Cumulative changes since Invicti ASPM 1.113.0!

This document lists all changes delivered in Invicti ASPM 1.113.24 compared with Invicti ASPM 1.113.0.

Feature availability may depend on license, configured integrations, deployment mode, and customer-specific settings.

New Features

• Allowed Jira automation to create issues without an ASPM assignee, with token-owner fallback behavior.
• Added more detailed 4me request and response diagnostics for failed issue operations.
• Added a migration path and deprecation guidance for Azure DevOps organization-scoped personal access tokens.
• Added vulnerability flag identifiers to scan-vulnerability responses, plus the supporting index required for flag-based filtering.
• Added recursive Black Duck subproject imports, traversal diagnostics, and a configurable subproject-import option.
• Completed Black Duck OpenVEX mitigation, status, justification, and required-field mappings.
• Expanded SBOM Vulnerability Radar handling for Black Duck generation and subproject templates, default template selection, findings across subprojects, and completed scans with no findings.
• Added the missing comparison operators (less-than-or-equal, equal, not-equal) for AppSec EPSS percentage and percentile filters.
• Added audit events for projects created through imports.
• Made NATS retention configurable.
• Added detection and handling for lost or overlong analysis stages across AMAN, SAAR, and VGM.
• Enabled SCA dependency scanning in Pentest AI.
• Added authenticated AppSec SCA module downloads and API-based cleanup for orphaned SBOM scans to the KCS command-line tool.
• Added API-key configuration for the Google Threat Intelligence integration.

Improvements

• Improved Jira Server and Data Center integration behavior, including endpoint selection, allowed values for Version, Fix Version, and custom fields, pagination, project-mapping warnings, grouped version options, and live custom-field option refresh.
• Improved Jira workflows across mapped projects, including cross-project links and synchronization, source-project lookup, orphaned-scan cleanup, calendar compatibility, active-scan finalization, and query performance.
• Improved 4me automatic issue creation, assignment, and close-note updates when no explicit assignee is available.
• Improved EUVD threat-intelligence synchronization reliability, flag cleanup, and duplicate processing.
• Migrated the Mandiant threat-intelligence integration to Google Threat Intelligence, aligning authentication and score mappings with the live API, preserving final synchronization batches, and improving delta-sync performance.
• Preserved recommendations from custom SCA scanners and separated Dependency Name from Dependency Path so package identity and filesystem location are retained and displayed correctly.
• Mapped the Last Seen value for SBOM Vulnerability Radar findings.
• Preserved Wiz severity and container-image references.
• Improved policy vulnerability pagination, filter consistency, page-size safeguards, oversized response reporting, and query performance; added bounded streaming, hardened cache and failure handling, and parallelized policy evaluation.
• Refreshed the default-organization cache after updates and reduced memory usage during vulnerability filtering.
• Prevented repeated Git blame processing for large files.
• Reduced AMAN analysis memory usage and query cost.
• Added targeted database indexes for reachable and exploit exposure filters and AMAN existing-finding scope queries.
• Hid the Retest Connection action where commercial SBOM tools do not support that operation.
• Improved non-interactive and automatically approved installations by skipping worker MongoDB prompts correctly.
• Enforced readable permissions on the Invicti ASPM AI configuration file.
• Reduced non-actionable authorization log noise.
• Protected API keys from build artifacts.
• Corrected container runtime security configuration related to root-user execution.
• Removed a stale package-lock entry associated with a critical jsPDF dependency exposure.
• Updated application and service dependencies for security and maintenance, including Go gRPC, Go cryptography, OpenAPI, Alpine, compression, container, audit-log, CNAPP, policy, SBOM, and KCS dependencies.
• Restricted analysis delivery jobs to the supported Invicti ASPM LTS release branch to prevent unintended build selection.
• Improved release-pipeline selection and packaging safeguards so supported artifacts are selected consistently and packaged as one cumulative Invicti ASPM release.
• Stabilized source workflows by skipping unnecessary repository clones, running pull-request merge operations in the correct clone directory, and normalizing repository-directory resolution.

Bug fixes

• Prevented a null-pointer failure during OWASP ZAP headless imports and cleaned up custom override handling.
• Corrected pentest listing and import behavior when a product has no project assignment, and added diagnostics for failed pentest lookups.
• Corrected the sample configuration for the session JWT secret.
• Corrected grouped Polaris finding imports and similarity hashes.
• Corrected Black Duck imports to use the overall CVSS score.
• Corrected Black Duck scan correlation so CVE identifiers appear correctly in Correlation Assistant and issue-assignment workflows.
• Fixed invalid CycloneDX reference handling in SBOM Vulnerability Radar.
• Corrected failed-results tab behavior that caused scrollbar flicker and other incorrect interface behavior.
• Corrected Wiz CSV parsing so each batch retains its own header.
• Corrected Anthropic sampling parameters for compatibility with newer Claude models.