1.33.0

Changed

• The --debug option now automatically turns on verbose mode.

• The --use-gitignore option now also applies to single files passed as argument.

• RPM packages now depend on git-core instead of git, reducing the number of dependencies to install (#983).

Fixed

• When using the --debug option, the log output no longer overlaps with the progress bars.

• The ggshield pre-commit hook no longer crashes when merging files with spaces in their names (#991).

• RPM packages now work correctly on RHEL 8.8 (#984).

1.32.2

Fixed

• Fixed a regression introduced in ggshield 1.32.1, which made ggshield install -m global crash (#972).

1.32.1

Fixed

• Fixed a case where ggshield commit parser could fail because of the local git configuration.

1.32.0

Added

• When scanning a merge commit, ggshield secret scan pre-commit now skips files that merged without conflicts. This makes merging the default branch into a topic branch much faster. You can use the --scan-all-merge-files option to go back to the previous behavior.

• ggshield secret scan commands now provide the --with-incident-details option to output more information about known incidents (JSON and SARIF outputs only).

• It is now possible to ignore a secret manually using ggshield secret ignore SECRET_SHA --name NAME.

Fixed

• The git commit parser has been reworked, fixing cases where commands scanning commits would fail.

1.31.0

Added

• We now provide tar.gz archives for macOS, in addition to pkg files.

Fixed

• JSON output: fixed incorrect values for line and index when scanning a file and not a patch.

1.30.2

Security

• Fixed a bug where ggshield secret scan archive could be passed a maliciously crafted tar archive to overwrite user files.

1.30.1

Added

• ggshield secret scan commands can now output results in SARIF format, using the new --format sarif option (#869).

• ggshield sca scan ci and ggshield sca scan all now support the MALICIOUS value for --minimum-severity

Changed

• ggshield now has the ability to display custom remediation messages on pre-commit, pre-push and pre-receive. These messages are defined in the platform and fetched from the /metadata endpoint of the API. If no messages are set up on the platform, default remediation messages will be displayed as before.

1.29.0

Removed

• The --all option of the ggshield sca scan ci and ggshield iac scan ci commands has been removed.

Added

• ggshield secret scan path now provides a --use-gitignore option to honor .gitignore and related files (#801).

• A new secret scan command, ggshield secret scan changes, has been added to scan changes between the current state of a repository checkout and its default branch.

• GGShield is now available as a standalone executable on Windows.

Changed

• The behavior of the ggshield sca scan ci and ggshield iac scan ci commands have changed. These commands are now expected to run in merge-request CI pipelines only, and will compute the diff exactly associated with the merge request.

Deprecated

• Running ggshield sca scan ci or ggshield iac scan ci outside of a merge request CI pipeline is now deprecated.

Fixed

• GGShield now consumes less memory when scanning large repositories.

• Errors thrown during ggshield auth login flow with an invalid instance URL are handled and the stack trace is no longer displayed on the console.

• Patch symbols at the start of lines are now always displayed, even for single line secrets.

• The ggshield auth login command now respects the --allow-self-signed flag.

• GGShield now exits with a proper error message instead of crashing when it receives an HTTP response without Content-Type header.

1.28.0

Added

• The SCA config ignored_vulnerabilities option now supports taking a CVE id as identifier.

1.27.0

Removed

• The This feature is still in beta, its behavior may change in future versions warning is no longer displayed for sca commands.

Added

• It is now possible to customize the remediation message printed by GGShield pre-receive hook. This can be done by setting the message in the secret.prereceive_remediation_message configuration key. Thanks a lot to @Renizmy for this feature.

• We now provide signed .pkg files for macOS.

• Add This feature is still in beta, its behavior may change in future versions warning to iac scan all

Changed

• Linux .deb and .rpm packages now use the binaries produced by pyinstaller. They no longer depend on Python.

Deprecated

• Dash-separated configuration keys are now deprecated, they should be replaced with underscore-separated keys. For example show-secrets should become show_secrets. GGShield still supports reading from dash-separate configuration keys, but it prints a warning when it finds one.

Fixed

• GGShield commands working with commits no longer fail when parsing a commit without any author.

• Configuration keys defined in the global configuration file are no longer ignored if a local configuration file exists.

• The option --exclude PATTERN is no longer ignored by the command ggshield secret scan repo.