v6.5.0 by mlodic · Pull Request #3138 · intelowlproject/IntelOwl

mlodic · 2025-12-30T16:32:57Z

Checklist for creating a new release

If we changed/added Docker Analyzers, we need to configure Docker Hub / Dependabot properly.
I have already checked if all Dependabot issues have been solved before creating this PR.
Update CHANGELOG.md for the new version. Tag another maintainer to review the Changelog and wait for their feedback.
Change version number in docker/.env and frontend/package.json.
Verify CI Tests. Solve all the issues (Dependencies, Django Doctor, CodeFactor, DeepSource, etc).
Create release for the branch develop and set it as a pre-release. Remember to prepend a v to the version number.
Write the following statement there (change the version number):

please refer to the [Changelog](https://github.com/intelowlproject/IntelOwl/blob/develop/.github/CHANGELOG.md#v331)

WARNING: We are building the new version of the project! The release will be officially available within 2 hours!

Wait for dockerHub to finish the builds
Merge the PR to the master branch. Note: Only use "Merge and commit" as the merge strategy and not "Squash and merge". Using "Squash and merge" makes history between branches misaligned.
Remove the "wait" statement in the release description and change the version status from pre-release to latest release.
Publish new Post into official Twitter and LinkedIn accounts (change the version number):

published #IntelOwl vX.X.X! https://github.com/intelowlproject/IntelOwl/releases/tag/vX.X.X #ThreatIntelligence #CyberSecurity #OpenSource #OSINT #DFIR

If that was a major release or an important release, communicate the news to the marketing staff
This is a good time to check for old dangling issues and clean-up the inactive ones. Same for issues solved by this release.

* phunter * fixed DeepSource errors * fixed errors related to docker run method * fixed errors with sensitive data leaks * fixed wrong number issue * fixed some minor bugs in phunter * used shlex and removed repeated phonenumber check * fixed migration issue * cleaned * fixed migration file name * chore: trigger CI * updated requirements file

* added hunting_abuse_api analyzer * added support for caching of FP list * fixes * added support for data model and handled ip edge case * added appropriate exceptions and some cosmetic changes --------- Co-authored-by: Akshit Maheshwary <[email protected]>

* Adapted Quad9 DNS resolver to DoH * Adapted Quad9 DNS malicious resolver to DoH * Added mixin for all DoH services * Removed deepsource warning * Removed deepsource warning

…or a typo

* added Expand URL analyzer * pivot for checking reputation of expanded URL * cosmetic changes --------- Co-authored-by: Akshit Maheshwary <[email protected]>

* added CommandSequenceAPI to greedybear analyzer * fixes to migration file * fixes * minor changes * addressed PR comments * handled other hash types and restored old schema * fixes * removing exception and some minor changes * updated migration numbers * fixed migration numbers --------- Co-authored-by: Akshit Maheshwary <[email protected]>

* fixed abuseipdb tags * fix to similar investigation search

* Frontend - Analyzables page (#2865) * adjusted menu * analyzables page draft + refactor * adjusted table columns and serializer * frontend tests * tests * prettier * fix * changes * fix * Analyzable overview page (#2883) * analyzable overview page draft * refactor * visualizers draft * Analyzable overview page * prettier * removed cache * changes * adjusted tests * fixed decay date visualizer * use enum --------- Co-authored-by: drosetti <[email protected]> * added data model tab (#2900) * Added 'user reports' in the history page (#2895) * added user-reports page * fix * changes * tests * changes * prettier * fixed decayed badge * fix * User events modal form (#2928) * form draft * adjusted backend * adjusted analyzable history * fix * fixed evaluation modal * renamed user reports to user events * renamed analyzable to artifact in the gui * adjusted frontend tests * fix * frontend tests * fix frontend tests * prettier * fix * fix * fix * refactor history tables * fix --------- Co-authored-by: drosetti <[email protected]>

* added GuardDog analyzer * resolving dependency conflicts * fixed migration issues * fixed test bugs * added mock for quad9_malicious_detector * changed subprocess.run from byte mode to text mode * shell-escaped possible user input variables in command * added gzip file support for GuardDogFile analyzer --------- Co-authored-by: Akshit Maheshwary <[email protected]>

* joesandbox analyzer * fixes errors * dumped migration files * fixed migration issues * cleaning code * fixed migration issues * minor changes * minor changes addressing PR comments --------- Co-authored-by: Akshit Maheshwary <[email protected]>

* unit tests Signed-off-by: pranjalg1331 <[email protected]> * unittests framework Signed-off-by: pranjalg1331 <[email protected]> * cleanup Signed-off-by: pranjalg1331 <[email protected]> * correct python error Signed-off-by: pranjalg1331 <[email protected]> * making class method Signed-off-by: pranjalg1331 <[email protected]> * mock location changed Signed-off-by: pranjalg1331 <[email protected]> * python deepsource Signed-off-by: pranjalg1331 <[email protected]> * abusix Signed-off-by: pranjalg1331 <[email protected]> * file base class initial draft Signed-off-by: pranjalg1331 <[email protected]> * blint_scan test Signed-off-by: pranjalg1331 <[email protected]> * boxjs Signed-off-by: pranjalg1331 <[email protected]> * debloat Signed-off-by: pranjalg1331 <[email protected]> * cleanup Signed-off-by: pranjalg1331 <[email protected]> * updated base class Signed-off-by: pranjalg1331 <[email protected]> * python errors Signed-off-by: pranjalg1331 <[email protected]> * added analyzer unit tests Signed-off-by: pranjalg1331 <[email protected]> * new file analyzers Signed-off-by: pranjalg1331 <[email protected]> * checkphish Signed-off-by: pranjalg1331 <[email protected]> * greynoise_labs Signed-off-by: pranjalg1331 <[email protected]> * ja4db Signed-off-by: pranjalg1331 <[email protected]> * netlas Signed-off-by: pranjalg1331 <[email protected]> * polyswarm Signed-off-by: pranjalg1331 <[email protected]> * thug_url Signed-off-by: pranjalg1331 <[email protected]> * zoomeye Signed-off-by: pranjalg1331 <[email protected]> * file analyzers test+ base class improved Signed-off-by: pranjalg1331 <[email protected]> * commenting old tests Signed-off-by: pranjalg1331 <[email protected]> * commenting old tests -2 Signed-off-by: pranjalg1331 <[email protected]> * commenting old tests -3 Signed-off-by: pranjalg1331 <[email protected]> * add init Signed-off-by: pranjalg1331 <[email protected]> * trial workflow Signed-off-by: pranjalg1331 <[email protected]> * correct error Signed-off-by: pranjalg1331 <[email protected]> * greynosise error Signed-off-by: pranjalg1331 <[email protected]> * greynosise error-2 Signed-off-by: pranjalg1331 <[email protected]> * comment out Signed-off-by: pranjalg1331 <[email protected]> * remove monkeypatch Signed-off-by: pranjalg1331 <[email protected]> * remove monkeypatch from file_analyzers Signed-off-by: pranjalg1331 <[email protected]> * zippy_scan Signed-off-by: pranjalg1331 <[email protected]> * yaraify test class Signed-off-by: pranjalg1331 <[email protected]> * uncomment Signed-off-by: pranjalg1331 <[email protected]> * delete Signed-off-by: pranjalg1331 <[email protected]> * uncomment analyzer tests Signed-off-by: pranjalg1331 <[email protected]> * new analyzer tests Signed-off-by: pranjalg1331 <[email protected]> * clearing monkeppatch Signed-off-by: pranjalg1331 <[email protected]> * modify class to remove mock response in docker analyzers Signed-off-by: pranjalg1331 <[email protected]> * no changes to pr automation Signed-off-by: pranjalg1331 <[email protected]> * test errors Signed-off-by: pranjalg1331 <[email protected]> * correct errors Signed-off-by: pranjalg1331 <[email protected]> * separated transactions tests Signed-off-by: pranjalg1331 <[email protected]> * hfinger Signed-off-by: pranjalg1331 <[email protected]> * loggin improved Signed-off-by: pranjalg1331 <[email protected]> * remove f Signed-off-by: pranjalg1331 <[email protected]> * merge logs Signed-off-by: pranjalg1331 <[email protected]> * deep python errors Signed-off-by: pranjalg1331 <[email protected]> * pr template update Signed-off-by: pranjalg1331 <[email protected]> * new analyzers + update pr template Signed-off-by: pranjalg1331 <[email protected]> * update dir structure for integration tests Signed-off-by: pranjalg1331 <[email protected]> * more tests Signed-off-by: pranjalg1331 <[email protected]> * lint Signed-off-by: pranjalg1331 <[email protected]> --------- Signed-off-by: pranjalg1331 <[email protected]>

* fixed axios errors * fix * comment

Signed-off-by: pranjalg1331 <[email protected]>

* adjusted prettifyErrors * fix

* Update JobResult.jsx Fix connection issue when intelowl is on nonstandard port * Update frontend dev proxy to correctly handle websockets * Pin the http proxy middlware for npm dev server * Move the http-proxy-middleware pin into dev dependencies as it's only required for local development * Updated the package lock json --------- Co-authored-by: Daniele Rosetti <[email protected]>

Bumps [jsonschema](https://github.com/python-jsonschema/jsonschema) from 4.23.0 to 4.25.1. - [Release notes](https://github.com/python-jsonschema/jsonschema/releases) - [Changelog](https://github.com/python-jsonschema/jsonschema/blob/main/CHANGELOG.rst) - [Commits](python-jsonschema/jsonschema@v4.23.0...v4.25.1) --- updated-dependencies: - dependency-name: jsonschema dependency-version: 4.25.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Co-authored-by: Daniele Rosetti <[email protected]>

* fix * refactor * fix

* feat(visualizer): add VisualizableImage backend class. Closes #3023 * feat(frontend): add ImageVisualizer React component * feat(frontend): integrate ImageVisualizer in visualizer parser * test: add tests for VisualizableImage component * fix(frontend): improve ImageVisualizer accessibility and CSS handling - Wrap clickable image in button element for accessibility (jsx-a11y) - Support string CSS values for maxWidth/maxHeight (e.g., '500px') - Update propTypes to accept both number and string dimensions * fix(frontend): remove container overflow to prevent image clipping * fix(test): click button wrapper instead of img for modal test * Fix: Added Image = VisualizableImage to the Visualizer class

Co-authored-by: Daniele Rosetti <[email protected]>

…llback (#2934) (#3073) * Fix Hybrid Analysis hash GET analyzer * Add HybridAnalysis analyzer monkeypatch * Import monkeypatch helpers for HA analyzer * Refactor ha_get.py for improved structure and clarity * Refactor observable data fetching and processing Refactor methods for fetching and processing observable data, enhancing clarity and reducing complexity. * Fix formatting in ha_get.py for consistency * Clean up ha_get.py by removing unused code restored pass for update method and removed the monkeypatch logic * Modify update method to use pass statement Replaced the implementation of the update method with a pass statement. --------- Co-authored-by: Daniele Rosetti <[email protected]> Co-authored-by: pranavshukla <[email protected]>

code-review-doctor

Some things to consider. View full project report here.

code-review-doctor · 2025-12-30T16:33:33Z

api_app/analyzers_manager/file_analyzers/yarax.py

+        rules_file_path = self.get_rule_location()
+        logger.info(f"Found rules at {rules_file_path}")
+
+        with open(rules_file_path, mode="r") as f:


UnicodeDecodeError can occur if the content of the file has characters incompatible with the OS's default encoding. Python uses the OS's default text encoding on the content because encoding is not set. More info.

code-review-doctor · 2025-12-30T16:33:33Z

api_app/user_events_manager/models.py

        on_delete=models.CASCADE,
    )
    date = models.DateTimeField(default=now, editable=False, db_index=True)
+    reason = models.CharField(max_length=256, default="", null=True)


Suggested change

reason = models.CharField(max_length=256, default="", null=True)

reason = models.CharField(max_length=256, default="", blank=True)

null=True on a string field causes inconsistent data types because the value can be either str or None. This adds complexity and maybe bugs, but can be solved by replacing null=True with default="". More details.

Bumps projectdiscovery/nuclei from v3.3.8 to v3.6.1. --- updated-dependencies: - dependency-name: projectdiscovery/nuclei dependency-version: v3.6.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

mlodic · 2025-12-30T18:23:43Z

I created the Phunter repo in DockerHub

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 5.0.0 to 6.0.0. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@330a01c...b7c566a) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [actions/cache](https://github.com/actions/cache) from 4 to 5. - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@v4...v5) --- updated-dependencies: - dependency-name: actions/cache dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…velop

mlodic · 2025-12-31T09:06:11Z

"Could not install packages due to an OSError: [Errno 28] No space left on device" error in backend tests....let's try again

…ntainers

mlodic · 2026-01-01T08:30:10Z

@drosetti @fgibertoni please check and provide feedback (or add changes) on the added changelog. Once we agree on that , I'll create the new release

fgibertoni

Once the tests are passed we should be good to go!

AnshSinghal and others added 30 commits May 22, 2025 08:36

added new feeds options for greedybear

d9570a9

updated readme

38d1506

Fix Quad9 integration to use DoH. Closes #2894 (#2907)

d7e472a

* Adapted Quad9 DNS resolver to DoH * Adapted Quad9 DNS malicious resolver to DoH * Added mixin for all DoH services * Removed deepsource warning * Removed deepsource warning

Changed ConnectionError to ConnectError in quad9_malicious_detector f…

d268336

…or a typo

improved logging for elastic search indexing

09daa1e

fixed unittest

513fb7d

Expand URL analyzer (#2920)

3ce0cd7

* added Expand URL analyzer * pivot for checking reputation of expanded URL * cosmetic changes --------- Co-authored-by: Akshit Maheshwary <[email protected]>

Fix abuseipdb tags (#2932)

7bdc3b9

* fixed abuseipdb tags * fix to similar investigation search

changed default time range in history

324572d

changed default user event to have a decay

49168ee

fixed filter for username in the evaluation pages in the history section

d1e4093

Added JoeSandbox Analyzer (#2925)

06017c5

* joesandbox analyzer * fixes errors * dumped migration files * fixed migration issues * cleaning code * fixed migration issues * minor changes * minor changes addressing PR comments --------- Co-authored-by: Akshit Maheshwary <[email protected]>

Fix serializer

e824693

Fix serializer

2af860a

Frontend - fixed errors in the new evaluation form (#2987)

47eaeec

* fixed axios errors * fix * comment

start artifacts dropdown closed when there are lots of elements

603788f

new tests (#3007)

423ff73

Signed-off-by: pranjalg1331 <[email protected]>

Bump openjdk-21 in Malware Tools Analyzers Dockerfile (#3025)

2da6268

fixed crontab schedule in ingestor config

f630f1a

fixed missing investigation error

de2f393

Frontend - adjusted prettifyErrors (#3041)

d095bb2

* adjusted prettifyErrors * fix

fix (#3042)

e34099c

rootp1 and others added 6 commits December 16, 2025 16:52

Fix: Correct X-End-Of-Life-Date (#3111)

3347dc3

Co-authored-by: Daniele Rosetti <[email protected]>

Fixed tags cell bug (#3121)

7e5a33e

* fix * refactor * fix

Fix undefined variable in InQuest hash_type error message (#3125)

4b4c9a7

Co-authored-by: Daniele Rosetti <[email protected]>

fixed pivoting in frontend

5817471

code-review-doctor bot suggested changes Dec 30, 2025

View reviewed changes

dependabot bot and others added 5 commits December 30, 2025 17:37

bump bbot

b5d3784

bump django

831b047

fixed nuclei container

598c00b

updated readme

474605e

mlodic and others added 5 commits December 30, 2025 19:26

bumped dnspython to 2.8.0 to updated knock package

0a977fc

upgraded dependencies and removed warning

7f3c20e

Merge branch 'develop' of github.com:intelowlproject/IntelOwl into de…

f881e98

…velop

mlodic added 2 commits December 31, 2025 11:35

fixed yaraify URL

43aed57

updated PR automation Slow run to avoid executing all the optional co…

e146626

…ntainers

YadavAkhileshh mentioned this pull request Dec 31, 2025

Fix YaraIfy link in free to use playbook #3140

Closed

added changelog for 6.5.0 and bumped versions

c42eaea

mlodic added 2 commits January 1, 2026 09:32

adjusted changelog

c83aacb

removed arm build for nuclei

68ca4c5

fgibertoni previously approved these changes Jan 2, 2026

View reviewed changes

changed phunter image name due to name error in dockerhub

99ecd61

mlodic dismissed fgibertoni’s stale review via 99ecd61 January 2, 2026 18:02

mlodic merged commit d0b5ea7 into master Jan 2, 2026
22 of 23 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

v6.5.0#3138

v6.5.0#3138
mlodic merged 77 commits intomasterfrom
develop

mlodic commented Dec 30, 2025 •

edited

Loading

Uh oh!

code-review-doctor bot left a comment

Uh oh!

code-review-doctor bot Dec 30, 2025

Uh oh!

code-review-doctor bot Dec 30, 2025

Uh oh!

mlodic commented Dec 30, 2025

Uh oh!

mlodic commented Dec 31, 2025

Uh oh!

mlodic commented Jan 1, 2026

Uh oh!

fgibertoni left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

12 participants

	reason = models.CharField(max_length=256, default="", null=True)
	reason = models.CharField(max_length=256, default="", blank=True)

Uh oh!

Conversation

mlodic commented Dec 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Checklist for creating a new release

Uh oh!

code-review-doctor bot left a comment

Choose a reason for hiding this comment

Uh oh!

code-review-doctor bot Dec 30, 2025

Choose a reason for hiding this comment

Uh oh!

code-review-doctor bot Dec 30, 2025

Choose a reason for hiding this comment

Uh oh!

mlodic commented Dec 30, 2025

Uh oh!

mlodic commented Dec 31, 2025

Uh oh!

mlodic commented Jan 1, 2026

Uh oh!

fgibertoni left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

12 participants

mlodic commented Dec 30, 2025 •

edited

Loading