All pull requests

Pull requests

• fix(seclang): handle single-quoted and extra-whitespace arguments in SecRuleRemoveByMsg/Tag

  #1762·AdamMagued opened Oct 14, 2026·

  ·
  1

  1

• fix(operators): don't panic in @validateNid cl when the match has no digits

  #1760·fzipi opened Oct 14, 2026Member·4 tasks done·

  ·
  2

• fix(bodyprocessors): keep multipart parts raw instead of decoding quoted-printable

  #1759·fzipi opened Oct 14, 2026Member·4 tasks done·

  ·
  2

• fix(collections): lowercase the ARGS_NAMES lookup key like ARGS

  #1757·fzipi opened Oct 14, 2026Member·4 tasks done·

  ·
  2

• perf(collections): lean match data for collection reads

  performance
  #1752·fzipi opened Oct 12, 2026Member·

  ·
  2

• perf(bodybuffer): stream body reads and bound what pooled transactions retain

  performance
  #1751·fzipi opened Oct 12, 2026Member·

  ·
  1

  6

• perf(engine): expand RULE:msg/logdata at match time, not per evaluated rule

  performance
  #1750·fzipi opened Oct 12, 2026Member·

  ·
  10

• test: document RESPONSE_CONTENT_LENGTH behaviour

  #1747·yashthakur2008 opened Oct 11, 2026·

  ·
  3

• fix(operators): stop leaking the rbl lookup goroutine, query DNSBLs with reversed octets

  #1746·fzipi opened Oct 11, 2026Member·

  ·
  1

  10

• fix: keep ctl:ruleRemoveTargetById removals per transaction

  #1745·rforced opened Oct 11, 2026·4 tasks done·

  ·
  1

  1

• feat(actions): add evalDepth for depth first chain evaluation

  #1744·adilalperenciftci opened Oct 11, 2026·

  ·
  1

  8

• fix(waf): replace transaction ids that cant be a path element

  #1743·adilalperenciftci opened Oct 11, 2026·

  ·
  1

  5

• fix(transformations): use slash-aware path cleaning

  #1742·jay23606 opened Oct 11, 2026·

  ·
  1

• fix(actions): expand macros in tag values per match

  #1741·fzipi opened Oct 10, 2026Member·

  ·
  1

  9

• fix(transaction): reject a body only when it exceeds the limit

  #1740·fzipi opened Oct 10, 2026Member·

  ·
  1

  14

• fix(waf): close WAF when NewWAF fails so memoize owners are released

  #1739·jcchavezs with CopilotAI opened Oct 9, 2026·

  ·
  1

  7

  

• fix(deps): update module golang.org/x/net to v0.60.0 [security]

  security
  #1737·renovate[bot] opened Oct 9, 2026Bot·1 task·

  ·
  2

• feat(bodyprocessors): populate MULTIPART_INVALID_PART

  #1733·ChrisJr404 opened Oct 3, 2026Contributor·

  ·
  1

  6

• docs(adr): point published-advisory ADRs at their GHSAs

  #1731·fzipi opened Oct 2, 2026Member·

  ·
  5

• fix(http): preserve redirect and drop interruptions in net/http connector

  #1719·fzipi with CopilotAI opened Sep 22, 2026·

  ·
  1

  4

  

• feat(bodyprocessors): parse XML file parts of a multipart body

  #1716·victorserbu2709 opened Sep 7, 2026·4 tasks done·

  ·
  24

• docs(adr): proposed record (ADR-0061) for REQUEST_BODY when a processor ran

  #1715·fzipi opened Sep 6, 2026Member·1 of 3 tasks·

  ·
  7

• docs(variables): correct XML SecLang example and note REQUEST_XML alias

  #1713·fzipi opened Sep 3, 2026Member·2 of 3 tasks·

  ·
  6

• test: make the declarative harness expressive enough to stop duplicating coverage

  #1711·jptosso opened Sep 3, 2026Member·

  ·
  2

• chore(deps): update module golang.org/x/crypto to v0.56.0 [security]

  breakingsecurity
  #1709·renovate[bot] opened Sep 3, 2026Bot·1 task·

  ·
  4