3.0 Release Checklist

[liquidsec]

This issue will serve as the final tracker as we push towards a 3.0 release.

Required PRs

• Verify SSL for infrastructure by default (but not target traffic) #3186 - Verify SSL for infrastructure by default (not target traffic)
• aspnet_bin_exposure: concurrent probes + bump module threads #3182 - aspnet_bin_exposure: concurrent probes + bump module threads
• paramminer: dedup by endpoint + param keys, not full URL string #3180 - paramminer: dedup by endpoint + param keys, not full URL string
• Add content-based dedup for modules #3179 - Add content-based dedup for modules
• Webbrute rework: HttpCompare baseline + defensive layers #3166 - Webbrute rework: HttpCompare baseline + defensive layers
• Add HTTP wildcard host detection #3164 - Add HTTP wildcard host detection
• Add 2.x → 3.0 migration guide #3128 - Add 2.x → 3.0 migration guide
• crt/crt_db error handling #3124 - crt/crt_db error handling
• Rewrite vhost module as virtualhost with native blasthttp #2993 - Rewrite vhost module as virtualhost with native blasthttp
• Verify SSL for infrastructure by default (but not target traffic) #3186
• Security patches #3196
• Add E2E tests, bump cloudcheck to 11.x #3210
• Reduce memory allocation pressure in HttpCompare, wayback, and paramminer #3213
• Comprehensive docs update #3208
• Prevent process pool zombies on crash #3207

Required Issues

• output_modules override behavior is confusing #3146 - output_modules override behavior is confusing
• Include IP, routing table in initial SCAN event #2137
• multiprocessing.Pool worker zombie processes #3203
• Failure to connect to ASNDB should give up gracefully #3215

Other Required Items

• Publicly release blasthttp
• Add/audit documentation
• Prepare blog post
• Changelog / release notes / finalize Migration Guide
• Docker image testing
• Final Version E2E testing

Nice to Have PRs

• http: add 429 rate-limit handling with host-level cooldowns #3145 - http: add 429 rate-limit handling with host-level cooldowns
• shodan_idb: enrich CVE findings with severity and CVSS #3082 - shodan_idb: enrich CVE findings with severity and CVSS
• Add waf_bypass module for WAF bypass detection  #2994 - Add waf_bypass module for WAF bypass detection

[sophymarine]

The 2.x → 3.0 migration guide section will probably save people the most time. BBOT output often feeds straight into diligence or investigations tooling where domains, subsidiaries, or officer names get correlated later. When the schema shifts even slightly, those downstream parsers tend to fail quietly.

I’d spell out the breaking bits very plainly. Field renames are the big one. Default behaviour in output_modules is another place pipelines can drift without anyone noticing. A short before/after JSON snippet would make the change obvious.

There’s also that open issue around output_modules override behaviour. If precedence changed between 2.x and 3.0, writing the exact rule down could spare people some confusing upgrade tests.

[liquidsec]

The 2.x → 3.0 migration guide section will probably save people the most time. BBOT output often feeds straight into diligence or investigations tooling where domains, subsidiaries, or officer names get correlated later. When the schema shifts even slightly, those downstream parsers tend to fail quietly.

I’d spell out the breaking bits very plainly. Field renames are the big one. Default behaviour in output_modules is another place pipelines can drift without anyone noticing. A short before/after JSON snippet would make the change obvious.

There’s also that open issue around output_modules override behaviour. If precedence changed between 2.x and 3.0, writing the exact rule down could spare people some confusing upgrade tests.

Good perspective, we can get a little more granular on the specific JSON/CSV output.

We've tried to bundle as many breaking changes in 3.0 at once to make the band-aid rip hopefully a one-time pain point.

The output module stuff is one of the last changes left - it is definitely quite confusing right now, hopefully we can sort it out properly.

[liquidsec]

Ready for deployment