nuclei 3.11.0

[BrewTestBot]

Created by brew bump

---

Created with brew bump-formula-pr.

Details

release notes

What's Changed
⚠️ Breaking Change: Signed templates required for JavaScript protocol
Starting with v3.11.0, custom templates that use the javascript: protocol must be digitally signed before Nuclei will load or execute them. Unsigned JavaScript templates are now skipped during template loading and when referenced from workflows.
Why this change
This release continues the security hardening started in v3.10.0 (sandbox enforcement, network policy checks, stricter code-template handling, YAML include protections, and related fixes in #7469). The JavaScript protocol exposes Go-backed modules through Nuclei's JS runtime, which significantly increases attack surface compared with request-only templates. Requiring signatures brings JavaScript templates in line with the existing protections for code-protocol templates.
Who is affected



Scenario
Impact




Default scans using nuclei-templates
No action needed - official templates are pre-signed and verified with ProjectDiscovery's public key


Custom/private templates using javascript:
Action required - sign templates before use


Templates using only flow: (e.g. flow: http(1)) without javascript:
No change


Workflows referencing unsigned JavaScript sub-templates
Those sub-templates are skipped



What to do
Sign your custom templates with:
nuclei -sign -t /path/to/your-template.yaml
See the Template Signing documentation for key generation, verification, and signing templates that reference external JavaScript or code files.

🔒 Security

feat(templates): require signatures for javascript templates by @dwisiswant0 in feat(templates): require signatures for javascript templates projectdiscovery/nuclei#7514

Other Changes

bump x/crypto and go-pkcs12 by @dogancanbakir in Bump x/crypto and go-pkcs12 projectdiscovery/nuclei#7516
general maintenance and cleanup by @Mzack9999 in General maintenance and cleanup projectdiscovery/nuclei#7469

Full Changelog: projectdiscovery/nuclei@v3.10.0...v3.11.0

View the full release notes at https://github.com/projectdiscovery/nuclei/releases/tag/v3.11.0.

---

[github-actions]

🤖 An automated task has requested bottles to be published to this PR.

Caution

Please do not push to this PR branch before the bottle commits have been pushed, as this results in a state that is difficult to recover from. If you need to resolve a merge conflict, please use a merge commit. Do not force-push to this PR branch.