v20.2.0

🅰️ Frontend

• Updated frontend to Angular 22.x and Angular Material 22.x
• Updated TypeScript to 6.0.x
• Updated angular-eslint to 22.x
• Switched QR code library from ng-qrcode to angularx-qrcode
• 2734b6ad9: Removed deprecated @angular/platform-browser-dynamic dependency

🎯 Challenges

• 03645895e: Harmonized challenge name capitalization (e.g., "Exposed credentials" → "Exposed Credentials")
• Added ⭐⭐-challenge "Misplaced IaC Files"
• Added ⭐⭐⭐⭐-challenge "Login Cloud Admin" (including coding challenge)
• Added ⭐⭐⭐-challenge "Vulnerable Infrastructure" (including coding challenge)
• 68815f2a7: Updated mitigation URLs for IaC-related challenges
• d832137b1: Supported n-gram in similarity checks for "System Prompt Extraction" (#3515)
• Disabled dangerous "Deprecated Interface" challenge on Docker/Heroku by default
• Added missing guard around dangerous "Local File Read" challenge

🎨 User Interface

• 8c92a2058: Added role field and deluxe membership link to user profile page

🕵️ Cheat Detection

• b55fe2977: Added cheat detection for source file overlap in challenge submissions using Dice Coefficient

🌐 I18N

• Updated server-side I18N base strings and backend translations

🧹 Technical Debt Reduction

• 3acae4030: Fixed TypeScript 6.0 deprecations
• 4a33cd421: Properly adopted test mocks for angularx-qrcode
• 27cccf771: Removed GitPod references entirely
• e3343c50b: Updated @types/node to v26.x
• Added allowScripts configuration to package.json and frontend/package.json
• b66bec35c: Refactored file path handling to also work on Windows
• 68a9a1d65: Optimized i18n handling by disabling file restoration during test suite runs
• a92bafc11: Removed contradictions and fluff from challenge descriptions
• 42149e0aa: Moved terraform routes out of existing vulnerable code snippet markers

🏗️ Build Process

• 7fa7ad76e: Replaced Grunt with a custom packaging script (scripts/package.mjs)
• df1b6bbd8: Extracted draft release creation from packaging pipeline into separate workflow step

⚙️ DevOps Automation

• Updated CI/CD pipelines to use new packaging script instead of Grunt

v20.1.1

🔥 Hotfix

• Added Node.js v26 to release pipeline to create expected packaged artifacts for Linux/Windows/MacOS

v20.1.0

👟 Runtime

• Added support for Node.js 26.x
• Replaced native libxmljs2 with WASM-based libxml2-wasm to remove native build dependency

🎯 Challenges

• Added ⭐⭐⭐-challenge: System Prompt Extraction (prompt injection against chatbot) (kudos to @JohannesR0essler)
• Added "Fix It"-phase for NFT Takeover coding challenge

🎨 UI

• Fixes heading overflow into product table by adjusting padding

🅰️ Frontend

• Refactored Scoreboard to use Angular Signals for improved performance
• Upgraded Cypress to v15

🐳 Docker

• Optimized encoding of some more pictures and videos to bring down the size of the container image down even more than before

🐛 Bugfixes

• #1788: Fixes issue preventing (properly) forged JWTs from being accepted in some endpoints
• #3433: Fixes some translation string from being properly displayed
• d95b385: Fixes welcome banner from not being properly scrollable & dismissable on certain mobile screen sizes

🧹 Housekeeping

• Migrated server unit tests from Mocha & Chai to the Node.js test runner
• Upgraded TypeScript to v6
• Rewrote ZIP upload handler to use async/await and updated unzipper library
• Replaced FormSubmitService with native form submission in frontend

🔧 Configuration

• Migrated configuration validation from YAML schema to zod
• Added overwriteUrlForCsrfChallenge option to allow customizing the attack origin for the CSRF challenge

🌐 I18N

• Updated various translations

v20.0.0

This release brings significant changes to existing challenges (⚡) which might break canned CTF setups as well as solution guides made for previous versions of OWASP Juice Shop! It also contains technical breaking changes or renamings (⚠️) which might require migrating to a newer Node.js version or updating existing customization files.

👟 Runtime

• Removed support for Node.js 20.x (⚠️)

🎯 Challenges

• Added several ✨AI✨ challenges (Require a configured LLM/AI endpoint to work)
  • "Chatbot Prompt Injection" ⭐⭐-challenge
  • "Greedy Chatbot Manipulation" ⭐⭐⭐-challenge
  • "AI Debugging" ⭐⭐-challenge
• Remove existing NLP-based chatbot implementation and corresponding challenges "Bully Chatbot" and "Kill Chatbot" (⚡)
• Renamed and broadened scope of Internet Traffic tag into External Dependency tag
• Challenges "Mint the Honeypot" and "Wallet Depletion" now require an ALCHEMY_API_KEY in order to function (⚠️)

🖼️ User Interface

• #3145: Changed product overview into more compact and modern grid layout (kudos to @bogminic)
• Redesigned Coding Challenge View to it's own separate page with a more intuitive flow and more modern code highlighters.
• #3197: Guest basket support for anonymous users with merge-on-login (kudos to @bogminic)
• #3154: Proper mobile scroll behavior (kudos to @btechwala03)
• #3317: Various UI and layout fixes (kudos to @bogminic)
• Apply blur effect and enhanced grid view also for photo wall
• #3310: Added new neon-fire theme (kudos to @VibhorGautam)
• Added new lime-green theme
• Set neon-fire as default theme for ctf configuration

🅰️ Frontend

• #3146: Updated frontend to Angular 21.x
• Migrate Angular Material themes from legacy M2 to M3
• Apply custom theme now also to Data Erasure Request view

🐳 Docker

• Optimized container image size to the smallest it has been since Juice Shop v8, over 7 years and many sizable additions ago

🐌 Performance

• Optimized startup time to start ~30% faster, by lazy-loading heavy dependencies and batching startup database inserts
• Split out pages with heavier dependencies for faster initial load
• Converted Easter egg planet textures and images to .avif format for better performance

📺 Monitoring

• 2d8ba61: Added prometheus metrics to track LLM token usage and tool calls. Note: needs to be supported by the LLM endpoint.

🤥 Cheat Detection

• 6f0e4f9: Added support for loosely coupled challenges to not trigger cheat scoring independent of timing
• e260c74: Now treating direct access to tracking pixels as guaranteed cheating

🔧 Configuration

• Added strict enum validation for several configuration options (e.g., codingChallengesEnabled, hintPlaybackSpeed, showCountryDetailsInNotifications)

🛒 Shop

• Added 10 new products (kudos to @bogminic for some of the new drink options)
• Added 1 new customer user basil

🧑‍🔧 Maintenance

• Migrated API test suite from Jest & Frisby to Node.js test runner & Supertest
• Migrated frontend test suite from Karma to Vitest
• #3187: Added unit tests for conversation storage service (kudos to @btechwala03)
• #3294: Improved stability for last login IP test (kudos to @sushantkhemalapure)
• #3150: Introduced force-clicks to improve Cypress test reliability (kudos to @btechwala03)
• Added PR compliance & spam check workflow
• Removed CommonJS exemption for jwt-decode

🌐 Internationalization

• Expanded 🇫🇷, 🇩🇪, 🇳🇴, 🇩🇰, 🇯🇵, 🇨🇳, 🇵🇱 and many other translations

v19.2.1

🏗️ Build Process

• Auto-update coding challenge snippets file in website repository during releases
• Fix creation of frontend bundle analysis diagram during releases

v19.2.0

This release contains an important policy or licensing change (📜) that might impact your interaction with the project as a user or contributor. This release furthermore contains breaking changes or renamings (⚠️) which might require updating existing customization files.

🎯 Challenges

• #2964: Added Password Hash Leak ⭐⭐-challenge (kudos to @tghosth)
• 6db9f29: Added coding challenge for Wallet Depletion challenge
• c3defc7: Added coding challenge for Mint the Honeypot challenge

🎨 User Interface

• Various usability enhancements for Coding Challenges
  • #2875: Added Jump to related coding challenge button to challenge-solved notifications (kudos to @sawankshrma)
  • 3d19b63: Make enabled coding challenge button visually distinct on Score Board
  • 7ce1352: Locked/unlocked icons of Find It and Fit It phase of Coding Challenges are now handled seperately
  • 3ae7dce: Opening a Coding Challenge now scrolls to Fix It tab if Find It was already solved
• #2876: Payloads in challenge descriptions on the Score Board can now be copied to clipboard by clicking on them (kudos to @abhay-codes07)
• #2932: Immediately refresh the hint tooltip when unlocking a new hint (kudos to @sawankshrma)
• #2982: Language dropdown list now includes backend strings in its translation gauge and percentage (kudos to @rajeshuchil)
• #3077: Add support for displaying ctf system wide notifications from MultiJuicer and other CTF Systems via a configurable endpoint

🎭 Customization

• Removed option challenges.showFeedbackButtons from all configurations (⚠️)

📋 SBOM

• #2859: Updated to CycloneDX 1.6 SBOMs (kudos to @jkowalleck)
• #3084: Only generate JSON SBOMs, no more XML SBOMs

🏦 Technical Debt

• Fixed accidental deviations of coding challenge snippets after refactorings
• #2872: Extracted all inline CSS style into class declarations (kudos to @agrim-rai)
• Various accessibility enhancements (kudos to @bogminic, @caffeine-rohit, @this-is-varunxyz, @agrim-rai, @JwCwn et al.)
• Various code refactorings and added test cases (kudos to @rajeshuchil, @HishamHR5, @ishwarthecodddr et al.)
• #3084: Migrated to newer Angular Application Build Infrastructure using esbuild instead of webpack

🐳 Docker

• Official Docker image now uses Node.js 24.x base images

🐛 Bugfixes

• Fixed visual glitch of search field in navigation bar (kudos to @abhay-codes07)

🤝 Code of Conduct

• Replaced Contributor Covenant 2.0-based CODE_OF_CONDUCT.md with a custom version based on and referring to the OWASP Code of Conduct (📜)

v19.1.1

🔥 Hotfix

• c9af649: Fix release pipeline issue on Windows with PowerShell for Node.js 22 and 24

v19.1.0

🎯 Challenges

• Introduced new category Observability Failures and moved four logging-/monitoring-related challenges there

🐛 Bugfixes

• Fixed various overflow and cut-off issues on smaller screens (kudos to @bogminic, @agrim-rai & @sukhmancode)
• #2676: Prevent server crash when rendering the User Profile fails for any reason

🌐 I18N

• #2757: Include function name in button and output label names on Web3 Contract editor screen (kudos to @devvaansh)

v19.0.0

This release brings significant changes to existing challenges (⚡) which might break canned CTF setups as well as solution guides made for previous versions of OWASP Juice Shop! It also contains technical breaking changes or renamings (⚠️) which might require migrating to a newer Node.js version or updating existing customization files.

👟 Runtime

• Added support for Node.js 24.x

🅰️ Frontend

• Updated frontend to Angular 20.x and Angular Material 20.x (kudos to @bogminic)

🆘 Hints

• Score Board now offers gradually unlockable hints per challenge
• Added backend and challenge solution webhook support for multiple text hints per challenge
• Removed hint and hintUrl fields from challenges.yml definition and corresponding entity model (⚠️)

v18.0.0

This release brings significant changes to existing challenges (⚡) which might break canned CTF setups as well as solution guides made for previous versions of OWASP Juice Shop! It also contains technical breaking changes or renamings (⚠️) which might require migrating to a newer Node.js version or updating existing customization files.

👟 Runtime

• Removed support for Node.js 18.x and no longer provide packaged distributions for this version (⚠️)
• Removed inofficial support for Node.js 19.x
• Switched from libxmljs to libxmljs2 as XML parser where binaries are available for up to at least Node.js 24

🐳 Docker

• Official Docker image now uses Node.js 22.x base images
• Removed pre-build step specific to libxmljs

🎭 Customization

• Added full-conversion DEF CON 33 theme that can be used with NODE_ENV=defcon33 npm start
• #2625: Added a metricsIgnoredUserAgents config option to configure uncommon metric collector user-agents for challenge tracking. Support for more common metric collectors have been added too, see bugfixes. (kudos to @SvenKirschbaum)

🎯 Challenges

• Added new Leaked API Key ⭐⭐⭐⭐⭐-challenge
• #2602: Added accompanying ftp/package-lock.json to make several Vulnerable Components category challenges more accessible
• Cross-Site Imaging challenge now uses https://cataas.com/ instead of frequently unavailable http://placecats.com/ service (⚡)

🐛 Bugfixes

• #2631: Fixed discount validation for "Forged Coupon" challenge to only trigger for 80%+ as intended
• #2625: Fixed metric challenge getting solved by non-prometheus monitoring agents. e.g. OpenTelemetry collector. (kudos to @SvenKirschbaum)