v0.7.0

Notable changes

Added

• secdb search: full-text search across ZEN SecDB (CVEs, CWEs, advisories,
  NASL plugins, ExploitDB entries), narrowed by record type (--type, a
  comma-separated list) and last-modified window (--since 30d), paged with
  --page/--per-page. The text output links each result to the web GUI and
  ends with the totals by type and severity; json/yaml/template print the
  results with their API field names, the counts by type, severity and source,
  and a pagination object.
• Template function path_url, the web-GUI link for a path returned by the API
  (such as a search hit's web_url).
• --jq <expression>: filter the JSON output of any command with a jq
  expression, without installing jq (e.g. secdb search log4shell --jq '.hits[].id'). It implies --output=json; strings are printed without
  quotes, one result per line, and an invalid expression fails before the API
  call.

Changed

• The SARIF report of audit linux and audit docker has its own automation
  ID, secdb-cli/audit-linux (it was secdb-cli/audit-purl, as for the
  PURL-based audits): GitHub Code Scanning shows their alerts in a separate
  category.
• audit linux over SSH runs ssh -vvv with --debug (or SECDB_DEBUG), so
  the connection log shows up in the debug output.
• --debug (or SECDB_DEBUG) logs the effective configuration: the global
  options (whether an API key is set, never the key itself), the audit options
  and the audited target.

Fixed

• -o yaml, -o template and -o html use the API field names, as -o json
  shows them, for every command: before, audit and ssvc calculate exposed
  the Go names to templates ({{.PURL}} instead of {{.purl}}) and lowercased
  them in YAML (basescore instead of base_score).
• The text output drops the control characters found in the data (titles and
  descriptions come from third-party feeds), so an escape sequence in a record
  can no longer reach the terminal.
• The template functions abbrev and trunc count characters, not bytes, so
  they no longer cut a multi-byte character in two.
• Notifications count the findings with no severity as unknown: the webhook
  counts had an empty "" key for them, and Slack and Teams left them out,
  so their counts didn't add up to the number of findings in the title.

Security

• Built with Go 1.26.9 and golang.org/x/net v0.60.0, which fix
  vulnerabilities in net/http, HTTP/2, crypto/tls and html/template.

Changelog

• 318dc6e Merge branch 'develop'
• 04958db build(deps): bump Go to 1.26.9 and golang.org/x/net to v0.60.0
• 858243a ci: run on every branch push, cancel superseded runs
• 5376968 cmd: update help
• 98d22ad docs(output): document --jq
• 29adf67 docs(search): document secdb search
• df0cd05 feat(audit): run ssh -vvv with --debug
• 5761488 feat(cmd): log the effective configuration with --debug
• 92d820e feat(output): add --jq to filter the JSON output
• 4131ddb feat(output): add the path_url template function
• 3bf74c6 feat(search): add secdb search
• 270e43b fix(notify): count the findings with no severity as unknown
• bff7915 fix(output): strip control characters from the text output
• c780ba5 fix(output): use the API field names in yaml and templates
• 7ed29c8 refactor(audit): prepare the PURLs to audit in one place
• e492355 refactor(audit): shape an audit once with audit.Analyze
• 4b99614 refactor(client): configure the client with client.Config
• 8b4fc66 refactor(cmd): group each command's flags in an options struct
• 23e87c6 refactor(inventory): move target
• d7eafaa refactor(lsp): take the mutex using helper methods
• 6f9ee21 refactor(notify): move the shared HTTP delivery to http.go
• 973b4ef refactor(update): name the newer-release check
• 72018ca refactor: merge user template
• cc231e7 refactor: remove the util package