Skip to content

Sync fork with WebGoat/WebGoat main #44

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
fgibelin merged 6 commits into from
Oct 12, 2026
Merged

Sync fork with WebGoat/WebGoat main #44

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
416d2a1
docs(cryptography): explain timing attack solutions (#2577)
nbaars Oct 11, 2026
4441470
feat(challenges): add chained security scenario (#2570)
nbaars Oct 11, 2026
cbc3bb0
fix(sql-injection): mark registration assignment solved
nbaars Oct 11, 2026
2d57cc9
fix(progress): allow users to share lesson assignments
nbaars Oct 11, 2026
10cecda
fix(challenges): record Challenge 8 completion
nbaars Oct 11, 2026
7e198f3
chore(release): prepare 2026.5
nbaars Oct 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 33 additions & 0 deletions RELEASE_NOTES.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,38 @@
# WebGoat release notes

## Version 2026.5

### New functionality

- Add an HMAC timing attack lesson (#2548).
- Add an HTTP parameter pollution lesson.
- Add a password hashing lesson covering salts, Argon2id, and peppers.
- Add the partner feed recovery challenge (#2570).
- Expand the command injection exercise with bounded, portable command execution (#1555).

### Bug fixes

- Allow multiple users to solve the same CSRF assignments (#2573).
- Record Challenge 8 completion after a correct flag submission (#2574).
- Mark advanced SQL injection registration as solved when it succeeds (#2575).
- Keep WebWolf on its configured port.

### Technical tasks

- Run the operating system CI builds in parallel and add issue triage for likely lesson vulnerabilities (#2569).
- Make XXE integration tests use controlled entity targets (#2547).
- Cover SQL mitigation form submissions in integration tests (#2502).
- Update dependencies and document the HMAC timing attack solutions (#2577).

### Contributors

- Nanne Baars
- Dependabot and GitHub Actions for automated maintenance commits

## Version 2026.4

See the [published v2026.4 release notes](https://github.com/WebGoat/WebGoat/releases/tag/v2026.4).

## Version 2026.3

A large release: WebGoat moves to Spring Boot 4 and Java 25, WebWolf's mail functionality is folded into WebGoat, and
Expand Down
Loading
Loading