v0.3.0 — Production Readiness & Extensibility

What's New

Extensibility

• YAML DSL for custom rules — define detection rules in YAML without writing Python (#30)
• Rule testing framework — test rules against sample files with malwar test-rules (#30)
• Plugin system — load third-party detection plugins at runtime (#38)
• ML-based risk scoring — machine learning model for anomaly-aware risk scores (#37)

Infrastructure

• PostgreSQL backend — optional PostgreSQL support alongside SQLite (#34)
• Redis caching layer — cache scan results and rule compilations (#35)
• GitLab CI template — ready-to-use .gitlab-ci.yml with Code Quality reports (#30)
• Azure DevOps template — pipeline template with SARIF and ##vso annotations (#30)

Security & Compliance

• Audit logging — immutable, append-only audit trail for all API operations (#20)
• Role-based access control (RBAC) — admin, analyst, and viewer roles (#32)
• CI security scanning — Bandit SAST, pip-audit, and CycloneDX SBOM in CI pipeline

Operations

• Scheduled scanning — background scan jobs on configurable intervals (#26)
• Multi-channel notifications — Slack, email, and webhook alerts on scan completion (#36)
• Git diff scanning — scan only changed files between commits (#30)

User Experience

• Dashboard analytics — trend charts, threat breakdown, scan volume over time (#39)
• Rich TUI — interactive terminal interface for browsing scans and findings (#40)

Stats

• 1,472 tests (16 skipped) — up from 345 in v0.2.0
• 26 detection rules — up from 19
• 30+ API endpoints — up from 16
• 82% code coverage
• 14 issues closed

Breaking Changes

None. v0.3.0 is fully backward-compatible with v0.2.x configurations and databases.

Install

pip install malwar==0.3.0

docker pull ghcr.io/ap6pack/malwar:0.3.0

Full Changelog: v0.2.1...v0.3.0