api #86

New issue

Closed

opened 2026-03-02 02:59:51 +03:00 by kerem · 0 comments

kerem commented

2026-03-02 02:59:51 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/bunkerity/bunkerweb-plugins/pull/83
Author: @dependabot[bot]
Created: 6/24/2024
Status: ✅ Merged
Merged: 6/24/2024
Merged by: @TheophileDiot

Base: dev ← Head: dependabot/go_modules/coraza/api/dev/github.com/corazawaf/coraza/v3-3.2.1

📝 Commits (1)

7c8a050 deps/coraza/api: bump github.com/corazawaf/coraza/v3 in /coraza/api

📊 Changes

1 file changed (+6 additions, -6 deletions)

View changed files

📝 coraza/api/go.mod (+6 -6)

📄 Description

Bumps github.com/corazawaf/coraza/v3 from 3.1.0 to 3.2.1.

Release notes

Sourced from github.com/corazawaf/coraza/v3's releases.

Coraza 3.2.1

This is a quick patch release to fix a potential data race that was noticed right after v3.2.0 (Thanks @MarcWort for reporting it!) and a minor fix about logging.

What's Changed

fix: race condition on StrID by @M4tteoP in corazawaf/coraza#1084

fix: makes max size log message CRS correlation rule friendly by @M4tteoP in corazawaf/coraza#1085

Full Changelog: https://github.com/corazawaf/coraza/compare/v3.2.0...v3.2.1

Version 3.2.0

Coraza v3.2.0 comes with:

Support for SecRuleUpdateTargetByTag, Base64DecodeExt, extended support for ranges of IDs with SecRuleUpdateTargetByID.

Support for case-sensitive matching for ARGS keys. It currently comes under the coraza.rule.case_sensitive_args_keys. Mind that, in compliance with RFC 3986 specification, it is planned to become the default behavior starting from the next major version.

Support for auditlog formatters for tinygo builds.

Various bug fixes, among other things, around log generation and Coraza middleware.

Performance implements and reduced memory allocation mostly thanks to @noboruma.

Updated CRS support to the latest CRS v4.3.0 version.

What's Changed

fix(deps): update module github.com/tidwall/gjson to v1.17.1 by @renovate in corazawaf/coraza#1004

fix(deps): update module golang.org/x/net to v0.22.0 by @renovate in corazawaf/coraza#1011

feat: expose expected directives for e2e test by @fionera in corazawaf/coraza#1012

avoid executing costly With if noop logger by @noboruma in corazawaf/coraza#1015

tests: covers eq operator. by @jcchavezs in corazawaf/coraza#1002

fix: RegisterWriter/RegisterFormatter case insensitive by @M4tteoP in corazawaf/coraza#1026

feat: Implements SecRuleUpdateTargetByTag, extends ByID with ranges by @M4tteoP in corazawaf/coraza#1020

tests: covers zero case in eq operator. by @jcchavezs in corazawaf/coraza#1029

feat: registers RegisterFormatters for tinygo by @M4tteoP in corazawaf/coraza#1027

fix(deps): update module golang.org/x/net to v0.23.0 by @renovate in corazawaf/coraza#1033

Fix: audit logs RelevantOnly match if interruption happens by @M4tteoP in corazawaf/coraza#1025

tests: adds logs for unexpected status code. by @jcchavezs in corazawaf/coraza#1037

fix(deps): update module golang.org/x/net to v0.24.0 by @renovate in corazawaf/coraza#1035

cache Rule ID string version by @noboruma in corazawaf/coraza#1039

chore: adds fs access check at startup time by @M4tteoP in corazawaf/coraza#1030

Add support for Base64DecodeExt by @soujanyanmbri in corazawaf/coraza#1046

fix: FuzzB64Decode regexp match for fuzzing by @fzipi in corazawaf/coraza#1054

chore(deps): bump golang.org/x/net from 0.22.0 to 0.23.0 in /testing/coreruleset in the go_modules group across 1 directory by @dependabot in corazawaf/coraza#1043

fix(deps): update module github.com/mccutchen/go-httpbin/v2 to v2.13.4 by @renovate in corazawaf/coraza#1001

fix(deps): update module github.com/petar-dambovaliev/aho-corasick to v0.0.0-20240411101913-e07a1f0e8eb4 by @renovate in corazawaf/coraza#1057

feat: add new maps with case sensitive keys by @fzipi in corazawaf/coraza#1055

fix: http parameter pollution test cases by @fzipi in corazawaf/coraza#1058

fix(deps): update module golang.org/x/sync to v0.7.0 by @renovate in corazawaf/coraza#1034

fix(deps): update module golang.org/x/net to v0.25.0 by @renovate in corazawaf/coraza#1060

fix: RemoveTargetById Args in multiphase mode by @M4tteoP in corazawaf/coraza#1061

fix: headers leaked during interruptions at phase 3/4 by @M4tteoP in corazawaf/coraza#1062

chore: deletes content temporary file on close. by @jcchavezs in corazawaf/coraza#924

chore: upgrades to CRS 4.1. by @jcchavezs in corazawaf/coraza#1032

chore: updates CRS tests to CRS4.2 by @M4tteoP in corazawaf/coraza#1066

fix(deps): update module github.com/mccutchen/go-httpbin/v2 to v2.14.0 by @renovate in corazawaf/coraza#1067

feat: add support for case sensitive args by @fzipi in corazawaf/coraza#1059

... (truncated)

Commits

aaf4413 fix: makes max size log message CRS correlation rule friendly (#1085)
060b8ff fix: race condition on StrID (#1084)
7c91e8c chore: updates CRS tests to CRS4.3 (#1081)
417f112 fix(deps): update module github.com/rs/zerolog to v1.33.0 (#1073)
e42dcd5 fix: setters of INBOUND_DATA_ERROR and OUTBOUND_DATA_ERROR (#1078)
74ec8de fix(deps): update module golang.org/x/net to v0.26.0 (#1075)
5ff4a3f fix(deps): update module github.com/corazawaf/libinjection-go to v0.2.1 (#1079)
cd2d3c4 fix(deps): update module github.com/corazawaf/libinjection-go to v0.2.0 (#1076)
5e4a004 fix: logs multiple vars matched by same rule (#1074)
711e4a4 feat: add support for case sensitive args (#1059)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/bunkerity/bunkerweb-plugins/pull/83 **Author:** [@dependabot[bot]](https://github.com/apps/dependabot) **Created:** 6/24/2024 **Status:** ✅ Merged **Merged:** 6/24/2024 **Merged by:** [@TheophileDiot](https://github.com/TheophileDiot) **Base:** `dev` ← **Head:** `dependabot/go_modules/coraza/api/dev/github.com/corazawaf/coraza/v3-3.2.1` --- ### 📝 Commits (1) - [`7c8a050`](https://github.com/bunkerity/bunkerweb-plugins/commit/7c8a0506397e6195af1212c9b5e137df97298b32) deps/coraza/api: bump github.com/corazawaf/coraza/v3 in /coraza/api ### 📊 Changes **1 file changed** (+6 additions, -6 deletions) <details> <summary>View changed files</summary> 📝 `coraza/api/go.mod` (+6 -6) </details> ### 📄 Description Bumps [github.com/corazawaf/coraza/v3](https://github.com/corazawaf/coraza) from 3.1.0 to 3.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/corazawaf/coraza/releases">github.com/corazawaf/coraza/v3's releases</a>.</em></p> <blockquote> <h2>Coraza 3.2.1</h2> <p>This is a quick patch release to fix a potential data race that was noticed right after <code>v3.2.0</code> (Thanks <a href="https://github.com/MarcWort"><code>@MarcWort</code></a> for reporting it!) and a minor fix about logging.</p> <h2>What's Changed</h2> <ul> <li>fix: race condition on StrID by <a href="https://github.com/M4tteoP"><code>@M4tteoP</code></a> in <a href="https://redirect.github.com/corazawaf/coraza/pull/1084">corazawaf/coraza#1084</a></li> <li>fix: makes max size log message CRS correlation rule friendly by <a href="https://github.com/M4tteoP"><code>@M4tteoP</code></a> in <a href="https://redirect.github.com/corazawaf/coraza/pull/1085">corazawaf/coraza#1085</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/corazawaf/coraza/compare/v3.2.0...v3.2.1">https://github.com/corazawaf/coraza/compare/v3.2.0...v3.2.1</a></p> <h2>Version 3.2.0</h2> <p>Coraza v3.2.0 comes with:</p> <ul> <li>Support for <code>SecRuleUpdateTargetByTag</code>, <code>Base64DecodeExt</code>, extended support for ranges of IDs with <code>SecRuleUpdateTargetByID</code>.</li> <li>Support for case-sensitive matching for <code>ARGS</code> keys. It currently comes under the <a href="https://github.com/corazawaf/coraza?tab=readme-ov-file#build-tags"><code>coraza.rule.case_sensitive_args_keys</code></a>. Mind that, in compliance with RFC 3986 specification, it is planned to become the default behavior starting from the next major version.</li> <li>Support for auditlog formatters for tinygo builds.</li> <li>Various bug fixes, among other things, around log generation and Coraza middleware.</li> <li>Performance implements and reduced memory allocation mostly thanks to <a href="https://github.com/noboruma"><code>@noboruma</code></a>.</li> <li>Updated CRS support to the latest CRS v4.3.0 version.</li> </ul> <h2>What's Changed</h2> <ul> <li>fix(deps): update module github.com/tidwall/gjson to v1.17.1 by <a href="https://github.com/renovate"><code>@renovate</code></a> in <a href="https://redirect.github.com/corazawaf/coraza/pull/1004">corazawaf/coraza#1004</a></li> <li>fix(deps): update module golang.org/x/net to v0.22.0 by <a href="https://github.com/renovate"><code>@renovate</code></a> in <a href="https://redirect.github.com/corazawaf/coraza/pull/1011">corazawaf/coraza#1011</a></li> <li>feat: expose expected directives for e2e test by <a href="https://github.com/fionera"><code>@fionera</code></a> in <a href="https://redirect.github.com/corazawaf/coraza/pull/1012">corazawaf/coraza#1012</a></li> <li>avoid executing costly With if noop logger by <a href="https://github.com/noboruma"><code>@noboruma</code></a> in <a href="https://redirect.github.com/corazawaf/coraza/pull/1015">corazawaf/coraza#1015</a></li> <li>tests: covers eq operator. by <a href="https://github.com/jcchavezs"><code>@jcchavezs</code></a> in <a href="https://redirect.github.com/corazawaf/coraza/pull/1002">corazawaf/coraza#1002</a></li> <li>fix: RegisterWriter/RegisterFormatter case insensitive by <a href="https://github.com/M4tteoP"><code>@M4tteoP</code></a> in <a href="https://redirect.github.com/corazawaf/coraza/pull/1026">corazawaf/coraza#1026</a></li> <li>feat: Implements SecRuleUpdateTargetByTag, extends ByID with ranges by <a href="https://github.com/M4tteoP"><code>@M4tteoP</code></a> in <a href="https://redirect.github.com/corazawaf/coraza/pull/1020">corazawaf/coraza#1020</a></li> <li>tests: covers zero case in eq operator. by <a href="https://github.com/jcchavezs"><code>@jcchavezs</code></a> in <a href="https://redirect.github.com/corazawaf/coraza/pull/1029">corazawaf/coraza#1029</a></li> <li>feat: registers <code>RegisterFormatter</code>s for tinygo by <a href="https://github.com/M4tteoP"><code>@M4tteoP</code></a> in <a href="https://redirect.github.com/corazawaf/coraza/pull/1027">corazawaf/coraza#1027</a></li> <li>fix(deps): update module golang.org/x/net to v0.23.0 by <a href="https://github.com/renovate"><code>@renovate</code></a> in <a href="https://redirect.github.com/corazawaf/coraza/pull/1033">corazawaf/coraza#1033</a></li> <li>Fix: audit logs RelevantOnly match if interruption happens by <a href="https://github.com/M4tteoP"><code>@M4tteoP</code></a> in <a href="https://redirect.github.com/corazawaf/coraza/pull/1025">corazawaf/coraza#1025</a></li> <li>tests: adds logs for unexpected status code. by <a href="https://github.com/jcchavezs"><code>@jcchavezs</code></a> in <a href="https://redirect.github.com/corazawaf/coraza/pull/1037">corazawaf/coraza#1037</a></li> <li>fix(deps): update module golang.org/x/net to v0.24.0 by <a href="https://github.com/renovate"><code>@renovate</code></a> in <a href="https://redirect.github.com/corazawaf/coraza/pull/1035">corazawaf/coraza#1035</a></li> <li>cache Rule ID string version by <a href="https://github.com/noboruma"><code>@noboruma</code></a> in <a href="https://redirect.github.com/corazawaf/coraza/pull/1039">corazawaf/coraza#1039</a></li> <li>chore: adds fs access check at startup time by <a href="https://github.com/M4tteoP"><code>@M4tteoP</code></a> in <a href="https://redirect.github.com/corazawaf/coraza/pull/1030">corazawaf/coraza#1030</a></li> <li>Add support for Base64DecodeExt by <a href="https://github.com/soujanyanmbri"><code>@soujanyanmbri</code></a> in <a href="https://redirect.github.com/corazawaf/coraza/pull/1046">corazawaf/coraza#1046</a></li> <li>fix: FuzzB64Decode regexp match for fuzzing by <a href="https://github.com/fzipi"><code>@fzipi</code></a> in <a href="https://redirect.github.com/corazawaf/coraza/pull/1054">corazawaf/coraza#1054</a></li> <li>chore(deps): bump golang.org/x/net from 0.22.0 to 0.23.0 in /testing/coreruleset in the go_modules group across 1 directory by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/corazawaf/coraza/pull/1043">corazawaf/coraza#1043</a></li> <li>fix(deps): update module github.com/mccutchen/go-httpbin/v2 to v2.13.4 by <a href="https://github.com/renovate"><code>@renovate</code></a> in <a href="https://redirect.github.com/corazawaf/coraza/pull/1001">corazawaf/coraza#1001</a></li> <li>fix(deps): update module github.com/petar-dambovaliev/aho-corasick to v0.0.0-20240411101913-e07a1f0e8eb4 by <a href="https://github.com/renovate"><code>@renovate</code></a> in <a href="https://redirect.github.com/corazawaf/coraza/pull/1057">corazawaf/coraza#1057</a></li> <li>feat: add new maps with case sensitive keys by <a href="https://github.com/fzipi"><code>@fzipi</code></a> in <a href="https://redirect.github.com/corazawaf/coraza/pull/1055">corazawaf/coraza#1055</a></li> <li>fix: http parameter pollution test cases by <a href="https://github.com/fzipi"><code>@fzipi</code></a> in <a href="https://redirect.github.com/corazawaf/coraza/pull/1058">corazawaf/coraza#1058</a></li> <li>fix(deps): update module golang.org/x/sync to v0.7.0 by <a href="https://github.com/renovate"><code>@renovate</code></a> in <a href="https://redirect.github.com/corazawaf/coraza/pull/1034">corazawaf/coraza#1034</a></li> <li>fix(deps): update module golang.org/x/net to v0.25.0 by <a href="https://github.com/renovate"><code>@renovate</code></a> in <a href="https://redirect.github.com/corazawaf/coraza/pull/1060">corazawaf/coraza#1060</a></li> <li>fix: RemoveTargetById Args in multiphase mode by <a href="https://github.com/M4tteoP"><code>@M4tteoP</code></a> in <a href="https://redirect.github.com/corazawaf/coraza/pull/1061">corazawaf/coraza#1061</a></li> <li>fix: headers leaked during interruptions at phase 3/4 by <a href="https://github.com/M4tteoP"><code>@M4tteoP</code></a> in <a href="https://redirect.github.com/corazawaf/coraza/pull/1062">corazawaf/coraza#1062</a></li> <li>chore: deletes content temporary file on close. by <a href="https://github.com/jcchavezs"><code>@jcchavezs</code></a> in <a href="https://redirect.github.com/corazawaf/coraza/pull/924">corazawaf/coraza#924</a></li> <li>chore: upgrades to CRS 4.1. by <a href="https://github.com/jcchavezs"><code>@jcchavezs</code></a> in <a href="https://redirect.github.com/corazawaf/coraza/pull/1032">corazawaf/coraza#1032</a></li> <li>chore: updates CRS tests to CRS4.2 by <a href="https://github.com/M4tteoP"><code>@M4tteoP</code></a> in <a href="https://redirect.github.com/corazawaf/coraza/pull/1066">corazawaf/coraza#1066</a></li> <li>fix(deps): update module github.com/mccutchen/go-httpbin/v2 to v2.14.0 by <a href="https://github.com/renovate"><code>@renovate</code></a> in <a href="https://redirect.github.com/corazawaf/coraza/pull/1067">corazawaf/coraza#1067</a></li> <li>feat: add support for case sensitive args by <a href="https://github.com/fzipi"><code>@fzipi</code></a> in <a href="https://redirect.github.com/corazawaf/coraza/pull/1059">corazawaf/coraza#1059</a></li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/corazawaf/coraza/commit/aaf44136da61921caa2353bd391c1341f3e480e8"><code>aaf4413</code></a> fix: makes max size log message CRS correlation rule friendly (<a href="https://redirect.github.com/corazawaf/coraza/issues/1085">#1085</a>)</li> <li><a href="https://github.com/corazawaf/coraza/commit/060b8ffc0ee4406846d4e063456b8beef679cecc"><code>060b8ff</code></a> fix: race condition on StrID (<a href="https://redirect.github.com/corazawaf/coraza/issues/1084">#1084</a>)</li> <li><a href="https://github.com/corazawaf/coraza/commit/7c91e8c2a5853fde66f8b4e3d8f0aee671445755"><code>7c91e8c</code></a> chore: updates CRS tests to CRS4.3 (<a href="https://redirect.github.com/corazawaf/coraza/issues/1081">#1081</a>)</li> <li><a href="https://github.com/corazawaf/coraza/commit/417f112ea2c38e135dd9fd9362d5d41c5a783b61"><code>417f112</code></a> fix(deps): update module github.com/rs/zerolog to v1.33.0 (<a href="https://redirect.github.com/corazawaf/coraza/issues/1073">#1073</a>)</li> <li><a href="https://github.com/corazawaf/coraza/commit/e42dcd569db250a872fd295bfd006b65df8ab809"><code>e42dcd5</code></a> fix: setters of INBOUND_DATA_ERROR and OUTBOUND_DATA_ERROR (<a href="https://redirect.github.com/corazawaf/coraza/issues/1078">#1078</a>)</li> <li><a href="https://github.com/corazawaf/coraza/commit/74ec8deacc7d31f982a9690a68f7eecce19092d8"><code>74ec8de</code></a> fix(deps): update module golang.org/x/net to v0.26.0 (<a href="https://redirect.github.com/corazawaf/coraza/issues/1075">#1075</a>)</li> <li><a href="https://github.com/corazawaf/coraza/commit/5ff4a3ff81d5b96f27aed2a2b5e0e8c1ee6d141c"><code>5ff4a3f</code></a> fix(deps): update module github.com/corazawaf/libinjection-go to v0.2.1 (<a href="https://redirect.github.com/corazawaf/coraza/issues/1079">#1079</a>)</li> <li><a href="https://github.com/corazawaf/coraza/commit/cd2d3c4ed6206de269056c243d77c4fae5482f9b"><code>cd2d3c4</code></a> fix(deps): update module github.com/corazawaf/libinjection-go to v0.2.0 (<a href="https://redirect.github.com/corazawaf/coraza/issues/1076">#1076</a>)</li> <li><a href="https://github.com/corazawaf/coraza/commit/5e4a00419ad24c221291a645948caaef8090c8c2"><code>5e4a004</code></a> fix: logs multiple vars matched by same rule (<a href="https://redirect.github.com/corazawaf/coraza/issues/1074">#1074</a>)</li> <li><a href="https://github.com/corazawaf/coraza/commit/711e4a40ddcaef1122a7fdae7c7f81797039d523"><code>711e4a4</code></a> feat: add support for case sensitive args (<a href="https://redirect.github.com/corazawaf/coraza/issues/1059">#1059</a>)</li> <li>Additional commits viewable in <a href="https://github.com/corazawaf/coraza/compare/v3.1.0...v3.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/corazawaf/coraza/v3&package-manager=go_modules&previous-version=3.1.0&new-version=3.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>