v0.5.0

v0.5.0

New features

• Cookie: a TUI workbench tab for framework signed session cookies (Flask/itsdangerous, Rack, Django) — decode, verify, crack and forge, the JWT tab's sibling (#565)
• Retest: diff two projects at endpoint scale — a Diff sub-tab, gori run diff, MCP diff_projects, and ⇧F/n to file a row as an Issue or Note (#824, #845)
• Issues: CVSS v3.1/v4.0 scoring with cvss:>=7 filtering, CVSS-aware exports and SARIF security-severity (#575)
• gRPC: proto descriptor sets and server reflection as schema sources, schema-aware field fuzzing (--field), gRPC FIELDS editing, and grpc-web outcomes read from the body frame (#823, #841, #849, #984)
• Hooks: pipe bytes through your own command — a Rewriter pipe op, a Decoder exec: step, a Probe exec rule, and mine --hook (#838, #853)
• Proxy: outbound TLS fingerprints per destination and per send (chrome/firefox/safari/curl), plus gori settings tls-fingerprint (#822, #844)
• Proxy: SOCKS5H, project-scoped proxy auth and destination filtering, and an upstream CONNECT proxy over TLS (http+tls://) (#858) - Rewriter: one-keystroke response-modification presets (unhide fields, drop CSP or security headers, disable SRI) installed as ordinary rules (#821) - Project: an ACTIVITY pane over the event feed, and config changes recorded with who changed what (#864)
• Fuzzer: save a complete run — every request/wire/response byte — with run history, bounded restore, gori run fuzz save/list/show/delete and MCP save_results (#897) - Repeater/Fuzzer: replay a WebSocket captured over HTTP/2 (RFC 8441 extended CONNECT)
• Probe: passive takeover, cleartext-credential, shared-cache and internal-host checks; blind OS command injection and XXE over OAST (#970, #974)
• MCP: --tools=SPEC picks which of the 160 tools the server advertises, so a client parks the catalogue it needs instead of ~43k tokens - TUI: / filters on the Discover, Miner and Authorize lists plus Help and Hotkeys; sub-tab multi-select; y copy on nine more lists; double-click parity; opt-in tab numbers; a Mouse settings section (#683, #860)
• Nix: the flake gains an overlay, and gori update recognises a relocated Nix store (#893) - Docs: a terminal-inspired reading layout with a book-style Playbooks space in English and Korean (#991)

Changes

• Keys: ⇧X clears any clearable tab, t marks, [/] cycle tabs, d no longer crawls from the Sitemap, and confirm cards answer ↵ with their own verb; every hint, chip and Help row names the effective keymap, and the Copy verbs are rebindable (#898, #899, #902) - TUI: History search yields, ^F highlighting is byte-linear, idle settings reloads leave the render fiber, Notes takes a paste as one edit, and modals stay answerable on a small terminal (#967, #975, #976, #977)
• Writes: a rule, tag, note or intercept edit the store refused is reported as refused instead of painted as saved, on every surface (#980, #990)
• QL: NOT(…)/-(…) negates the group, status:5XX folds, method~/scheme~ take regexes, and a field the backend cannot answer is refused instead of searched as text
• MCP: paging truth for list_history/list_sitemap, both ends of the capture window in project_info, cut bodies flagged in get_flow/compare_flows/get_response_body_chunk, and OAST transport failures marked retryable (#906, #918, #981)
• CLI: gori run refuses a stray positional, says when --limit cut the listing, pads columns in terminal cells, and names an unbound $NAME in the mine/sequence/minimize summaries - Protocol: an h2 trailer can no longer restate the status, a decoded h2 response survives a transport failure, Connection tokens are read across repeated lines, and a refused response head is kept on the flow - Authorize: a run whose baseline was itself refused reads review, not BYPASS; leaving a project stops the engine; slot names collide case-insensitively - Export/Import: the code a "Copy as" row hands over runs, and a HAR round-trip keeps the framing the source stated
• Repeater: --verbatim stops a session binding too, the Sandbox gate is taken on the bytes that go on the wire, and h2 header names go out byte-exact (#910)
• Docker: gori no longer runs as PID 1 (so docker stop exits 143), tzdata ships, and WORKDIR is /data - Fixes: 27 Decoder defects, Sequencer sample top-up, Miner framing and stop-ends-retries, Discover character references in links, Probe truncated-body false positives, and the Export request-line framing guard (#985–#990)

New Contributors

• @d0kk2bi made their first contribution in #809
• @chei-l made their first contribution in #839
• @ksg97031 made their first contribution in #907

Special Thanks

• @sebastianosrt Thank you so much for your great contributions!

Full Changelog: v0.4.0...v0.5.0