Ghostwriter v7.2.0

Summary

This release brings a major change to evidence management: the full deprecation of finding-level evidence, as promised in v6.0.

When evidence management was first introduced in Ghostwriter, findings were the only supported evidence destination, so evidence was attached directly to individual findings. As Ghostwriter matured and gained new features, such as report sections and observations, users needed to reuse evidence in more places. To support that, we added the option to attach evidence either to a finding or to a report.

Over time, the community identified limitations with this model and asked we simplify it. That time has come, so please be aware of this and communicate the change to your users before upgrading.

The included migrations will convert any finding-level evidence to report evidence. If there happens to be a naming conflict, the migrations will handle that for you. They will also update references in the finding if the evidence's name changes. This should be a rare occurrence because the client enforced unique names across all evidence under a report, but the database technically allowed duplicate names as long as the name was unique for the finding or report.

CHANGELOG

[7.2.0] - 30 June 2026

Added

• Added Playwright as a local dev package for end-to-end testing
• Added evidence metadata parser coverage for collaborative editor evidence loading

Changed

• Breaking: All evidence now attaches to a report object and is available to all findings and other report fields
• XLSX report exports now populate the "Supporting Evidence" column from report evidence references used by each finding
  • This includes first-class evidence objects, legacy {{.Evidence Name}} tags, {{.ref Evidence Name}} references, and {{.caption Evidence Name}} captions
• Collaborative editor evidence loading now validates report metadata before querying evidence and keeps the evidence tool disabled only until report-scoped evidence context is ready
  • Users can still upload and insert report evidence from finding, observation, and report extra field editors
• Previews of extra fields now more closely match your report configuration
  • Image evidence will appear in accordance with your border, image width, and alignment configurations
  • Captions will appear above or below evidence based on the configured location
  • Text evidence now matches other code blocks as they typically do in the final reports
    • They no longer inherit a border based on the border configuration
    • They are now the full width of the content instead of bound to the evidence width intended for images
• The extra fields section of the report dashboard now presents fields as cards for easier review and access
• Loading of JSON extra fields is now "lazy" to defend page performance when these fields contain large JSON blobs
  • The JSON data is also removed after closing the preview to maintain page performance

Fixed

• Fixed severity colors appearing incorrect in xlsx reports

Removed

• Breaking: Removed finding-level evidence ownership
  • Existing finding-owned evidence migrates to the owning report
  • In case of friendly name collisions, the migration adjusts the friendly name as needed to preserve both evidence records
  • References to renamed migrated evidence update in the source finding's rich-text fields and extra fields
  • The evidence upload API and Hasura metadata no longer accept non-empty finding or findingId evidence associations