for the scanner and bridge-tab suggestions.

Downloads

Not sure which Mac you have? Apple menu > About This Mac. "Apple M1/M2/M3/M4" means Apple Silicon (arm64); anything listing an Intel processor needs the x64 build.

Fixed

• SNI scanner never found a working host. Every probe failed with an internal .NET SslStream error (the certificate-validation callback was set in two places at once), so results always came back "blocked" and the scanner looked like it did nothing. It now completes TLS handshakes and reports reachable SNI hosts correctly.
• SNI scanner status messages are now localized ("Ready.", "Scanning…", "Enter at least one domain to test.", etc.) instead of always showing in English.

Added

• The saved-bridges library now shows a Ping column - the latency measured when each entry was saved.

Downloads

Added

• Bridge scanner: "Load bridges" — fetches the selected category/transport list into the input without scanning, so you can review or edit the list first, then scan (a two-step flow like BridgeHop's).
• "Import file" on both the bridge scanner and the SNI scanner — load bridge lines / candidate domains from a .txt/.csv file.
• Saved-bridges library: ping badge — each saved entry's latency now shows as a green (or amber, when slow) "✔ ms" badge instead of a plain number.

Downloads

Added

• SNI scanner: "Load candidates" - one click fills the box with a built-in starter list of common CDN/front domains (Cloudflare, Fastly, Google, Microsoft, Apple, jsDelivr, Wikipedia, and more), so you have something to scan without needing to know which domains to try. Then press Start Scan; the green rows are the SNI hosts that work on your network. You can still edit the list, import your own, or paste more.

Note

macOS builds are back - v3.6.2's Mac assets were held up by a pending Apple developer agreement, now resolved. This release ships the complete set for all platforms.

Downloads

Fixed

• Snowflake starting again on censored networks (#71). Snowflake was failing to start with "Managed proxy ... terminated with status code 2" and the connection bar stuck, whenever the AMP-cache rendezvous was enabled. The AMP cache was being passed as a -ampcache command-line flag, which the bundled Snowflake binary (lyrebird) rejects, so it exited immediately. It is now set as an ampcache= parameter on the Snowflake bridge line, which lyrebird reads. This mainly affected networks where Smart Connect forces Snowflake AMP (for example Iran).

Added

• SNI scanner compact layout. The SNI scanner now matches the bridge scanner: a "Custom list" toggle keeps the candidate-domain box collapsed until you turn it on or load, import, or request a list, so the controls take less room.
• Request SNI (per-country lists). Working SNI hosts are country-specific, so the SNI scanner gained a "Request SNI" button that fetches a candidate list for your country from the OnionHop SNI-lists source and loads it for scanning. A country picker appears when the source is reachable.
• Export Working. The SNI scanner can now save the working SNI hosts to a text file.
• About page release links. Each release in the changelog history now has a "View on GitHub" link that opens that release's page, and the sources section lists the new OnionHop SNI Lists source.

Downloads

Added

• Copy button in the saved library. Each entry in Scanner > Saved now has a "Copy" button next to Apply and Delete. It copies just that bridge line or SNI host to the clipboard, so you can paste it into the bridge scanner or SNI scanner and rescan it directly. Previously you had to Apply an entry and copy it from another tab before you could rescan it.

Downloads

Fixed

• Bridge scanner verifies webtunnel for real. The scanner now confirms a webtunnel bridge with an actual handshake (a WebSocket upgrade to the bridge's own endpoint, which must return 101) instead of only checking that its CDN front answered on 443. A dead webtunnel bridge whose front is still up is now correctly shown as unreachable, so a scanned webtunnel list no longer marks bridges as working when Tor cannot connect through them (#74).
• Transport start failures now say why. When a pluggable transport could not run, Tor only reported an opaque "Managed proxy ... terminated with status code 2", which hid the real cause (this is what made obfs4 and snowflake "connect then immediately fail" for some users). The app now preflights each transport binary and logs the actual reason, a crash, a wrong-architecture binary, a missing execute bit, and so on, so the problem is diagnosable instead of opaque (#74).

Downloads

Fixed

• Clearer log when the transport can't reach reachable bridges. If a bridged connect fails after the reachability scan found bridges reachable but the transport could not connect to any of them, the log now names the likely cause: a firewall or security tool blocking OnionHop's transport helper (lyrebird / webtunnel-client), or bridges that are dead at the protocol layer. Previously this appeared only as an unexplained wall of "general SOCKS server failure" (#74).

Downloads

Fixed

• Transport helpers now run from a stable path, so firewalls can allow them (#74). On macOS and Linux, the bridge transport helpers (lyrebird / webtunnel-client) ran from the system temp directory. Per-app firewalls like Little Snitch identify a process by its executable path, so a helper in a periodically-purged temp folder never got a durable allow rule and could be silently denied without ever prompting - every bridge then failed with "general SOCKS server failure" even with an "allow all" rule for OnionHop itself. The helpers now run from a stable per-user location (~/Library/Caches/onionhop-pt on macOS, ~/.cache/onionhop-pt on Linux), so the firewall can prompt once and remember the answer, the same way it does for Tor Browser's bundled lyrebird. The stale-transport cleanup at connect time now also covers helpers running from that directory.

Downloads

Fixed

• obfs4 bridges are now verified with a real handshake before connecting. The pre-connect scan used to only TCP-test obfs4, so bridges that were dead or blocked at the obfs4 layer still got handed to Tor, producing a wall of "general SOCKS server failure" warnings and a long pause before it connected. The app now drives the bundled obfs4 client to complete the actual handshake and drops the ones that fail, so connecting is faster and the log is far quieter (#74). If the check cannot run or nearly everything fails (for example the whole set is blocked from your network), it safely falls back to the previous behavior.
• Fixed "connected but no websites load" in TUN/VPN mode on Windows (browser showed ERR_PROXY_CONNECTION_FAILED). If an earlier session had crashed or been force-closed while the system proxy was applied, Windows kept that proxy enabled, pointing browsers at a port from that dead session; TUN mode never corrected it. The app now clears a leftover proxy that matches its own format at connect time, and in TUN mode it logs a clear note if some other system proxy is enabled. Third-party proxy settings are never touched.

Downloads

• Upload Fuzzer Logs to GCS only if not in a uworker by @IvanBM18 in #5363
• process: Adds logs to the timeout timers that terminate processes by @g-ortuno in #5367
• Gracefully handle metadata look up for update_task check for bots off GCE by @dylanjew in #5362

Full Changelog: v2.35.0...v2.35.1

• fix: persist engine startup state for CMSync route logging by @jam300 in #37356
• Fix invalid MTU value reported for Windows network interfaces by @vikman90 in #37394
• Restore modern.bpf.o checkfiles baseline reverted by 4.14.7 merge by @lchico in #37414
• Suppress version-coordination WARNINGs on stop/unavailable module by @lchico in #37372
• Clarify security policy for pre-release versions and disclosure timeline by @vikman90 in #37423
• Bump 5.0.0 branch by @wazuhci in #37429
• wazuh-manager: Memory and copy-reduction improvements part 1 by @matigarciadev in #36979
• Improve default cores detection by @LucioDonda in #37288
• Standardize and verify Wazuh configuration documentation by @TomasTurina in #37411
• Handle rootcheck removed tags by @rovogel in #37346
• Update docs (agent) for the new password in manager by @Miguevrgo in #37420
• Backport the workflow for generating pre-release agent issues to version 5.0.0 by @MarcelKemp in #37490
• Upgrade 5.0.0 python dependencies by @jepalfer in #37361
• Change indexer user name and password by @TomasTurina in #37502
• Remove startup deprecation warning from cluster_control and agent_upgrade by @vikman90 in #37509
• Change indexer username and password to wazuh-manager by @TomasTurina in #37520
• Fix to improve fim_sync db performance. by @hernanvalenzuela in #37180
• SCA/FIM sync lifecycle: close DBs on graceful shutdown, defer coordination during first sync, and increment SCA check version on change by @jr0me in #37353
• Fix version comparison in indexer documents updates by @TomasTurina in #37498
• Propagate sync errors to each module by @jpcerrone in #37212
• Cache indexer credentials in clusterd by @TomasTurina in #37504
• Standardize CHANGELOG format and keep prior versions in the bumper by @jotacarma90 in #37513
• Warn on duplicate agent connection only when it persists by @jotacarma90 in #37493
• Backport: Lower DBSync-not-available shutdown messages to DEBUG to 5.0.0 by @anromerom in #37567
• Add retry logic to indexer templates download by @TomasTurina in #37643
• Reduce authd enrollment log severity for expected rejections by @jotacarma90 in #37540
• Reduce memory usage when downloading VDP feed by @Antoniogm03 in #37375
• Fix server-side version bump for disconnected agent metadata updates by @TomasTurina in #37647
• Re-enable AWS Inspector integration tests in 5.0.0 by @MAnDumu in #37645
• Fix sca internal limits by @rovogel in #37438
• Silence untrustworthy FIM schema-validation errors during shutdown by @Nicogp in #37688
• Fix spurious ERROR/WARNING logs during agent shutdown by @Nicogp in #37673
• Fix daemon stats for analysisd by @NahuFigueroa97 in #37525
• Resolve logging macro collisions and improve LogFn design (#37354) by @jotacarma90 in #37393
• Enable authd in manager source-install integration test step by @jotacarma90 in #37693
• Stop verify-agent-conf from falsely warning on agent-only wodle blocks, without breaking their validation by @vikman90 in #37680
• Fixing CIS 6.1.9 rule impossible permission check for /etc/group- by @hossam1522 in #35405
• Lower connection socket error log to debug level in wazuh-agentd by @MAnDumu in #37685
• Memory improvements part 2 by @NahuFigueroa97 in #37433
• Fix make clean-deps failing when src/external is missing by @vikman90 in #37724
• fix date schema validation error in scheduled metrics by @LucioDonda in #37703
• Report failure when block-ip fails to block an IP by @lchico in #37439
• Fix rename race on logcollector file status during shutdown by @Miguevrgo in #37695
• Calibrate log levels in router and vulnerability_scanner by @jotacarma90 in #37731
• Adds AR Windows binary extension fallback by @rjcausarano in #37496
• Lower httpsrv C++ standard from 20 to 17 by @jotacarma90 in #37751
• Add new indexer API roles mapping by @jepalfer in #37746
• Fix Windows block-ip firewall-enabled check misfire and ineffective route fallback by @nbertoldo in #37430
• Free rpm macro context to stop unbounded growth by @Nicogp in #37758
• Report modulesSync failure as debug during agent shutdown by @anromerom in #37689
• Report manager-not-ready sync failures as deferred by @anromerom in #37720
• wazuh-engine: Indexer connector exponential backoff by @matigarciadev in #37756
• Fix issue reference in the daemons stats changelog entry by @jotacarma90 in #37827

Full Changelog: v5.0.0-beta3...v5.0.0-beta4

Bug Fixes

• javascript: make published dist loadable by plain Node (885e65c)
• javascript: make published dist loadable by plain Node (ESM + CJS) (#830) (885e65c)

Features

• #660: expose context param on scenario.judge() public API (#667) (900f3d8)
• #666: per-role voice modality negotiation — declaration-first, two-phase validation, OTEL stamps (#670) (007a69f)
• events: support LANGWATCH_PROJECT_ID via X-Project-Id header (#619) (7aec1c7)
• tracing: stamp scenario SDK name+version as trace attributes (#744) (#745) (43dd4fa)
• voice: continuous ElevenLabs mic pump + is_connected guard (#740 slice A) (#741) (b6e7f93)
• voice: harvest voice result fields on exit paths + concrete typing (#740 slice E) (#742) (439b7be)
• voice: instrument base + ElevenLabs adapter with LangWatch spans (#777) (2b32872)
• voice: instrument Gemini Live adapter with LangWatch spans (#780) (8ba8687)
• voice: instrument OpenAI Realtime adapter with LangWatch spans (#782) (3152969)
• voice: instrument Pipecat adapter + background-loop spans (#774) (67f71b1)
• voice: instrument Pipecat adapter + background-loop spans (#781) (67f71b1)
• voice: instrument Twilio adapter with LangWatch spans (#788) (8747eed)
• voice: realtime_langwatch_session context manager for live OpenAI Realtime apps (#673) (#676) (e89d00c)

Bug Fixes

• #161: re-parse criteria when LLM returns stringified JSON dict (#552) (b819849)
• #488: log voice adapter and ffmpeg disconnect failures at WARNING (#556) (86bf466)
• #655: replace brittle judge criteria with generic behavioral criteria in audio examples (#679) (732d426)
• #664: transcribe agent turns at runtime so the voice user simulator can read them (#665) (4b99682)
• #695: twilio terminal sentinel on silent/tool-only stop (dead-recv-loop hang) (#697) (e675224)
• python: derive scenario.version from package metadata (#800) (0d505a7)
• security: bump pyjwt to 2.13.0 (#677) (00807b7)
• security: bump python/uv.lock security floors (cryptography, python-multipart, starlette, python-liquid, pydantic-settings) (#685) (ee9a5d5)
• security: raise esbuild, js-yaml, and dompurify override floors across JS workspaces (#671) (c76bab2)
• security: raise vite 8.x floor to >=8.0.16 across scenario workspaces (#709) (42d877e)
• voice/#491: diagnose + resolve multi-turn @e2e suite-wedge + tighten VAD tests (#694) (2dfc381)
• voice/#498: surface recv-loop termination as attributable PipecatRecvError (#692) (c1f552c)
• voice/#648: terminal drain on non-audio completion (EL + WebSocket) (#693) (c42320e)
• voice/#662: guard #662's response.create call sites against the active-response race (JS + PY) (#669) (0968374)
• voice/ts: explicit EL ConvAI turn-commit so scripted next-turn receive re-engages (#596) (795ae8e)
• voice: guard response.create on active response in recv_audio (#659) (5e844ea)
• voice: hosted ElevenLabs single-exchange ceiling — docs + enriched timeout error (#643) (aae16be)
• voice: skip Twilio e2e fixtures on absent env, not fail (#798) (4c883d0)
• voice: terminate wait=False test drain on end-of-turn, re-enable in CI (#691) (022056d)

Documentation

• voice: drop references to a docs/proposals tree that never landed (#613) (#823) (0ef4314)

Features

• voice: instrument base + ElevenLabs adapter with LangWatch spans (#777) (2b32872)
• voice: instrument Gemini Live adapter with LangWatch spans (#780) (8ba8687)
• voice: instrument OpenAI Realtime adapter with LangWatch spans (#782) (3152969)
• voice: instrument Pipecat adapter + background-loop spans (#774) (67f71b1)
• voice: instrument Pipecat adapter + background-loop spans (#781) (67f71b1)
• voice: instrument Twilio adapter with LangWatch spans (#788) (8747eed)

Bug Fixes

• security: bump @opentelemetry sdk-node/exporter-prometheus to 0.217.0 (87d5509)
• security: bump @opentelemetry sdk-node/exporter-prometheus to 0.217.0 (with ReadableSpan migration) (#702) (87d5509)
• security: raise esbuild, js-yaml, and dompurify override floors across JS workspaces (#671) (c76bab2)

Warning

We DO NOT own the domain ilspy[.]org See #3709
Download ILSpy only from GitHub Releases!

This release is based on .NET 10.0. Please make sure that you have it installed on your machine beforehand.

Note for Mac users: see https://github.com/icsharpcode/ILSpy/wiki/Build-Artifacts#running-the-macos-artifact because the ILSpy.app is neither signed nor notarized.

Avalonia Cross Platform Port

• PR #3755: Avalonia 12 Port and Removal of the WPF UI
• PR #3759: Metadata explorer cleanup, flags-filter fixes, and WPF row-details parity
• PR #3766: Round-trip the legacy WPF SessionSettings shape
• PR #3768: Build, test, and package ILSpy on Linux and macOS in CI
• PR #3861: Show text-based resources inline with syntax highlighting
• PR #3875: Avalonia 12.1
• PR #3876: Keep BAML decompilation working when WPF assemblies are missing

New Features

• PR #3847: Unpack !AvaloniaResources into per-file resource tree nodes
• PR #3801: Fix #3797: resolve ilspycmd -t type names with fuzzy matching
• PR #3789: Add a bookmarks feature for the decompiled C# view
• PR #3786: Add omnibar breadcrumb and search bar above the decompiled code
• PR #3769: Make the override modifier a link to the overridden member
• PR #3762: Add Open from NuGet feed dialog for browsing and opening packages

User Interface

• PR #3857: Fix #2078: Generic local functions not highlighted properly
• PR #3855: Fix #3845: Add option to expand XML documentation comments
• PR #3814: Toggle the fold under the right-click, not at the caret
• PR #3812: Syntax-colour analyzer signatures with bold type names (#2164)

Enhancements

• PR #3872: Decompile await on dynamic expressions
• PR #3837: Fix #3804: decompile foreach over inline array
• PR #3791: Fix #3777: decompile runtime async without a separate C# 15 setting
• PR #3843: Bound XamarinCompressedFileLoader against crafted XALZ headers
• PR #3842: Bound WebCilFile section access against mapped-view length
• PR #3841: Harden BAML reader against crafted-resource crashes
• PR #3816: Allow overriding an assembly's target framework for reference resolution
• PR #3840: Bound .rsrc resource-tree parsing against crafted input
• PR #3838: Guard against OOB read when bundle signature is at file start
• PR #3818: Display the IL 'tail.' prefix in C# output
• PR #3808: Migrate the VS extension to an SDK-style VSIX (dotnet build) and retire the VS2017/2019 add-in
• PR #3802: Fix #3799 and three related stackalloc initializer decompilation defects
• PR #3780: Compute public-key tokens with a managed SHA-1

Documentation

• PR #3868: CONTRIBUTING.md for the AI era
• PR #3870: Add decompiler architecture document

Testing / Infrastructure

• PR #3771: Run the decompiler test suite on Linux
• PR #3788: Use cross-platform separators for the FSharp.Core.dll test path
• PR #3807: Adopt SDK default Compile items in Decompiler and Decompiler.Tests
• PR #3815: Verify generated PDBs against the compiler's breakpoint map (PdbGen fixtures previously passed vacuously)
• PR #3836: Don't assert decompiled local types match the signature
• PR #3839: Add fine-grained debug steps with highlighting for C# and ILAst
• PR #3849: Set OpenSSL SHA1 flag in build scripts
• PR #3859: Add test coverage for untested corners of implemented language features
• PR #3874: Upload TestCases folder as artifact when CI tests fail

Contributions

• PR #3851: Fix #3850: recover ReadOnlySpan array literals from the legacy lazy cache — @sailro, thank you!
• PR #3878: Handle negative dictionary capacity in string switch transform — @ds5678, thank you!
• PR #3828: Fix #3826: wrap an overflowing constant subexpression in unchecked() — @sailro, thank you!
• PR #3831: Fix #3825: reconstruct async iterators with [EnumeratorCancellation] and await in finally — @sailro, thank you!
• PR #3830: Fix #3827: keep the while-loop for a ref local used after the loop (avoid an uninitialized hoisted ref decl) — @sailro, thank you!
• PR #3823: Fix #3821: keep ref-struct conditional as if/return, not ?. / ?? (CS8978) — @sailro, thank you!
• PR #3822: Fix #3820: decompile dynamic ~ as ~x instead of an unsupported-opcode error — @sailro, thank you!
• PR #3796: Fix decompiler tests project inside VS — @DoctorKrolic, thank you!
• PR #3787: dev: fix editorconfig parsing on some editors — @mochaaP, thank you!
• PR #3879: Fix the "Use nested namespace structure" option — @ds5678, thank you!

Bug Fixes

• PR #3881: Reject negative char index in the length-and-char string switch
• PR #3866: Fix #3475: Emit 'true ? null : new { ... }' for null of anonymous type
• PR #3864: Fix #3860: Avoid 'out var' if the variable recurs in the argument list
• PR #3873: Fix dynamic event-assignment decompilation leaking is-event opcode
• PR #3863: Simplify hoisted null-guard fold to reference-type constructor chains
• PR #3852: Fix #3824: fold a hoisted argument null-guard at the ILAst level
• PR #3832: Fix #3754: omit async stepping info for runtime-async methods
• PR #3806: Fix Export NullReferenceException for images/resourcexsd.baml
• PR #3792: Fix #3774: keep field initializers when decompiling a static ctor alone
• PR #3790: Skip missing session assemblies when navigating on launch
• PR #3776: Escape reserved Windows device names in output file names

For a full list of changes click here.

• Type the gradle, swift, and pre_commit ecosystems by @JamieMagee in #15534
• Default cooldown to 3 days when default-days is not specified (behind a feature flag) by @robaiken with @Copilot in #15344
• Use shared base cooldown in git_submodules by @robaiken in #15537
• [Update graph] Avoid PathDependenciesNotReachable killing the whole job by @brrygrdn in #15522
• [Update Graph] Ensure that txt/in pairs are included properly in layers when working out references by @brrygrdn in #15581
• build(deps): bump opentofu to 1.12.1 by @RinseV in #15231
• Type the Sentry before_send processors by @JamieMagee in #15569
• Clear T.untyped from four strong updater files by @JamieMagee in #15570
• feat(opentofu): use registry API for multi-platform lockfile hashes by @diofeher in #15296
• julia: various fixes by @IanButterworth in #15549
• Type git_metadata_fetcher's git responses by @JamieMagee in #15572
• pre-commit: add regression tests for prerelease version filtering by @v-HaripriyaC in #15542
• add test ensuring duplicate PRs aren't submitted in security jobs by @brettfo in #15584
• Clear T.untyped from already-strong ecosystem files by @JamieMagee in #15573
• Update branch name case values to align with schema accepted values by @AbhishekBhaskar in #15592
• julia: fix TypeError when a cooldown is configured by @IanButterworth in #15591
• Fix codespell typo in updater job spec by @thavaahariharangit with @Copilot in #15599
• Swift: SemVer-compliant version comparison and validation by @v-HaripriyaC in #15589
• Type git source details by @JamieMagee in #15593
• Expose typed git source details by @JamieMagee in #15594
• v0.387.0 by @dependabot-core-action-automation[bot] in #15604

New Contributors

• @RinseV made their first contribution in #15231

Full Changelog: v0.386.0...v0.387.0

Features

• add Claude Code agent adapter (#687) (8d642d4)
• events: support LANGWATCH_PROJECT_ID via X-Project-Id header (#619) (7aec1c7)

Bug Fixes

• #695: twilio terminal sentinel on silent/tool-only stop (dead-recv-loop hang) (#697) (e675224)
• voice/#662: guard #662's response.create call sites against the active-response race (JS + PY) (#669) (0968374)

Miscellaneous

• lint: forbid non-null assertions in library src and gate it in CI (#751) (#755) (c8eeb5e)

• Use clusterfuzz_manifest.json to set ChromeBuildArchive by @notvictorl in #5351
• Correct execution permission check 100 -> 0o100 by @notvictorl in #5353
• Gracefully shut down Centipede fuzzers by @aakallam in #5358
• symbolizer: Add success tests and clean up tests by @g-ortuno in #5359
• symbolizer: Stop using llvm-symbolizer if it crashes by @g-ortuno in #5361
• Always set BOT_COUNT metric in the run_bot task loop by @dylanjew in #5360

Full Changelog: v2.34.0...v2.35.0

### Added

• Pro C/C++ scans now skip code inside statically-dead preprocessor branches
  (for example, #if 0 ... #else ... #endif). Patterns that would otherwise
  match against intentionally-disabled code no longer report on it. (cpp-if-zero-filter)
• Restored obackward: semgrep-core and semgrep-core-proprietary once again print a backtrace when receiving a fatal signal (e.g. SIGSEGV) (obackward)
• semgrep install-semgrep-pro now sends usage metrics so that
  installation errors can be tracked. Metrics can be disabled with
  --metrics off or SEMGREP_SEND_METRICS=off. Metrics payloads also
  now include the method used to install the Semgrep CLI (pip, homebrew,
  docker, or unknown), detected heuristically. See metrics.md for
  more details of what exactly is sent. (engine-2858)

### Changed

• Increased the timeout for dynamic dependency resolution subprocesses from
  600 to 900 seconds, giving large projects more time to resolve dependencies
  before timing out. (SC-3699)
• Pro C/C++ #if 0 filtering now also handles cases where the directive splits a
  syntactic unit. For example, a function signature toggle like #if 0 void foo(int i) { #else void foo(uint32_t i) { #endif. (engine-994)

### Fixed

• Fixed a crash at startup (Fatal error: Failed to allocate signal stack for domain 0) when running Semgrep on systems with musl 1.2.6 (e.g. Alpine 3.24) on
  recent Intel CPUs whose kernel-reported minimum signal-stack size exceeds musl's
  build-time SIGSTKSZ (notably AMX-capable Xeons). (ENGINE-2863)

• Dockerfile: Fixed parse errors on RUN instructions that use heredoc syntax
  (<<EOF, <<-EOF, quoted delimiters). (LANG-263)

• metavariable-type now supports fully qualified type names in languages
  where a qualified name in type position parses as an expression (e.g.
  Python's types: [a.b.C]) when the metavariable's type is determined by
  type inference, such as Pro engine cross-file type resolution. (LANG-583)

• Updated the ocaml-tree-sitter-core dependency to the latest main.

  • Fails loudly on a parser/runtime ABI mismatch
  • Stamps every generated parser.c with the tree-sitter version that produced it.
  • Changed paths where tree-sitter versions are installed (lang-591)

Warning

We DO NOT own the domain ilspy[.]org See #3709
Download ILSpy only from GitHub Releases!

This release is based on .NET 10.0. Please make sure that you have it installed on your machine beforehand.

Bug Fixes

• Fix: Stop the assembly list from disposing removed assemblies

• Make chromium testcases public when bug is made public by @jonathanmetzman in #5338

Full Changelog: v2.33.14...v2.34.0

• Fix stale mapping and respect delete in rsync_from_disk by @PauloVLB in #5357
• Skip RPATH patching on Schema v1 builds by @notvictorl in #5318

Full Changelog: v2.33.13...v2.33.14

• Capture offending gem details on bundler registry metadata errors by @kbukum1 in #15512
• Bundler: apply empty-checksum metadata patch to the v2 helper by @kbukum1 in #15513
• [Update graph] Ensure bystander txt files are removed before parsing for Python by @brrygrdn in #15508
• Handle global.json with no SDK version in dotnet_sdk parser by @brettfo in #15510
• Type the cargo ecosystem and remove it from the T.untyped burndown by @JamieMagee in #15492
• Type the conda ecosystem and remove it from the T.untyped burndown by @JamieMagee in #15493
• Type the docker ecosystem and remove it from the T.untyped burndown by @JamieMagee in #15495
• Use shared git-tag cooldown in terraform by @robaiken in #15472
• Retry corepack once on signature metadata error by @thavaahariharangit with @Copilot in #15466
• Type the deno, elm, devcontainers, bazel, and helm ecosystems by @JamieMagee in #15527
• Add word-separator and lowercase formatting for branch name by @AbhishekBhaskar in #15478
• Fix Docker cooldown not respected for multi-arch images missing Last-Modified by @robaiken with @Copilot in #15486
• Reduce redundant git-source probes during npm metadata resolution by @thavaahariharangit with @Copilot in #15480
• Type the maven ecosystem and remove it from the T.untyped burndown by @JamieMagee in #15531
• Add branch name config template format support with validation by @AbhishekBhaskar in #15535
• fix(gradle): prefer local gradlew for lockfile updates by @thavaahariharangit in #15546
• helm: support versioning-strategy (range-preserving updates) by @casey-robertson-paypal in #15218
• Bump gradle from 9.4.1-jdk21-ubi to 9.6.1-jdk21-ubi in /gradle by @dependabot[bot] in #15498
• [Update graph] Add support for requirements.txt 'layering' instead of compressing to a single file by @brrygrdn in #15521
• Allow periods in Helm values file names for Docker ecosystem by @telnet23 in #15557
• Match existing group PRs covering a subset of job directories by @IanButterworth in #15548
• Bump library/golang from 1.26.1-bookworm to 1.26.5-bookworm in /go_modules by @dependabot[bot] in #15562
• Fix npm security updates for transitive dependencies in workspace monorepos by @Swampen in #15514
• Add helm to the smoke-test matrix by @casey-robertson-paypal in #15554
• v0.386.0 by @dependabot-core-action-automation[bot] in #15564

New Contributors

• @telnet23 made their first contribution in #15557
• @Swampen made their first contribution in #15514

Full Changelog: v0.385.0...v0.386.0

• symbolizer: catch errors when closing pipes for crashed symbolizers by @g-ortuno in #5356

Full Changelog: v2.33.12...v2.33.13

• feat: add OpenRouter detector by @McPatate in #4500
• Integrations fully codeowns detectors by @trufflesteeeve in #5104
• [INS-332] Add New Relic Insights Insert key detector by @mustansir14 in #4778
• [INS-351] Added Duffel Token Detector by @MuneebUllahKhan222 in #4795
• [INS-341] Added Shippo detector by @MuneebUllahKhan222 in #4820
• [INS-467] Add IPinfo detector to default detectors list by @mustansir14 in #4970
• fix: reject --include-repos/--exclude-repos with --repo in github scan by @kashifkhan0771 in #5112
• [INS-468] Add improved lob detector to defaults.go by @mustansir14 in #4971
• feat(action): add image input to allow registry mirror overrides by @eightseventhreethree in #4965
• feat: Support archived repo exclusion from GH org scans by @hibare in #4875
• [INT-715] Retry transient failures when verifying OpenAI keys by @bill-rich in #5117
• [INS-410] Added batch token detector by @MuneebUllahKhan222 in #4824
• [INT-650] Don't log as error when git diff is too long by @bill-rich in #5113

New Contributors

• @McPatate made their first contribution in #4500
• @eightseventhreethree made their first contribution in #4965

Full Changelog: v3.95.8...v3.95.9

Features

• stamp scenario SDK version as trace attributes (#733) (#736) (6612c50)

Bug Fixes

• voice: reconcile EL audioQueue at turn boundaries (#747) (#748) (1b135f7)

Code Refactoring

• realtime: use the injectable Logger instead of console.* (#724) (#750) (54a89c5)
• voice/tests: hoist AudioUserSimulator fixture to fixtures/ (#524) (#738) (e1dda4b)

Removed

• Removed deprecated wazuh-dbd daemon and database_output configuration. (#37035)

Fixed

• Improved cluster payload buffer allocation strategy. (#37280)
• Improved cluster archive decompression limits. (#37119)
• Improved cluster worker file path validation. (#36998)
• Improved API authentication stability with bounded thread pools, regex timeouts and payload size limits. (#37034)
• Updated aiohttp, cryptography, PyJWT, python-multipart and starlette Python dependencies. (#37361)

Agent

Fixed

• Fixed AWS SQS subscriber wodle resolving the wrong AWS account for cross-account iam_role_arn configurations. (#36791)
• Fixed agent keepalive scheduling after a system clock rollback causing false Disconnected status. (#36338)
• Fixed eBPF FIM whodata dropping file events on older kernels such as Amazon Linux 2 and 2023. (#37014)
• Fixed eBPF FIM whodata missing file move/rename events into monitored folders. (#37023)
• Added IP address validation to the ip-customblock active response to prevent malformed input in file path operations. (#36730)
• Added a null check for inode and device fields in the FIM whodata event handler. (#37245)

Ruleset

Fixed

• Fixed multiple Debian, Ubuntu and Windows SCA checks generating incorrect results. (#37385)
• Fixed a typo in the SELinux SCA check causing false failures on CentOS 8, 9 and 10 systems configured as permissive. (#36361)
• Fixed the AlmaLinux 9 and 10 bootloader permissions SCA check regex and optional file handling. (#36396)
• Fixed the /etc/gshadow- permissions SCA check always failing due to an incorrect all condition. (#36795)
• Fixed a macOS SCA PolicyBanner check false failure by wrapping the command in sh -c for glob expansion. (#36783)

RESTful API

Fixed

• Fixed TypeError when sorting agents by version with empty version strings. (#37323)
• Improved sensitive data masking in cluster configuration endpoint. (#37039)

### Infra/Release Changes

• Updated Dart parser to a more recent upstream version. (LANG-579)

Bug Fixes

• security: raise protobufjs override floors (CRITICAL) (#683) (7841995)
• voice: grace-wait + STT fallback so user-simulator reacts to real transcript (#734) (#735) (5f4cbe9)

• [Swarming] Decouples linux from android_emulator fuzzing by @IvanBM18 in #5347
• Use threads for datastore operations under targets feature flag by @PauloVLB in #5352

Full Changelog: v2.33.11...v2.33.12

• Support package-scoped NuGet release notes by @Cjewett in #15211
• Filter null entries from job directories by @brettfo in #15457
• devcontainers: preserve major-only Feature pins when precision-matching tags are absent by @thavaahariharangit with @Copilot in #15445
• Type opaque hashes in common with T.anything by @JamieMagee in #15458
• Type the options passthrough in base classes with T.anything by @JamieMagee in #15459
• Apply git-tag cooldown across ecosystems by @robaiken in #15369
• Type requirement helpers in the update-checker base class by @JamieMagee in #15461
• Select group update handler for multi-ecosystem NuGet jobs by @brettfo in #15460
• Type error-detail payloads across common and the updater by @JamieMagee in #15462
• Type package release details with T.anything by @JamieMagee in #15463
• Type message builder commit options and vulnerabilities-fixed by @JamieMagee in #15465
• Fix multiple --default-index args when multiple replaces-base credentials exist by @thavaahariharangit with @Copilot in #15481
• Fetch gradle.properties and making available lock file generation with in dependabot by @thavaahariharangit with @Copilot in #15467
• Detect cargo registries across hierarchical .cargo/config.toml files by @brettfo in #15474
• fix(bundler): only re-vendor platform gems for updated dependencies by @jurre in #15451
• Fix Sorbet runtime signature violations by @JamieMagee in #15476
• Use shared git-tag cooldown in python by @robaiken in #15470
• Fix multiline HTML version parsing for Python/UV private registries by @thavaahariharangit with @Copilot in #15469
• v0.385.0 by @dependabot-core-action-automation[bot] in #15502

New Contributors

• @Cjewett made their first contribution in #15211

Full Changelog: v0.384.0...v0.385.0

⚠️ Breaking Change: Signed templates required for JavaScript protocol

Starting with v3.11.0, custom templates that use the javascript: protocol must be digitally signed before Nuclei will load or execute them. Unsigned JavaScript templates are now skipped during template loading and when referenced from workflows.

Why this change

This release continues the security hardening started in v3.10.0 (sandbox enforcement, network policy checks, stricter code-template handling, YAML include protections, and related fixes in #7469). The JavaScript protocol exposes Go-backed modules through Nuclei's JS runtime, which significantly increases attack surface compared with request-only templates. Requiring signatures brings JavaScript templates in line with the existing protections for code-protocol templates.

Who is affected

What to do

Sign your custom templates with:

nuclei -sign -t /path/to/your-template.yaml

See the Template Signing documentation for key generation, verification, and signing templates that reference external JavaScript or code files.

🔒 Security

• feat(templates): require signatures for javascript templates by @dwisiswant0 in #7514

Other Changes

• bump x/crypto and go-pkcs12 by @dogancanbakir in #7516
• general maintenance and cleanup by @Mzack9999 in #7469

Full Changelog: v3.10.0...v3.11.0

• removed "unauthorized" as exception for rotated graphana secrets by @jordanTunstill in #5068
• fix(azuresastoken): match SAS tokens regardless of parameter order by @genisis0x in #5043
• Add prometheus metrics for engine channels and workers by @mcastorina in #5095
• [INS-465] Skip unverified JWT Detector results when feature flag is enabled by @MuneebUllahKhan222 in #5072
• [INS-334] Octopus Deploy detector by @MuneebUllahKhan222 in #4787
• Fix Syntax error in feature.go by @MuneebUllahKhan222 in #5109
• Include encoded resume info instead of clobbering it by @bill-rich in #5110

Full Changelog: v3.95.7...v3.95.8

• Improve cluster file synchronization error handling by @TomasTurina in #36129
• Update trojan signatures to avoid false positives on modern distros by @Miguevrgo in #35927
• Improve cluster merged file parameter validation by @vikman90 in #36204
• Create a backup of local_rules.xml during execution of IT analysisd tier 0 1 by @Antoniogm03 in #36201
• Improve tmp_file path validation in cluster DAPI by @vikman90 in #36246
• Revert bump main branch by @wazuhci in #36303
• Bump 4.14.7 branch by @wazuhci in #36312
• Serialize procps access to prevent modulesd crash by @cborla in #36261
• Remove obsolete configuration blocks from API upload_configuration setting by @TomasTurina in #36252
• Restore working vulnerability scanner database workflow by @jotacarma90 in #36332
• Propagate agent merged_sum after hot reload in cluster by @jotacarma90 in #36164
• Merge 4.14.7 into main by @jotacarma90 in #36331
• Authd tier 0-1 flaky tests fix by @jotacarma90 in #36342
• Review agent info logs by @Antoniogm03 in #36234
• Fix the wazuh-manager-modules crash that occurs while downloading the feed by @Antoniogm03 in #36337
• Migrate FIM DB path queries to parameterized statements by @Darioortegaleyva in #36399
• Fix AlmaLinux 9/10 bootloader permissions SCA check regex and optional file handling by @vikman90 in #36396
• Cluster file processing parameter validation by @vikman90 in #36296
• Add missing 4.10.2-4.10.5 and 4.8.2 entries to changelogs by @jotacarma90 in #36407
• Treat the absence of the hash document as expected, not an error by @juliancnn in #36355
• geo_point validation support all compatible formats by @LucioDonda in #36034
• Prevent Syscollector and SCA use-after-free on modulesd shutdown by @nbertoldo in #36359
• Add cluster security model and configuration documentation by @vikman90 in #36405
• Bump CB_SCAN_STARTED timeout and trigger ITs on wm_syscollector.c by @jr0me in #36446
• Fixed an issue in eBPF with LSM hooks and improved the health check by @MarcelKemp in #35838
• Validate cluster node name format by @vikman90 in #36460
• eBPF libraries updated by @MarcelKemp in #36467
• Bump 4.14.6 branch by @wazuhci in #36517
• Revert "Bump 4.14.6 branch" by @MARCOSD4 in #36518
• Bump 4.14.6 branch by @wazuhci in #36519
• Update changelog for 4.14.6 RC 1 by @jotacarma90 in #36562
• Fix policy evaluation errors by @fcontrerasc in #36449
• Release startup hash gate when the reload chain fails by @jr0me in #36302
• Revert "Add missing 4.10.2-4.10.5 and 4.8.2 entries to changelogs" by @MarcelKemp in #36591
• Merge merge-4.14.7-into-main into main [automated] by @wazuhci in #36624
• Restore event counter and classify received messages by @jotacarma90 in #36456
• Unify manager integration tests workflows by @ignaciogalle12git in #36235
• Remove unused Node.js 12 from arm64 deb agent builder by @Miguevrgo in #36156
• Remove unused Node.js 12 from arm deb agent builders (4.14.7) by @Miguevrgo in #36157
• SCA typo bug in SELinux SCA rule for CentOS 8/9/10 by @Miguevrgo in #36361
• Fix detect-changes glob to honour ** recursively and extract logic into a reusable action by @Nicogp in #36617
• Merge merge-4.14.6-into-4.14.7 into 4.14.7 [automated] by @wazuhci in #36623
• Reduce log noise when engine has no synchronized ruleset by @NahuFigueroa97 in #36356
• Update test modules paths by @rovogel in #36668
• Only download external deps when required by @TomasTurina in #36244
• Merge 4.14.7 into main by @jotacarma90 in #36664
• Mail forwarding and reporting 5.0 migration guide by @Ripdiegozz in #36357
• Added Ubuntu 26.04's SCA policy in the SPECS by @MarcelKemp in #36712
• Preliminary support new OSs - Ubuntu 26.04 - Add SCA content by @AwwalQuan in #36708
• Safeguards to inventory sync by @juliancnn in #36469
• Improve the method of detecting duplicates by @NahuFigueroa97 in #36344
• Fix race condition preventing inventory synchronization after agent reload by @nbertoldo in #36682
• Added API integration tests workflow by @MiguelazoDS in #36196
• Fix non-atomic write for file_status.json in logcollector by @nbertoldo in #36722
• Make agent-info shutdown waits interruptible by @lchico in #36719
• Validate IP address in ip-customblock active response by @vikman90 in #36730
• wazuh-agent remains active after uninstall on Fedora 44 / DNF5 by @Miguevrgo in #36727
• Use per-target rpath and remove redundant LD_LIBRARY_PATH/WAZUH_ENGINE_GROUP exports by @jotacarma90 in #36455
• Fix changelog chronological order and update bumper script by @Darioortegaleyva in #36729
• Monitoring a symlink without follow_symbolic_link by @Darioortegaleyva in #36081
• SCA policies migration guide from 4.x to 5.x by @jr0me in #36671
• Fix 5x wazuhdb integration tests by @ignaciogalle12git in #36713
• Downgrade transient manager-reported sync failures logs to debug by @jr0me in #36744
• Show sca timouts as Not Run by @jpcerrone in #36258
• Authd workflow creation for 5.x by @jepalfer in #36404
• Adapt remoted tests to 5.x by @Antoniogm03 in #36609
• Update unclassified event criteria by @LucioDonda in #36681
• use safeloader in yaml file loader by @LucioDonda in #36753
• Downgrade expected modulesd socket warnings/errors during agent restart to debug by @jr0me in #36755
• Documentation: Ciscat and openscap migration to SCA by @jpcerrone in #36723
• Document the deprecation of OSquery in order to use IT Hygiene in version 5.0 by @nbertoldo in #36756
• Preserve wazuh-syscheckd Full Disk Access attribution on macOS reload by @Nicogp in #36754
• Normalize severity Msg by @hernanvalenzuela in #36759
• Agent Groups 5x Migration Guide by @fcontrerasc in #36726
• Add NULL validation for optional FlatBuffer fields in inventory_sync by @vikman90 in #36773
• Fix agent keepalive scheduling after system clock rollback by @Darioortegaleyva in #36338
• Create integratord migration guide to 5.x by @Adman23 in #36750
• Syslog output (csyslogd) 5.0 migration guide by @gonzaarancibia in #36741
• Merge merge-4.14.7-into-main into main [automated] by @wazuhci in #36767
• Migration documentation: syslog input alternative by @rovogel in #36781
• Drop libcrypt dependency from Python dep by @jotacarma90 in #36782
• Change duplicated link to intented one by @Miguevrgo in #36794
• Add centralized input validation for active response framework by @vikman90 in #36745
• Fix sca check for etc/shadow by @Miguevrgo in #36795
• Align remoted metrics shipper with new field names by @jotacarma90 in #36740
• Fix wrap PolicyBanner stat in 'sh -c' so glob expands in macOS SCA check 41062 by @Nicogp in #36783
• Bump main branch by @wazuhci in #36801
• Defer module coordination while FIM first sync is in progress by @anromerom in #36762
• Revert "Bump main branch" by @MARCOSD4 in #36802
• Change log severity for recoverable and expected conditions by @hernanvalenzuela in #36786
• Prevent data race in schema validator factory concurrent initialization by @Nicogp in #36789
• Schema generation for dotted and nested field mappings by @jam300 in #36473
• Engine support null values in schema validation by @LucioDonda in #36470
• docs: add Active Response 4.x to 5.x migration guide by @jcorredor-spec in #36402
• Use env mappings for variable passing in builderpackage workflows by @Miguevrgo in #36738
• Adds 4.x to 5.x migration documentation. by @rjcausarano in #36785
• Fix AWS cross-account SQS queue URL when using iam_role_arn by @fcontrerasc in #36791
• Fix enrollment key validation and improve input handling by @vikman90 in #36807
• Lower agent_sync_protocol and module sync log levels to reduce false-alarm noise by @Nicogp in #36817
• Add unit tests for utils, aws_tools, DockerListener, gcloud and azure modules by @AnDumu in #36761
• Normalize numeric inode to string events (6960) by @hernanvalenzuela in #36837
• Prevent indexer consumer wait during shutdown by @jotacarma90 in #36836
• Update manager 5x documentation by @ignaciogalle12git in #36833
• Add bump-issue-link support to bumper workflow by @jotacarma90 in #36868
• Add guide for migrating manager coordinator from 4.x to 5.x by @jepalfer in #36829
• Add Wazuh Manager Configuration documentation from 4.x to 5.x by @Antoniogm03 in #36779
• Add documentation to migrate filebeat to indexer connector by @Antoniogm03 in #36866
• wazuh-manager: Benchmark and footprint by @juliancnn in #36145
• Update manager upgrade block message by @jotacarma90 in #36987
• 5.x PR workflows improvements by @ignaciogalle12git in #36766
• Add Manager 5.0 release notes and breaking changes by @ignaciogalle12git in #36850
• ci(gha): migrate server/manager workflows to AWS CodeBuild runners [main] by @jotacarma90 in #37012
• chore: update vulnerable Python framework dependencies by @jotacarma90 in #37024
• Add Manager 5.0 wazuh-manager.conf configuration reference by @jotacarma90 in #36999
• Add virustotal migration guide by @jepalfer in #37013
• Add VD migration documentation by @ignaciogalle12git in #37008
• Add documentation for wpk upgrade by @Antoniogm03 in #37015
• Migrate agent build workflows to AWS CodeBuild runners by @Nicogp in #37028
• XML Decoders migration to YAML by @jepalfer in #36959
• CDB to KVDB migration guide by @jepalfer in #36996
• Documentation of Agentless migration to 5.x by @Antoniogm03 in #37025
• Fix manager reload/restart silently fails by @ignaciogalle12git in #36962
• Randomize key generation for installation by @jepalfer in #36861
• Retry vulnerability feed validation failures promptly by @jotacarma90 in #36874
• Bump 5.0.0 branch by @wazuhci in #37040
• Fix agent permanently stuck when TCP connection is silently half-closed by @nbertoldo in #36790
• ci(gha): migrate server/manager workflows to AWS CodeBuild runners [4.14.6] by @jotacarma90 in #37010
• ci(gha): migrate server/manager workflows to AWS CodeBuild runners [4.14.7] by @jotacarma90 in #37011
• fix: correct blob URL refs for release branch by @jotacarma90 in #37046
• Use restricted wazuh-server user for Manager Indexer authentication by @jotacarma90 in #37061
• fix(packages): use wazuh-manager-control in manager init.d scripts by @jotacarma90 in #37059
• fix: Update the unclassified event doc by @juliancnn in #37126
• Skip vanished /proc entries during ports scan by @Nicogp in #36859
• Fix RBAC permission check to verify allow effect in update_config rules by @vikman90 in #37076
• Add destination confinement to worker non-merged and extra file sync paths by @jotacarma90 in #36998
• Patch cluster authentication by @ignaciogalle12git in #37039
• Lower stale-session indexer log to debug by @jotacarma90 in #37150
• Limit recursion depth in XML parser by @vikman90 in #37147
• Add status endpoint by @NahuFigueroa97 in #37022
• Add log collectors reference docs by @AnDumu in #37057
• Run the Windows MSI package test on the AWS CodeBuild runner by @nbertoldo in #37165
• Remove merged.mg hash cache to fix stale syscollector flush by @hernanvalenzuela in #37048
• Enrich MITRE fields with id and names by @fcontrerasc in #37054
• Reduce indexer connection warning noise by @jam300 in #37021
• Remove deprecated wazuh-dbd daemon by @vikman90 in #37035
• Bound decompressed size when processing sync archives by @jotacarma90 in #37119
• Bump 4.14.6 branch by @wazuhci in #37176
• Add libcrypt fix (#36782) to 4.14.6 changelog by @jotacarma90 in #37178
• Delay IndexerDownloader connection warnings until 3 failed attempts by @jotacarma90 in #37177
• Add parameterized target selection to Coverity scan workflow by @lchico in #37171
• Align remoted tier 2 CodeBuild setup by @jotacarma90 in #37155
• Add rules migration guide by @Jorgesnchz in #36305
• Migrate agent Linux/Windows test workflows to AWS CodeBuild runners by @Nicogp in #37051
• Silence spurious keepalive warnings on the Windows agent by @nbertoldo in #37187
• wazuh-engine: Improve log messages and logger by @juliancnn in #36995
• Set default indexer connector credentials by @TomasTurina in #37192
• Fix incorrect snprintf size calculation in winevtchannel decoder by @vikman90 in #37198
• Align VD feed-download log levels with indexer consumer state by @jotacarma90 in #37199
• Recognize renamed indexer consumer status in engine sync by @jotacarma90 in #37204
• Merge 4.14.6 into 4.14.7 by @jotacarma90 in #37210
• Token replacement to avoid permission errors by @MarcelKemp in #37237
• Merge 4.14.7 into 5.0.0 by @jotacarma90 in #37211
• Eliminate TOCTOU races in healthcheck file operations by @rjcausarano in #37160
• Sca file policy block standardization by @Johnng007 in #37179
• Bind agent index selection and scope deletes by cluster by @jotacarma90 in #37154
• Add Null Check for Inode and Dev Fields in FIM Whodata Event Handler by @vikman90 in #37245
• Docs/6764 logcollector whats new 5.0 by @AnDumu in #37056
• Repair RPM builder toolchain downloads by @jr0me in #37130
• Add cluster name validation by @TomasTurina in #37238
• Add cluster readiness endpoint by @NahuFigueroa97 in #37129
• Defer cluster payload buffer allocation until data is received by @jepalfer in #37280
• Indexer connector bulk size and flush interval configurable by @LucioDonda in #37158
• Enable shared-password enrollment by default by @ignaciogalle12git in #37151
• Fix unit test workflow paths and report handling by @jotacarma90 in #37317
• Migrate agent + server CI artifacts to S3 — 4.14.7 (#5300, #5298) by @jr0me in #37186
• Handle eol amazon inspector classic by @rovogel in #37194
• Fix wazuh-modulesd missing after macOS agent restart by @cborla in #37020
• Fix test_worker failing unit test by @jepalfer in #37314
• Improve log messages by @Antoniogm03 in #36876
• Improve changelog format by @jotacarma90 in #37332
• Lower log level of transient cluster IPC failures (#37277, #37276) by @jotacarma90 in #37326
• Fix TypeError when sorting agents by version with empty version strings by @TomasTurina in #37323
• Migrate agent + server CI artifacts to S3 — 5.0.0 (#5300, #5298) by @jr0me in #37185
• Validate asset resource names before policy promotion by @jam300 in #37172
• Revert wazuh-server indexer credentials and propagate log context in indexer connector by @jotacarma90 in #37333
• Add VD readiness status HTTP endpoint by @jotacarma90 in #37213
• Use github.workspace for wodles report paths by @Nicogp in #37342
• Skip FIM whodata cases on the tier-2 Linux job (CodeBuild) by @Nicogp in #37291
• Migrate 4.x Windows test runners to AWS CodeBuild by @Nicogp in #37193
• Lower log level of transient queue send failures in modulesd by @lchico in #37345
• Add changelog check workflow by @TomasTurina in #37343
• Add changelog check workflow for 5.0.0 by @TomasTurina in #37351
• Retry OS_SendUnix on ENOBUFS to stop dropping binary sync messages on macOS by @nbertoldo in #37349
• change: Allow null root_decoder as alias of empty string on policy cr… by @juliancnn in #37347
• Fix eBPF FIM whodata for Amazon Linux by @Miguevrgo in #37014
• Merge 4.14.6 into 4.14.7 by @jotacarma90 in #37358
• Bump 5.0.0 branch by @wazuhci in #37371
• Merge 4.14.7 into 5.0.0 by @jotacarma90 in #37360
• Migrate remaining CI artifacts to S3 for the 5.0.0 branch (#3502) by @jr0me in #37350

New Contributors

• @MARCOSD4 made their first contribution in #36518
• @Ripdiegozz made their first contribution in #36357
• @Adman23 made their first contribution in #36750
• @jcorredor-spec made their first contribution in #36402

Full Changelog: v5.0.0-beta2...v5.0.0-beta3

• Check for string before decoding db_config value by @dylanjew in #5345
• Hide Chromium trusted job warning on non-Chromium instances by @ViniciustCosta in #5344

Full Changelog: v2.33.10...v2.33.11

• Migrate Android Build API usage to V4 OnePlatform under feature flag by @dylanjew in #5335
• Fix issue with double-opening temp corpus files by @aakallam in #5342

Full Changelog: v2.33.9...v2.33.10

⚠ BREAKING CHANGES

• voice: the EL adapter's SDK migration removes the public WebSocketLike test-seam type (superseded by the SDK's own WebSocketFactory). Niche, but note it for the version bump.

Bug Fixes

• security: raise vite 8.x floor to >=8.0.16 across scenario workspaces (#709) (42d877e)
• voice: real voice-in by default for hosted ElevenLabs ConvAI (#707) (267426b)

• Bazel: Fix prerelease filtering with same-release-line scoping by @v-HaripriyaC in #15332
• Respect cooldown for Docker digest updates and suppress multi-arch no-ops by @robaiken in #15354
• Bypass npmrc min-release-age for transitive npm security updates by @robaiken in #15386
• Ratchet the Sorbet T.untyped burndown by @JamieMagee in #15399
• feat(docker): implement single-platform image detection and optimize manifest fetching logic by @jpinz in #15390
• Fix private registry config not found error not being raised issue in npm_and_yarn by @AbhishekBhaskar in #15394
• don't fail if nuget cred is missing url by @brettfo in #15378
• Type commit_message_options with a value object by @JamieMagee in #15400
• Type the Dependabot config file parser by @JamieMagee in #15401
• Fix Terraform registry replacement typing and credential semantics by @thavaahariharangit with @Copilot in #15406
• fix: avoid path collisions for SHA-pinned GitHub Actions by @markhallen in #14806
• Nix: skip flake inputs pinned to a bare commit SHA by @JamieMagee in #15412
• Type the vulnerability version-range renderer by @JamieMagee in #15402
• Add JobCommand enum and Command property to NuGet Job model by @brettfo in #15277
• Upgrade Ruby to 4.0.5 by @Bo98 in #14830
• Bump updater-core image to RubyGems/Bundler 4.0.13 by @JamieMagee in #15256
• Fix issue with PrivateRegistryConfigNotFound error incorrectly firing when scope is configured by @AbhishekBhaskar in #15416
• Fake MSBuild SolutionDir during NuGet discovery (#13756) by @brettfo in #15392
• NuGet: Filter all editable files not present prior to discovery by @brettfo in #15358
• Support Central Package Versions updates in XmlFileWriter by @brettfo in #15409
• [Update Graph] Report empty manifests as present but empty instead of omitting them by @brrygrdn in #15427
• Fix vcpkg empty PRs for up-to-date baselines by @JamieMagee in #15420
• Nix: update NixOS channel tarball inputs by @JamieMagee in #15413
• fix(opentofu): accept terraform_registry credentials for OCI registry tags by @thavaahariharangit in #15422
• Commit changes to workspace member TOML files by @crabbit-git in #15142
• Fix COREPACK_NPM_REGISTRY trailing slash causing pnpm HTTP 404 on private registries by @thavaahariharangit with @Copilot in #15444
• Map additional NuGet feed errors to private_source_bad_response by @brettfo in #15426
• Support version and security NuGet job commands by @brettfo in #15430
• Show the vcpkg release tag instead of master in PR titles by @JamieMagee in #15433
• Register MSBuild before running the job so early NuGet errors are reported by @brettfo in #15431
• Add a baseline to vcpkg projects missing one by @JamieMagee in #15432
• Fix file updater failed to update for all support files sentry error by @AbhishekBhaskar in #15421
• Skip disabled Maven repositories by @adoroszlai in #15443
• v0.384.0 by @dependabot-core-action-automation[bot] in #15438

New Contributors

• @crabbit-git made their first contribution in #15142
• @adoroszlai made their first contribution in #15443

Full Changelog: v0.383.0...v0.384.0

• [b/526599452] Remove UI buttons for deleting fuzzers and jobs by @decoNR in #5337

Full Changelog: v2.33.8...v2.33.9

🎉 New Features

• Added per-host HTTP client pooling by @Mzack9999 in #7301

🐞 Bug Fixes

• Fixed handling in hosterrorscache to automatically skip hosts that consistently time out by @knakul853 in #7455
• Fixed preservation of explicit target port in network templates (fixes #7323) by @XananasX7 in #7465
• Fixed connection reuse and improved port pre-flight handling by @Mzack9999 in #6715
• Fixed code template signature validation before DAST loading by @dogancanbakir in #7472
• Fixed gating of MySQL allowAllFiles option to require -lfa flag by @dogancanbakir in #7473
• Fixed ASCII-section regex to properly escape literal . by @snicket2100 in #7476
• Fixed recording of decoded bytes for debug dumps by @snicket2100 in #7478
• Fixed proper escaping of dbname in lib/pq URLs by @dwisiswant0 in #7479
• Fixed network policy enforcement prior to LDAP dialing by @dwisiswant0 in #7494
• Fixed normalization and rejection of trace file DSN options in Oracle by @dwisiswant0 in #7480
• Fixed proper escaping of MSSQL database names in connection URLs by @dwisiswant0 in #7481
• Fixed krbforge to reject unsandboxed ccache writes by @dwisiswant0 in #7482
• Fixed rejection of request-condition(s) during fuzzing by @dwisiswant0 in #7466
• Fixed: YAML now correctly rejects recursive include chains by @dwisiswant0 in #7492
• Fixed resource leaks by @Mzack9999 in #7502

Other Changes

• Updated govaluate dependency to prevent slice-bounds panic on invalid UTF-8 input by @XananasX7 in #7464
• Updated goja dependency by @Mzack9999 in #7467
• Updated dependencies to remove unused packages by @dwisiswant0 in #7457
• Refactored templates to centralize opt-in capability gating by @dwisiswant0 in #7489
• Added fuzzing parser harnesses for raw requests and templates by @dwisiswant0 in #7459
• Refactored template rendering boundary by @dwisiswant0 in #7499

New Contributors

• @XananasX7 made their first contribution in #7465
• @snicket2100 made their first contribution in #7476

Full Changelog: v3.9.0...v3.10.0

• fix(sources/filesystem): order resume comparison by path component by @genisis0x in #5041
• test(handlers): point APK test fixture at trufflehog-test-assets by @amanfcp in #5053
• fixed regex typo that was causing conf uuid's to be surfaced as non-live atlassian secrets. by @jordanTunstill in #5029
• Fix GitHub App cross-org member enumeration using per-installation tokens by @dustin-decker in #4774
• fix: add git worktree support in PrepareRepo by @andoniaf in #4690
• [INS-406] Braintrust detector by @MuneebUllahKhan222 in #4826
• huggingface: add bucket scanning by @julien-c in #5017
• Skip reverification results during deduplication by @mcastorina in #5069
• chore(renovate): bump shared config to v1.0.3 by @bryanbeverly in #5044
• Add scan_all_installations option for multi-org GitHub App scanning by @dustin-decker in #4775
• Expose SecretParts in the JSON output by @bradlarsen in #5073
• [INS-497] Add Pganalyze Read Key Detector by @MuneebUllahKhan222 in #4993
• [INS-197] Add redhatpyxis api key detector by @MuneebUllahKhan222 in #4995
• [INS-407] Fixed AWS detector producing non deterministic output by @MuneebUllahKhan222 in #4836

New Contributors

• @genisis0x made their first contribution in #5041
• @andoniaf made their first contribution in #4690
• @julien-c made their first contribution in #5017

Full Changelog: v3.95.6...v3.95.7

!!! You need to recompile persistent mode/LLVMFuzzerTestOneInput target !!!

• afl-health:
  • new tool: AFL++ campaign health tool checker, much more advanced than
    afl-whatsup, with tips, analysis and ssh support
• afl-fuzz:
  • Futex implementation missed the clean-up of the shmem
  • Futex shmem now lives in general shared memory map as by default only
    32 such regions are supported in MacOS
• afl-cc:
  • new C11 mode (AFL_LLVM_C11 at compile time): afl-cc records each
    function's local variable count and afl-fuzz uses it as an extra queue
    scheduling signal to favor more complex code paths. Noticably improvement,
    based on the paper https://mlsec.org/docs/2026-icse.pdf
  • if -fsanitize-coverage-allowlist=/-fsanitize-coverage-ignorelist= is
    passed without AFL_LLVM_ALLOWLIST/AFL_LLVM_DENYLIST being set, the
    supplied list is reused as AFL_LLVM_ALLOWLIST/AFL_LLVM_DENYLIST (with
    a warning) so the optimized PCGUARD honors it
  • instrument allow/deny lists (AFL_LLVM_ALLOWLIST/AFL_LLVM_DENYLIST and
    the GCC equivalents): function (fun:) entries are now matched verbatim
    with fnmatch() instead of having a * prepended automatically - add a
    leading * yourself for a suffix match. Function entries are matched
    against both the mangled and the demangled (LLVM) / unqualified (GCC)
    name, and an explicit fun: prefix now permits : so demangled C++/Rust
    names can be listed. File (src:) entries are unchanged and still match
    as a suffix (an implicit leading *)
  • AFL_LLVM_CRASHLIST - crash on any function that is marked not to be
    instrumented but is entered by fuzzing input
  • bugfix for __AFL_LOOP() that lingered since vanilla afl, first run
    coverage map would look different to following runs, impacting lots of
    functionality (minimizing, stability, etc.)
• afl-* script tools:
  • prefer AFL_PATH to find afl-showmap
• man pages: fixed the SYNOPSIS and OPTIONS sections for several tools

  This version:

        * Improves the directory check against VirusTotal (-d option). The
          "AV Detection" column is renamed to "AV", the Sample and other
          columns are narrowed and realigned, and two new local-analysis
          columns are added for each sample: "Overlay", indicating whether
          the PE has an overlay (YES/NO, or N/A for non-PE files), and
          "Ent", showing the file entropy as a value from 0.00 to 8.00. The
          entropy is the highest per-section entropy of the PE (the best
          signal for packed or encrypted sections), falling back to the
          whole-file Shannon entropy for non-PE files.

        * Shows the overlay size in the VirusTotal file report (-v 1/2/3).
          When a PE has an overlay, an "Overlay Size" field is now printed
          right below the "Overlay" field, formatted in KB/MB rather than
          raw bytes.

        * Shows overlay information in the VirusTotal hash report (-v 8).
          The report by hash now reports whether the sample has an overlay
          (and its size, in KB/MB) directly from VirusTotal's pe_info data,
          without downloading the sample.

        * Shows the file entropy in the VirusTotal file report (-v 1/2/3).
          An "Entropy" field is now printed below the overlay information,
          using the same value as the -d directory check: the highest
          per-section entropy of the PE (0.00 to 8.00), falling back to the
          whole-file Shannon entropy for non-PE files.

Removed

• Removed unused SSL/TLS transport option from cluster. (#35648)

Fixed

• Improved message decompression handling in remoted. (#35773)
• Improved agent name validation to reject names starting with dot. (#35833)
• Fixed segfault in vulnerability scanner module shutdown when disabled. (#36011)
• Fixed string buffer handling in version comparison function. (#36059)
• Improved cluster file synchronization security. (#36060)
• Improved cluster file synchronization error handling on invalid task identifiers. (#36129)
• Improved cluster merged file parameter validation to prevent directory escape. (#36204)
• Improved tmp_file path validation in cluster DAPI. (#36246)
• Improved cluster non-merged file path validation during worker file processing. (#36296)
• Improved cluster node name format validation in the hello handler. (#36460)
• Fixed missing agent.host.ip in inventory documents when agent IP is empty. (#35475)
• Fixed stale agent synced status after hot reload on cluster worker nodes. (#6726)

Agent

Fixed

• Fixed agent registration not running on reinstall after apt-get remove. (#35727)
• Fixed MS-Graph integration handling for relationships containing /. (#35431)
• Fixed macOS syscollector to skip package receipts whose payload is no longer installed. (#35380)
• Fixed missing eBPF create, modify and delete events on Ubuntu 24/26 and improved FIM whodata healthcheck. (#35838)
• Hardened FIM database path lookups by migrating to parameterized SQL queries. (#36399)

RESTful API

Fixed

• Escaped control characters in API usernames in access logs. (#35866)
• Added input validation in cluster result handling and authentication. (#35757)
• Fixed current user resolution in the update-user endpoint to enforce admin protection. (#35442)

Ruleset

Fixed

• Updated rootcheck trojan signatures to avoid false positives on modern distributions (Debian 13, Ubuntu 26, Arch Linux). (#35927)

Other

Changed

• Updated cryptography, urllib3 and python-multipart Python dependencies. (#35982)
• Updated eBPF libraries: libbpf to 1.7.0 and bpftool to 7.7.0. (#36467)

Fixed

• Fixed wazuh-manager startup failure on RHEL 10 by dropping the libcrypt dependency from embedded Python. (#36782)

Bug Fixes

• voice/#648: terminal drain on non-audio completion (EL + WebSocket) (#693) (c42320e)

Features

• #660: expose context param on scenario.judge() public API (#667) (900f3d8)
• sdk: add langwatch config to ScenarioConfig for race-condition-free multi-tenant runs (#545) (eab72b3)

Bug Fixes

• #655: replace brittle judge criteria with generic behavioral criteria in audio examples (#679) (732d426)
• security: bump hono >=4.12.25 and ws >=8.21.0 (#684) (5050488)
• voice/#661: port sliding-idle-deadline to TypeScript receiveAudio (#668) (c66ed6d)
• voice/ts: explicit EL ConvAI turn-commit so scripted next-turn receive re-engages (#596) (795ae8e)

• Adds support for --no-streaming flag in Android ASan jobs by @IvanBM18 in #5332
• Skip Region Load Checking in is_remote_task by @javanlacerda in #5331
• Revert "Fix legacy Datastore access in data_handler.py for UWORKERs" by @hunsche in #5339

Full Changelog: v2.33.7...v2.33.8

### Added

• Added an experimental --x-dependency-paths flag to scan and ci that includes the full dependency path(s) for transitive supply-chain findings in --json and --sarif output. (SC-3547)

### Changed

• Malicious supply chain rules are now labeled "Malicious" instead of "Basic" in the scan analysis summary table. (SC-3504)

### Infra/Release Changes

• semgrep-core no longer depends on libpcre 8.x; libpcre2 10.x is now the sole regex engine. (drop-libpcre)
• Aliengrep (generic mode) now uses the maintained libpcre2 10.x regular-expression library instead of the deprecated libpcre 8.x. Matching behavior is unchanged. (aliengrep-pcre2)
• The metavariable-regex and metavariable-comparison (re.match()) runtimes now use the maintained libpcre2 10.x library instead of the deprecated libpcre 8.x. Matching behavior is unchanged. (eval-generic-pcre2)

• Bump bundled npm from 11.8.0 to 11.17.0 by @kbukum1 in #15335
• Fix composer specs failure due to block-insecure feature by @AbhishekBhaskar in #15334
• Add blocked_versions.ignored metric for Security-blocked update checks by @kbukum1 in #15333
• Preserve original bundler checksum on Bundler 4.0.11+ lockfile updates by @lucasmazza in #15249
• Generate .npmrc from scope property when lockfile inference fails by @AbhishekBhaskar in #15264
• Revert disabling block insecure flag in composer by @AbhishekBhaskar in #15339
• Fix no method error during fetching credentials properties by @AbhishekBhaskar in #15340
• Use only uv.lock for uv dependency graphing by @Nishnha in #15217
• Add transitive blocked-version enforcement to updater by @robaiken in #15295
• fix(npm_and_yarn): strip trailing slash from registry URL in Corepack env vars by @ajha-cs in #15324
• Fix pre-commit cooldown bypass and incorrect PR metadata issues with grouped updates by @AbhishekBhaskar in #15346
• Surface blocking parent dependency in npm fix-unavailable message by @thavaahariharangit in #15337
• Skip Gradle cooldown metadata fetch when cooldown is not configured by @yeikel in #15136
• Bundler: surface invalid registry gem metadata as a private source error by @kbukum1 in #15351
• Set default max branch name length to 100 characters by @kbukum1 in #15282
• set temporary token for cargo auth that the proxy will then replace by @brettfo in #15298
• Reject updates for private registries without proper dependabot configuration by @AbhishekBhaskar in #15347
• gradle: bump updater image to 9.4.1 by @thavaahariharangit in #15356
• Bundler: tolerate empty registry checksum metadata in v4 helper by @kbukum1 in #15359
• Preserve custom gradle-wrapper.properties values during wrapper updates by @kbukum1 in #15336
• fix(pre-commit, github-actions): use tag creation date for cooldown instead of commit date by @robaiken in #15350
• Update Sorbet toolchain and regenerate gem RBIs by @JamieMagee in #15304
• Enable six zero-offense Sorbet guardrail cops by @JamieMagee in #15305
• Replace to_hash with to_h and enable ImplicitConversionMethod by @JamieMagee in #15306
• Enforce method signatures via Sorbet/EnforceSignatures by @JamieMagee in #15307
• Image content validation for manifest lists for container image updates by @jpinz in #15352
• Type Version and Requirement internals across ecosystems by @JamieMagee in #15379
• Type RequirementsUpdater base and gradle/maven/sbt with DependencyRequirement by @JamieMagee in #15380
• Type standalone RequirementsUpdaters with DependencyRequirement by @JamieMagee in #15381
• Drop Python 3.9 support by @kbukum1 in #15391
• Stub docker manifest request in helm update_checker spec by @JamieMagee in #15398
• Parse DependencyGroup rules into typed readers by @JamieMagee in #15395
• Type provider_metadata as integer-keyed by @JamieMagee in #15396
• Fix Swift native requirement parser when there are additional arguments in .package() by @kkebo in #15311
• v0.383.0 by @dependabot-core-action-automation[bot] in #15365

New Contributors

• @lucasmazza made their first contribution in #15249
• @ajha-cs made their first contribution in #15324
• @kkebo made their first contribution in #15311

Full Changelog: v0.382.0...v0.383.0

  This version:

        * Improves how the LLM enrichment report reads. The Markdown
          structure the model returns is now rendered with color instead of
          raw markers: the title and section headings (# and ##) and the
          **bold** key terms and verdicts are highlighted, and the markdown
          symbols themselves are removed, so the report reads as a formatted
          assessment rather than plain markup. On a dark background the body
          text is shown in a near-white tone for stronger contrast and
          easier reading, while headings and labels keep their
          blue/purple/cyan accents. The same rendering is applied
          consistently across the CLI, the interactive REPL and the TUI, and
          the enrichment prompts now ask the model to use that heading and
          bold structure so the formatting stays consistent.

• Enigma detector enhance verification to prevent false verified findings by @shahzadhaider1 in #5011
• fix: scan files with lines exceeding bufio's default 64 KB token limit by @MuneebUllahKhan222 in #5022
• fix(postgres): honor ignore tags for default port URLs by @Dawn-Fighter in #4968
• Move to github.com/moby/moby/client from docker/docker by @trufflesteeeve in #4987
• fix: avoid terminal probes before CLI output by @Hackerchen716 in #4994
• Update test containers dependency by @trufflesteeeve in #4978
• Re-host pkg/handlers JSON test fixtures under the org by @amanfcp in #5023
• [INS-465] Add datadogapikey detector to defaults.go by @mustansir14 in #4969
• [INS-470] Add Tly detector to defaults.go, gate it behind feat flag and update its verification logic by @MuneebUllahKhan222 in #5006
• [INS-473] Add wit detector to defaults.go, gate it behind feat flag and update verification logic by @MuneebUllahKhan222 in #5008
• Updating Klaviyo PK new format by @breetan in #5009
• Restructure Klaviyo detector pattern tests by @martinlocklear in #5026
• Replace Renovate config with shared preset (high-risk tier) by @bryanbeverly in #4992
• set redacted value to last 4 characters of secret, to match how the secret type admin interface displays it by @jordanTunstill in #5027
• GitHub finegrained analyzer was improperly handling errors by @dustin-decker in #4498
• [INS-469] Added Rev detectors to defaults.go and gated it behind feature flag by @MuneebUllahKhan222 in #5005
• Fix Renovate lookup: update setup-captain version comment by @bryanbeverly in #4999
• [INS-472] [INS-515] Add user detector to defaults.go, gate it behind feat flag, update verification logic and add custom ep configuration by @MuneebUllahKhan222 in #5007
• Fix: Resolve known dedup issues in notifierWorker by @MuneebUllahKhan222 in #5028
• fix(dropbox): prevent long sl.u. tokens from being truncated by @lukem-ts in #5012
• fix: add filetype=sdist param to pypi detector by @lukem-ts in #4988
• Handlers - Embed small HTTP test fixtures by @amanfcp in #5001
• S3: surface bucket listing failures and fix multi-role object count by @shahzadhaider1 in #5035

New Contributors

• @Dawn-Fighter made their first contribution in #4968
• @Hackerchen716 made their first contribution in #4994
• @breetan made their first contribution in #5009
• @lukem-ts made their first contribution in #5012

Full Changelog: v3.95.4...v3.95.6

• MacOS persistent mode now uses futex mode now too which increases speed
  and reduces system call overhead (opt out with AFL_FAST_CHILD_SYNC) - this
  requires a MacOS from 2024 onwards.
• afl-fuzz
  • new adaptive MOpt! Much better than the outdated one we still had.
    How good it is still needs to be seen but initially it seems to be
    better than standard havoc
  • enforce halt on UBSAN errors
• afl-cc:
  • enforce halt on UBSAN errors (AFL_USE_USBAN=1)
  • better cmplog on MacOS
  • removed unsupported LLVM version code paths from afl-cc and llvm passes
  • compcov: fixes for float splittings (thanks to @ngg)
• nyx_mode:
  • fix nyx_mode issues (thanks to @morehouse)
• qemu_mode:
  • non-colliding coverage!
  • faster persistent fuzzing
  • minor bug fixes
• qemu_bridge:
  • new mode with current QEMU version, so plugins possible, new processors
  • sightly slower than qemu_mode
  • WIP!

• capture error for mapping by @javanlacerda in #5325
• Guard Fuzzing Tasks Behind ENABLE_FUZZ_FOR_BOTS Feature Flag by @javanlacerda in #5328

Full Changelog: v2.33.6...v2.33.7

### Added

• Added support for more operators for folding for constant propagation, including subtraction, division, bit ops, bit shifts, comparisons, and more. (const-folding)
• Added a nosemgrep_disabled field to the scan configuration so the platform can disable nosemgrep inline ignore comments org-wide for a scan. (APPEX-1122)
• Semgrep now skips binary files (images, archives, compiled executables,
  etc.) during scanning by default, detected via matching file extensions
  to known file-format magic bytes Pass --no-exclude-binary-files to
  scan binary files as before. (ENGINE-2708)

### Fixed

• semgrep ci with --sarif now correctly populates the output's ignores
  field with nosemgrep-suppressed findings, in accordance with other output
  formatters. (gh-6651)

### Infra/Release Changes

• Updated the ocaml-tree-sitter-core submodule to the latest upstream main, providing

  • improved thread-safety
  • bumps the tree-sitter CLI option used from 0.20.6 to 0.20.8.

  (ocaml-tree-sitter-core-bump)

• [Swarming] Crash service on startup by @IvanBM18 in #5285
• Remove blackbox fuzzing debug logs by @PauloVLB in #5316
• Revert "Defer fuzzer logs to postprocess (#5311)" by @PauloVLB in #5322
• [Swarming] Adds Response proto & discards tasks with missing dimensions by @IvanBM18 in #5289

Full Changelog: v2.33.5...v2.33.6

• Add support for scope property in npm_registry credentials by @AbhishekBhaskar in #15219
• uv: Remove dead add_auth_env_vars code and add credential matching diagnostics by @kbukum1 in #15209
• Fix npm registry credential leak to sibling paths on the same host by @Copilot in #15248
• Fix pnpm lockfileVersion 9.0 parsing error with optional chaining by @markhallen in #13959
• Parse remaining Job collections into typed structs by @JamieMagee in #15262
• Add a typed Hash subclass for requirement entries by @JamieMagee in #15263
• Fix Gradle wrapper jar encoding by @kbukum1 in #15235
• fix(maven): handle .target updates in file updater by @thavaahariharangit in #15270
• Default all Cargo crates to increase-if-necessary by @JamieMagee in #14306
• Improve handling of Python failures when insecure-external-code-execution: deny is set, Tidier summary output by @brrygrdn in #15269
• Type updated_requirements as DependencyRequirement across all ecosystems by @JamieMagee in #15272
• Remove T.untyped from four common files by @JamieMagee in #15278
• Type create_dependency_file with keyword arguments by @JamieMagee in #15279
• Remove T.untyped from three updater files by @JamieMagee in #15281
• fix(npm_and_yarn): prefer replaces-base registry over lockfile source for metadata fetches by @thavaahariharangit in #15273
• Type DependencyFile#to_h and Notice#to_hash serialization hashes by @JamieMagee in #15283
• Type parse_dep_string return in bundler and npm_and_yarn by @JamieMagee in #15284
• Type registry_parser, git_pin_replacer, and drop stale pnpm entry by @JamieMagee in #15286
• Type python requirement_parser and pip_compile_files by @JamieMagee in #15287
• Type parse_dep_string return in cargo and pub by @JamieMagee in #15288
• Remove stale ForbidTUntyped entries for eight update checkers by @JamieMagee in #15297
• Type Prism AST node parameters in bundler finders by @JamieMagee in #15299
• Introduce typed GitTagDetails for GitCommitChecker local-tag shape by @JamieMagee in #15300
• Type requirements parameters as DependencyRequirement in gradle and cargo by @JamieMagee in #15302
• Type go_modules requirement parsing and version comparison by @JamieMagee in #15303
• Clarify npm security update failure messages by @thavaahariharangit in #15294
• Bump the regclient group across 1 directory with 2 updates by @dependabot[bot] in #14769
• Fix CHECKSUMS header being stripped when removing bundler 4.0.x entry (#15193) by @jmgarnier in #15229
• Bump bundled Deno to 2.8.3 for lockfile v5 support by @markhallen in #15319
• Add Deno workspace support by @markhallen in #15322
• Bump golang.org/x/mod from 0.33.0 to 0.37.0 in /go_modules/helpers by @dependabot[bot] in #15314
• v0.382.0 by @dependabot-core-action-automation[bot] in #15317

New Contributors

• @jmgarnier made their first contribution in #15229

Full Changelog: v0.381.0...v0.382.0

### Added

• Pro: Added experimental cross-file (interfile) analysis for Gosu, enabling taint tracking across multiple Gosu source files. (gosu-interfile)
• Added support for more operators for folding for constant propagation, including subtraction, division, bit ops, bit shifts, comparisons, and more (ENGINE-2789)

### Fixed

• Fixed parsing of integer literals with an underscore immediately after the radix prefix (e.g. 0x_dead_beef, 0o_755, 0b_1010_1010). (LANG-533)
• Python parsing now preserves type parameters on def and class definitions. (LANG-536)
• Semgrep no longer stores the API token in ~/.semgrep/settings.yml's stored
  token when the current scan's token is supplied via the SEMGREP_APP_TOKEN
  envvar. (SEC-2240)
• semgrep ci scans originating from a pre-commit hook will no longer fail with
  Unable to create '<tmp>/.git/index.lock': Not a directory in certain cases. (engine-2736)

### Infra/Release Changes

• Added parsing tests covering Python language features (Python 3.0–3.12). (LANG-531)

Bug Fixes

• deps: close 16 npm security alerts in scenario examples (#637) (ced16fe)
• deps: close 25 npm security alerts in docs and the JS SDK (#620) (ca91380)
• deps: close CRITICAL shell-quote and uuid alerts in JS SDK (#636) (abdc38f)
• voice/#623: reframe realtime agent audio turns so the voiced sim does not echo them (#653) (9302877)
• voice/sdk/#451: stop re-stringifying input_audio array in event-reporter (#639) (d5188d3)
• voice/sdk/#451: stop re-stringifying input_audio array in event-reporter (see+listen) (d5188d3)
• voice+judge: surface dropped model tool calls (#630 + #631) (#635) (de60f82)
• voice: hosted ElevenLabs single-exchange ceiling — docs + enriched timeout error (#643) (aae16be)
• voice: surface tool-only realtime turns (no audio chunk) (#647) (6041447)

Miscellaneous

• deps/#608: migrate elevenlabs@1.59.0 → @elevenlabs/elevenlabs-js (#611) (6498df4)
• examples/voice/#486: retire legacy gpt-4o-audio-preview surface, migrate supported audio examples to gpt-audio-mini (#612) (1ebdd1c)

Documentation

• voice/#606: document STT/TTS model choices as deliberate current-gen (#610) (6211df3)

Code Refactoring

• #518: move capability-matrix doc assertion to dedicated voice-docs suite (#550) (68df34c), closes #518

Features

• voice/#597: voice-mode user-simulator prompt — spoken sentences, not telegraphic (#641) (3a7f660)

Bug Fixes

• #221: return actual conversation in ScenarioResult.messages instead of judge context (#553) (b32125f)
• #496: stop str()-coercing multimodal content in OTel trace + red-team refusal detection (#546) (83842e1)
• deps: close 16 npm security alerts in scenario examples (#637) (ced16fe)
• voice/#493: keepalive-aware recv_audio — tolerate silent-but-pinging stretches (#649) (1e6e1f3)
• voice/#498: surface attributable first-chunk timeout (phase + timeout + cause) (#652) (02e3e3e)
• voice/#623: reframe realtime agent audio turns so the voiced sim does not echo them (#653) (9302877)
• voice: surface tool-only realtime turns (no audio chunk) (#647) (6041447)

Miscellaneous

• examples/voice/#486: retire legacy gpt-4o-audio-preview surface, migrate supported audio examples to gpt-audio-mini (#612) (1ebdd1c)

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>

• Fix leaking Cuttlefish helper process during the teardown by @9640-Akhil in #5299
• Rename EngineOutput to FuzzerRunOutput in uworker_msg and fuzz_task by @PauloVLB in #5310
• Defer fuzzer logs to postprocess by @PauloVLB in #5311
• Support fuzz_targets property in clusterfuzz_manifest.json by @notvictorl in #5305

Full Changelog: v2.33.4...v2.33.5

Bug Fixes

• voice+judge: surface dropped model tool calls (#630 + #631) (#635) (de60f82)

🎉 New Features

• Added support for protocol redirects by @Mzack9999 in #7296
• Added impacket integration by @Mzack9999 in #7356
• Added wmi, tsch, scmr, and dcom helper modules for JS by @dwisiswant0 in #7388
• Added mirroring of -config, -report-config, and -dashboard flags for SDK callers by @ShubhamRasal in #7393

🐞 Bug Fixes

• Fixed DNS variables resolving issue by @Mzack9999 in #7379
• Fixed expressions to prefer exact placeholders over expressions by @dwisiswant0 in #7397
• Fixed an issue in JS where runtimes that outlive the interrupt grace period are not abandoned, by @Mzack9999 in #7378
• Fixed an issue in reporting/jira where status-not was not matched against the transition target status name by @knakul853 in #7361
• Fixed runner to write unsigned-templates warning (WRN) to stderr by @ChrisJr404 in #7371
• Fixed InternalEvent access serialization in interactsh by @dwisiswant0 in #7322
• Fixed workflow to ensure context is properly propagated to child and race steps by @dwisiswant0 in #7383
• Fixed reporting/gitlab by bumping client-go to v1.9.1 and widening IDs to int64 by @ShubhamRasal in #7398
• Fixed memogen to skip context correctly and auto-push scope to upstream by @Mzack9999 in #7419
• Fixed a slice-bounds panic in telnetmini's ParseNTLMResponse when handling truncated NTLM challenges by @tejgokani in #7425
• Fixed SMBv1 probing in JS to occur after SMB2 negotiation by @dwisiswant0 in #7430
• Fixed templates to reject unknown fields when loading JSON templates by @tejgokani in #7453
• Fixed persistence of QueryAuthStrategy parameters in ApplyAuthStrategy by @akhilesharora in #7410
• Fixed loader to warn when templates are excluded by .nuclei-ignore tags by @dogancanbakir in #7452

Other Changes

• Splitted exact matches and pattern handling in catalog for improved performance by @mikhail5555 in #7340
• Updated README_PT-BR.md to reflect current project description and features by @gugacyber in #7405
• Fixed broken cloud scanning link by @dogancanbakir in #7413
• Bumped pdsec modules + govaluate/aurora migration by @dogancanbakir in #7414
• Dropped vulnerable docker/docker dependency by @dogancanbakir in #7447
• Used path-aware filesystem containment checks by @dwisiswant0 in #7420
• Centralized runtime session handling by @dwisiswant0 in #7449

New Contributors

• @ChrisJr404 made their first contribution in #7371
• @gugacyber made their first contribution in #7405
• @akhilesharora made their first contribution in #7410
• @tejgokani made their first contribution in #7425

Full Changelog: v3.8.0...v3.9.0

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>

• Disable npmMinimalAgeGate for Yarn Berry security updates by @yeikel in #15191
• Add Bundler 4 support by @JamieMagee in #15180
• Bump org.apache.maven.plugins:maven-dependency-plugin from 3.10.0 to 3.11.0 in /maven/lib/dependabot/maven by @dependabot[bot] in #15190
• Add GONOPROXY/GONOSUMDB env vars to go_modules FileParser by @Nishnha in #15159
• fix(go_modules): include advisory pseudo-version boundaries for security fix resolution by @thavaahariharangit in #15213
• Retry Gradle metadata fetch on EOF by @thavaahariharangit in #15204
• Handle npm registry EOFError in latest version finder by @thavaahariharangit in #15205
• fix(python): honor .pip-tools.toml unsafe-package in pip-compile updates by @thavaahariharangit in #15202
• Swift: add missing rescue-path test for trailing slash in normalize_name by @Copilot in #15220
• Fix TypeError: String does not have #dig method in PipenvRunner by @Copilot in #14821
• fix(go_modules): run strict go mod tidy and surface real errors by @kbukum1 in #15094
• Gate YARN_NPM_MINIMAL_AGE_GATE on Yarn 4.10+ by @yeikel in #15226
• opentofu: handle OCI source type in MetadataFinder by @diofeher in #14990
• Respect cooldown rules when generating Poetry lockfiles by @thavaahariharangit in #15232
• Fix nuget exception on call to single() by @sebasgomez238 in #15233
• Fix Maven property update previous version metadata by @kbukum1 in #15224
• Detect ICU package error indicating EOL SDK by @brettfo in #15234
• Fix docker_compose parser crash on YAML symbols in lock files by @kbukum1 in #15036
• Handle Berry lockfiles without explicit Yarn config by @Copilot in #14820
• Fix behavioral gap in prerelease detection found with Python and generalized to common by @v-HaripriyaC in #15179
• Fix incorrect cooldown filtering for sha pinned dependencies in pre-commit by @AbhishekBhaskar in #15225
• Harden Helm helper CLI argument handling and fix helm search flag ordering by @Copilot in #15247
• Add an experimental GitHub Action summary for graph jobs by @brrygrdn in #15223
• Add RBI shims for API client wrappers, remove ~110 T.unsafe calls by @JamieMagee in #14615
• Bump library/rust from 1.94.0-bookworm to 1.95.0-bookworm in /cargo by @dependabot[bot] in #15188
• Replace Job's untyped hashes with T::ImmutableStruct by @JamieMagee in #14616
• Fix Gradle/Maven prerelease detection gaps by @v-HaripriyaC in #15222
• Fix OCI Helm chart metadata finder to strip oci:// prefix by @Copilot in #13634
• Fix workflow summary experiment name by @brrygrdn in #15250
• Validate dependency versions in GlobalJsonDiscovery by @brettfo in #15255
• Enable two Sorbet cops, ignore bazel/nix specs by @JamieMagee in #15257
• Enable Sorbet/ForbidTUntyped with a todo backlog by @JamieMagee in #15258
• v0.381.0 by @dependabot-core-action-automation[bot] in #15246

Full Changelog: v0.380.0...v0.381.0

Features

• voice: agent-initiated turns + echo-safe agent-transcript surfacing (#621) (#622) (bc060b2)

Bug Fixes

• deps: close scenario python aiohttp and starlette security alerts (#625) (a32568b)

• Enforce testcase-level access control for testcase blob downloads in /download by @evilgensec in #5297
• Require verified email for whitelisted-domain trust by @vitaliset in #5314
• Do not file public GitHub issues for security testcases by @vitaliset in #5315

New Contributors

• @evilgensec made their first contribution in #5297

Full Changelog: v2.33.3...v2.33.4

Breaking Changes in ICSharpCode.Decompiler

• Remove IsRef, IsOut and IsIn flags from IParameter
• Replace ParameterModifiers with ReferenceKind.

New Language Features

• Update pattern detection to Roslyn 4.11.0
• Support types that provide DisposeAsync without implementing IAsyncDisposable.
• Add support for C# 12 primary constructors.
• Add support for C# 12 'ref readonly' parameters

Contributions

• Add smooth scrolling to settings panels and DecompilerTextView (see #3244 by @tom-englert)
• Decompiler Settings: Checkbox in group header does not reflect state of the group (see #3252 by @tom-englert)
• Various WPF-related refactorings by @tom-englert (see #3257, #3266, #3274, #3283, #3285, #3291, #3292, #3294, #3295, #3297, #3298, #3299, #3302, #3308 and #3314)
• Ignore empty version directories of dotnet (#3265 by @Herrmel)
• Fix Derived Types Node always being empty (#3280 by @Applesauce314)

Enhancements

• Allow running tests on ARM64 (see #3231)
• Alow collecting analyzers annotated with ExportAnalyzerAttribute (see #3239)
• Fix #3237: Use ref readonly locals for readonly.ldelema
• Fix #3001: Support new resources format in ResourcesFile/ResXResourceWriter
• Fix #3134: Include newobj, initobj and call instructions in TypeInstantiatedByAnalyzer
• Fix #3089: Add comment regarding .constraint prefix expressed as cast in C#

Bug fixes

• Fix #3209: Ensure using directives are added for extension methods in higher level patterns such as: foreach -> GetEnumerator(), collection initializer -> Add() and deconstruction -> Deconstruct().
• Fix #3255: Ignore exceptions while decoding sequence point blobs.
• Fix #2166: Unnecessary uint casts/conversions for certain bitwise operations
• Fix #3310: Filter out copy-constructor only if it's an actual record type.

And many other fixes, for a full list click here.

New Language Features

• Updated pattern detection to Roslyn 4.12

Contributions

• Diagramming feature by @h0lg (see #3324)
• More WPF-related refactorings by @tom-englert (see #3325 and #3335)
• High DPI fixes by @CreateAndInject (see #3348 and #3350)
• Missing DecompilerSettings by @naratteu (see #3356)

Enhancements

• Allow implicit conversions in switch

Performance

• Performance: Initialize ToolPanes in DockWorkspace.InitializeLayout() instead of the property getter to avoid WPF seeing them in InitializeComponent() and rendering all panes docked at the right before the layout is properly initialized.

Bug fixes

• Fix #3319: KeyDownEvent field reference was replaced with KeyDown event reference.
• Fix #3349: Make ILSpy ready for .NET 10
• Fix #3361: switch-value conversion was losing its target type.

And many other fixes, for a full list click here.

Generic themes of this release were refactoring the old WPF code base and moving away from platform-dependent implementations to make reuse easier via our ILSpyX package.

A few notable picks from the "What's new" department for you to check out: WebCIL and standalone ECMA-335 metadata support, as well as diagramming (either via ilspycmd or assembly context menu). And in general quality-of-life improvements like the ability to disable automatic assembly loading, performance improvements via DATAS and future-proofing for .NET 10.

New Language Features

• Add support for C# 12 primary constructors.
• Add support for C# 12 'ref readonly' parameters
• Added support for switch on (ReadOnly)Span<char> using a compiler-generated hash function.
• Added new a.GetValueOrDefault(b) -> a ?? b transform for side-effect-free default values.
• Support types that provide DisposeAsync without implementing IAsyncDisposable.
• Updated pattern detection to Roslyn 4.12

Enhancements

• Added support for reading WebCIL assemblies (IL embedded in WASM) (see #3184)
• Added support for reading standalone ECMA-335 metadata (portable PDB and other metadata blobs) (see #3149)
• #3118: Add "Clear assembly list" menu item.
• #2893: Add option to disable automatic assembly loading.
• Allow implicit conversions in switch
• IL output: Add indentation level to make it easier to see custom attributes belonging to interface implementations.
• IL output: Print metadata token of custom attribute.
• Replace native interop CommandLineToArgvW with parsing in Process.Unix.cs from System.Diagnostics.Process #3201
• Natural Sort without interop #3196
• AOT and x-plat changes #3203
• Allow running tests on ARM64 (see #3231)
• Alow collecting analyzers annotated with ExportAnalyzerAttribute (see #3239)
• Fix #3237: Use ref readonly locals for readonly.ldelema
• Fix #3001: Support new resources format in ResourcesFile/ResXResourceWriter
• Fix #3134: Include newobj, initobj and call instructions in TypeInstantiatedByAnalyzer
• Fix #3089: Add comment regarding .constraint prefix expressed as cast in C#
• Fix #3372: Fix loading a DLL that contains byte sequences matching ZIP central directory
• Use Microsoft.Sbom.Targets in NuGets #3346

Contributions

• Diagramming feature by @h0lg (see #3324)
• Various WPF-related refactorings by @tom-englert (see #3257, #3266, #3274, #3283, #3285, #3291, #3292, #3294, #3295, #3297, #3298, #3299, #3302, #3308, #3314, #3325 and #3335)
• High DPI fixes by @CreateAndInject (see #3348 and #3350)
• TreeView: Add referenced types, members and exported types under references (#3092, @fowl2)
• Adjust colors of AvalonEdit built-in highlightings for dark themes (#3138, @ltrzesniewski)
• Add support for Mono C# compiler 2.6.4 pinned region with array variable (#3110, @ElektroKill)
• Add smooth scrolling to settings panels and DecompilerTextView (see #3244 by @tom-englert)
• Ignore empty version directories of dotnet (#3265 by @Herrmel)
• Missing DecompilerSettings by @naratteu (see #3356)
• Fix metadata display of DynamicLocalVariable and DefaultNamespace custom debug information (#3111, @ElektroKill)
• Read and use tuple element names and dynamic type information from PDBs (#3114, @ElektroKill)
• Bugfix: infinite loop in DetermineEffectiveAccessibility (#3164, @yzdeveloper)
• Decompiler Settings: Checkbox in group header does not reflect state of the group (see #3252 by @tom-englert)
• Fix Derived Types Node always being empty (#3280 by @Applesauce314)

Performance

• Activate Dynamic Adaptation To Application Sizes (DATAS) (#3122).
• RDP hardware acceleration (#3122): Enabling hardware acceleration for Remote Desktop Protocol (RDP) to boost performance.
• Performance: Initialize ToolPanes in DockWorkspace.InitializeLayout() instead of the property getter to avoid WPF seeing them in InitializeComponent() and rendering all panes docked at the right before the layout is properly initialized.

Breaking Changes

• ICSharpCode.Decompiler: Added MetadataFile base class for PEFile
• ICSharpCode.Decompiler: IModule.PEFile is now named IModule.MetadataFile
• ICSharpCode.Decompiler/ILSpyX: Added IFileLoader API to allow for easier extensibility of supported file formats (see #3191)
• ILSpy: Split BAML decompiler into library and add-in (see #3178)
• ILSpy/ILSpyX: Moved non-UI analyzer API to ILSpyX (see #3186)
• ICSharpCode.Decompiler: IProjectFileWriter and IProjectInfoProvider APIs are now public (see #3151 and #3191)
• @file support with breaking changes to command line options #3205
• New single instance handling #3212
• Remove IsRef, IsOut and IsIn flags from IParameter
• Replace ParameterModifiers with ReferenceKind.

Bug fixes

• Fix #3072: Ignoring resources with the same name as a namespace.
• Fix bug in UnknownType: Ensuring that the FullName of nested unknown types contains the outer type name(s), not just the namespace and nested type name.
• Fix #3153: Always using SHA1 for public key tokens.
• Fix ILSpy for ZIP files/VSIX with bundle signatures: Enabling ILSpy to open ZIP files and VSIX packages containing bundle signatures.
• Omit package entries from the treeview that denote the directory.
• Fix #3142: Exception when analyzing source of library with global assembly attributes
• Fix #3113: Remove GetAlternativeName and instead reuse existing names, if there are no conflicts.
• Fix #3197: Bug when trying to read a bundle/archive file
• Fix #3189: Support primitive types in Expression.Constant(object) pattern in Expression Trees
• Fix #3209: Ensure using directives are added for extension methods in higher level patterns such as: foreach -> GetEnumerator(), collection initializer -> Add() and deconstruction -> Deconstruct().
• Fix #3255: Ignore exceptions while decoding sequence point blobs.
• Fix #2166: Unnecessary uint casts/conversions for certain bitwise operations
• Fix #3310: Filter out copy-constructor only if it's an actual record type.
• Fix #3319: KeyDownEvent field reference was replaced with KeyDown event reference.
• Fix #3349: Make ILSpy ready for .NET 10
• Fix #3361: switch-value conversion was losing its target type.

And many other fixes, for a full list click here.

New Language Features

• Update pattern-detection to Roslyn 4.13

Enhancements

• #1572: Do not generate variable names that match C# keywords.
• #2716: Add an option to allow sorting custom attributes
• #3377: Extend error information if multiple assemblies with the same (short) name are selected when creating a solution file.
• #3393: Option to turn off smooth scrolling
• #3399: Add module filename as ToolTip of AnalyzerEntityTreeNode
• #3440: Added support for evaluation-order-preserving reference type check
• #3316: Add "variable scopes" to improve naming local variables and anonymous method parameters

Contributions

• Add support for array initialization based on RuntimeHelpers.CreateSpan<T> (see #3380 by @ds5678)
• Load resource stream outside of delegate (see #3389 by @snorrk)
• Allow ILSpy to launch, when net8.0 is not installed, but a later version (see #3391 by @nil4)
• Fix nested namespace directories (see #3449 by @ds5678)
• Fix #3402: System.NullReferenceException on right click on .NET 9 (see #3403 by @tom-englert)
• Add an option to turn off smooth scrolling (see #3405 by @tom-englert)
• Use type hint in pointer arithmetic (see #3413 by @ds5678)
• Improve UI for primary constructors on non-record types (see #3455 by @ds5678)
• Fix exception when writing resx files without adding any resources (see #3418 by @jwfx)
• Enhance null handling in switch transformations (see #3422 by @ds5678)
• Don't include generic constraints in generated explicit overrides (see #3443 by @ds5678)
• Improve generation of not equals check (see #3425 by @ElektroKill)

Bug fixes

• Fix #2269: LocalFunctionDecompiler misplaces nested local functions in ctors
• Fix #3322: Add missing checks for equality comparison
• Fix #3378: Navigation shortcuts (Alt-Left and Alt-Right) don't work when TreeView has focus
• Fix #3381: Make sure that selectedNode is still selected when focus is deferred in IsActive property changed handler.
• Fix #3383: more aggressively transform object initializers on structs
• Fix #3384: add special case for null-literal conversions in optional argument handling.
• Fix #3385: Allow address uses of structs in using transform, if the reference is passed to an in parameter.
• Fix #3392: uses of init-setters must use object-initializer syntax.
• Fix #3401: Multiple problems when exporting an assembly as project
• Fix #3414: Apply latest session settings before saving upon closing the main window
• Fix #3342: Wrong null check in MethodVirtualUsedByAnalyzer
• Fix #3450: Fix "Clear assembly list" not actually persistent.
• Fix #3432: Do not include delegate construction use-sites in DetermineCaptureAndDeclarationScopes.
• Fix attributes tooltip of GenericParam metadata table

And many other fixes, for a full list click here.

New Language Features

• #3467: C# 12 InlineArrays
• #3500: Added .NET 10 as test target
• #3500: Added minimal language feature support to successfully detect new code patterns used in .NET 10

Enhancements

• #3519: Add API diff feature. Please see the PR for how this feature works, and in the collapsed region at the end of the release notes how such an API diff report could look like (full file is attached to release as ICSharpCode.Decompiler9.1to10Preview1Changes_ApiDiff.md).
• #3494: Add dynamic ILSpy settings options to ILSpyCmd
• #3489: Make WholeProjectDecompiler.CreateDecompiler protected virtual to make the decompilation pipeline extensible.

Contributions

• Add configuration option to check for overflow and underflow (see #3484 by @ds5678)
• Allow creating a MetadataFile with a MetadataReader / MetadataStringDecoder (see #3487 by @lordmilko)
• Add an option to not transform Activator.CreateInstance<T>() to new T() (see #3497 by @DoctorKrolic)
• TargetFramework and TargetServices APIs are now public (see #3501 by @nikitalita)
• Support disassembling single file bundle for ILSpy (see #3398 by @cshung)
• Fix stack overflow exception in CSharpResolver (see #3471 by @ds5678)
• Handle explicit optional parameter after default parameter (see #3470 by @ds5678)
• Fix disassembler output, correcting flag(NUM) to flags(NUM) (see #3473 by @hez2010)
• Fix null reference exception when writing resource files (see #3474 by @ds5678)
• Fix SDK-style (modern) inter-project references (see #3502 by @petercrabtree)
• Fix incorrect method match for static methods with instance signature (see #3504 by @MSchmoecker)

Performance

• #3486: Remove XML serialization from DecompilerSettings in ILSpy

Bug fixes

• Fix #3464: Missing cast in interpolated string
• Fix #3482: Drag and Drop is no longer working in the Assemblies tree view.
• Fix #3492: Do not crash, if field used by RuntimeHelpers.InitializeArray is malformed.

And many other fixes, for a full list click here.

New Language Features

• Update pattern detection to Roslyn 5.0 RTM
• C# 13: allows ref struct constraint
• C# 14: extension members

Enhancements

• CSharpConversions: General improvements, fixing various missing rules for C# up to version 9.
• #3344: Support ckfinite IL opcode in decompiler
• #3563: Disassembler: Add support for ildasm /caverbal format
• Detection of records and primary constructors: various bugfixes and improvements. (Special thanks to @sonyps5201314 and @mmusu3)

User Interface

• #3521: Add API to set an initially highlighted entity after navigation
• Navigate visible history (see #3591 by @miloush)
• Improve WordBreak in CustomDialog (see #3535 by @CreateAndInject)
• Use AssemblyWarning when AssemblyReference load faulted (see #3013 by @workgroupengineering)
• Refactoring of EntityToString API (see #3635)
• Removed translations (see #3648)

Contributions

• Allow extracting multiple package entries (see #3508 by @CreateAndInject)
• Support allows ref struct constraint (see #3537 by @jjonescz)
• Allow passing an IDecompilerTypeSystem rather than a DecompilerTypeSystem to CSharpDecompiler (see #3529 by @lordmilko)
• Add DecompilerSettings.ExpandParamsArguments (see #3534 by @MSchmoecker)
• Add DecompilerSettings.AlwaysMoveInitializer: Always move initializer from static constructor to field initializer (see #3540 by @miloush)
• Improve decompilation of unmanaged function pointers (see #3620 by @ds5678)
• Improve decompilation of pre-increment operators (see #3472 by @ds5678)
• Fix #3462: Scrolling with scroll wheel breaks after using file search (see #3538 by @tom-englert)
• Support batch PDB generation (see #3619 by @sonyps5201314)
• Fixes for primary constructors (see #3614 by @mmusu3)
• Improve inlining of boxed values (see #3587 by @ds5678)
• List name first in ILSpy title for multiple instances (see #3589 by @miloush)
• Improve Framework Id detection (see #3581 by @ds5678)
• Enable detection of .NET version without TargetFrameworkAttribute (see #3580 by @ds5678)
• Do not create object initializers for tuples (see #3579 by @ds5678)
• Fix lower case type name conflicting with variable name (see #3572 by @ds5678)
• Fix regression in decompiling local functions with default parameters (see #3560 by @ds5678)
• Copy-propagate the stack slot for collection initializers (see #3554 by @ds5678)
• Normalize UTF-8 BOM Marks and ps1 Indention (see #3546 by @petercrabtree)
• Minor Dev Environment Fixes (.editorconfig cleanup, typo fix, .gitignore tweak) (see #3544 by @petercrabtree)
• Replace GeneratePdbForAssembly with GeneratePdbForAssemblies to improve user experience and remove redundant code. (see #3630 by @sonyps5201314)
• Fix the issue where PDBs generated by ILSpy do not match (see #3629 by @sonyps5201314)
• Do not use ObservableObject when ObservableObjectBase is sufficient. (see #3644 by @tom-englert)

API Clean-up

• Removed legacy UnresolvedUsingScope
• Renamed ResolvedUsingScope to UsingScope
• Removed legacy ToTypeReference
• Removed ITypeReference and implementations

Bug fixes

• Fix #3524: Property without backing field cannot have an initializer.
• Fix #3512: Local function name collides with local variable name
• Fix #2165: DeclareVariables step must update ResolveResult annotation when using out var.
• Fix #3518 by replacing FixLoneIsInst with an inlining restriction.
• Fix #3465: Operator '>' cannot be applied to operands of type 'X' and 'X'
• Fix #3468: Try harder to avoid ref locals if UseRefLocalsForAccurateOrderOfEvaluation is not enabled.
• Fix #3323: Simplify cleanup in AwaitInFinallyTransform, ensuring that we do not miss any containers.
• Fix #1873: Clear ILRange in CopyPropagation
• Fix #1789: missing hyperlink for MethodGroupResolveResult.
• Fix #3476: Scroll position not restored when navigating back
• Fix #3545: Covariant return not detected for abstract override property
• Fix #3549: Do not crash on encountering nil tokens.
• Fix #3543: Missing parentheses around field assignment expression in list initializers
• DebugDirectoryTreeNode: AddressOfRawData and PointerToRawData columns should use hex display.
• DebugDirectoryTreeNode: PointerToRawData was always showing 0 and AddressOfRawData was showing the wrong value.
• Fix #3577: Properly infer the switch governing type and preserve conversions
• Fix #3626: Do not emit named arguments for bool constants, if it causes the call to become ambiguous.
• Fix #3612: WholeProjectDecompiler.CleanUpName does not count bytes on Unix.

And many other fixes, for a full list click here.

Enhancements

• Dedicated UI and Decompiler APIs for C# 14 extensions #3680

Contributions

• Fix in erroneously being applied to this (see #3682 by @nikitalita)
• Update TransformCollectionAndObjectInitializers to check for init-only properties (see #3678 by @nikitalita)
• Fix PowerShell PostBuild failing when solution path contains spaces (see #3669 by @Myself-Bloons)
• Replace FileVersionInfo.GetVersionInfo with DecompilerVersionInfo.Version constant (see #3667 by @MattParkerDev)
• Render operating system name as well as architecture if present (see #3653 by @MatthewSteeples)
• Refactor for cross platform port (see #3641by @lextm)

Bug Fixes

• Fix #3655: ExtractPackageEntryContextMenuEntry
• Fix #3684: Hide compiler-generated base-class forwarding accessor methods
• Fix #3674: Incorrect derived types shown, when generic type inherit from non-generic type with the same name.
• Fix #3671: TransformCollectionAndObjectInitializers mistakenly included trailing variable initialization.

For a full list of changes click here.

Warning

We DO NOT own the domain ilspy dot org See #3709
Download ILSpy only from GitHub Releases!

This release is based on .NET 10.0. Please make sure that you have it installed on your machine beforehand.

New Language Features

• C# 13: allows ref struct constraint
• C# 14: extension members
• #3467: C# 12 InlineArrays
• Update pattern detection to Roslyn 5.0 RTM
• #3500: Added .NET 10 as test target

User Interface

• Dedicated UI and Decompiler APIs for C# 14 extensions #3680
• Navigate visible history (see #3591 by @miloush)
• Removed translations (see #3648)
• #3521: Add API to set an initially highlighted entity after navigation
• Improve WordBreak in CustomDialog (see #3535 by @CreateAndInject)
• Use AssemblyWarning when AssemblyReference load faulted (see #3013 by @workgroupengineering)
• Refactoring of EntityToString API (see #3635)