From 706193ea2631959c4d08c155864ab645bfac5d7a Mon Sep 17 00:00:00 2001 From: Simon Bennetts Date: Thu, 12 Oct 2023 12:19:40 +0200 Subject: [PATCH] Update 2.14 page with headline changes Signed-off-by: Simon Bennetts --- .../javahelp/contents/releases/2.14.0.html | 75 +++++++++++++++++++ 1 file changed, 75 insertions(+) diff --git a/addOns/help/src/main/javahelp/contents/releases/2.14.0.html b/addOns/help/src/main/javahelp/contents/releases/2.14.0.html index 832ce75b..eed096cc 100644 --- a/addOns/help/src/main/javahelp/contents/releases/2.14.0.html +++ b/addOns/help/src/main/javahelp/contents/releases/2.14.0.html @@ -12,6 +12,77 @@

Release 2.14.0

This is a bug fix and enhancement release.
These release notes do not include all of the changes included in add-ons updated since 2.13.0. +

+This release was made possible thanks to our Platinum Sponsor, the Software Security Project +

+Some of the more significant enhancements include: + +

Rebranding and Docker Hub Move

+ +ZAP has had some minor rebranding changes as a result of the move to the Software Security Project. +

+As part of that move the official ZAP Docker images are being published to the +Software Security Project Docker Hub Organisation. +The OWASP links should continue to work for now but we recommend you change to use the new ones ASAP. +

+Note that you can also pull the ZAP Docker images from GitHub Container Registry. + +

Host Header Manipulation

+ +Host headers can now be manipulated in ZAP - we know many of you have been waiting for this for a long time! + +The Break, Manual Request and Requester dialogs all have a new "Update Host Header" button. +This is enabled by default (to keep backwards compatibility) but if you turn this off then you will be able to specify your own host headers which will be sent to the target site. + +

ZAPit

+ +This release adds a new `-zapit` command line option to perform a quick ‘reconnaissance’ scan of the URL specified. + +For more details see the ZAPit help page + +

API File Transfers

+ +You can now upload and download files to and from ZAP via the API. +Note that this feature is disabled default as a security measure. + +For more details, including how to enable it, see the API help page. + +

Graal JS Add-on Access

+ +Since Oracle removed removed the Nashorn JavaScript engine from Java 15 anyone using Java 15+ has had to rely on the Graal JS add-on for Java Script support. +Unfortunately due to classloader issues it was not able to access add-on classes, which significantly limited its functionality. +

+These issues have now been resolved which means that GraalJS is the recommended Java Script engine to use in ZAP. + +

Postman Support

+ +ZAP can now import Postman collections thanks to the new Postman add-on. + +

SBOMs

+ +ZAP includes a runtime Software Bill of Materials (SBOM) generated by CycloneDX +for both the ZAP core and all of the add-ons maintained by the ZAP team. + +For more details see the Software Bill of Materials help page. + +

ZAP API OpenAPI Definition

+ +An OpenAPI definition for the ZAP API is available in the main repository, which can be used to generate custom API clients. +This definition is planned to be kept up to date for the latest core and add-on releases. +

+Note that currently the definition does not declare the most appropriate types for the parameters and does not contain the responses. + +

ZAP Browser Extensions

+ +The eagle-eyed among you may have noticed that there are now ZAP Firefox and Chrome extensions: https://github.com/zaproxy/browser-extension + +These are included in the new Client Side Integration add-on which supports: + +* Browser Recording +* Streaming client side events to ZAP + +This is not (yet) included in the main ZAP releases so you will need to download it from the +Marketplace.

Dependency Updates

@@ -57,6 +128,9 @@

Enhancements

  • Issue 8067 : Allow to disable modification of multiple options
  • Issue 8070 : Prevent concurrent usage of ZAP home
  • Issue 8089 : Break: Allow host header manipulation
    • +
  • Issue 8101 : Extend ScanEventPublisher to support params
    • +
  • Issue 8109 : Make SBOM zip available via GUI, cmdline and API.
    • +
  • Issue 8118 : Record config stats

    • Bug fixes

    @@ -67,6 +141,7 @@

    Bug fixes

  • Issue 8028 : Set the view to `ExtensionAdaptor` sooner
  • Issue 8055 : Include country name for duplicated languages
  • Issue 8068 : Use the current database body size values
    • +
  • Issue 8111 : Raw HTML displayed in options panels for search matches