All pull requests

Pull requests

• fix(runner): set HTTPS_PROXY and all proxy env vars when proxy-internal is enabled

  #7876·TassioSales opened Oct 14, 2026·

  ·
  1

  5

• fix(templates): keep flow and other template options on compiled-cache hits

  #7870·G360-Niek opened Oct 13, 2026Contributor·3 of 4 tasks·

  ·
  2

• fix(headless): enforce network policy on ws and wss schemes (#7867)

  #7868·TassioSales opened Oct 13, 2026·

  ·
  1

  20

• feat(input): pin a target to an ip with the ip key of target lines

  #7863·mazzz3r opened Oct 11, 2026·4 tasks done·

  ·
  1

• feat(progress): report completion by executed templates

  #7861·mazzz3r opened Oct 11, 2026·4 tasks done·

  ·
  1

  4

• perf(protocols/http): defer building FullResponseString when unused by operators

  #7857·AdamMagued opened Oct 10, 2026·

  ·
  1

  4

• feat(reporting): close Linear issues when a finding is fixed

  #7856·knakul853 opened Oct 9, 2026Contributor·

  ·
  6

  

• chore(deps): bump the go_modules group across 1 directory with 2 updates

  dependenciesgo
  #7855·dependabot[bot] opened Oct 9, 2026Bot·

  ·
  1

• fix(extractors): reject invalid xpath expressions during extractor compilation (#7750)

  #7854·TassioSales opened Oct 8, 2026·4 tasks done·

  ·
  1

  2

• fix(catalog): match known config files by exact basename

  #7853·NitinReddy-A opened Oct 8, 2026·

  ·
  1

  2

• fix(http): self-heal HTTP-to-HTTPS requests immediately on detection

  #7850·SamIntruder opened Oct 7, 2026·3 of 4 tasks·

  ·
  1

  2

• fix(installer): fail fast on unremovable templates update lock

  #7831·m10x opened Oct 6, 2026·3 tasks done·

  ·
  5

• chore: fix some comments

  #7830·kleonyuan opened Oct 6, 2026·2 of 4 tasks·

  ·
  2

• fix(http): set ip var from IP-literal target when dial history is empty

  #7828·ruzfi opened Oct 5, 2026·3 of 4 tasks·

  ·
  1

  4

• fix(raw): keep a path that contains "HTTP" in a versionless request line

  #7812·CalvinTjoaquinn opened Oct 1, 2026·3 of 4 tasks·

  ·
  2

• fix(extractors): reject misapplied group and attribute fields on wrong extractor types (#7808)

  #7810·TassioSales opened Oct 1, 2026·3 of 4 tasks·

  ·
  1

  2

• fix(extractors): reject fields the extractor type never reads

  #7809·sandiyochristan opened Sep 30, 2026Contributor·4 tasks done·

  ·
  1

  3

• fix(openapi): send format: binary octet-stream bodies as octet-stream

  #7802·omlahore opened Sep 29, 2026·2 of 4 tasks·

  ·
  1

  2

• fix(raw): two defects in the raw header loop

  #7799·CalvinTjoaquinn opened Sep 29, 2026·3 of 4 tasks·

  ·
  3

• feat(output): expose stable request identity for findings

  agent-generated
  #7798·knakul853 opened Sep 29, 2026Contributor·

  ·
  4

  

• fix(input): emit JSON objects in RequestResponse.MarshalJSON

  #7796·comradezephyr opened Sep 28, 2026·

  ·
  1

  2

• slow down a host that starts blocking

  #7793·dogancanbakir opened Sep 28, 2026Member·

  ·
  1

  12

  

• fix(openapi): build request bodies from an example of the empty schema

  #7786·omlahore opened Sep 27, 2026·2 of 4 tasks·

  ·
  1

  7

• feat(openapi): support OAuth2 and OpenID Connect access tokens

  #7784·root-Manas opened Sep 27, 2026·3 of 4 tasks·

  ·
  12

• feat: add OrcaRouter as a first-class LLM provider with API key and PKCE login

  #7770·hodeswildsmith455-boop opened Sep 22, 2026·4 tasks done·

  ·
  6