v4.5.2

v4.5.2 Changelog

• Features or Enhancements

  • Updated Android certificate analysis with apksigner from build-tools 37.0.0 and apktool 3.x support for more robust, version-agnostic cert parsing
  • Added high-confidence known secret format detection in Android/iOS string analysis (GitHub, Slack, Stripe, OpenAI, PEM keys, and more)
  • Migrated VirusTotal integration to API v3 with large-file upload support (up to 650MB)
  • CI/Docker supply-chain hardening: SBOM attestations, Actions updates, Postgres 18 compose layout, and PyPI publishing via OIDC Trusted Publishing

• Bug Fixes

  • Fixed CSRF "null origin" error during SAML SSO login (e.g. Keycloak)
  • Fixed formatting in SKIP_CLASS_PATH list
  • Fixed Android rule to match the literal mode argument in getSharedPreferences

What's Changed

• Update: certificate analysis (apksigner) by @AdrienHutinel in #2630
• fix csrf error by @Antiksec in #2633
• Fix formatting in SKIP_CLASS_PATH list by @Zen1th53 in #2634
• fix(rules): match the literal mode argument in getSharedPreferences by @Eljees in #2638
• ci: bump docker workflow actions and add SBOM attestations by @kobihikri in #2639
• Detect known secret formats in Android/iOS string analysis by @mmmugh in #2640
• ci/docker: supply-chain Actions updates and Postgres 18 compose layout by @ajinabraham in #2643
• Migrate VirusTotal integration to API v3 by @ajinabraham in #2644
• chore: bump Python dependencies by @ajinabraham in #2645
• ci: publish to PyPI with OIDC Trusted Publishing by @ajinabraham in #2646

New Contributors

• @AdrienHutinel made their first contribution in #2630
• @Zen1th53 made their first contribution in #2634
• @Eljees made their first contribution in #2638
• @kobihikri made their first contribution in #2639
• @mmmugh made their first contribution in #2640

Full Changelog: v4.5.1...v4.5.2