fix(deps): update module github.com/corazawaf/coraza/v3 to v3.0.4

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
github.com/corazawaf/coraza/v3	require	patch	v3.0.0-20221004054810-060cedcb166d -> v3.0.4

---

Release Notes

corazawaf/coraza (github.com/corazawaf/coraza/v3)

v3.0.4: Version 3.0.4

Compare Source

What's Changed

• chore(deps): bump golang.org/x/sync from 0.1.0 to 0.3.0 by @​dependabot in https://github.com/corazawaf/coraza/pull/862
• chore: upgrades coraza to latest aho-corasick. by @​jcchavezs in https://github.com/corazawaf/coraza/pull/867
• fix: Logs print different messages for each the disruptive actions by @​M4tteoP in https://github.com/corazawaf/coraza/pull/827
• chore(deps): bump github.com/tidwall/gjson from 1.14.4 to 1.17.0 by @​dependabot in https://github.com/corazawaf/coraza/pull/878

Full Changelog: v3.0.3...v3.0.4

v3.0.3: Version 3.0.3

Compare Source

What's Changed

• chore(readme): explicits CRS supported version by @​M4tteoP in https://github.com/corazawaf/coraza/pull/834
• chore: adds go mod tidy and go work sync for all modules. by @​jcchavezs in https://github.com/corazawaf/coraza/pull/835
• adds more verbosity on go mod tidy errors by @​jcchavezs in https://github.com/corazawaf/coraza/pull/837
• add https audit log support by @​jptosso in https://github.com/corazawaf/coraza/pull/826
• chore: fixes e2e pkg. by @​jcchavezs in https://github.com/corazawaf/coraza/pull/841
• chore: updates e2e standalone command by @​M4tteoP in https://github.com/corazawaf/coraza/pull/845
• Adds Log() to MatchedRule, fixes audit log without log by @​M4tteoP in https://github.com/corazawaf/coraza/pull/848
• chore(e2e): check response body read error only if a body is expected by @​M4tteoP in https://github.com/corazawaf/coraza/pull/852
• chore: drops benchmark CI. by @​jcchavezs in https://github.com/corazawaf/coraza/pull/857
• implement https mime by @​jptosso in https://github.com/corazawaf/coraza/pull/850
• chore: adds memoize implementation for regexes and ahocorasick by @​jcchavezs in https://github.com/corazawaf/coraza/pull/836

Full Changelog: v3.0.2...v3.0.3

v3.0.2: Version 3.0.2

Compare Source

What's Changed

• fix: blocks body buffer reader once the body buffer has been reset. by @​jcchavezs in https://github.com/corazawaf/coraza/pull/825
• fix: benchmark and propagate the status to not to swallow the failure by @​jcchavezs in https://github.com/corazawaf/coraza/pull/808

Full Changelog: v3.0.1...v3.0.2

v3.0.1

Compare Source

Important

This tag fixes a high-severity vulnerability. See GHSA-c2pj-v37r-2p6h

Full Changelog: v3.0.0...v3.0.1

v3.0.0

Compare Source

What's Changed

Coraza's latest v3.0.0 release brings a highly refactored engine that offers more flexibility and major improvements.

Notable changes include:

• Performance improvement: Performance has been improved by up to 100 times due to several key enhancements such as:
  • New debug logs system based on Zerolog for a fast and with low to zero allocations.
  • Cache transformation logic across the same transaction.
  • Optimized variable collection types.
• Refactored API: Coraza now relies on a more straightforward and user-friendly API.
• New Plugin Package: The new package simplifies the extension of Coraza's functionalities.
• Full CRS v4 Support: Coraza fully supports the CRS v4 branch, always making CRS compatibility of top priority. The CI now includes a CRS testing suite to guarantee a regression-free development.
• Cross-platform support: Both Go and TinyGo for WASM builds are now supported.
• New experimental Multiphase feature: Introducing a new way for early data evaluation and blocking.
• Dataset support: designed for in-config .data files emulation.

Contributors

Many thanks to all the contributors and users that made this release possible:

• @​anuraaga
• @​bxlxx
• @​codefromthecrypt
• @​fzipi
• @​Hayak3
• @​jcchavezs
• @​jptosso
• @​M4tteoP
• @​manojgop
• @​nacx
• @​ns-sundar
• @​piyushroshan
• @​ShiMing-Q
• @​sts
• @​y05h1k1ng
• @​zc2638

v3.0.0-rc.3

Compare Source

What's Changed

• registers pmFromDataset, fixes Dataset propagation, adds tests by @​M4tteoP in https://github.com/corazawaf/coraza/pull/777
• docs: update README and SECURITY by @​fzipi in https://github.com/corazawaf/coraza/pull/780
• Validate audit log parts by @​Hayak3 in https://github.com/corazawaf/coraza/pull/779
• Remove intermediate string allocation when writing match details log by @​anuraaga in https://github.com/corazawaf/coraza/pull/781
• fix: aligns multimatch to modsec behavior by @​M4tteoP in https://github.com/corazawaf/coraza/pull/778
• chore: increases rule.go test coverage by @​M4tteoP in https://github.com/corazawaf/coraza/pull/786
• remove wrong loop in matchData by @​Hayak3 in https://github.com/corazawaf/coraza/pull/785
• hotfix: fixes rule_test after merge by @​M4tteoP in https://github.com/corazawaf/coraza/pull/788
• chore(deps): bump github.com/magefile/mage from 1.14.0 to 1.15.0 by @​dependabot in https://github.com/corazawaf/coraza/pull/791
• chore(deps): bump golang.org/x/net from 0.9.0 to 0.10.0 by @​dependabot in https://github.com/corazawaf/coraza/pull/789
• feat(ci): stale only awaiting for feedback's issue by @​M4tteoP in https://github.com/corazawaf/coraza/pull/793
• Multiphase: chains further support, ARGS split, CRS like tests by @​M4tteoP in https://github.com/corazawaf/coraza/pull/719
• feat: adds auditlog plugins API by @​jcchavezs in https://github.com/corazawaf/coraza/pull/787
• fix/feat: Macro expansions, error logs redundancy, support msg/logdata in inner rules by @​M4tteoP in https://github.com/corazawaf/coraza/pull/792
• remove alpha disclosure from README by @​jptosso in https://github.com/corazawaf/coraza/pull/796
• breaking: removes code parameter from ErrorLog and AuditLog by @​M4tteoP in https://github.com/corazawaf/coraza/pull/800

New Contributors

• @​Hayak3 made their first contribution in https://github.com/corazawaf/coraza/pull/779

Full Changelog: v3.0.0-rc.2...v3.0.0-rc.3

v3.0.0-rc.2

Compare Source

What's Changed

• Use bitset for inferred phases by @​anuraaga in https://github.com/corazawaf/coraza/pull/727
• Document test failures due to regex matching arbitrary bytes by @​anuraaga in https://github.com/corazawaf/coraza/pull/730
• Enable multiline mode for rx by @​anuraaga in https://github.com/corazawaf/coraza/pull/732
• Use binaryregexp for rx operator by @​anuraaga in https://github.com/corazawaf/coraza/pull/731
• Add rx test case confirming case-insensitive rules will work by @​anuraaga in https://github.com/corazawaf/coraza/pull/733
• fix(ci): remove sonarcloud by @​fzipi in https://github.com/corazawaf/coraza/pull/738
• fix(bodyprocessors): fix forcerequestbodyvariable overriding processor by @​jptosso in https://github.com/corazawaf/coraza/pull/740
• fix(bodyprocessors): force response body overrides mime requirements by @​jptosso in https://github.com/corazawaf/coraza/pull/741
• chore: create plugins package. by @​jcchavezs in https://github.com/corazawaf/coraza/pull/734
• chore: drops unused methods in TransactionState by @​jcchavezs in https://github.com/corazawaf/coraza/pull/739
• chore: describes currently excluded CRS excluded rules by @​M4tteoP in https://github.com/corazawaf/coraza/pull/744
• fix: fixes fuzz target. by @​jcchavezs in https://github.com/corazawaf/coraza/pull/745
• Update tool versions by @​anuraaga in https://github.com/corazawaf/coraza/pull/710
• fix(action): Add many validations for setvar by @​jptosso in https://github.com/corazawaf/coraza/pull/747
• fix: adds full support for ruleRemoveById. by @​jcchavezs in https://github.com/corazawaf/coraza/pull/749
• Small simplification to macro readability by @​anuraaga in https://github.com/corazawaf/coraza/pull/751
• Remove Single.Set from API for now by @​anuraaga in https://github.com/corazawaf/coraza/pull/750
• chore: updates tests to latest CRS, updates go-ftw by @​M4tteoP in https://github.com/corazawaf/coraza/pull/752
• transform expireVar to noop by @​jptosso in https://github.com/corazawaf/coraza/pull/755
• Move remaining plugin-related logic to experimental by @​anuraaga in https://github.com/corazawaf/coraza/pull/753
• Small simplification to cmd_line code by @​anuraaga in https://github.com/corazawaf/coraza/pull/761
• Use standard library for base64 decode by @​anuraaga in https://github.com/corazawaf/coraza/pull/758
• Small simpflication to css_decode by @​anuraaga in https://github.com/corazawaf/coraza/pull/762
• Delegate to normalisePath from normalisePathWin by @​anuraaga in https://github.com/corazawaf/coraza/pull/763
• Append into output buffer for removecommentschar by @​anuraaga in https://github.com/corazawaf/coraza/pull/764
• chore(deps): bump golang.org/x/net from 0.8.0 to 0.9.0 by @​dependabot in https://github.com/corazawaf/coraza/pull/766
• fix: synthesizes Transfer-Encoding header inside the transaction by @​M4tteoP in https://github.com/corazawaf/coraza/pull/768
• Include key size in ARGS_COMBINED_SIZE by @​anuraaga in https://github.com/corazawaf/coraza/pull/756

Full Changelog: v3.0.0-rc.1...v3.0.0-rc.2

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

📢 Thoughts on this report? Let us know!