Changelog

This page summarizes the notable changes to NetVuln Tool through the current release (v4.2.4). The complete, authoritative history lives in CHANGELOG.md at the repository root and follows the Keep a Changelog format.

The project follows semantic versioning. Stable releases are tagged vX.Y.Z on main; dev is the integration branch. Version bumps and Gitea Releases are automated by the CI pipeline (see Contributing).

Unreleased (in development)

Work merged to dev and not yet cut to a stable tag.

Added

• WiFi access-point discovery (#71): scripts/discover_wifi.sh, an opt-in standalone Linux-only scanner that enumerates nearby access points in managed mode via nmcli (0-100 link quality) or iw (dBm), with a guarded best-effort --monitor capture path (aircrack-ng). Emits wifi_scan_results.json. See WiFi Discovery.
• Field-appliance enclosure design (#74): a proprietary two-part 3D-printed case for a Raspberry Pi 5 plus RTL-SDR under appliance/ (OpenSCAD source, print-ready STLs, renders, assembly guide). The subtree is All Rights Reserved, not Apache-2.0, and is excluded from the published container image (see Open Source Boundary).
• docker-compose.yml: one-command containerized scans (docker compose run --rm scan recon -t <lan>), pre-wiring host networking and the sessions volume so privileged scans need no cap flags (#65). See Docker.
• C2 session visibility and on-demand push (#86): run_scan captures and reports the session id it created and accepts an optional upload: true payload to push results to the portal; a new push_session command uploads an existing session on demand (path-traversal validated). See Command and Control.
• C2 operator guide and persisted push_config overrides (#84): new docs/C2_GUIDE.md; pushed config overrides now persist across daemon reload/restart via .c2_overrides.conf.

Fixed

• C2 run_scan with profile: quick always failed (#86): quick/quick_recon now correctly map to -P quick_recon instead of a nonexistent --quick flag.
• Host discovery silently swallowed nmap crashes (#82): discovery now runs one nmap per target, captures stderr to host_discovery.err, and surfaces a signal-death (rc >= 128) as a loud error plus an info-severity finding rather than reporting "0 hosts found".
• WiFi findings mislabeled the signal unit (#73): normalized records now carry a per-backend unit (link quality % for nmcli, dBm for iw).
• Privileged scans from the container (#65): the Dockerfile grants cap_net_raw+eip on the nmap binary and sets NMAP_PRIVILEGED=1, so the non-root user gets full privileged scans with a plain docker run.
• HTML report not generated by the Python orchestrator (#66): generate_html_report now self-initializes NV_JSON_MODE when unset.

[4.2.4] - 2026-07-04

Fixed

• E2E smoke test share-lookup false failure (#62): scripts/e2e_smoke_test.sh now includes a minimal report_html part in the upload round-trip, so the portal stores a report blob and the share-token lookup returns 200. Added a BATS regression test. (1036 BATS + 143 client + 436 Python tests.)

[4.2.3] - 2026-07-04

Added

• Session license metadata plus business-tier gating (#46): the scan pipeline stamps a license block (tier, source, key fingerprint, validated-at timestamp; never the plaintext key) into every session JSON, mirroring the Python orchestrator. Webhook alert channels and remediation tracking now require an active business/MSP license, degrading gracefully on lower tiers.

Fixed

• Wrong tool version stamped in reports (#52): NV_VERSION now derives from the VERSION file at source time (was hardcoded 2.7.0), so report footers, session tool_version, and the exec summary render the correct version. bump_version.sh consistency-checks the fallback pin.

CI

• release.yml runs the BATS assertion lint (#47), matching ci.yml and the pre-commit hook.

[4.2.0] - [4.2.2]

Added

• Container image (#54): a single-stage Alpine Dockerfile bundling the full recon toolchain (nmap plus NSE, bash, coreutils, jq, bind-tools, whois, openssl, samba-client, net-snmp-tools) and the source tree, run as a non-root netvuln user. Published to the Gitea container registry via .gitea/workflows/publish-image.yml (:latest plus :<VERSION>). See Docker.

Fixed

• v4.2.1 container publish hardening (#54): lowercase the repository path for buildx, plus a fail-fast preflight that verifies REGISTRY_USER/REGISTRY_TOKEN are set.
• v4.2.2 CI/release BATS runner consistency: both workflows force-install a pinned bats v1.13.0 so a stale pre-installed bats cannot mis-parse heredoc test fixtures and skip release tagging.

[4.1.0] - 2026-06-10

Added

• Unified license key model (#40): NV_API_KEY is the canonical license, with identical bash and Python resolution precedence (NV_LICENSE_KEY, NV_API_KEY, CONSULTATION_API_KEY, ~/.netvuln/license.key). Keys parse against nvt_{pro|biz|msp}_{64hex}; the tier drives a feature gate matrix (soft gates that warn and skip, never blocking core scanning). See License Provisioning.
• Online license validation with cache and grace (#40): lib/license_validate.sh and netvuln/license.py query GET /api/license with a 24h cache and a 72h offline grace window (fingerprint only, mode 600 cache).
• ORC 9.64 compliance framework (#41): maps findings to the five technical divisions of Ohio Revised Code 9.64, with a readiness report tab, executive summary block, statutory deadlines, and attestation checklist. Opt-in and business-tier gated. See Compliance Mapping.
• BATS assertion convention plus lint (#42): scripts/check_bats_assertions.sh and a canary suite.

Fixed

• Mid-test BATS assertions silently passing on bash < 4.1 (#42): 1,452 bare standalone [[ ... ]] assertions across 37 suites are now guarded with || false (the upstream-documented fix). CI on Debian was never affected; exposure was local dev on macOS /bin/bash 3.2.

[4.0.0] - [4.0.4]

Added

• Automated CI versioning (#28): VERSION as the single source of truth, scripts/bump_version.sh (patch/minor/major) atomically updating VERSION, pyproject.toml, and netvuln/__init__.py; release_check.yml enforces the bump on PRs to main; release.yml auto-creates the git tag and Gitea Release with generated notes on merge.
• Python quality CI job: python-checks runs pytest plus mypy via venv.

Fixed

• v4.0.1 - v4.0.4 release-pipeline hardening: workflow_dispatch manual fallback, a fix for a column-0 Python heredoc that broke the release.yml YAML, and a workflow-yaml CI job (scripts/validate_workflows.py) that catches the heredoc trap at PR time.

[3.3.0] - [3.5.0] Python orchestrator

Added

• Python orchestrator (#v3.3.0): the netvuln/ package with a full CLI (recon/scan/upload/push/diff/status/version), a pipeline runner, nmap XML parsing, a native scoring engine (A-F grades, dual model), native HTTP upload and diff, strict mypy, and a py.typed marker. pip install -e . provides the netvuln console script. See Python Orchestrator.
• Pipeline plugin hooks, license soft gate, and progress callbacks (v3.4.0): _run_hooks() fires at phase boundaries; netvuln status --remote lists portal sessions via JWT; netvuln daemon wraps netvuln_daemon_ctl.sh.
• Parallel module execution (v3.5.0): independent enumeration and report modules run concurrently via ThreadPoolExecutor with per-module temp JSON merge; the pre-push test hook is split from pre-commit.
• C2 command handler and plugin architecture (v3.3.0): lib/command_handler.sh (run_scan, update_schedule, push_config, restart, shutdown, update, set_log_level) and lib/plugin_loader.sh. api_debug.sh portal debug tool.

[3.2.0] - [3.2.1] Compliance and topology

Added

• Compliance framework mapping: automatic finding-to-control mapping for CIS Controls v8, NIST CSF, PCI-DSS v4.0, and SOC 2 with gap analysis (compliance_mapper.sh), plus a Compliance report tab.
• Network topology visualization: per-host risk scoring, subnet grouping, and an inline SVG network map in reports (network_topology.sh); a D3.js force-directed graph in the portal.

[3.1.0] - 2026-03-03

Added

• Synthetic collection generator (synthetic_collection.sh) for test datasets with configurable severity mix and trends.
• Exception / accept-liability workflow (remediation_update.sh --accept/--revoke) with justification, approver, and optional auto-expiry.
• Dual scoring model: an operational risk score (post-exceptions) alongside the actual risk score (risk_score.sh), with a portal risk register.

[3.0.0] - 2026-03-03

Added

• Persistent scheduling daemon (netvuln_daemon.sh) replacing cron: multi-config management, a pure-bash cron expression engine, exponential-backoff retry, portal health heartbeats, and signal-driven lifecycle (SIGHUP/SIGTERM/SIGUSR1).
• Daemon control CLI (netvuln_daemon_ctl.sh) with systemd install/uninstall and a service unit template. See Daemon Mode.

2.x series (2026-02 to 2026-03)

The 2.x line built out the core assessment and reporting stack:

• v2.15.0 template engine for executive summaries (Mustache-like syntax, PDF export, custom templates).
• v2.14.0 report white-labeling (config-driven branding, CSS overrides) and CLIENT_ID multi-tenancy scoping.
• v2.12.0 - v2.13.0 platform validation (pi_validate.sh), missed-scan detection (schedule_monitor.sh), and multi-config schedule management (schedule_list.sh, schedule_status.sh).
• v2.11.0 cross-platform support for macOS and Linux/Debian (Raspberry Pi), with platform detection helpers.
• v2.9.0 - v2.10.0 alert result capture, executive summary upload, schedule metadata injection, health endpoint, and E2E smoke tests.
• v2.8.0 the risk scoring engine (A-F grades, trend analysis), email security assessment (SPF/DKIM/DMARC), cross-session remediation tracking, the scan diff CLI (CI exit code 2), and multi-channel alerts (email/Slack/webhook).
• v2.0 - v2.7.0 the multi-phase recon pipeline, self-contained HTML reports (tabs, pagination), CVE/CVSS lookup, the consultation upload portal, and the remediation playbook.

Version history (quick reference)

Version	Tag	Highlights
4.2.4	v4.2.4	E2E smoke test share round-trip fix (#62); 1036 BATS + 143 client + 436 Python tests
4.2.3	v4.2.3	Session license metadata + business-tier gating (#46); NV_VERSION from VERSION file (#52)
4.2.0 - 4.2.2	v4.2.x	Containerized Alpine image published to the Gitea registry (#54); publish + bats-pin hardening
4.1.0	v4.1.0	Unified license model + online validation; ORC 9.64 framework; BATS || false sweep (#40, #41, #42)
4.0.0 - 4.0.4	v4.0.x	Automated CI versioning + auto-tagging; Python quality CI; release-pipeline hardening (#28)
3.3.0 - 3.5.0	v3.3-3.5	Python orchestrator (full CLI, native scoring/upload/diff, strict mypy); plugin hooks; parallel modules
3.2.0 - 3.2.1	v3.2.x	Compliance mapping (CIS v8, NIST CSF, PCI-DSS v4.0, SOC 2); network topology visualization
3.1.0	v3.1.0	Synthetic collections; exception/accept-liability workflow; dual scoring model
3.0.0	v3.0.0	Persistent scheduling daemon; daemon control CLI; systemd integration
2.8.0 - 2.15.0	v2.8-2.15	Risk scoring, email security, remediation tracking, alerts, exec summaries, white-labeling, scheduling
2.0 - 2.7.0	v2.x	Multi-phase recon pipeline, HTML reports, CVE lookup, portal upload, remediation playbook
1.0	v1.0.0	Initial release: 4 scan modes, CSV export, logging

For the full entry-by-entry history, including every patch release and portal companion note, read CHANGELOG.md in the repository.