chore(deps): update dependency coreruleset-v3 to v4 in config/_default/params.yaml

[renovate]

This PR contains the following updates:

Package	Update	Change
coreruleset-v3	major	3.3.7 -> 4.17.1

---

Release Notes

coreruleset/coreruleset (coreruleset-v3)

v4.17.1

Compare Source

What's Changed

⭐ Important changes

• chore: removed detection for LaTeX injection by @​Xhoenix in https://github.com/coreruleset/coreruleset/pull/4221

🧰 Other Changes

• fix(942340): remove dot star by @​Xhoenix in https://github.com/coreruleset/coreruleset/pull/4220

Full Changelog: coreruleset/coreruleset@v4.17.0...v4.17.1

v4.17.0

Compare Source

What's Changed

⭐ Important changes

• feat: remove PCI DSS tags (#​4194) by @​pha6d in https://github.com/coreruleset/coreruleset/pull/4203

🆕 New features and detections 🎉

• feat: added detection for ASP.NET errors by @​Xhoenix in https://github.com/coreruleset/coreruleset/pull/4092
• feat: added detection for RCE via Referer header by @​Xhoenix in https://github.com/coreruleset/coreruleset/pull/3993
• feat: added detection for LaTeX injection by @​Xhoenix in https://github.com/coreruleset/coreruleset/pull/4206
• feat: added detection for ruby errors and code leakage by @​Xhoenix in https://github.com/coreruleset/coreruleset/pull/4089

🧰 Other Changes

• fix(951xxx): remove dot star by @​Xhoenix in https://github.com/coreruleset/coreruleset/pull/4171
• fix: use word bondary on 952110 to avoid matching non-java errors by @​EsadCetiner in https://github.com/coreruleset/coreruleset/pull/4177
• feat: Update java-classes.data by @​KIC-8462852 in https://github.com/coreruleset/coreruleset/pull/4173
• fix(931130): update file uri with single slash by @​fzipi in https://github.com/coreruleset/coreruleset/pull/4193
• fix(932281): avoid matching on json payloads by @​EsadCetiner in https://github.com/coreruleset/coreruleset/pull/4187
• fix: 932280/932281 bypass by @​Xhoenix in https://github.com/coreruleset/coreruleset/pull/4207

New Contributors

• @​KIC-8462852 made their first contribution in https://github.com/coreruleset/coreruleset/pull/4173
• @​pre-commit-ci[bot] made their first contribution inhttps://github.com/coreruleset/coreruleset/pull/41855
• @​pha6d made their first contribution in https://github.com/coreruleset/coreruleset/pull/4203

Full Changelog: coreruleset/coreruleset@v4.16.0...v4.17.0

v4.16.0

Compare Source

What's Changed

🆕 New features and detections 🎉

• feat: remediation for Python SSTI by @​TheRubick in https://github.com/coreruleset/coreruleset/pull/4145
• fix: update rule 942560 by @​Xhoenix in https://github.com/coreruleset/coreruleset/pull/4161
• feat: detect generic config filenames by @​EsadCetiner in https://github.com/coreruleset/coreruleset/pull/4102
• feat: update java-errors.data by @​Xhoenix in https://github.com/coreruleset/coreruleset/pull/4113
• feat: added rule to detect Bash Brace Expansion by @​Xhoenix in https://github.com/coreruleset/coreruleset/pull/3780
• feat: added MongoDB operators by @​Xhoenix in https://github.com/coreruleset/coreruleset/pull/4162
• feat: added zmodload and sudo-rs by @​Xhoenix in https://github.com/coreruleset/coreruleset/pull/4143

🧰 Other Changes

• fix(941160): remove dot star by @​fzipi in https://github.com/coreruleset/coreruleset/pull/4155
• fix(934140): remove dot star by @​fzipi in https://github.com/coreruleset/coreruleset/pull/4165
• fix(932370): remove dot star by @​fzipi in https://github.com/coreruleset/coreruleset/pull/4166
• fix(955xxx): remove dot star by @​Xhoenix in https://github.com/coreruleset/coreruleset/pull/4169
• fix(933150): moving printf to 933160 for additional php syntax check (933150 PL-1, 933160 PL-1) by @​EsadCetiner in https://github.com/coreruleset/coreruleset/pull/3840
• fix: create a stricter sibling to 932370 and move at to PL-2 (932370 PL-1, 932371 PL-2) by @​EsadCetiner in https://github.com/coreruleset/coreruleset/pull/4015
• fix(942340): remove dot star by @​fzipi in https://github.com/coreruleset/coreruleset/pull/4164
• refactor(942340): move to regex assembly by @​fzipi in https://github.com/coreruleset/coreruleset/pull/4014
• fix(933160): remove dot star by @​fzipi in https://github.com/coreruleset/coreruleset/pull/4167

New Contributors

• @​TheRubick made their first contribution in https://github.com/coreruleset/coreruleset/pull/4145

Full Changelog: coreruleset/coreruleset@v4.15.0...v4.16.0

v4.15.0

Compare Source

What's Changed

🆕 New features and detections 🎉

• feat: add User-Agent and Referer into targets (942280 PL1) by @​azurit in https://github.com/coreruleset/coreruleset/pull/4115
• feat: update java-classes.data by @​Xhoenix in https://github.com/coreruleset/coreruleset/pull/4080
• feat: block database yaml files by @​EsadCetiner in https://github.com/coreruleset/coreruleset/pull/4130

🧰 Other Changes

• fix: false positive with title_strip_tags by moving strip_tags to 933160 by @​EsadCetiner in https://github.com/coreruleset/coreruleset/pull/4105
• fix: remove self command by @​EsadCetiner in https://github.com/coreruleset/coreruleset/pull/4111
• fix: remove rc shell to reduce FPs by @​theseion in https://github.com/coreruleset/coreruleset/pull/4125
• feat: remove unnecessary character class from 933151 by @​TimDiam0nd in https://github.com/coreruleset/coreruleset/pull/4135
• fix: false positives with session tokens/cookies 933150 by @​EsadCetiner in https://github.com/coreruleset/coreruleset/pull/4142
• fix: add word ending to unix command sendmail (932235 PL1, 932236 PL2, 932239 PL2, 932260 PL1) by @​franbuehler in https://github.com/coreruleset/coreruleset/pull/4141
• feat: 933151 change from capture and double pmf to regex by @​TimDiam0nd in https://github.com/coreruleset/coreruleset/pull/4139
• feat: 933120 change from capture and double pmf to regex by @​TimDiam0nd in https://github.com/coreruleset/coreruleset/pull/4138
• feat: remove exclusion of deprecated __utm cookies by @​theseion in https://github.com/coreruleset/coreruleset/pull/4151

Full Changelog: coreruleset/coreruleset@v4.14.0...v4.15.0

v4.14.0

Compare Source

What's Changed

🆕 New features and detections 🎉

• feat: detect ASP web shells by @​Xhoenix in https://github.com/coreruleset/coreruleset/pull/4063
• feat: detect compressed database dumps by @​EsadCetiner in https://github.com/coreruleset/coreruleset/pull/4082
• feat: detect javascript methods import fetch console.log console.dir by @​EsadCetiner in https://github.com/coreruleset/coreruleset/pull/4076

🧰 Other Changes

• fix: fixing FPs related to rule 951220 by @​azurit in https://github.com/coreruleset/coreruleset/pull/4079
• fix: don't block ttf font files by @​EsadCetiner in https://github.com/coreruleset/coreruleset/pull/4081
• fix: 932270 FP by @​Xhoenix in https://github.com/coreruleset/coreruleset/pull/3917
• fix(954100): detect forward slash in path by @​Xhoenix in https://github.com/coreruleset/coreruleset/pull/4094
• fix: remove .application from restricted extensions by @​EsadCetiner in https://github.com/coreruleset/coreruleset/pull/4103
• fix: 44J-250329 by @​EsadCetiner in https://github.com/coreruleset/coreruleset/pull/4107

Full Changelog: coreruleset/coreruleset@v4.13.0...v4.14.0

v4.13.0

Compare Source

What's Changed

⭐ Important changes

• fix(security): fixing double URL decode of REQUEST_URI by @​azurit in https://github.com/coreruleset/coreruleset/pull/4047

🆕 New features and detections 🎉

• feat: block header related to CVE-2025-29927 (Next.js) by @​azurit in https://github.com/coreruleset/coreruleset/pull/4053
• feat: added new XSS payloads by @​Xhoenix in https://github.com/coreruleset/coreruleset/pull/4055
• feat: add potential malicious file extensions into tx.restricted_extensions by @​Xhoenix in https://github.com/coreruleset/coreruleset/pull/4068
• feat: add additional files commonly accessed by bots by @​EsadCetiner in https://github.com/coreruleset/coreruleset/pull/4069
• feat: adding .dist and .dpkg-dist into tx.restricted_extensions by @​azurit in https://github.com/coreruleset/coreruleset/pull/4057
• feat: add more default session cookie names by @​Xhoenix in https://github.com/coreruleset/coreruleset/pull/4062

🪦 Rule removals

• feat: remove rule 952100 for detecting Java Source Code Leakage by @​S0obi in https://github.com/coreruleset/coreruleset/pull/4052

🧰 Other Changes

• fix(934130): extend prototype pollution payload by @​Xhoenix in https://github.com/coreruleset/coreruleset/pull/4036
• fix: rule 930110 is not supposed to match bare '..' without (back)slashes by @​azurit in https://github.com/coreruleset/coreruleset/pull/4050
• fix: use boundary to fix false positive with email firstname.dockery@host.tld by @​EsadCetiner in https://github.com/coreruleset/coreruleset/pull/4045
• feat: refresh restricted-upload.data by @​S0obi in https://github.com/coreruleset/coreruleset/pull/4046
• fix: tag inconsistency per file by @​Xhoenix in https://github.com/coreruleset/coreruleset/pull/4031
• fix: added pre-check of unset TX variable by @​airween in https://github.com/coreruleset/coreruleset/pull/4066
• fix: false positive found in quantitative testing round 2 for unix rce rules (932230 PL-1, 932235 PL-1, 932250 PL-1, 932260 PL-1, 932231 PL-2, 932220 PL-2, 932236 PL-2, 932239 PL-2, 932232 PL-3, 932238 PL-3) by @​EsadCetiner in https://github.com/coreruleset/coreruleset/pull/4019

New Contributors

• @​daum3ns made their first contribution in https://github.com/coreruleset/coreruleset/pull/4043
• @​S0obi made their first contribution in https://github.com/coreruleset/coreruleset/pull/4046

Full Changelog: coreruleset/coreruleset@v4.12.0...v4.13.0

v4.12.0

Compare Source

What's Changed

🆕 New features and detections 🎉

• feat: prevent V1 cookie format use by @​fzipi in https://github.com/coreruleset/coreruleset/pull/4006
• feat: added new restricted files for openstack and docker compose by @​azurit in https://github.com/coreruleset/coreruleset/pull/4021

🧰 Other Changes

• fix: multipart header tag consistency by @​Xhoenix in https://github.com/coreruleset/coreruleset/pull/3992
• fix: prevent invalid commands matches on 5 characters or less (932220 PL-2, 932230 PL-1, 932232 PL-3, 932235 PL-1, 932236 PL-2, 932237 PL-3, 932238 PL-3, 932239 PL-2, 932250 PL-1, 932260 PL-1) by @​EsadCetiner in https://github.com/coreruleset/coreruleset/pull/3735
• docs: add warning about default charsets modification by @​fzipi in https://github.com/coreruleset/coreruleset/pull/4003
• fix: response splitting rules and tests by @​theseion in https://github.com/coreruleset/coreruleset/pull/4009
• fix(933160): use better regex by @​fzipi in https://github.com/coreruleset/coreruleset/pull/4010
• fix: move fopen to 933160 to resolve fp with RootAndLeafOpenCamera.jpg (933150 PL-1, 933160 PL-1) by @​EsadCetiner in https://github.com/coreruleset/coreruleset/pull/4016
• fix(941210): update log message to reflect rule javascript word detection by @​fzipi in https://github.com/coreruleset/coreruleset/pull/4023
• fix: remove .env from lfi-os-files.data by @​theseion in https://github.com/coreruleset/coreruleset/pull/4024

New Contributors

• @​renovate made their first contribution in https://github.com/coreruleset/coreruleset/pull/4000

Full Changelog: coreruleset/coreruleset@v4.11.0...v4.12.0

v4.11.0

Compare Source

What's Changed

🪦 Rule removals

• feat: Remove rules for lack of viable attack scenario (920220 PL1, 920221 PL1) by @​dune73 in https://github.com/coreruleset/coreruleset/pull/3969

🧰 Other Changes

• fix: remove aliases man, mi, si and resolve positives (932125 PL1) by @​franbuehler in https://github.com/coreruleset/coreruleset/pull/3971
• fix: remove where, if, for and vol and resolve false positives (932380 PL1) by @​franbuehler in https://github.com/coreruleset/coreruleset/pull/3972
• fix: make 932300 actually case-insensitive by @​theseion in https://github.com/coreruleset/coreruleset/pull/3977
• fix: remove sql function names to resolve false positives (942151 PL1) by @​franbuehler in https://github.com/coreruleset/coreruleset/pull/3973
• fix: issue 3809 by @​Xhoenix in https://github.com/coreruleset/coreruleset/pull/3983

Full Changelog: coreruleset/coreruleset@v4.10.0...v4.11.0

v4.10.0

Compare Source

What's Changed

🆕 New features and detections 🎉

• feat: block CVE-2023-5003 by @​azurit in https://github.com/coreruleset/coreruleset/pull/3955
• feat: prevent accessing PHP variables by @​azurit in https://github.com/coreruleset/coreruleset/pull/3965

🧰 Other Changes

• fix: FP against pattern with = following at arbitrary position by @​theseion in https://github.com/coreruleset/coreruleset/pull/3963

Full Changelog: coreruleset/coreruleset@v4.9.0...v4.10.0

v4.9.0

Compare Source

What's Changed

⭐ Important changes

• feat: add variable to skip response rules by @​fzipi in https://github.com/coreruleset/coreruleset/pull/3944

🆕 New features and detections 🎉

• feat: add fish shell files to restricted-files.data by @​OhMyVolk in https://github.com/coreruleset/coreruleset/pull/3915
• feat: add quantitative testing to Git workflow by @​airween in https://github.com/coreruleset/coreruleset/pull/3924

🧰 Other Changes

• feat: added support for new web shells by @​azurit in https://github.com/coreruleset/coreruleset/pull/3898
• fix(security): remove double URL decode (921151 PL2, 932190 PL3, 942441 PL2, 942442 PL2, 942460 PL3) by @​azurit in https://github.com/coreruleset/coreruleset/pull/3741
• docs: extended rule documentation (900200) by @​dune73 in https://github.com/coreruleset/coreruleset/pull/3934

New Contributors

• @​OhMyVolk made their first contribution in https://github.com/coreruleset/coreruleset/pull/3915

Full Changelog: coreruleset/coreruleset@v4.8.0...v4.9.0

v4.8.0

Compare Source

What's Changed

⭐ Important changes

• fix: 9EA-241022 v4 by @​RedXanadu in https://github.com/coreruleset/coreruleset/pull/3905

🆕 New features and detections 🎉

• chore: set up nginx tests by @​theseion in https://github.com/coreruleset/coreruleset/pull/3856

🧰 Other Changes

• fix: remove unnecessary capture groups by @​TimDiam0nd in https://github.com/coreruleset/coreruleset/pull/3849
• fix(942120): update operators by @​Xhoenix in https://github.com/coreruleset/coreruleset/pull/3841
• fix(933120): do not match on base64 encoded strings by @​fzipi in https://github.com/coreruleset/coreruleset/pull/3863
• fix(refactor): 942130 and 942131 regex-assembly by @​Xhoenix in https://github.com/coreruleset/coreruleset/pull/3862
• fix(942520): SQL operators can be one or more characters by @​Xhoenix in https://github.com/coreruleset/coreruleset/pull/3845
• chore: remove verify id-range by @​fzipi in https://github.com/coreruleset/coreruleset/pull/3885
• chore: remove find-max-datalen-in-tests by @​fzipi in https://github.com/coreruleset/coreruleset/pull/3891
• chore: remove honeypot sensor by @​fzipi in https://github.com/coreruleset/coreruleset/pull/3883
• chore: remove browser tools by @​fzipi in https://github.com/coreruleset/coreruleset/pull/3887
• chore: remove send-payload-pls by @​fzipi in https://github.com/coreruleset/coreruleset/pull/3879
• chore: remove geo-location by @​fzipi in https://github.com/coreruleset/coreruleset/pull/3875
• chore: remove crs2 renumbering by @​fzipi in https://github.com/coreruleset/coreruleset/pull/3873
• chore: remove change-version script by @​fzipi in https://github.com/coreruleset/coreruleset/pull/3869
• chore: remove join multiline rules by @​fzipi in https://github.com/coreruleset/coreruleset/pull/3877
• chore: remove av-scanning by @​fzipi in https://github.com/coreruleset/coreruleset/pull/3871
• chore: remove util virtual patching by @​fzipi in https://github.com/coreruleset/coreruleset/pull/3889
• fix: include v3.3.6 release notes in latest by @​fzipi in https://github.com/coreruleset/coreruleset/pull/3867
• chore: remove fp-finder by @​fzipi in https://github.com/coreruleset/coreruleset/pull/3893

New Contributors

• @​evidencebp made their first contribution in https://github.com/coreruleset/coreruleset/pull/3837
• @​mtaket made their first contribution in https://github.com/coreruleset/coreruleset/pull/3855

Full Changelog: coreruleset/coreruleset@v4.7.0...v4.8.0

v4.7.0

Compare Source

What's Changed

🆕 New features and detections 🎉

• feat: added sendgrid.env into restricted files by @​azurit in https://github.com/coreruleset/coreruleset/pull/3823

🧰 Other Changes

• fix: Changed regex (920470) to match multiple whitespaces after Content-Type parameters to avoid false-positives by @​lostmann-owl-it in https://github.com/coreruleset/coreruleset/pull/3818
• fix: fp with user-agent containing ; pg (932239 PL2) by @​franbuehler in https://github.com/coreruleset/coreruleset/pull/3727
• fix: update xss detection with onwebkitplaybacktargetavailabilitychanged event by @​fzipi in https://github.com/coreruleset/coreruleset/pull/3822
• feat: refactoring (944110 PL1) by @​azurit in https://github.com/coreruleset/coreruleset/pull/3715

New Contributors

• @​lostmann-owl-it made their first contribution in https://github.com/coreruleset/coreruleset/pull/3818

Full Changelog: coreruleset/coreruleset@v4.6.0...v4.7.0

v4.6.0

Compare Source

What's Changed

⭐ Important changes

• fix: prevent using backslash in file names by @​fzipi in https://github.com/coreruleset/coreruleset/pull/3799
• feat: add new rule to catch invalid character in multipart headers by @​airween, @​theseion, @​fzipi in https://github.com/coreruleset/coreruleset/pull/3796

Big thanks tu @​luelueking for reporting us these two ☝️ .

🧰 Other Changes

• feat: rule to detect bash tilde expansion by @​Xhoenix in https://github.com/coreruleset/coreruleset/pull/3765
• fix: Update 932270's ver by @​airween in https://github.com/coreruleset/coreruleset/pull/3786
• perf: remove unnecessary chain rule and capture (921180 PL3) by @​EsadCetiner in https://github.com/coreruleset/coreruleset/pull/3787
• fix: add pem to restricted file extensions by @​EsadCetiner in https://github.com/coreruleset/coreruleset/pull/3789
• fix(942160): check REQUEST_FILENAME by @​mat1010 in https://github.com/coreruleset/coreruleset/pull/3782

New Contributors

• @​mat1010 made their first contribution in https://github.com/coreruleset/coreruleset/pull/3782

Full Changelog: coreruleset/coreruleset@v4.5.0...v4.6.0

v4.5.0

Compare Source

What's Changed

🆕 New features and detections 🎉

• feat: added arithmetic expansion payload by @​Xhoenix in https://github.com/coreruleset/coreruleset/pull/3756

🧰 Other Changes

• fix(security): alias false negative by @​Xhoenix in https://github.com/coreruleset/coreruleset/pull/3740
• feat: add test overrides for nginx by @​theseion in https://github.com/coreruleset/coreruleset/pull/3369
• fix: use proper capture for log output of 932300 by @​theseion in https://github.com/coreruleset/coreruleset/pull/3763
• chore: use lowercase character class for 932320 by @​theseion in https://github.com/coreruleset/coreruleset/pull/3772
• fix: remove nonnecessary variable (932260 PL1) by @​dune73 in https://github.com/coreruleset/coreruleset/pull/3773

New Contributors

• @​aryehb made their first contribution in https://github.com/coreruleset/coreruleset/pull/3755

Full Changelog: coreruleset/coreruleset@v4.4.0...v4.5.0

v4.4.0

Compare Source

What's Changed

🆕 New features and detections 🎉

• feat: skip response rules if data are compressed by @​azurit in https://github.com/coreruleset/coreruleset/pull/3742, https://github.com/coreruleset/coreruleset/pull/3712

🧰 Other Changes

• fix(934140): update regex by @​fzipi in https://github.com/coreruleset/coreruleset/pull/3731
• fix: replacing t:UrlDecode with t:UrlDecodeUni (921240 PL1, 932170 PL1, 932171 PL1, 932190 PL3, 932190 PL1, 933211 PL3, 941310 PL1, 941350 PL1) by @​azurit in https://github.com/coreruleset/coreruleset/pull/3713

Full Changelog: coreruleset/coreruleset@v4.3.0...v4.4.0

v4.3.0

Compare Source

What's Changed

🆕 New features and detections 🎉

• feat: catch Java PostgreSQL errors (951240 PL1) by @​azurit in https://github.com/coreruleset/coreruleset/pull/3686
• feat: block The Mysterious Mozlila User Agent bot (913100 PL1) by @​brentclark in https://github.com/coreruleset/coreruleset/pull/3646

🧰 Other Changes

• fix: Oracle SQL database data leakage FP (951120 PL1) by @​azurit in https://github.com/coreruleset/coreruleset/pull/3685
• fix: typos in 920330 and 942280 tests by @​TimDiam0nd in https://github.com/coreruleset/coreruleset/pull/3688
• test: change pl-1 to pl1 to be inline with others by @​TimDiam0nd in https://github.com/coreruleset/coreruleset/pull/3690
• feat: use renovate to update docker-compose by @​theseion in https://github.com/coreruleset/coreruleset/pull/3697
• fix: FP for sched (932235 PL1, 932236 PL2, 932237 PL3, 932239 PL2, … by @​theseion in https://github.com/coreruleset/coreruleset/pull/3701
• fix: collections not being initialized without User-Agent header by @​azurit in https://github.com/coreruleset/coreruleset/pull/3645
• feat: refactoring of rule 941310 (PL1 941310) by @​azurit in https://github.com/coreruleset/coreruleset/pull/3700
• fix: resolving more FPs with Oracle error messages (951120 PL1) by @​azurit in https://github.com/coreruleset/coreruleset/pull/3703
• fix: removing double t:urlDecodeUni (920221 PL1, 920440 PL1, 932200 PL2, 932205 PL2, 932206 PL2) by @​azurit in https://github.com/coreruleset/coreruleset/pull/3699
• fix: false positives from PHP config directives and functions (933120 PL1, 933151 PL2) by @​ssigwart in https://github.com/coreruleset/coreruleset/pull/3638
• feat: prevent detection of web shells rules as malware by Windows Defender (955260 PL1) by @​azurit in https://github.com/coreruleset/coreruleset/pull/3687
• fix: fp with name axel by removing it from rce rule (932260 PL1) by @​franbuehler in https://github.com/coreruleset/coreruleset/pull/3705

New Contributors

• @​TimDiam0nd made their first contribution in https://github.com/coreruleset/coreruleset/pull/3688
• @​brentclark made their first contribution in https://github.com/coreruleset/coreruleset/pull/3646

Full Changelog: coreruleset/coreruleset@v4.2.0...v4.3.0

v4.2.0

Compare Source

Version 4.2.0 - 2024-04-23

Changes with direct rule impact (sorted by lowest rule ID per change where available):

• fix: increase length of Accept-Encoding header from 50 to 100 (920520 PL1) (Franziska Bühler) [#​3661]
• fix: add missing roundcube files (930120 PL1, 930121 PL2, 930130 PL1, 932180 PL1) (Esad Cetiner) [#​3635]
• fix: add visudo and cscli to unix-shell.data (932160 PL1, 932161 PL2) (Esad Cetiner) [#​3663]
• feat: block crowdsec cscli and visudo commands (932235 PL1, 932236 PL2, 932237 PL3, 932239 PL2, 932260 PL1) (Esad Cetiner) [#​3649]
• fix: add detection for php evasion attempt (933100 PL1) (Franziska Bühler) [#​3667]

Changes without direct rule impact:

• feat: disassemble php rule (933100 PL1) (Franziska Bühler) [#​3662]
• chore: remove references to nonexistant 942110 rule (Esad Cetiner) [#​3648]

Full Changelog: coreruleset/coreruleset@v4.1.0...v4.2.0

v4.1.0

Compare Source

What's Changed

• feat: add check for combinations of t:lowercase and (?i) to lint (Franziska Bühler) [#​3584]
• feat: add support for additional ansible and chef commands (932160 PL1, 932161 PL2, 932235 PL1, 932260 PL1, 932236 PL2, 932239 PL2, 932237 PL3) (Esad Cetiner) [#​3601]
• feat: move HTTP header rules to phase 1 (932161 PL2, 932205 PL2, 932206 PL2, 932237 PL3) (Esad Cetiner) [#​3570]
• fix: prevent FPs against names due to "cron" (932260 PL1, 932236 PL2, 932237 PL3, 932239 PL2) (@​superlgn) [#​3578]
• fix: add missing tags and ver action (various rules) (Jozef Sudolský) [#​3571]
• fix: adding more missing tags and ver actions (Jozef Sudolský) [#​3593]
• fix: do not check URL fragments in referer headers as part of the existing rule to prevent FPs (932205 PL2) (Max Leske) [#​3485]
• fix: range expressions must not start with \v (various rules) (Max Leske) [#​3615]
• fix: remove t:lowercase from rules that use '(?i)' modifier in their regex (942150 PL2, 942151 PL1, 942152 PL2) (Ervin Hegedus) [#​3585]
• test: change HTTP method to uppercase for test 932260-28 (Matteo Pace) [#​3580]
• chore(deps): update workflow actions (Max Leske) [#​3613]
• chore: add Esad Cetiner to list of developers (@​EsadCetiner) [#​3589]

New Contributors

• @​floyd-fuh made their first contribution in https://github.com/coreruleset/coreruleset/pull/3612

Full Changelog: coreruleset/coreruleset@v4.0.0...v4.1.0

v4.0.0

Compare Source

This is the OWASP CRS version 4.0.0.

Important changes:

• feat: introduce plugin architecture for extending CRS and minimizing attack surface. (Christian Folini, Max Leske, Jozef Sudolský, Andrew Howe) [#​2038, #​2448, #​2404]
• feat: migrate application exclusions and less-used functionality to plugins (Christian Folini, Max Leske, Jozef Sudolský, Andrew Howe)
• feat: introduce early blocking option (Christian Folini) [#​1955]
• feat: introduce new rule file/category to detect use of common web shells in responses (955100-955340 PL1, 955350 PL2) (Jozef Sudolský, Andrea Menin) [#​1962, #​2039, #​2116]
• feat: rename 'Node.js' category to 'generic' (Felipe Zipitría) [#​2340]
• feat: make all formerly PCRE-only regular expressions compatible with RE2/Hyperscan regular expression engines (Max Leske, Felipe Zipitría, Allan Boll, Franziska Bühler) [#​1868, #​2356, #​2425, #​2426, #​2371, #​2372]
• feat: add support for HTTP/3 (Jozef Sudolský) [#​3218]
• feat: add granular control over reporting levels in 9801xx rules (Simon Studer, Andrew Howe, Christian Folini) [#​2482, #​2488]
• feat: add new rule to explicitly detect multiple Content-Type abuse (CVE-2023-38199) (920620 PL1) (Andrea Menin) [#​3237]
• feat: add enable_default_collections flag to not initialize collections by default (Matteo Pace) [#​3141]
• feat: extend definition of restricted headers to include Content-Encoding and Accept-Charset by default (920450 PL1, 920451 PL2) (Walter Hop) [#​2780, #​2782]
• feat: drop HTTP/0.9 support to resolve FP (Federico G. Schwindt) [#​1966]
• fix: refactor and rename anomaly scoring variables and paranoia level definition (Simon Studer) [#​2417]
• tests: complete goal of 100% test coverage for rules (entire team, Juan-Pablo Tosso, NiceYouKnow)
• feat: switch to using WordNet instead of spell for finding English words in spell.sh (Max Leske) [#​3242]
• feat: publish nightly packages regularly (Felipe Zipitría) [#​2207]

Tool changes:

• feat: extend spell.sh script with an opt-in manual list of common and partial words. (Matteo Pace) [#​3273]
• feat: rework spell.sh utility to help with detection of false positives English words (Andrea Menin) [#​3029]
• feat: improve usability of spell.sh utility (Max Leske) [#​3238]
• feat: extend rules-check.py script to better enforce rule format in project guidelines (Ervin Hegedus) [#​3113]
• feat: extend rules-check.py script to ensure that auditLogParts is only used in last chained rule (Ervin Hegedus) [#​2609]
• feat: extend rules-check.py script to ensure that rules use @rx operator explicitly (Ervin Hegedus) [#​2541]
• feat: extend rules-check.py script to strip comments when parsing crs-setup.conf.example (Ervin Hegedus) [#​3161]
• feat: add utility to change version numbers (Ervin Hegedus) [#​2085]
• feat: add utility script to find rules without tests (Ervin Hegedus) [#​2279]
• feat: add crs-rules-check tool that runs sanity checks against rules (Ervin Hegedus) [#​2236]
• feat: add utility to find longest data lengths (Ervin Hegedus) [#​2277]
• feat: improve rule-ctl script to modify rules (Max Leske) [#​2193]
• feat: improve unique ID matching and documentation in send-payload-pls.sh (Manuel Spartan) [#​2288]
• feat: unify regexp utils to automate error-prone actions and automatically update rules from regular expression sources (Max Leske) [#​2149, #​2223, #​2423, #​2495, #​2489, #​2473]
• fix: adjust log directories needed for volume mounts to Git (Max Leske) [#​2103]
• fix: replace backend docker container for tests to fix JSON Unicode reflection (Max Leske) [#​3464]
• feat: add new test method: check for tags on rules against allowlist (Ervin Hegedus) [#​3437]

Changes with direct rule impact (sorted by lowest rule ID per change where available):

• feat: add placeholder files for new plugin architecture (Walter Hop) [#​2515]
• feat: check initialization and use for all TX variables (Ervin Hegedus) [[#​3043](https://redirect.gi

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cloudflare-workers-and-pages]

Deploying website with    Cloudflare Pages

Latest commit:	67f8a0c
Status:	✅  Deploy successful!
Preview URL:	https://49cf79bb.website-1u6.pages.dev
Branch Preview URL:	https://renovate-major-4-all-major.website-1u6.pages.dev

View logs

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 4.x releases. But if you manually upgrade to 4.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.