1.6.2

• Detect JS injections (eval / new Function(...))
• Detect MongoDB JS injections ($where / ...)
• Performance improvement

1.6.1

• Add support for mongodb v6.10.0 and higher
• Improve TypeScript types for Hono middleware
• Keep all ports for outbound connections

1.6.0

• Introduce a new require hooking system for instrumentation
• Send server architecture information along with agent info
• Improve SQL injection detection by using a library that parses queries like a real database for better accuracy
• Improve fs instrumentation
• Improve path instrumentation
• Add support for the postgres package
• Add support for the mariadb package
• Expose a new API for accurate rate limiting based on IP and optional user ID, as well as user blocking.
• Add support for the fastify package
• Add support for the @graphql-tools/executor package
• Add support for the koa package
• Enable OpenAPI discovery by default
• Add environment variable AIKIDO_MAX_API_DISCOVERY_SAMPLES to control the maximum number of API discovery samples per route.
• Add support for the @clickhouse/client package
• Detect string formats during API discovery
• Discover GraphQL schemas
• Fix false positives for applications making requests to themselves on localhost, previously flagged as SSRF attacks
• Recognize ULID identifiers in route pattern
• Expose externals as require("@aikidosec/firewall/bundlers") to use with bundlers like esbuild
• Add compatibility with dd-trace
• Add support for IP address blocking, allowing configuration of country-based request blocking via the dashboard

1.6.0-beta.20

• Improve package.json (Add homepage etc)
• Improve wrapping functions for compatibility with node-red

1.6.0-beta.19

• Bugfix for Hono v4.6.9 and newer
• Improve undici protection by setting global dispatcher sooner
• Add support for undici v7
• Expose externals function via @aikidosec/firewall/bundler, which is useful when your app is bundled using e.g. esbuild

1.6.0-beta.18

• Add support for IP address blocklists (e.g. by country)

1.6.0-beta.16

• Upgrade to latest zen internals (fixes false positive for user input in SQL comments)

1.6.0-beta.15

• Make Zen compatible with dd-trace

1.6.0-beta.14

• Ghost compatibility

1.6.0-beta.13

• Bugfix for Ghost (Preserve original handler name)