Whodis 2.5.3

Whodis v2.5.3

Whodis 2.5.3 introduces the expanded WHODIS identity, reorganizes the source
tree for clearer Go module boundaries, and improves release artifact auditing.
CLI behavior, report schema, and the GUI engine protocol remain compatible with
2.5.2.

Branding and documentation

• WHODIS is now presented as Web Host Observatory Domain Investigation Suite
  in the README and the desktop About dialog.
• The README includes refreshed logo and product-preview artwork, clearer badge
  styling, and a direct link from the platform badge to installation guidance.

Source layout

• The Go module and its packages now live under v2/, matching the public
  module version while retaining the existing
  github.com/Alex9001/whodis/v2 import path.
• Contributor, security, migration, build, packaging, and CI paths have been
  updated for the new layout.

Release integrity and maintenance

• Release SBOMs are consolidated into one versioned bundle with checksum and
  content validation, while individual SBOM files are omitted from the public
  asset set.
• Dependabot can automatically merge reviewed patch and minor updates when the
  required checks pass.
• Documentation badges have consistent styling and include the DeepWiki entry.

Compatibility

• Public report schema remains version 5.
• The private GUI protocol remains version 5.
• Existing commands, formats, configuration files, and snapshot imports remain
  compatible.

The release pipeline builds and verifies the CLI and native GUI for Linux,
Windows, and macOS, then publishes checksums, SBOMs, provenance, installers,
archives, native packages, and the multi-architecture container image.

Whodis 2.5.2

Whodis v2.5.2

Whodis 2.5.2 hardens registration target handling, makes native desktop results
substantially easier to copy and research, and adds maintainability guardrails.
CLI behavior, report schema, and the GUI engine protocol remain compatible with
2.5.1.

Lookup reliability

• Hostname and URL normalization now rejects ambiguous AS-number prefixes while
  preserving valid domains, including compatibility cases such as
  askjeeves.com.
• Homepage redirect handling keeps the effective response URL without losing
  the originally requested investigation target.
• New regression, fuzz, and benchmark coverage exercises target parsing,
  redirect resolution, and bounded homepage analysis.

Desktop result interaction

• Result grids and trees support selectable cells and multi-cell copying.
• Copy Selection and Copy Full Result are separate actions in the Edit menu and
  toolbar, with correct enabled states for the focused field.
• Research rows provide Copy and Open Link actions through their context menu;
  double-click opening remains available.
• Stack detail text, raw output, overview fields, DNS results, evidence, related
  domains, and research results can now be selected without retyping values.

Maintenance and dependencies

• Large CLI parsing, audit-check, and custom-policy functions are divided into
  focused components with equivalent behavior and expanded tests.
• CI now prevents severe Go cyclomatic/cognitive complexity and C++ cognitive
  complexity regressions.
• Go runtime dependencies, the container build image, and pinned GitHub Actions
  have been refreshed to their reviewed Dependabot versions.

Compatibility

• Public report schema remains version 5.
• The private GUI protocol remains version 5.
• Existing commands, formats, configuration files, and snapshot imports remain
  compatible.

The release pipeline builds and verifies the CLI and native GUI for Linux,
Windows, and macOS, then publishes checksums, SBOMs, provenance, installers,
archives, native packages, and the multi-architecture container image.

Whodis 2.5.1

Whodis v2.5.1

Whodis 2.5.1 fixes external browser links in the Linux AppImage and cleans up
the project's public documentation. CLI behavior, report schema, and the GUI
engine protocol remain compatible with 2.5.0.

AppImage link handling

• Homepage, online documentation, and issue-reporting actions now launch the
  host system's browser from AppImage builds.
• Links inside bundled help and investigation research results use the same
  AppImage-safe launcher.
• The launcher removes AppImage library and plugin paths before starting the
  host's xdg-open or gio helper, preventing bundled Qt libraries from
  interfering with desktop integration.
• If a browser helper cannot be started, Whodis shows a clear error with a
  selectable address instead of failing silently.

Documentation cleanup

• The README opening is more direct, labeled feature lists use colons, and
  unnecessary em dashes have been removed from the public copy.
• Historical release-note files have been replaced by one reusable release
  notes document. The release workflow uses it only when its heading matches
  the tag, preventing stale notes from reaching a release.
• AUR and community-package instructions now live as evergreen maintainer
  guides without machine-specific fingerprints or release-number pins.

Compatibility

• Public report schema remains version 5.
• The private GUI protocol remains version 5.
• Existing commands, formats, configuration files, and snapshot imports remain
  compatible.

The release pipeline builds and verifies the CLI and native GUI for Linux,
Windows, and macOS, then publishes checksums, SBOMs, provenance, installers,
archives, native packages, and the multi-architecture container image.

Whodis 2.5.0

Whodis v2.5.0

Whodis 2.5 is the reliability and usability release for the full domain
investigation suite. It adds help inside both applications, closes private-
network gaps in target-derived probes, bounds nested work for large batches,
and expands the tests that protect release builds.

Help inside Whodis

• whodis help now lists command reference and concise offline workflow
  guides for registration, DNS, diagnosis, investigation, batch work,
  snapshots, privacy, and troubleshooting.
• The native app exposes the same embedded guide catalog in a searchable,
  modeless Help window. Press F1 even when the private engine is unavailable.
• Homepage, full documentation, and issue-reporting links are available from
  the native Help menu and open only after an explicit user action.

Safer bounded diagnostics

• Diagnose and Investigate now apply the public-destination policy to derived
  HTTP, TLS, SMTP, MTA-STS, and DNS-advertised service connections, including
  redirects and the final dial.
• Private, loopback, link-local, documentation, and other special-use
  destinations are reported as blocked/indeterminate by default rather than as
  evidence that the domain is broken. Managed internal targets can still opt
  in with --allow-private.
• A shared configurable probe semaphore bounds nested network fan-out across
  simultaneous Diagnose and Investigate requests, and waiting probes respond
  to cancellation.
• Engine instances share the immutable compiled technology fingerprint catalog,
  eliminating hundreds of megabytes of repeated initialization allocation for
  embedded clients and GUI helper restarts.
• Bootstrap, RDAP, DNS-over-HTTPS, Globalping, enrichment, and MTA-STS response
  bodies have explicit size limits.

Reliability and release confidence

• Regression coverage now includes every custom policy rule type, bootstrap
  ETag/stale-cache behavior, stream cancellation, atomic output replacement,
  GUI-engine shutdown, and the Batch-window lifecycle.
• Native Go fuzz targets cover subject/endpoints, registration text, DNS wire
  normalization, report rendering, policies, and snapshots. Representative
  engine, rendering, analysis, batch, and policy benchmarks establish a local
  baseline.
• Desktop release builds run the widget suite on Windows and macOS as well as
  Linux. Linux CI also adds an AddressSanitizer/UndefinedBehaviorSanitizer Qt
  build.
• Monthly maintenance checks run race tests, vulnerability analysis, and
  bounded fuzzing. Public-protocol compatibility checks remain manual and
  advisory so ordinary CI is deterministic and offline.
• Dependabot now keeps Go modules, GitHub Actions, and container dependencies
  visible through grouped monthly updates.

Compatibility

• Public report schema remains version 5.
• The private GUI protocol remains version 5.
• Existing commands, formats, configuration files, and schema-v4 snapshot
  imports remain compatible.
• CLI and GUI continue to ship as independent packages so server installs do
  not acquire Qt.

The release pipeline builds and verifies the CLI and native GUI for Linux,
Windows, and macOS, then publishes checksums, SBOMs, provenance, installers,
archives, native packages, and the multi-architecture container image.

Whodis 2.4.0

Whodis v2.4.0

Whodis 2.4 makes site investigation substantially more useful without turning
the project into a crawler or a synthetic website grader. One bounded homepage
response now produces a granular, evidence-backed technology profile and a
concise set of practical homepage observations.

Better technology detection

• Stack components can now report a detected version, parent platform,
  descriptive traits, confidence basis, and the total number of evidence
  signals.
• Wappalyzer fingerprints are categorized more precisely. Technologies found
  only through another product's implication are clearly marked low confidence.
• Explicit server, runtime, WordPress, and edge headers retain high-confidence
  evidence and expose useful version information when present.
• WordPress asset paths and markup recognize WooCommerce, Gravity Forms, Ninja
  Forms, ACF, Elementor, Genesis, common cache/optimization plugins, and other
  popular extensions.
• Unrecognized public WordPress plugin and theme slugs remain visible as
  explicitly unmapped observations rather than disappearing from the report.
• Loose page text is not treated as product evidence, and repeated signals are
  deduplicated behind a bounded evidence list.

Score-free homepage observations

• whodis investigate records response protocol, status, encoding, cache
  hints, decoded size, and whether the HTML analysis was truncated.
• Source-level delivery observations cover scripts, blocking hints,
  stylesheets, image markup, preload/preconnect hints, minified filenames, and
  third-party origins without fetching those resources.
• Basic SEO observations cover title, description, canonical, viewport,
  robots directives, H1 count, structured data, Open Graph, and Twitter cards.
• Browser security-header and transport observations cover HTTPS, HSTS, CSP,
  frame protection, nosniff, referrer policy, permissions policy, and insecure
  resource references.
• Lightweight accessibility observations cover document language, image alt
  attributes, and static form labels/ARIA names.
• Deterministic pass, info, and warning observations appear in the normal
  Findings output. There is deliberately no overall score.

CLI, reports, and desktop

• Terminal and Markdown reports add a compact Homepage observations table and
  show component versions, relationships, confidence basis, and capped evidence.
• One-row-per-target CSV adds homepage URL, status, and summary columns.
• JSON and YAML expose the complete additive homepage profile and structured
  component metadata.
• The native Overview groups platform, commerce, plugins/forms, themes,
  optimization, infrastructure, and homepage observations without adding a
  cluttered new tab.
• Stack remains a master/detail workspace and now shows version, parent,
  traits, basis, and hidden-evidence counts for the selected component.

Boundaries and compatibility

• Whodis reads no more than the first 1 MiB of one final homepage response. It
  does not execute JavaScript, fetch referenced assets, crawl additional pages,
  calculate Lighthouse/Core Web Vitals, grade a site, or make vulnerability or
  product-absence claims.
• Redirect query strings, credentials, cookie values, and terminal control
  characters are excluded from retained evidence.
• Public report schema remains version 5; the new fields are additive.
• The private GUI protocol remains version 5 and advertises the additive
  homepage_profile capability.

The release pipeline builds and verifies the CLI and native GUI for Linux,
Windows, and macOS, then publishes checksums, SBOMs, provenance, installers,
archives, native packages, and the multi-architecture container image.

Whodis 2.3.0

Whodis v2.3.0

Whodis 2.3 expands site investigation with a curated research workspace. It
turns each investigated domain and public IP into useful manual pivots without
silently sharing targets with third parties.

Research workspace

• The native desktop app adds a dedicated Research view, grouped by domain,
  IPv4 address, and IPv6 address.
• A single native Open selected or Copy link action replaces repetitive
  buttons throughout the Stack view.
• Core links cover AlienVault OTX, VirusTotal, BuiltWith, urlscan.io, crt.sh,
  the Wayback Machine, Shodan, and Censys.
• Optional links add Wappalyzer, Netcraft, GreyNoise, AbuseIPDB, BGP.Tools, and
  IPinfo.
• Every link is created locally. A research service receives a target only
  when the user explicitly opens its link.

Flexible defaults

• --research-links core|all|off|<id>[,<id>...] controls links for one CLI
  investigation.
• whodis config set research-links ... persists a CLI default, and the
  configuration wizard exposes the same choices.
• The desktop Advanced dialog offers Core, All, Off, and individual provider
  selection, with settings remembered between sessions.
• Existing custom HTTPS investigation-link templates remain supported and can
  be combined with built-in providers.

Compatibility

• Public report schema remains version 5; JSON and YAML research links retain
  the existing link shape.
• Saved investigations preserve their research-provider selection for replay.
• The private GUI engine protocol advances to version 5 so the engine can send
  the provider catalog and descriptions to the native interface.
• OTX enrichment remains separate and explicitly opt-in with --enrich otx.

The release pipeline builds and verifies the CLI and native GUI for Linux,
Windows, and macOS, then publishes checksums, SBOMs, provenance, installers,
archives, native packages, and the multi-architecture container image.

Whodis 2.2.0

Whodis v2.2.0

Whodis 2.2 makes dense desktop results easier to read and puts the most useful
investigation conclusions up front. It is a focused native-GUI release; CLI
commands and machine-readable report formats remain compatible with v2.1.

Adaptive result layouts

• Every result table and tree now wraps long values instead of clipping them.
• Columns are directly resizable and their widths are remembered separately for
  Overview, DNS, Compare, Delegation, Services, Findings, Stack, Related,
  Errors, Contacts, evidence, and batch results.
• Row heights update after a resize so long DNS values, errors, contacts, and
  technology summaries remain readable.
• The investigation Stack splitter position is remembered as well.

Cleaner investigation workflow

• Investigations now open on Overview, where a new Technology &
  infrastructure section summarizes web technology, server/edge, hosting,
  network owner, DNS provider, mail, analytics/security, and other findings.
• Overview summaries use high- and medium-confidence components, remove
  duplicates, and keep the full list available in a tooltip when a category is
  condensed.
• Stack now uses a master/detail layout. Category headings organize findings;
  selecting one technology, network, link, or note shows its summary and
  evidence once in the lower pane.
• Repetitive Evidence columns and per-finding evidence children are gone.
• Manual investigation pivots are explicit buttons and are never opened in the
  background.

Compatibility

• Public report schema remains version 5.
• The private GUI engine protocol remains version 4.
• No CLI syntax, JSON/YAML fields, snapshot format, or investigation inference
  rules changed in this release.

The release pipeline builds and verifies the CLI and native GUI for Linux,
Windows, and macOS, then publishes checksums, SBOMs, provenance, installers,
archives, native packages, and the multi-architecture container image.

Whodis 2.1.0

Whodis v2.1.0

Whodis 2.1 adds evidence-backed website and infrastructure investigation to
the domain workstation. A single bounded operation now turns public web, DNS,
mail, PTR, and IP-registration observations into a concise stack profile while
keeping every conclusion traceable to its evidence.

Highlights

• whodis investigate example.com summarizes detected web technologies,
  network ownership, DNS providers, and mail infrastructure.
• Technology fingerprints include category, role, confidence, and supporting
  evidence rather than presenting guesses as facts.
• Network ownership and managed hosting are reported separately, avoiding
  assumptions such as treating every Amazon-owned address as an AWS-hosted
  application.
• The native desktop app adds dedicated Stack and Related views.
• Dashboard, plain, tree, GeekBoys, JSON, YAML, Markdown, CSV, and NDJSON
  renderers understand investigation results.
• Local investigation snapshots can be saved and compared through the existing
  audit workflow.

Optional enrichment

AlienVault OTX passive-DNS enrichment is explicitly opt-in with
--enrich otx. Results are capped and related hostnames are checked against
current DNS so Whodis can label observations current, stale, or unknown.
The optional API key is read only from WHODIS_OTX_API_KEY and is never stored
in configuration, reports, snapshots, or logs.

A configurable HTTPS investigation link is available for manual pivots. Whodis
displays it but never opens it automatically.

Safety and compatibility

• Investigation does not execute JavaScript, crawl sites, scan arbitrary
  ports, or contact discovered related domains.
• Third-party enrichment is never enabled by a saved default and enriched
  reports cannot be persisted as local snapshots.
• Engine reports advance to schema version 5 and the private desktop protocol
  advances to version 4. Existing v2 registration and DNS commands retain
  their syntax; integration authors should review MIGRATING_TO_V2.md.

The release pipeline verifies the CLI and native GUI, race and static analysis,
security scans, installers, cross-platform packages, SBOMs, provenance, and the
multi-architecture container image before publication.

Whodis 2.0.1

Whodis v2.0.1

Whodis 2.0.1 is the final stabilization release for the v2 domain workstation.
It fixes correctness and desktop workflow issues found during the post-release
audit without changing the command-line interface.

Fixed

• DNS comparisons now compare each name, type, and class independently instead
  of treating A, AAAA, or other requested types as competing answers.
• The desktop Compare view shows resolver agreement, disagreement, failures,
  transport, response code, DNSSEC state, and timing.
• Retry Failed in the batch window updates failed rows in place and preserves
  successful results in the table and exported file.
• Desktop raw export writes the source selected in the Raw view and is offered
  only when a raw registration response exists.
• WHOIS responses over the 8 MiB safety limit now fail explicitly instead of
  being silently truncated and parsed.

Hardening

• Desktop batches are capped at 1,000 targets; larger jobs remain available
  through the CLI's streaming formats.
• The private GUI engine no longer sends raw registration responses twice.
• Exportable GUI results now use a 64 MiB, 20-result, 30-minute bounded cache.

All CLI, race, static-analysis, installer, native GUI, packaging, and release
checks remain part of the release pipeline.

Whodis 2.0.0

Whodis v2.0.0

Whodis v2 turns the readable RDAP/WHOIS client into a complete, scriptable
domain workstation without making the simple command harder:

whodis example.com

Highlights

• One operation engine shared by the CLI and native Qt desktop app
• Operation-aware schema-v4 subjects for domains, DNS names, IPs, prefixes,
  ASNs, IDNs, URLs, wildcard owners, and reverse DNS
• Explicit registration, inspect, dns, and diagnose command families
• DNS inventory queries run concurrently with bounded resolver work
• CSV and one-report-per-line NDJSON alongside dashboard, tree, GeekBoys,
  plain, JSON, YAML, Markdown, and raw registration output
• Local sanitized snapshots, semantic diffs, and guarded live replay
• Built-in health checks, three scrutiny levels, strict custom YAML/JSON
  policies, stable exit codes, and opt-in failure webhooks
• Atomic output files and protected snapshot storage
• HTTPS/public-address defaults for automatic referrals, opt-in exceptions,
  context-aware TCP cancellation, RDAP retry/backoff, and safer TSIG secret
  sources
• GUI protocol v3, Inspect, selectable DNS types, persistent advanced
  preferences, shared-engine batch work, and visible partial errors
• Cross-platform release assets remain split into the server-friendly
  whodis CLI and self-contained whodis-gui desktop application

Snapshot files omit dedicated API-token and TSIG-secret fields. Live replay of
custom registry or resolver endpoints requires the explicit
--allow-snapshot-endpoints trust switch, so importing a snapshot does not
silently activate its network configuration.

Breaking changes

• The Go module path is now github.com/Alex9001/whodis/v2.
• Engine JSON/YAML reports use schema version 4.
• The private GUI helper protocol is version 3 and no longer exposes the old
  registration-only lookup method.
• Automatic RDAP/referral routing refuses insecure HTTP and private network
  destinations unless explicitly allowed.

See MIGRATING_TO_V2.md for field and API details.

Compatibility

The familiar no-command registration lookup remains unchanged. scan remains
an alias for inspect, and axfr remains an alias for dns transfer so shell
history and existing command invocations keep working. The v1-style Go
registration types remain available as compatibility APIs, but new work should
use Engine and Report.

Known boundaries

DNS has no universal record-list operation, RWhois has no global bootstrap,
diagnosis is intentionally bounded, snapshots are local rather than a hosted
scheduler, and the first v2 desktop packages are unsigned. See the README for
the full, current limitations and package verification guidance.