v2.8.0

Changelog

Features

• f0df9f4: docker:feature - Validate Docker version from the Docker API (#965) (@luiguip)
• 522076a: cli:feat - add SARIF output support (#946) (@anthturner)
• df2e20c: hash:feature - new hash format and handle the future depreciations (#996) (@nathanmartinszup)
• 578e883: workflow:feat - Automating the release notes (#997) (@wiliansilvazup)
• 6e052fb: java:feature - Add Rule for CVE-2022-21724 (#1033) (@wiliansilvazup)
• 2c11096: rules:feat - adding rule to spring framework rce (#1053) (@nathanmartinszup)
• a615329: docs:feat - Security Policies (#1052) (@lucasbrunozup)

Bug fixes

• 1bfe223: install/sh:bugfix - updating install sh to install latest if more recent (#913) (@nathanmartinszup)
• 9245d7d: bundler:fix - correctly parse output error (#921) (@matheusalcantarazup)
• e263056: formatters:fix - not show which tool generate the error (#932) (@matheusalcantarazup)
• 0a2ecee: trivy:bugfix - adding func to avoid hash changes in trivy formatter (#929) (@nathanmartinszup)
• 73511f0: engine/swift:bugfix - improving HS-SWIFT-24 rule to avoid false positives (#930) (@nathanmartinszup)
• 18e8b89: formatters/tfsec:bugfix - vulnerabilities were being ignored due missing severity (#934) (@nathanmartinszup)
• 87673d1: engine/leaks:bugfix - improving leaks rule 26 (#972) (@nathanmartinszup)
• c4184c5: engines/jvm:fix - false positives on base64 encode/decode (#974) (@matheusalcantarazup)
• 22acb2b: dockerfile:fix - update and upgrade packages (#977) (@matheusalcantarazup)
• 0c1e691: commitAuthors:bugfix - fix when pass invalid line to SetCommitAuthors and changed formatters error handling approach (#978) (@iancardosozup)
• b6d92cd: dockerfiles:bugfix - adding no cache flag (#982) (@nathanmartinszup)
• 1b9673d: dockerfiles:bugfix - updating docker base image (#983) (@nathanmartinszup)
• 6e4d0c1: dockerfile:bugfix - updating dockerfiles docker base image (#989) (@nathanmartinszup)
• f860773: docs:fix - commit template message (#992) (@matheusalcantarazup)
• 345c748: analyzer:bugfix - separate warnings from errors (#1013) (@nathanmartinszup)
• 29c7330: gitleaks:bugfix - updating formatter to gitleaks v8 (#1010) (@nathanmartinszup)
• 96fbcc8: sarif:bugfix - removing version prefix (#1019) (@nathanmartinszup)
• 8517c84: goreleaser:bugfix - adding release auto (#1027) (@nathanmartinszup)
• 748d681: utils/file:fix - missing {HORUSEC_CLI} prefix and typo on log debug (#1025) (@matheusalcantarazup)
• a0c13d2: docker:fix - missing image name on debug log (#1026) (@matheusalcantarazup)
• e8eb1ba: horusec:fix - Errors reported in v2.8.0-beta.1 (#1050) (@wiliansilvazup)
• df32c1c: analyzer:fix - Fixing details wrong (#1054) (@wiliansilvazup)

Chores

• f2c500d: yarnaudit:chore - improve tests and code cleaning (#910) (@matheusalcantarazup)
• 0df35e4: analyzer:chore - split analyzer implementation into runner (#909) (@matheusalcantarazup)
• d3018a8: workflow/security:chore - updating security workflow to use latest rc (#911) (@nathanmartinszup)
• 802f0c4: formatters:chore - remove unused methods from IService (#912) (@matheusalcantarazup)
• 04f682e: formatter:chore - replace strings.Replace to fmt.Sprintf (#914) (@matheusalcantarazup)
• d0f5f52: nancy:chore - remove logs when running without GITHUB_TOKEN env (#922) (@matheusalcantarazup)
• c43d93c: engine/java:chore - add CVE-2021-44832 detail to the description of the HS-JAVA-150 rule (#916) (@dearrudam)
• bfb07e6: workflows:chore - removing old release file to avoid confusion (#924) (@nathanmartinszup)
• 112e82e: bundler:chore - improve tests and code cleaning (#925) (@matheusalcantarazup)
• 5d8b435: phpcs:chore - Update PHP_CodeSniffer to show severity and code (#935) (@wiliansilvazup)
• 3d9f22a: engine:chore - update to new engine (#923) (@iancardosozup)
• a175361: sonarqube:chore - merge entities/sonarqube with services/sonarqube pkg (#947) (@matheusalcantarazup)
• ae31579: git:chore - move CommitAuthor declaration to git pkg (#948) (@matheusalcantarazup)
• 886da4c: makefile:chore - bump gci tool (#970) (@matheusalcantarazup)
• 43c551d: swift:chore - Improvements Tests of all Swift Rules (#953) (@wiliansilvazup)
• 6b630c1: kubernetes:chore - Improvements Tests of all Kubernetes Rules (#961) (@wiliansilvazup)
• aadaaed: enums:chore - remove unused enums/engine pkg (#979) (@matheusalcantarazup)
• 9f7dd64: checkov:chore - removing pborman/ansi dependency (#975) (@iancardosozup)
• 6abcc37: engine/java:chore - updating log4j rule to avoid false positives (#980) (@nathanmartinszup)
• 8659ee7: formatters:chore - add missing RuleIDs (#967) (@anthturner)
• d7fcbe3: lint:chore - Fix lint, format and Horusec API tests (#1004) (@wiliansilvazup)
• 0bd4d4d: formatters:chore - normalize not found files warn message (#1023) (@matheusalcantarazup)
• 649b267: formatters/ruby:chore - removing unnecessary error messages (#1024) (@nathanmartinszup)
• 763a796: custom_rules:chore - Refactored tests for custom_rules to table tests (#1049) (@Adam88morris)
• 013b22e: javascript::chore - Adding improvements on javascript rules (#1043) (@wiliansilvazup)
• 40d4191: csharp:chore - Improvements on safe and unsafe code in csharp (#1037) (@wiliansilvazup)
• cf7b1bf: dart:chore - Adding improvements on dart rules (#1038) (@wiliansilvazup)
• 6a4dd93: k8s:chore - Adding improvements on k8s rules (#1039) (@wiliansilvazup)
• 841c343: leaks:chore - Adding improvements on leaks rules (#1040) (@wiliansilvazup)
• 229df8b: swift:chore - Adding improvements on swift rules (#1042) (@wiliansilvazup)
• c6f20fe: nginx:chore - Adding improvements on nginx rules (#1041) (@wiliansilvazup)

Others

• f14f910: fix:semgrep - Disable collect metrics and fix log message (#968) (@wiliansilvazup)
• 0f24a9e: chore:workflow - Added new workflow to validate release workflows (#988) (@wiliansilvazup)
• 51a7006: docs: add issues section (#991) (@HenriqueZup)
• 2aa2c5b: release:build - Removing GPG and sign images from build.yaml (#1018) (@wiliansilvazup)
• ac6405a: scs: bugfix - att outdated chsharp sdk on horusec-engine-csharp (#1022) (@iancardosozup)
• cce34ce: This commit implements vulnerable and safe samples for the javascript rules. (#1051) (@lucasbrunozup)

Docker images

• docker pull horuszup/horusec-cli:v2.8.0

Full Changelog: v2.7.1...v2.8.0