Update nuclei to 3.4.8

[blsaccess]

This PR uses https://api.github.com/repos/projectdiscovery/nuclei/releases/latest to obtain the latest version of nuclei and update the version in bbot/modules/nuclei.py."

Release notes:

What's Changed

Features & Improvements

• Remove singletons from Nuclei engine (continuation of #6210) (#6296) by @hdm
• Address race conditions in http.Request and MemGuardian (#6321) by @hdm
• Support concurrent Nuclei engines in the same process (#6322) by @hdm
• feat: log event for template host skipped during scanning (#6324) by @Ice3man543
• feat(code): log unavailable engines as error while validating (#6326) by @dwisiswant0
• Bump github.com/bytedance/sonic to v1.14.0 for Go 1.25 compatibility (#6348) by @stefanb
• feat: loading templates performance improvements (#6364) by @Ice3man543
• feat(fuzz): evaluate variables (#6358) by @dwisiswant0
• Enable templates for template listing and displaying (#6343) by @dogancanbakir
• Refactor: use maps.Copy for cleaner map handling (#6283) by @gopherorg

🐞 Bug Fixes

• Fix headless: variables now available in headless templates (#6301) by @alban-stourbe-wmx
• Fix lib: scans not stopping on context cancellation (#6310) by @dwisiswant0
• Fix panic from uninitialized colorizer (#6315) by @josedh
• Fix to preserve original transport for linear HTTP client (#6357) by @Ice3man543
• Fix offlinehttp: replace "-" with "_" in headers for DSL variables (#6363) by @Isaac0616
• Fix(events): correct JSON encoder type in ScanStatsWorker (#6366) by @dwisiswant0
• Fix: prevent nil pointer panic in WAF detector (#6368) by @knakul853
• Fix headless: merge extra headers (#6376) by @ysokolovsky
• Fix: prevent unnecessary template updates (#6379) by @dwisiswant0

🔨 Maintenance

• chore(deps): bump the modules group with 3 updates (#6305) by @dependabot[bot]
• chore(config): remove deprecated code and calls (#6311) by @dwisiswant0
• build(docker): bump builder image golang:1.23-alpine → golang:1.24-alpine (#6316) by @dwisiswant0
• chore: fix inconsistent function name in comment (#6338) by @jishudashen
• build(make): update template-validate commands (#6385) by @dwisiswant0
• chore(deps): bump go_modules group with 2 updates (#6388) by @dependabot[bot]
• ci(tests): migrate to golangci-lint v2 (#6380) by @dwisiswant0

New Contributors

• @josedh made their first contribution in ISSUE: 6314 - fixing panic caused by uninitialized colorizer projectdiscovery/nuclei#6315
• @hdm made their first contribution in Remove singletons from Nuclei engine (continuation of #6210) projectdiscovery/nuclei#6296
• @gopherorg made their first contribution in refactor: use maps.Copy for cleaner map handling projectdiscovery/nuclei#6283
• @jishudashen made their first contribution in chore: fix inconsistent function name in comment projectdiscovery/nuclei#6338
• @stefanb made their first contribution in Bump github.com/bytedance/sonic to v1.14.0 for Go 1.25 compatibility projectdiscovery/nuclei#6348
• @Isaac0616 made their first contribution in fix(offlinehttp): Replace "-" in headers with "_" for DSL variables projectdiscovery/nuclei#6363
• @ysokolovsky made their first contribution in fix(headless): merge extra headers projectdiscovery/nuclei#6376

Full Changelog: projectdiscovery/nuclei@v3.4.7...v3.4.8

[liquidsec]

[INFO] nuclei: [WRN] Found 1 templates with syntax error (use -validate flag for further examination)
[INFO] nuclei: [WRN] Found 1 templates with runtime error (use -validate flag for further examination)
[DBUG] nuclei: Failed to decode line: [WRN] Loading 203 unsigned templates for scan. Use with caution.
[INFO] nuclei: [INF] Current nuclei version: v3.4.8 (unknown) - remove '-duc' flag to enable update checks
[INFO] nuclei: [INF] Current nuclei-templates version: v10.2.7 (unknown) - remove '-duc' flag to enable update checks
[INFO] nuclei: [INF] New templates added in latest release: 55
[INFO] nuclei: [INF] Templates loaded for current scan: 8263
[INFO] nuclei: [INF] Executing 8060 signed templates from projectdiscovery/nuclei-templates
[INFO] nuclei: [INF] Targets loaded for current scan: 1
[INFO] nuclei: [INF] Automatic scan tech-detect: Templates clustered: 470 (Reduced 444 Requests)
[INFO] nuclei: [INF] Executing Automatic scan on 1 target[s]
[INFO] nuclei: panic: runtime error: invalid memory address or nil pointer dereference
[INFO] nuclei: [signal SIGSEGV: segmentation violation code=0x1 addr=0x20 pc=0x20c0cc6]
[INFO] nuclei: 
[INFO] nuclei: goroutine 28209 [running]:
[INFO] nuclei: github.com/projectdiscovery/nuclei/v3/pkg/tmplexec.(*TemplateExecuter).ExecuteWithResults(0xc00008ceb0?, 0xc0218f4960)
[INFO] nuclei: 	github.com/projectdiscovery/nuclei/v3/pkg/tmplexec/exec.go:287 +0x126
[INFO] nuclei: github.com/projectdiscovery/nuclei/v3/pkg/protocols/common/automaticscan.(*Service).getTagsUsingDetectionTemplates.func1(0xc0168acb08)
[INFO] nuclei: 	github.com/projectdiscovery/nuclei/v3/pkg/protocols/common/automaticscan/automaticscan.go:304 +0x1aa
[INFO] nuclei: created by github.com/projectdiscovery/nuclei/v3/pkg/protocols/common/automaticscan.(*Service).getTagsUsingDetectionTemplates in goroutine 22012
[INFO] nuclei: 	github.com/projectdiscovery/nuclei/v3/pkg/protocols/common/automaticscan/automaticscan.go:260 +0x106

we will definitely hold off on this version....

[liquidsec]

version is broken

[hdm]

Hi folks! I'm one of the people who worked on the Executer option changes in this release and we've been running this in production for a few weeks. I'll flag this to the PD team and see if we can figure out why your test fails when the rest of us haven't reprod.

[liquidsec]

@hdm

Hi folks! I'm one of the people who worked on the Executer option changes in this release and we've been running this in production for a few weeks. I'll flag this to the PD team and see if we can figure out why your test fails when the rest of us haven't reprod.

Hi, I haven't tried 3.4.9 yet(3.4.9 also affected), but for 3.4.8 was able to easily cause the error just by just using the --automatic-scan option

[liquidsec]

@hdm I was actually about to open an issue over there - then i noticed there was a new version out, so i started our pipeline with it to see if the issue had already been resolved in that version. Looks like its still present.

projectdiscovery/nuclei#6417

[hdm]

@liquidsec thanks and yes please!

[aconite33]

@liquidsec thanks and yes please!

projectdiscovery/nuclei#6417 Issue created.

also, hi HDM.

[hdm]

thank you @dwisiswant0 for the fix!