v3.1.1

3.1.1

A maintenance release: reflected-XSS recall and false-positive fixes, url/file/pipe subcommand parity, request-fan-out bounding, and unified logging.

Changed

• Unified scan target parameter: Server and MCP now take target; REST keeps url as a backward-compatible alias. Fixes #1152.
• Unified debug logging: Routed all debug output through a single stderr dbg_log! macro and structured server/MCP loggers, and aligned OOB / blind output with the standard log format (#1145, #1147, #1144).

Fixed

• Restored reflected-XSS recall in raw-JS-expression and regex-literal contexts. Fixes #1161.
• Demoted inert URL-scheme and javascript: self-link reflections, clearing the residual false positive from #1153 (#1154, #1160).
• Front-loaded the protocol-scheme payload family so the per-param cap can no longer evict it. Fixes #1159.
• url / file / pipe subcommands now apply config files, global flags, and --include-all (#1151) and respect an explicit -i / --input-type (#1149).
• --output write failures are now reported via stderr and a non-zero exit code. Fixes #1150.
• Scoped --scan-timeout cancellation to the timed-out target so it no longer aborts other targets, plus assorted OOB and retry edge-case fixes.
• Fixed the Nix build by dropping removed darwin.apple_sdk framework inputs. Fixes #1158.

Performance & Reliability

• Per-parameter payload safety cap and recall-preserving DOM-phase early-exit to bound request fan-out (#1155, #1156).
• Bounded unbounded task spawning in parameter mining and cut server / hot-path lock-hold and allocations.
• Capped the HPP reflection body read to bound scanner memory. Fixes #1148.

---

Full Changelog: v3.1.0...v3.1.1

v3.1.0

3.1.0

A feature release: out-of-band (blind) XSS detection, external- and modern-DOM-sink analysis, CSP / Trusted Types awareness, filter-aware payload synthesis, HAR input, a global rate limiter, and broad WAF-bypass and server/MCP hardening.

Added

• Blind / out-of-band XSS (--blind-oob): OAST detection via an interactsh server, catching execution in stored, async, and other non-reflecting sinks. CLI-only for now.
• External JavaScript analysis (--analyze-external-js): Fetches a target's same-origin <script src> bundles (16 files / 512 KiB cap) and runs them through AST DOM-XSS analysis. Fixes #1094.
• Wider DOM-XSS coverage: Models Document.parseHTMLUnsafe() and window.open() as sinks (#1127) and extends the recognized JS sink-name set (#1139).
• Outdated JS library detection (--detect-outdated-libs): Flags known-vulnerable front-end library versions as informational findings. Opt-in. Fixes #1074.
• CSP & Trusted Types awareness: Emits strict-dynamic / nonce gadget payloads and adapts to Trusted Types when a policy is present. Fixes #1097.
• Filter-aware payload synthesis: Computes exact JS breakout sequences from the observed script prefix, including escaped-quote and nested-context cases. Fixes #1075, #1072, #1073.
• Attribute-decode WAF-bypass mutations: Four mutations (KeywordEntityEncode, SchemeBreak, EntityScheme, MultiSlash) that exploit the HTML tokenizer's attribute-value entity decoding — a layer literal-string WAF regexes don't model.
• Size-limited WAF inspection-window bypass: Detects WAFs that inspect only the first N bytes of a request and positions payloads past the window. Part of #1106.
• HAR input (--input-type har): Accepts a HAR / proxy export (Burp, Caido, ZAP, DevTools, mitmproxy) as a scan source, one target per request. Restores a Go v2.x capability. Fixes #1095.
• Global rate limiting (--rate-limit / -r / --rl): A requests-per-second token bucket shared across all workers and targets (0 = unlimited), bounding the aggregate outbound rate that --delay can't. Fixes #1096.
• Transient retry policy (--retries / --retry-delay): Optional exponential-backoff retries for HTTP 5xx and transient transport errors (off by default; HTTP 429 is always retried).
• --insecure TLS flag: Makes TLS certificate validation configurable for scan / server / mcp (default on; --insecure=false enforces). Fixes #1111.
• Whole-scan timeout for server & MCP (scan_timeout): Bounds total scan duration for concurrent REST / MCP jobs. Part of #1103.
• Structured output metadata (SARIF / Markdown / TOML): The scan meta envelope (version, targets, duration, request/finding counts, per-target WAF info) now appears in all three formats for parity with JSON. Fixes #1093.

Changed

• Adaptive WAF evasion (--waf-evasion): Replaced the blunt workers=1 / delay=3000ms preset with randomized inter-request jitter and an escalating cooldown on clusters of blocked responses. Part of #1096.
• HTTP server internals: Refactored the REST server into a dedicated subsystem with an extracted job domain.

Fixed

• Cut reflected-XSS false positives and corrected path special-character probing — higher recall with ~31% fewer requests. Fixes #1117.
• Require a payload's handler/sink to survive on the marker element before verifying [V], removing truncated-reflection false positives. Fixes #1118.
• Demoted inert encoded-echo reflections for non-tag payloads. Fixes #1133.
• Clear DOM taint on clean / sanitized reassignment, removing a class of DOM-XSS false positives. Fixes #1087.
• --encoders now accepts htmlpad, unicode, and zwsp. Fixes #1076.
• Closed xssmaze WAF-facade detection gaps. Fixes #1104.
• Parse-DoS hardening against deeply nested hostile JS, plus assorted false-negative and WAF / lifecycle fixes. Fixes #1115.
• --blind-oob no longer swallows the target URL. Fixes #1132.
• Closed 10 latent bugs from a source audit (#1107) and a batch of low-severity fixes (#1116).

Security & Reliability

• Hardened the scanner / server / MCP against hostile responses — capped body reads and reflection-scan work to prevent OOM and hangs (#1119, #1129).
• REST responses now set an explicit Content-Type with nosniff, and the server warns on non-loopback binds without auth. Fixes #1122.
• Fixed a per-job scope leak and added rate-limit / concurrency caps for server and MCP scans (#1105, #1090).

New Contributors

• @akagifreeez made their first contribution in #1076
• @aodihis made their first contribution in #1099

Full Changelog: v3.0.2...v3.1.0

v3.0.2

3.0.2

A packaging and source-build release: installing from source — AUR, cargo install, and musl — now links cleanly, and the broken v3.0.1 release pipeline is repaired so every platform artifact ships.

Fixed

• Source Builds (AUR / cargo install / musl): Switched the rustls TLS backend from aws-lc-rs to the portable ring provider, so source builds no longer fail to link against aws-lc-sys's bundled C/assembly. Dalfox installs ring's CryptoProvider at startup via ensure_crypto_provider(), since reqwest now relies on rustls-no-provider. (thanks @linuxmobile / #1061)
• Release Packaging: Repaired .deb/.rpm generation — dropped the invalid description/homepage keys from [package.metadata.deb] that aborted the v3.0.1 pipeline, and moved homepage/repository to [package] where cargo-deb reads them.
• Release Matrix: Hardened the release workflow so one failing target no longer drops the rest — added fail-fast: false, upload the binary archive before .deb/.rpm packaging, collect packages from their real output paths, fix the duplicated linux- in package names, and pin tag_name so workflow_dispatch runs target the intended version. (v3.0.1 shipped only the musl and macOS binaries; Windows .zip, both glibc .tar.gz, and all .deb/.rpm were missing.)

Changed

• Documentation Site: Hardened the docs site to the Website Specification — self-hosted Inter/JetBrains Mono fonts and highlight.js, added robots.txt, security.txt, and a .well-known/agent-skills manifest, and tightened the CSP and page templates.

---

Full Changelog: v3.0.1...v3.0.2

v3.0.1

3.0.1

Added

• DOM-XSS Coverage: AST analysis now recognizes jQuery $()/jQuery() selector-to-HTML sinks, dynamic import() execution sinks, and fetch()/XMLHttpRequest response sources.
• WAF Fingerprints: Added NetScaler and cookie-based signatures and generalized the bypass mutations shared across vendors.
• Packaging: Added native .deb/.rpm packages (cargo-deb + cargo-generate-rpm), musl binaries (x86_64-musl, aarch64-musl), and Snapcraft and AUR distribution.

Changed

• WAF Bypass Performance: Made WAF bypass payload expansion orthogonal to avoid combinatorial blow-up during scanning.
• Progress UI: Animated the scan spinner and progress bars with a metallic shimmer.

Fixed

• Explicit -p targets are now always tested, regardless of --skip-* flags.
• Explicit -p header/cookie/multipart injection points are honored.
• Explicit -d body params are tested under --skip-mining/--skip-mining-dict (XSSMaze detection 92.7% → 98.2%).
• Workers shut down gracefully instead of panicking on a closed semaphore.
• --custom-payload content is validated up front rather than only checking that the file exists.
• Release tooling no longer truncates aur/PKGBUILD during version bumps.

---

Full Changelog: v3.0.0...v3.0.1

v3.0.0

3.0.0

Dalfox v3 is a complete rewrite in Rust, replacing the legacy Go implementation (now on the v2 branch) with an asynchronous architecture and a modern CLI structure.

Added

• AST-Based JS Analysis: Replaced heavy headless browsers with fast and accurate static analysis powered by oxc for DOM-XSS detection.
• Model Context Protocol (MCP): Added an MCP stdio server (dalfox mcp) to expose Dalfox tools directly to AI coding assistants.
• Async REST API Server: Rebuilt the API server using axum with async job queueing, real-time cancellation, and webhook notifications.
• Extended Formats & Configurations: Added TOML/JSON configuration files along with markdown, sarif (GitHub Code Scanning), and toml output formats.
• Safety & Control: Introduced --dry-run preflight mode, --stream-findings for immediate feedback, and limit-capping flags (--max-payloads-per-param, --scan-timeout).

Changed

• Unified CLI Interface: Consolidated all target scan paths under a single scan subcommand, preserving legacy aliases (url, file, pipe) for backward compatibility.
• Exit Code Standardization: Aligned standard exits (0 for clean, 1 for findings, 2 for errors) for seamless CI pipeline integration.
• Intelligent Output: Replaced command-line spinners with per-target progress bars, automatically suppressing banners for silence or machine-readable modes.

Removed

• Headless Browser Engine: Removed Chromium/chromedp engine and all headless-related CLI flags.
• Legacy Vulnerability Checkers (BAV): Deprecated non-XSS checks to strictly focus on specialized XSS scanning.
• Outmoded CLI Options: Removed --found-action, --grep, --report, and --max-cpu flags in favor of unified pipelines, formats, and async runtimes.

Security & Reliability

• Hardened the REST server with constant-time API key comparisons and strict JSONP callback validation.
• Sandbox improvements to exclude local cookie file loaders (--cookie-from-raw) from the MCP tool interface.
• Implemented panic isolation (catch_unwind) to prevent scanner and MCP thread crashes.

New Contributors

• @chei-l made their first contribution in #943

Full Changelog: v2.12.0...v3.0.0

v2.13.0

Highlights

This release closes four security advisories in REST/MCP server mode (one critical RCE, three high-severity file/memory vectors), adds out-of-scope domain filtering, early-stop scan mode, and JSON body parameter testing, and significantly expands the secret-pattern grep ruleset.

This is the last v2.x feature release. Future development will focus on the v3 Rust rewrite; v2 will move to security-backport-only maintenance going forward.

Security

REST and MCP server modes used to deserialize the full options struct from the request body, letting unauthenticated callers drive host-side filesystem and shell execution. PR #923 strips these CLI-only fields at the API boundary.

• fix(server): harden REST/MCP scan options and second-stage param channel by @hahwul in #923
• Closes one Critical and three High-severity advisories — see the Security tab for details.

If you run dalfox server without --api-key, upgrade immediately.

Features

• feat: add --out-of-scope domain filtering option by @sheikhshaheerimran in #876
• feat: early stop on results, filter result type by @Gby56 in #909
• Add comprehensive JSON body parameter support for XSS testing by @Copilot in #798
• Improve grepping (regex hardening, anchored Slack/GitHub patterns, httptest harness) by @hahwul in #885
• Add new secret-pattern regex coverage (Sentry, Netlify, Firebase, GitLab, SendGrid, Dropbox, Asana, DigitalOcean, Linear, Shopify) by @r0x10ffff in #883

Bug Fixes

• fix: resolve data race and nil pointer panic in processParams by @toteb in #917
• fix: prevent false positives when XSS payload is reflected in JSON/JSONP by @realnits in #894
• fix: logger issue by @CyberRoute in #834

Build / Tooling

• Add Go 1.24 and 1.25 to CI test matrix by @hahwul in #801
• Add comprehensive GitHub Copilot instructions for Dalfox development by @Copilot in #800

Dependencies

• chore(deps): bump github.com/chromedp/chromedp from 0.13.7 to 0.14.2 (#793, #805, #826)
• chore(deps): bump golang.org/x/term from 0.32.0 to 0.42.0 (#784, #797, #813, #827, #879, #887, #895, #914)
• chore(deps): bump golang.org/x/sync from 0.15.0 to 0.20.0 (#785, #814, #893)
• chore(deps): bump github.com/olekukonko/tablewriter from 1.0.8 to 1.1.4 (#794, #817, #881, #896)
• chore(deps): bump github.com/swaggo/swag from 1.16.4 to 1.16.6 (#788, #795)
• chore(deps): bump github.com/swaggo/echo-swagger from 1.4.1 to 1.5.2 (#897)
• chore(deps): bump github.com/spf13/pflag from 1.0.6 to 1.0.10 (#789, #812)
• chore(deps): bump github.com/spf13/cobra from 1.9.1 to 1.10.1 (#809)
• chore(deps): bump github.com/sirupsen/logrus from 1.9.3 to 1.9.4 (#880)
• chore(deps): bump github.com/stretchr/testify from 1.10.0 to 1.11.1 (#807)
• chore(deps): bump github.com/PuerkitoBio/goquery from 1.10.3 to 1.12.0 (#898)
• chore(deps): bump rexml from 3.3.9 to 3.4.2 in /docs (#815)
• chore(deps): bump addressable from 2.8.7 to 2.9.0 in /docs (#912)
• [ImgBot] Optimize images by @imgbot in #786

New Contributors

• @CyberRoute made their first contribution in #834
• @r0x10ffff made their first contribution in #883
• @realnits made their first contribution in #894
• @Gby56 made their first contribution in #909
• @toteb made their first contribution in #917

Full Changelog: v2.12.0...v2.13.0

v2.12.0

What's Changed

• chore(deps): bump golang.org/x/term from 0.31.0 to 0.32.0 by @dependabot in #730
• chore(deps): bump golang.org/x/sync from 0.13.0 to 0.14.0 by @dependabot in #729
• chore(deps): bump github.com/mark3labs/mcp-go from 0.20.0 to 0.27.1 by @dependabot in #734
• chore(deps): bump github.com/mark3labs/mcp-go from 0.27.1 to 0.28.0 by @dependabot in #735
• feat: Implement custom workflow for building and uploading release bi… by @hahwul in #738
• feat: Add DELETE endpoints for scan data management by @hahwul in #740
• chore(deps): bump github.com/labstack/echo/v4 from 4.13.3 to 4.13.4 by @dependabot in #739
• feat: Add --custom-blind-xss-payload flag by @hahwul in #741
• Rake to Just by @hahwul in #754
• Add AI.md for AI agent guidance. by @hahwul in #755
• Update dependencies and fix changes by @hahwul in #757
• Improve help message (grouping) by @hahwul in #760
• chore(deps): bump github.com/chromedp/chromedp from 0.13.6 to 0.13.7 by @dependabot in #762
• Rename AI.md to AGENTS.md by @hahwul in #763
• Added advanced XSS scanning features by @ibrahmsql in #765
• chore(deps): bump github.com/olekukonko/tablewriter from 1.0.7 to 1.0.8 by @dependabot in #766
• Add Nixpkgs section by @fabaff in #768
• Add API Key based auth by @hahwul in #770
• feat: Improve test coverage for internal modules by @hahwul in #769
• feat: Add CORS and JSONP support for server mode by @hahwul in #771
• Add new object and embed codebase XSS payloads for bypasses by @hahwul in #772
• Add raw HTTP request support to pipe mode by @hahwul in #773
• feat: Add markdown report format by @hahwul in #777
• Update PoC numbering to use PoC1, PoC2 format in tests by @hahwul in #778
• Fix code formatting and alignment for consistency by @hahwul in #779
• Add Caido integration documentation and workflow images by @hahwul in #781
• Release v2.12.0 by @hahwul in #782

New Contributors

• @ibrahmsql made their first contribution in #765
• @fabaff made their first contribution in #768

Full Changelog: v2.11.0...v2.12.0

v2.11.0

DalFox v2.11.0 Release Notes

What's New

• MCP Server Mode: Added dalfox server --type=mcp for enhanced server support. (doc)
• JSONL Output Format: Introduced dalfox url <TARGET> --format=jsonl for JSON Lines output. (doc)
• XDG_CONFIG_HOME Support: Added support for configuration storage based on the XDG Base Directory Specification, utilizing XDG_CONFIG_HOME for standardized config file management. by @s7x (doc)

Improvements

• Code refactoring for better maintainability.
• Enhanced configuration handling and server command options.
• Optimized images for improved performance.
• Downgraded minimum Go version for broader compatibility.
• Documentation:
  • Added llms.txt in documentation for detailed LLM references.
  • Jekyll Plugin: Included plugin for combined LLM documentation.

Bug Fixes

• Fixed issues reported in #701. by @Cruzcat1975
• Resolved typo and potential memory allocation issue in code scanning alert #713.

Dependency Updates

• Bumped github.com/chromedp/chromedp from 0.13.3 to 0.13.6.
• Bumped golang.org/x/sync from 0.12.0 to 0.13.0.
• Bumped golang.org/x/term from 0.29.0 to 0.31.0.
• Bumped github.com/PuerkitoBio/goquery from 1.10.2 to 1.10.3.
• Bumped github.com/hahwul/volt from 1.0.6 to 1.0.7

Full Changelog: v2.10.0...v2.11.0

v2.10.0

What's Changed

Release Notes

Features

• Added workflow_dispatch to Docker workflow (#577)
• Updated 'BAV' behavior to be disabled by default; added --use-bav option to enable it (#596)
• Added Args struct to cmd package for command-line argument handling (#607)
• Added unit tests for scanning package functions (#605)
• Added functional tests (#632)
• Added custom transport support (#636 by @Bide-UK)
• Added option to skip discovery (#644 by @noperator)
• Added result limit option to file and pipe commands (#676)
• Added force headless verification option (#677)
• Added new web app manifest and favicon images; updated logo size in index.html (#680)
• Added Snapcraft configuration for Dalfox publishing (#689) with fixes (#690, #691, #692, #693)
• Enhanced scan error handling and added tests for scan functionality (#655)
• Added new payload and comment patterns (#640)
• Added initial tests for endpoints on testphp.vulnweb.com (#674)

Improvements

• Updated Go version and installation instructions (#593, #654 to 1.24)
• Improved documentation: Docker usage, resource titles (#594), general enhancements (#586, #686)
• Updated project badges for better visibility (#681)
• Updated README with new features and installation instructions (#683)
• Optimized multi-stage Dockerfile and updated base image (#606)
• Improved test cases with correct URL and local server for POST requests (#623)
• Updated funding configuration to use GitHub sponsorship (#624)
• Updated Jekyll workflow and dependencies for Ruby 3.4 (#638)
• Improved performance (#639)
• Updated Codecov workflow and configuration: new coverage format (#649), ignored cmd directory (#604, #650, #651, #652, #653)
• Optimized images (#671, #682, #688 by @imgbot)

Refactoring

• Refactored code structure (#600, #672)
• Renamed workflows for clarity and updated Docker build process (#626)
• Refactored TestInitialize assertions for clarity and correctness (#661)
• Refactored log messages for clarity and consistency (#684)
• Updated scan tests and mock server usage (#685)

Fixes

• Fixed zombie processes in found action (#625 by @arjun-1) and cmd run (#628 by @arjun-1)
• Standardized YAML formatting across workflow files (#627)
• Corrected source URL format in snapcraft.yaml and updated platform support (#690, #693)

Dependency Updates

• Bumped golang.org/x/term: 0.23.0 → 0.29.0 (#579, #589, #602, #618, #630)
• Bumped github.com/chromedp/chromedp: 0.10.0 → 0.13.3 (#590, #621, #635, #648, #658, #673, #675)
• Bumped github.com/labstack/echo/v4: 4.12.0 → 4.13.3 (#601, #608, #610, #612)
• Bumped golang.org/x/sync: 0.8.0 → 0.12.0 (#588, #603, #629, #646, #659)
• Bumped github.com/PuerkitoBio/goquery: 1.9.2 → 1.10.2 (#598, #616, #633)
• Bumped github.com/stretchr/testify: 1.9.0 → 1.10.0 (#592)
• Bumped github.com/swaggo/swag: 1.16.3 → 1.16.4 (#591)
• Bumped golang.org/x/crypto: 0.27.0 → 0.31.0 (#609)
• Bumped github.com/briandowns/spinner: 1.23.1 → 1.23.2 (#620)
• Bumped github.com/spf13/cobra: 1.8.1 → 1.9.1 (#634)
• Bumped golang.org/x/net: 0.35.0 → 0.36.0 (#660)
• Bumped github.com/hahwul/volt: 1.0.5 → 1.0.6 (#657)

Miscellaneous

• Updated contributors workflow to use wow-actions (#662)
• Updated functional test workflow and added RSpec tests for XSS challenge (#666)
• Updated version to v2.10.0 (#687)

New Contributors

• @arjun-1 made their first contribution in #625
• @Bide-UK made their first contribution in #636
• @noperator made their first contribution in #644

Full Changelog: v2.9.3...v2.10.0

v2.9.3

Changelog

What's Changed

• Bump golang.org/x/sync from 0.5.0 to 0.6.0 by @dependabot in #519
• Bump golang.org/x/term from 0.15.0 to 0.16.0 by @dependabot in #518
• Sync by @hahwul in #523
• Dev by @hahwul in #524
• Sync (main to dev) by @hahwul in #525
• Update .goreleaser.yml by @hahwul in #526
• Bump golang.org/x/term from 0.16.0 to 0.17.0 by @dependabot in #530
• Bump github.com/chromedp/chromedp from 0.9.3 to 0.9.5 by @dependabot in #529
• Dev by @hahwul in #531
• Correct GH edit address by @palmiak in #532
• [ImgBot] Optimize images by @imgbot in #533
• Dev by @hahwul in #534
• Bump github.com/PuerkitoBio/goquery from 1.8.1 to 1.9.0 by @dependabot in #535
• Bump github.com/swaggo/swag from 1.16.2 to 1.16.3 by @dependabot in #527
• Bump github.com/stretchr/testify from 1.8.4 to 1.9.0 by @dependabot in #537
• Bump github.com/PuerkitoBio/goquery from 1.9.0 to 1.9.1 by @dependabot in #536
• Bump golang.org/x/term from 0.17.0 to 0.18.0 by @dependabot in #538
• 📝 Update installation instructions for dalfox by @hahwul in #539
• Update documents by @hahwul in #540
• Update README.md by @josemlwdf in #544
• Bump golang.org/x/term from 0.18.0 to 0.19.0 by @dependabot in #543
• Bump golang.org/x/sync from 0.6.0 to 0.7.0 by @dependabot in #542
• Update document and Dependencies update. by @hahwul in #545
• Bump golang.org/x/net from 0.21.0 to 0.23.0 by @dependabot in #547
• Bump github.com/labstack/echo/v4 from 4.11.3 to 4.12.0 by @dependabot in #546
• Bump golang.org/x/net from 0.21.0 to 0.23.0 by @dependabot in #548
• Dependencies upgrade by @hahwul in #549
• Bump github.com/PuerkitoBio/goquery from 1.9.1 to 1.9.2 by @dependabot in #550
• Bump golang.org/x/term from 0.19.0 to 0.20.0 by @dependabot in #553
• Bump golang.org/x/term from 0.20.0 to 0.21.0 by @dependabot in #557
• Bump github.com/briandowns/spinner from 1.23.0 to 1.23.1 by @dependabot in #559
• Bump github.com/spf13/cobra from 1.8.0 to 1.8.1 by @dependabot in #561
• fix: only custom payload should not insert base xss payloads by @giper45 in #568
• Bump github.com/chromedp/chromedp from 0.9.5 to 0.10.0 by @dependabot in #564
• fix: update NewMessageID test to check for positive values by @hahwul in #572
• Bump golang.org/x/sync from 0.7.0 to 0.8.0 by @dependabot in #566
• Bump golang.org/x/term from 0.21.0 to 0.23.0 by @dependabot in #569
• Release v2.9.3 by @hahwul in #574
• Fixed goreleaser config bug by @hahwul in #575
• Dev by @hahwul in #576

New Contributors

• @palmiak made their first contribution in #532
• @josemlwdf made their first contribution in #544
• @giper45 made their first contribution in #568
• @TannicArcher #571
• @khanjanny @P1k4f0u34 @sharmaz11 #565

Full Changelog: v2.9.2...v2.9.3