# changelog

author: Danila Vershinin <info@getpagespeed.com> 3.2.1-1
changelog:
  - 3.2.1 release compatible with PHP >= 5.5.9 (3.2.2 has runtime issue https://github.com/gordalina/cachetool/issues/158)
  - fixed up binary


author: Danila Vershinin <info@getpagespeed.com> - 0.2.14-1
changelog:
  - Rewrote `regex_redos` plugin for improved ReDoS detection with no external dependencies.
  - Added support for nginx 1.29.3 with updated `add_header_redefinition` behavior.
  - `if` blocks now correctly expose regex capture groups as variables.
  - Expanded documentation with new guides and examples for plugins.
  - Added extensive integration tests for WordPress configurations.
  - Improved code quality with legacy cleanup and better comments.


author: Danila Vershinin <info@getpagespeed.com> - 0.2.21-1
changelog:
  - Fix security vulnerability in configuration parsing.
  - Improve compatibility with newer versions of Nginx.
  - Enhance error handling for invalid configurations.
  - Update documentation for clearer usage instructions.
  - Refactor code for better maintainability.
  - Optimize performance for large configuration files.


author: Danila Vershinin <info@getpagespeed.com> - 0.2.22-1
changelog:
  - Added Checkstyle XML output format for CI/CD integration.
  - Integrated Bandit for local security scanning in pre-commit.
  - Custom hook for hardcoded IP checks added.
  - Path filters now skip tests for documentation changes.
  - NOSONAR/nosec comments added to reduce false positives.


author: Danila Vershinin <info@getpagespeed.com> - 0.2.23-1
changelog:
  - Added weak_ssl_tls plugin to detect insecure SSL/TLS configurations.
  - Introduced auto-fix mode with new CLI options.
  - New option to preview fixes without modifying files.
  - Updated README with categorized plugin documentation.
  - Ensured compatibility with Python 3.6 in test suite.


author: Danila Vershinin <info@getpagespeed.com> - 0.2.24-1
changelog:
  - Added new plugin for HSTS header security checks.
  - Updated weak_ssl_tls to be TLS-only, removing HSTS.
  - HSTS checks now skip servers with ssl_reject_handshake on.
  - Introduced plugin to warn on HTTP/2 misconfigurations.
  - Improved compatibility with default_server settings.
  - Enhanced security posture with new header checks.


author: Danila Vershinin <info@getpagespeed.com> - 0.2.25-1
changelog:
  - Fix compatibility issues with recent web server versions.
  - Improve error handling for misconfigured rules.
  - Enhance performance of rule evaluation process.
  - Update dependencies for better security and stability.
  - Add support for new configuration options.
  - Refine documentation for clearer usage instructions.


author: Danila Vershinin <info@getpagespeed.com> - 0.2.26-1
changelog:
  - Restored promotional footer in rich_console formatter.
  - Footer links to getpagespeed.com/repo-subscribe.


author: Danila Vershinin <info@getpagespeed.com> - 0.2.27-1
changelog:
  - Graceful handling of malformed nginx configs to prevent crashes.
  - Improved error messaging for invalid directives.
  - Added tests for better validation of config handling.


author: Danila Vershinin <info@getpagespeed.com> - 0.2.30-1
changelog:
  - Fixed false positive in ReDoS detection for optional groups.
  - Improved accuracy of nested quantifier vulnerability detection.


author: Danila Vershinin <info@getpagespeed.com> - 0.2.31-1
changelog:
  - Added security check for publicly accessible NGINX stub_status directives.
  - Detects configurations missing allow/deny directives.
  - Improves security by preventing unauthorized access to server metrics.


author: Danila Vershinin <info@getpagespeed.com> - 0.2.32-1
changelog:
  - Fix HSTS false positive when security_headers or more_set_headers provides HSTS.
  - Invert ssl_prefer_server_ciphers check: flag on (LOW) instead of off.


author: Danila Vershinin <info@getpagespeed.com> - 0.2.33-1
changelog:
  - Fixed false positive for `status_page_exposed` warning.
  - Unix socket servers no longer trigger missing IP restrictions.


author: Danila Vershinin <info@getpagespeed.com> - 0.2.34-1
changelog:
  - Fixed malformed Docker command in README documentation.
  - Updated outdated plugin paths to checks in documentation.
  - Added missing status_page_exposed check in documentation.
  - Changed CI/CD workflow trigger for PyPI publishing.
  - Corrected double period typo in code docstring.


author: Danila Vershinin <info@getpagespeed.com> - 0.8.3-1
changelog:
  - Switch to dvershinin/jinja2-cli fork for Python 3.6 compatibility
  - Upstream 1.0.0 dropped Python 3.6 support


author: Danila Vershinin <info@getpagespeed.com> - 0.8.4-1
changelog:
  - Add hjson and json5 format support
  - Add -f shorthand for --format
  - Fix querystring parsing
  - Allow explicitly setting None values


author: Danila Vershinin <info@getpagespeed.com> - 0.8.5-1
changelog:
  - Support tomllib (Python 3.11+) for EL10/Fedora 39+ compatibility
  - Remove python3-toml dependency on systems with built-in tomllib


author: Danila Vershinin <info@getpagespeed.com> - 4.20.0-1
changelog:
  - Updated restricted file extensions for enhanced security.
  - Added configuration files for PrestaShop and Magento.
  - Included 'expect' header in restricted headers list.
  - Fixed missing capture keyword issue.
  - Reduced false positives with JSON payloads.
  - Corrected rules to block instead of pass.
  - Updated regex to handle new payload formats.


author: Danila Vershinin <info@getpagespeed.com> - 4.21.0-1
changelog:
  - Added IPv6 support and XML scan for SSH scheme.
  - Introduced new restricted file extensions detection.
  - Improved unit tests for double comment handling.
  - Fixed multiple blocking issues in rules.
  - Corrected function names in several rules.
  - Reduced false positives for substring detections.
  - Added help documentation for non-English users.


author: Danila Vershinin <info@getpagespeed.com> - 4.22.0-1
changelog:
  - Fixed critical issue 9AJ-260102.
  - Added sequence for CVE-2025-55182 POCs.
  - Reduced false positives in rules.
  - Improved handling of arrays in ARGS_NAMES.
  - Updated regex for Rust compatibility.
  - Dropped older spelling variants.


author: Danila Vershinin <info@getpagespeed.com> - 4.23.0-1
changelog:
  - Added rule to enforce content-type for requests with a body.
  - Introduced detection for Vite.js path traversal vulnerability.
  - Blocked fake 'mozilla/5.g' user-agent.
  - Resolved false positives with ad and tracker cookies.
  - Improved handling of malformed URLs in SSRF rules.
  - Prevented upload of PHP session files.
  - Updated rules for restricted files and file extensions.


