Snapshot Version 2607 from 3.3dev

Features as TL;DR

• OpenSSL 4.0 compatiblity
• support for RFC 8998 and draft-yang-tls-hybrid-sm2-mlkem ,
• Add missing TLS 1.3 Brainpool groups
• Serveral client handshake updates
• More HTTP security headers
• Provide DNS HTTPS RR functionality (RFC 9460)

What's Changed

• Docker + IPv6 by @drwetter in #2994
• Change banner back to 3.3dev by @drwetter in #2992
• Amend IPv6 with host networking by @drwetter in #2995
• don't use 3.0 docker images anymore by @drwetter in #2997
• Bump docker/login-action from 3 to 4 by @dependabot[bot] in #2998
• Bump docker/setup-qemu-action from 3 to 4 by @dependabot[bot] in #2999
• Bump docker/metadata-action from 5 to 6 by @dependabot[bot] in #3000
• Bump docker/setup-buildx-action from 3 to 4 by @dependabot[bot] in #3001
• Bump docker/build-push-action from 6 to 7 by @dependabot[bot] in #3002
• OpenSSL 4 compatibility by @dcooper16 in #3005
• Fix typo by @drwetter in #3010
• Make sure date -r hits a dir readable by @drwetter in #3012
• Add support for RFC 8998 and draft-yang-tls-hybrid-sm2-mlkem by @dcooper16 in #3014
• Clean up etc/tls_data.txt by @dcooper16 in #3017
• OpenSSL 4 compatibility for stapled OCSP responses by @dcooper16 in #3018
• Add missing TLS signature schemes by @dcooper16 in #3021
• Use OpenSSL with -sigalgs option to obtain server's certificate by @dcooper16 in #3020
• Add missing TLS 1.3 Brainpool groups by @dcooper16 in #3024
• Identify TLS 1.3 ciphers by OpenSSL name by @dcooper16 in #3023
• Address missing extended_master secret extension properly by @drwetter in #3029
• Fix doc error regarding MAX_SOCKET_FAIL + MAX_OSSL_FAIL by @drwetter in #3031
• Fix DN conversion when reading certificate issuer by @drwetter in #3030
• Client handshake updates by @drwetter in #3038
• Apple handshakes updates by @drwetter in #3036
• Added link to php-ssl Certificate scanning integration by @phpipam in #3039
• Improve PR #3041 by @drwetter in #3042
• Fix DNS CAA check for IP scans and subdomains by @grhza in #3041
• Introduce early warning function by @drwetter in #3043
• Add fs data clientsimulation json by @drwetter in #3045
• Fix Permissions-Policy header listed twice in output by @SteveVaneeckhout in #3046
• Update runner to macos-26 (arm64 as before) by @drwetter in #3052
• Fix --mx host:port parsing and incorrect no-MX message (#2986) by @potato-20 in #3049
• Report additional modern security headers (INFO) by @potato-20 in #3050
• Handle badges, remove 1 bracket by @drwetter in #3053
• Fix badges, try 2 by @drwetter in #3054
• Trying to fix the badge issue by @drwetter in #3055
• Revert "Trying to fix the badge issue" by @drwetter in #3056
• Hide CI badges for now by @drwetter in #3057
• Provide better debugging means for GH runners by @drwetter in #3058
• Automate pandoc by @drwetter in #3064
• Bump actions/checkout from 4 to 6 by @dependabot[bot] in #3068
• [Bug] FIXME: issuer_CN error with more than 5 lines in Issuer #3065 by @logopk in #3066
• Bump actions/checkout from 6 to 7 by @dependabot[bot] in #3069
• Revive hsts preload by @drwetter / @potato-20 in #3071
• AI section + minor improvements by @drwetter in #3072
• clarify what a breaking change is by @drwetter in #3073
• Provide DNS HTTPS RR functionality by @drwetter in #3047
• Fix escaping. by @lapo-luchini in #3075
• Fix -4/-6 flag being ignored when no specific test is selected by @SteveVaneeckhout in #3076
• Fixed 'cert_trust_wildcard' identifier when multiple certificates are… by @TheraNinjaCat in #3059
• Fix empty result for HTTPS_RR for Mac and friends by @drwetter in #3078
• fix: inverted return check in sym-encrypt() at testssl.sh:14741 makes … by @ericcgu in #3080
• Fix confusion when scanning TLS-1.3-only hosts by @drwetter in #3084
• Update pull_request_template.md by @drwetter in #3088
• bugfix: aesgcm_used --> enc_aesgcm_used by @ericcgu in #3086
• Small check for semantic unit tests by @drwetter in #3089
• Fix stored XSS in HTML report via unescaped Location: header (#3090) by @ericcgu in #3091

New Contributors

• @phpipam made their first contribution in #3039
• @grhza made their first contribution in #3041
• @potato-20 made their first contribution in #3049
• @lapo-luchini made their first contribution in #3075
• @TheraNinjaCat made their first contribution in #3059
• @ericcgu made their first contribution in #3080 (manually added, github didn't bother)

Full Changelog: v3.3dev-snapshot-2602...v3.3dev-snapshot-2607