Release notes

We are pleased to announce the latest release of Spotter, packed with new features, enhancements, and fixes.

Note

Spotter updates are part of our ongoing commitment to enhancing Spotter's functionality and user experience. We welcome any feedback and are here to answer any questions.

Check out all the latest updates and improvements:

2025-07-09 Release

• Spotter App version: 5.13.0

Improvements

• Improved Steampunk Spotter App reliability and performance.

2025-06-18 Release

• Spotter App version: 5.12.0

Improvements

• The check result H1003 is no longer triggered for inline items which contain one Jinja expression. It is now returned if an inline item contains more than one Jinja expression.
• Many visual and functional improvements as well as improved reliability of check results.

2025-06-04 Release

• Spotter App version: 5.11.0

New checks

• E910 - short name used in Jinja
  • Results in an error if a short name is used in a Jinja expression instead of a fully-qualified name.
• E911 - play contains Jinja using short name
  • Results in an error if in a play a short name is used in a Jinja expression instead of a fully-qualified name.
• E912 - inventory contains Jinja using short name
  • Results in an error if in an inventory a short name is used in a Jinja expression instead of a fully-qualified name.
• H1905 - missing collection requirement for Jinja
  • Generates a hint when a Jinja expression uses a collection that is missing from the requirements.yml.
• H1906 - play contains Jinja that is missing collection requirement
  • Generates a hint when in a play a Jinja expression uses a collection that is missing from the requirements.yml.
• H1907 - inventory contains Jinja that is missing collection requirement
  • Generates a hint when in an inventory a Jinja expression uses a collection that is missing from the requirements.yml.
• E2707 and E2708 have an improved handling of the ansible.builtin.combine jinja input parameters.

Improvements

• Many visual and functional improvements as well as improved reliability of check results.

2025-05-07 Release

• Spotter App version: 5.9.0
• Spotter CLI version: 5.5.0

Improvements

• As part of the Supply Chain Management improvements, you can now export and import constraints directly in the Steampunk Spotter App.
• Versions in the Supply Chain Management constraints now support inexact qualifiers such as >, >=, ~=, <=, or <.
• Exporting and importing of Check management rules is also available in the Steampunk Spotter App.
• E-mail notifications may now be configured to be delivered in Japanese language.
• Improved reliability of scan operations and live scan progress accuracy.

2025-03-26 Release

• Spotter App version: 5.8.0
• Spotter CLI version: 5.4.0

New checks

• W1904 - installed collection version fallback
  • Results in a warning that that an installed collection is newer than the latest version known to Steampunk Spotter. The checks will assume an older, but latest for Spotter, version of the collection.

Improvements

• We have reduced the time taken to scan most of the projects by parsing the directory structure of your project in parallel.
• Many visual and functional improvements as well as improved reliability of check results.

2025-03-12 Release

• Spotter App version: 5.7.0

New checks

• H012 - required parameter missing in the parent as jinja
  • Results in a hint that the user should verify the Jinja2 expression or an inline value for presence of a required parameter.

Improvements

• The checks ranging from E3500 to E3510 are now able to check inventories, if present in the scan input. Steampunk Spotter now applies the same version for checking inventories that is used for checking tasks.
• E1002 and H1003 are now improved to provide a corrected message that no longer uses parameter name instead of module name. They also include a relevant documentation link in the output. Further, they permit any subsequent checks to run in the same task.

2025-02-19 Release

• Spotter App version: 5.6.0

Improvements

• New Site settings allow on-prem instance administrator to disable actions related to organizations. This includes users' ability to create new organizations or edit existing ones.
• Instance administrators may also use Site settings to enable direct registration of new users into organizations. When enabled, organization administrators may register new users directly into the Steampunk Spotter organizations.

2025-01-29 Release

• Spotter App version: 5.5.0
• Spotter CLI version: 5.3.0

New checks

• E011 - Unknown module parameter used
  • Results in an error when a module parameter is used that doesn't seem to have been implemented for the module. Suggests to implement the task without the parameter, or switch to one of the modules that does support this parameter instead. This is now specifically enabled also for the ansible.builtin modules systemd, sysvinit, package and service.
• W112 - YAML template or an incomplete task file
  • Results in a warning when Spotter detects a file that might be a broken task file, or might also be a legitimate YAML template. Users may then decide to either put W112 on a skip list, or change the file to make it a valid Ansible task file.

Improvements

• We have unified the wording of "Custom policies" across the Steampunk Spotter App, no longer using the "Custom rules" term.
• New spotter scan CLI switch --skip-detect-secrets disables detection and obfuscation of sensitive data in the client before preparing the payload.
• Many visual and functional improvements as well as improved reliability of check results.

2025-01-15 Release

• Spotter App version: 5.4.0
• Spotter CLI version: 5.2.1

New checks

• E2309 - Error originating from a custom OPA policy
  • Results in an error related to variables as detected by a custom policy.
• W2310 - Warning originating from a custom OPA policy
  • Results in a warning related to variables as detected by a custom policy.
• H2311 - Hint originating from a custom OPA policy
  • Results in a hint related to variables as detected by a custom policy.
• H1006 - Inline parameters used in a shell-like module
  • For shell-like modules with inline parameters where the cmd parameter is provided inline, any appearance of an = sign could lead to ambiguous interpretations. In this case, we advise to expand the task.

Improvements

• Instance administrators may now take advantage of the new Admin > Site settings view for configuring the main settings of the Steampunk Spotter App instance.
• Fixed the CLI's mapping the results for variables with the input file, line and column number for scans that use imported payload.
• Many visual and functional improvements.

2024-12-18 Release

• Spotter App version: 5.3.0
• Spotter CLI version: 5.2.0

Improvements

• Improved user experience in the Custom rules view. You can now edit policy text definitions in the Spotter Web App, delete individual policies, or create new policies from scratch.
• Learn more about custom policies with OPA in Steampunk Spotter in this new document.
• New Environment tab in the Reports view shows statistics on the Ansible and Python versions, Ansible collections used (including specific versions) and execution environment templates to ensure consistent setups across projects.
• Many visual and functional improvements.

2024-12-05 Release

• Spotter App version: 5.2.0
• Spotter CLI version: 5.1.1

Improvements

• Synchronization of the Steampunk Spotter users with LDAP is now more reliable, particularly when handling users with identical identifiers that differ only by letter case.
• Management of custom policies has been improved, making updating or clearing policies significantly faster.
• The spotter build command now performs the EE build operation from the directory it’s run in, ensuring better support for files referenced in the EE manifest.
• General reliability improvements to the spotter build command.
• Enabled running spotter scans for Ansible version 2.18.

2024-11-13 Release

• Spotter App version: 5.1.0

Improvements

• An overhaul of the Reports view brings metrics more relevant to the day-to-day operations into its default Overview tab. We have also streamlined the reports, removing the Scan results and the Inputs tabs, integrating their metrics into the Overview tab.
• Regular users now have read-only access to features previously reserved to the organization administrators. Helpful pop-ups describe why actions are not available to the user.
• Many visual and functional improvements.

2024-10-29 Release

• Spotter App version: 5.0.0
• Spotter CLI version: 5.0.0

Improvements

• The new Upgrade tab in the Reports view shows detailed reports on upgrading Ansible playbooks, the Ansible version, and collection versions. This helps you monitor your team's progress as they work through any issues while migrating your automation projects to the latest Ansible platform and handling dependency updates.
• The Create Project button in the Projects view and the Invite New Member button in the Members view are now visible to users who previously had no access to them. These buttons appear in a disabled state, with a pop-up explaining why the actions are currently unavailable.
• For organizations using on-site or self-signed TLS certificates, the Steampunk Spotter CLI now offers improved usability. The HTTP client uses the system's Certificate Authority (CA) store instead of the one from the Python requests library. New CLI options also allow for selecting a custom CA store or bypassing the trusted TLS certificate entirely.

2024-10-23 Release

• Spotter App version: 4.10.0
• Spotter CLI version: 4.4.1

New checks

• E111: Keyword static is obsolete
  • reports an error when the static keyword is in use in a module for Ansible 2.8 or newer. For static modules, the check result instructs that the keyword should be replaced with an include_* family keyword, while in dynamic modules, it tells that the keyword should be removed.

Improvements

• New quick-start experience replaces the old banner with a flow that guides you through main Steampunk Spotter App features.
• New option to enable case-insensitive usernames for LDAP logins.
• General checks reliability and usability improvements.
• Fixes for missing images and rich text (markdown) elements such as the CLI set-up steps.

2024-10-09 Release

• Spotter App version: 4.9.0
• Spotter CLI version: 4.4.0

New checks

• W908: Module include deprecated
  • Check warns about any use of ansible.builtin.include as deprecated for Ansible versions before 2.16.
• E909: Module include deprecated
  • Check reports an error on any use of ansible.builtin.include as obsolete at and after Ansible 2.16.
• For detected use of the _include module, Spotter no longer offers any suggestion to replace it with the deprecated or obsoleted ansible.builtin.include.
• If a play uses import_playbook, Steampunk Spotter no longer reports the E1405 error about the hosts keyword being required.

Improvements

• New insight into the security status of your projects is now available as a section of the Reports view. This allows for monitoring of the unresolved security issues in the projects, the level of risk and the extent of the issues reported by the Steampunk Spotter.
• The scan summary in the CLI console now includes the count of files scanned and paths skipped while scanning.
• Scans running during an AAP execution collect and send information on the AAP job ID, inventory ID and project revision.

2024-09-25 Release

• Spotter App version: 4.8.0

Improvements

• A new plugin documentation view containing a comprehensive database of every collection, plugin, and module from the Ansible Galaxy, searchable by its version number.

2024-09-11 Release

• Spotter App version: 4.7.0

New checks

• E3600: Installed collection forbidden check
  • One or more Supply Chain Management constraints disallow this collection to be installed.
• E3601: Python version forbidden check
  • One or more Supply Chain Management constraints disallow this version of Python.
• E3602: Module forbidden check
  • One or more Supply Chain Management constraints disallow this module.
• E3603: Collection in the requirements forbidden check
  • One or more Supply Chain Management constraints disallow this collection to be present in the requirements.

Improvements

• New functionality to manage settings for controlling the software supply chain. The new view allows for adding and managing constraints to deny or allow only specific modules, collections or Python platforms.

2024-09-06 Release

• Spotter App version: 4.6.0

Improvements

• Console-based audit logs are now available for instance administrators of enterprise deployments.

2024-08-28 Release

• Spotter App version: 4.5.0
• Spotter CLI version: 4.3.0

New checks

• E3302: Hard-coded secret variable value check
  • Check reports an error when a variable value contains a hard-coded secret instead of using Ansible Vault.

Improvements

• Visual refresh of the Web App.
• New ability to recognize and include variables files into the scan input.
• General security and usability improvements.

2024-08-07 Release

• Spotter App version: 4.4.0

Improvements

• General fixes and improvements of the scanning, rewrites and the Web App.

2024-07-24 Release

• Spotter App version: 4.3.0
• Spotter CLI version: 4.2.0

Improvements

• New view Scan profiles provides controls for creating and managing custom scan profiles for an organization.
• On top of the built-in scan profiles (i.e., default, security, and full), any of the custom profile names may now be used as PROFILE in the spotter scan --profile PROFILE command.
• For the on-premises enterprise users, the built-in suggestions engine now starts up as soon as the Spotter App starts.
• General fixes and improvements of the scanning, rewrites and the Web App.

2024-07-17 Release

• Spotter App version: 4.2.0
• Spotter CLI version: 4.1.0

Improvements

• Scan input now includes all the relevant files in all subdirectories. This includes files that may previously have been missed because CLI assumed a specific structure of the directories.
• New ability to recognize and include roles, blocks, plugins and module defaults into the scan input.
• New spotter scan switch --exclude-paths directs the CLI to omit the specified directories and files from being scanned.- The CLI now also parses blocks in the input.
• New spotter scan switch --no-ansible-version allows the client to set the target ansible version to unknown.
• New ability of the spotter scan command to collect the locally installed Python packages. To prevent this information from being used in the payload, a new --exclude-environment switch is available.
• General fixes and improvements of the checks, parsing and rewrites.

2024-06-19 Release

• Spotter App version: 4.1.0
• Spotter CLI version: 4.0.0

New checks

• E3500: Inventory plugin existence check

  • Check identifies that the inventory plugin used in the input cannot be found in the knowledge base database.

• E3501: Inventory plugin excessive parameters check

  • Check identifies that the parameter used in the inventory is not valid.

• H3504: Inventory plugin deprecated parameters check

  • Check identifies that hints that the parameter used in the inventory has been deprecated.

• E3505: Inventory plugin required parameters check

  • Check identifies that a parameter required in the inventory is not set.

• E3506: Inventory plugin required parameters with no fallback check

  • Check identifies that a parameter required in the inventory is not set, and the corresponding fallback environment variable has not been set either.

• H3507: Inventory plugin required parameters with fallback check

  • Check hints about setting the fallback environment variable in all systems for the corresponding required parameter that was not set in the inventory.

• W3508: Inventory plugin parameter type coercion check

  • Check warns about a parameter in the inventory having being coerced into a different type.

• E3509: Inventory plugin parameter as a dictionary check

  • Check identifies that a parameter in the inventory is provided as a list, but the plugin expects a dictionary instead.

• E3510: Inventory plugin parameter outside its parameter check

  • Check identifies that in an apparent indentation error, a parameter is used in the inventory that should be put inside another parameter.

• E2716: Inventory plugin Jinja2 invalid parameter check

  • Check identifies that Jinja2 expression applied to the inventory uses a parameter that does not exist.

• E2717: Inventory plugin Jinja2 excessive parameter check

  • Check identifies that Jinja2 expression applied to the inventory has too many parameters.

• E2718: Inventory plugin Jinja2 single value requirement for check

  • Check identifies that a formal parameter in Jinja2 expression applied to the inventory has two supplied values.

• E2719: Inventory plugin Jinja2 required parameter check

  • Check identifies that Jinja2 expression applied to the inventory is missing a required parameter.

• E2720: Inventory plugin Jinja2 invalid item check

  • Check identifies that an item in the Jinja2 expression applied to the inventory does not exist.

New features

• New button in the scan details view provides a download of the execution environment YAML file that matches the environment where the scan was executed in.
• New CLI command spotter build which serves as a wrapper command for ansible-builder build. It produces an Ansible Execution Environment, which has the Steampunk Spotter client embedded. This enables integration with AAP.

Improvements

• The spotter config get command now provides an output in a format that is compatible with the spotter config set command.

2024-06-05 Release

• Spotter App version: 4.0.0

Improvements

• Increased accuracy of the checks for the supplied parameters to the modules implemented in PowerShell.

New checks

• W2607: PowerShell module security check

  • Check identifies when issues are detected in the PowerShell implementation of a module used in the playbook.

• E3400: Module entry point check

  • Check identifies when the provided module entry point does not exist.

• W3401: Required parameters in role check

  • Check identifies when a variable required by the role has not been set.

---

2024-05-15 Release

• Spotter App version: 3.15.0

Improvements

• Added information regarding the scan environment to scans initiated against Git repositories from the Spotter App.
• Made the Scan environment button more prominent for better accessibility.
• Updated the Check catalogue to include playbook examples alongside respective scan outputs.
• Added extended documentation covering Check management, and LDAP settings.
• Added This year and Last year options to choose from while selecting the time period for analysis in the app.
• Clear Text Filters Easily: Text filter fields now have an "X" button for clearing text, available in:
  • Check catalogue (Filter by name, description code)
  • Reports > Inputs (Collection filter, Module filter)
  • Scan Details view (Filter by filename, description code)
• Reset All Filters: New Reset filter buttons are added to clear all filters in:
  • Check catalogue (Filter by name, description code)
  • Scan details view

Fixes

• Fixed a bug where charts incorrectly filled data points by interpolation instead of extrapolation.
• Fixed the issue where the misleading "Something went wrong when checking the license" message would erroneously display in the login box following extended periods of user inactivity. We took the appropriate measures to avoid errors at the user registration time.
• Fixed the issue related to accessing the Check catalogue at a particular check result, ensuring that the view now correctly scrolls to the intended entry.

---

2024-04-24 Release

• Spotter App version: 3.14.0

New checks

• E2706: Required parameters check

  • Check identifies when a Jinja expression uses non-existing parameters in a task.

• E2707: Excessive parameters check

  • Check identifies the use of excessive parameters in a Jinja expression in a task.

• E2708: Single value requirement for parameters check

  • Check identifies double definition for a single parameter in a Jinja expression, in a task.

• E2709: Missing required parameter check

  • Check identifies when a Jinja expression is missing a required parameter in a task.

• E2710: Jinja item detection check

  • Check detects when a Jinja item does not exist in a task.

• E2711: Required parameters check

  • Check identifies when a Jinja expression uses non-existing parameters in a play.

• E2712: Excessive parameters check

  • Check identifies the use of excessive parameters in a Jinja expression in a play.

• E2713: Single value requirement for parameters check

  • Check identifies double definition for a single parameter in a Jinja expression in a play.

• E2714: Missing required parameter check

  • Check identifies when a Jinja expression is missing a required parameter in a play.

• E2715: Jinja item detection check

  • Check detects when a Jinja item does not exist in a play.

New features

• Added a runtime setting; Enterprise users may disable new user registrations in their on-prem deployments of Spotter.
• We introduced an optional time-based expiration for API tokens, allowing users to set token expiration dates and implement error handling for expired tokens.

Improvements

• Action Start scanning now directs users to the top of the page for streamlined access.
• Enhanced Custom rules; Spotter now supports updating and clearing policies directly from the app.
• Enhanced Check management; Spotter now supports organization-level management of skipping and enforcing checks directly from the app.
• Users can now close the dropdown in the check catalogue after accessing links with anchors.
• We flattened the hierarchy by relocating Runtime settings to the list end to reduce confusion and unintentional navigation collapses.
• Scan environment is now displayed in the Spotter app. You can access it inside of every given project.
• Added support for RHEL 9.3 in on-prem installations.

Fixes

• Fixed the issue preventing multiple saves of subsequent runtime settings during a single user visit, ensuring successful saves without errors on all attempts.
• Fixed the issue causing admin settings to vanish when switching between runtime settings.
• Fixed the handling of crashes when users input incorrect custom TLS settings, with the utilization of self-signed certificates as a fallback.

---

2024-04-11 Release

• Spotter App version: 3.13.1

Fixes

• Fixed display issue in Scan details view of Spotter app. This update ensures that each check result row now accurately displays a reconstruction of the play or task it corresponds to.

---

2024-04-10 Release

• Spotter App version: 3.13.0

New features

• The Spotter app now enables you to easily view all uploaded custom policies, enhancing user control and efficiency: policies listing, code rendering, and smooth navigation between policies and projects. You can view your policies in the Custom rules section.

Improvements

• Documented how to configure integration with Active Directory under a new Active directory support section in the On-prem documentation.

Fixes

• Fixed issues with self-signed certificates support for TLS connections after installs and upgrades, easing setup for secure communications.

---

2024-03-27 Release

• Spotter App version: 3.12.0
• Spotter CLI version: 3.3.0

Improvements

• The on-prem installation documentation now includes instructions for entering license information during the initial setup.
• Customized bind handling for Active Directory LDAP searches by ensuring a successful bind on the connection.
• Try On-prem CTA: Introduced a Call-to-Action button on the top navigation for easy access to on-premise setup modal.
• Adjusted the navigation by relocating Your plan to the subscription page for improved accessibility.
• The registration form for the on-prem users is now in a single view.

Fixes

• Implemented pagination support for LDAP searches to manage size limit exceeded errors resulting from a large number of results.

---

2024-03-13 Release

• Spotter App version: 3.11.0
• Spotter CLI version: 3.2.0

New features

• Developed on-prem license models and efficient verification methods.
• Added SARIF format support for scan results in the CLI. Use spotter scan --sarif report.sarif playbook.yml for easy integration with GitHub code scanning and other SARIF-compatible platforms.

Fixes

• Fixed the issue where switching projects in the Spotter app with pagination lead to an "error while retrieving project scan list."
• Fixed the issue where switching pages results in multiple code snippets were being inadvertently opened.

---

2024-02-28 Release

• Spotter App version: 3.10.0

Improvements

• The E3000- No module found for specified version check has been improved to only trigger if there is no known earlier minor version in the knowledge base, enhancing the accuracy of checks.
• Improved the scan details view in the Spotter app to enable each check result row to display a reconstruction of the play or task it corresponds to, providing clearer insights into scan results.
• New and improved Feedback link in the navigation sidebar enables easier and more detailed user feedback submission.

Fixes

• Fixed the Start scanning button to reopen the Your quick start guide if it had previously been closed, ensuring users have access to the guide when needed.

---

2024-02-22 Release

• Spotter App version: 3.9.0

New features

• Enabled multiple source LDAP organizations to be mapped into a single Steampunk Spotter organization, allowing for more flexible user management.
• Added an option for enabling instance admins to view and manage all organizations within the app as if they were an org admin, regardless of their membership status in those organizations.

Improvements

• Enhanced the organization drop-down to display the exact number of organizations for users who are members of more than 5 organizations.
• Set LDAP timeout to 30 seconds to improve the system's responsiveness and reliability.
• Improved error messaging for LDAP configurations by providing a more informative "Unexpected error" message for backend errors, enhancing user understanding and troubleshooting.
• Increased the robustness of LDAP sync by gracefully handling duplicate usernames or email addresses in LDAP input and discrepancies among multiple users.
• Made errors of individual LDAP settings visible when testing settings or running sync, aiding in the identification and resolution of configuration issues.
• Refined the login view to allow users to retain previously typed entries when switching between Internal and LDAP login methods, enhancing the user experience.

---

2024-02-14 Release

• Spotter App version: 3.8.0

New checks

• H1903: Required collections/modules verification check
  • The check ensures all required collections/modules for scanned playbooks are installed, providing hints for missing or mismatched versions.

New features

• LDAP integration: Added the ability to configure managed Steampunk Spotter user accounts, groups and user roles by directory information services available in your network.

---

2024-01-31 Release

• Spotter App version: 3.7.0
• Spotter CLI version: 3.1.1

New checks

• H806: Decimal mode format check

  • This check is designed to ensure that the mode settings in specific Ansible modules are in the correct numerical format. The focus is on the file and copy modules of Ansible, where it's common to specify file permissions.

• E3300: Hardcoded secret detection in tasks

  • This check identifies instances where secrets (such as passwords or API keys) are hardcoded directly within a task. The recommendation is to use variables or Ansible Vault for better security practices. This check is relevant for ensuring best practices and enhancing security within configurations.

• E3301: Hardcoded secret detection in plays

  • This check targets the detection of hardcoded secrets within Ansible plays. The presence of such secrets is considered a security risk and goes against best practices. Instead of embedding secrets directly, the recommendation is to utilize variables or Ansible Vault, which offer more secure and manageable approaches to handling sensitive information. This check is pertinent to ensuring adherence to best practices and bolstering security.

• E3200: Production environment debugger check

  • The check highlights tasks that may interrupt execution due to the activation of the debugger. It advises against using the debugger in production environments to maintain smooth and uninterrupted execution flows.

• W2705: Jinja2 implicit field wrapping warning (CVE-2023-5764)

  • This check identifies instances where a 'Jinja2' field is implicitly wrapped within a Jinja2 expression, leading to a potential risk of double evaluation, which is flagged under CVE-2023-5764. Such practices can introduce security vulnerabilities into the playbook. The check emphasizes the importance of adhering to secure coding practices and avoiding patterns that could result in unintended behavior or security risks. For further guidance, refer to the Ansible Porting Guide.

New features

Enabled dynamic banners in the app.

Improvements

• Enhanced CLI from version 3.1.0 onwards to utilize data type information sent to the cloud.

Pricing plan updates:

• Reduced Free Plan scan quota from 100 to 5 scans per month.
• Discontinued Individual Plan, renamed Team Plan to Pro Plan, and changed Free Trial Team Plan to Free Trial Pro Plan with same features.

Fixes

• Fixed text overflow issue for long email addresses in the My profile drop-down menu.
• Fixed the role change restriction for the sole organization administrator.

---

2024-01-17 Release

• Spotter App version: 3.6.0
• Spotter CLI version: 3.1.0

New checks

• H3100: Only roles or tasks

  • A check for smoother and clearer play execution. We recommend sticking to either 'tasks' or 'roles' but not both. Mixing them can make the order of execution a bit confusing, so keep it simple and use one or the other.

• W1408: Reserved variable name changes play

  • This check identifies instances where reserved variable names are overridden, which could result in unpredictable application behavior. The check emphasizes adherence to best practices for reliable code security and validation.

• W1407: Reserved Ansible name validation

  • This check ensures that variables do not use reserved Ansible names, which is crucial for maintaining code security, best practices, and proper validation.

New features

• Enhanced scan responses now include links to detailed scan information available in the Spotter web app, as well as the Organization ID, offering improved accessibility and additional resources.
• Custom endpoint use: You can now use custom endpoints from config files.
• Instance admins in organization member list: Enhanced visibility of instance admins on on-prem installations.
• Enabled Content Security Policy (CSP) header: Implemented and enabled the CSP header for enhanced security.

Improvements

• Administrators and users can now use e-mails that don't contain any dot . in the host name, e.g.: info@local.
• Improved the system's numerical interpretation capabilities by ensuring correct parsing of octal values in YAML 1.1.
• Spotter CLI is now tested to support Python 3.12.
• Improved the progress bar display for nonexistent files.
• Improved efficiency of discovering CLI environment's Ansible version.
• Improved CLI output by separating warning messages.
• Sending relative paths to the scanned files instead of the absolute ones.
• Removed unnecessary looping in the rewriting process, improving efficiency and readability.
• Removed sleep after last request and improved request handling strategies.
• Implemented TLS certificate configuration in Spotter's runtime settings.

Fixes

• Fixed race condition in asynchronous scanning.
• Fixed inline form string value quoting issue.
• Fixed BCC email functionality.

---

2024-01-09 Release

• Spotter App version: 3.5.0

New checks

• H1601: Enforce naming conventions in playbooks
  • Check to ensure all plays and tasks are appropriately named.
• W1406: Reserved variable name changes
  • Overriding reserved variable names can cause unpredictable behavior. This check ensures you avoid these reserved names, maintaining your environment's stability and security.
• H2704: Implement Jinja2 spacing
  • Check to enhance readability and reduce typos in Jinja2 syntax. For readability, Jinja2 expressions should have spaces after {{ and before }}.
• H2205: Advice against 'vars_prompt' use
  • Playbooks should not use the vars_prompt feature when using AAP, as the automation controller does not interactively allow for vars_prompt questions. This check helps you catch when you should consider replacing vars_prompt with ordinary variables or Ansible Vault.

New features

• New links from Check results codes to Check catalogue entries
  • The Reports/Check results segments now also include direct links to the check catalogue.
• Profile badges in Check catalogue
  • Added profile badges to check catalogue examples to improve the clarity and functionality of your scans. You can learn more about Spotter profiles, here.
• Enhanced validation is now available by providing preprocessed data to OPA. Within Rego rules, you can access both module names and their Fully Qualified Collection Names (FQCN) for each task.
• Direct organization invitation acceptance within the Spotter app
  • We've improved the Spotter app to allow for direct acceptance and rejection of invitations. This feature offers a convenient alternative for on-premises contexts where email delivery capabilities might be restricted due to policy. It also centralizes invitation control within the Spotter app, providing a more integrated solution than relying solely on external email channels.

Improvements

• Granted instance admin universal permissions for broader access.
• Updated CI/CD builds for CLI pre-2.2.0 to avoid mismatches in expected output.
• Standardized color usage in the 'most common errors' section for error levels.
• Implemented Content-Security-Policy header to enhance application security.
• Updated the system to support the 'listen' keyword for both tasks and handlers for improved differentiation.
• Verified and ensured correct processing of the win_shell module with Jinja expressions.

---

2023-12-14 Release

• Spotter App version: 3.4.0
• Spotter CLI version: 3.1.0

New features

• New links from Check results codes to Check catalogue entries
  • Implemented cross-referencing to the catalogue. You can now easily access it with a single click on your check results codes in the Dashboard and Reports segments of the Spotter app.
• Source and CLI Version in Scan Input:
  • Included CLI version and request source in scan details.
• Profiles Field in Catalogue API Endpoint:
  • Introduction of a profiles field in the catalogue API.

Improvements

• Updated Integrations and CLI QSG Links: Modification of links for better on-prem installation compatibility.

Fixes

• Fixed admin menu post token refresh: Stability enhancement for the admin menu.
• Fixed Jinja in Module_Args and Args usage: Resolution of a specific case in Jinja argument handling.
• Upgraded Fortawesome & Fixed Firefox Font Issue: Browser compatibility improvements and Firefox font issue resolution.

---

2023-12-06 Release

• Spotter App version: 3.3.0
• Spotter CLI version: 3.0.0

New checks

• E2703: Jinja validity for plays
  • Spotter checks the Jinja syntax in Ansible Plays, providing recommendations if any errors are found.

New features

• Spotter app:
  • New quick start guide to guide new users on how to use Spotter with shortcuts to documentation and frequently used functionality. A new button Start scanning opens this guide.
  • We added a new Integrations view with cards linking to the relevant documentation.

Improvements

• Module support: Now supporting ruamel.yaml > 0.18 and Pydantic V2.
• Progress bar: Now shows an "in progress with an unknown total" animation, visible during parsing before exporting the payload.
• spotter --token switch is now preferred over its --api-token equivalent.
• Environment variable: Added SPOTTER_TOKEN alongside the existing SPOTTER_API_TOKEN.
• Cleaner command listing: Removed global parser metavar listing all commands as {a, b, c, d}.
• Improved console output: Reworded to prevent sentence punctuation from being included in clicked URLs.
• Removed --option/-o flag.
• Removed --format junit_xml option.
• Removed --include-values and --include-metadata.
• Use config get, config set, and config clear instead of get-config, set-config, and clear-config.
• Transitioned to policies set and policies clear instead of set-policies and clear-policies.
• Optional --origin ORIGIN switch to indicate scan context. Supported ORIGIN values: cli, docker, ide, ci.
• Enhanced task details: Payload now includes play_id in task details.
• CLI version in payload: Scan payload now includes the CLI version.
• Relocated Subscriptions link to the profile menu dropdown.

Fixes

• Fixed regression issues in shell module results.
• Fixed W2900 - Undefined variable behavior warning to address false positives.

---

2023-11-22 Release

• Spotter App version: 3.2.0
• SPotter App version: 3.2.1

New checks

• W2900 - Undefined variable behavior warning
  • Issues a warning if 'DEFAULT_UNDEFINED_VAR_BEHAVIOR' is set to false. For best practices, this should be true or omitted.
• E1405 - Missing host keyword error
  • Introduces an error check for playbooks missing the crucial 'hosts' keyword, ensuring proper execution across the desired hosts.
• E110 - Indeterminable module name error
  • Flags an error when multiple module candidates lead to ambiguity in a task, ensuring clarity in module specifications.
• H004 - Deprecated parameter warning
  • Alerts to deprecated parameters, like using 'user' instead of 'url_username' in the ansible.builtin.uri module.

New features

• Introducing the new Ansible Playbook Platform naming.
• Documentation enhancements in Spotter
  • Spotter docs have been thoroughly updated for better clarity and accuracy. Access the Documentation from the dropdown menu in the lower-left corner of the Spotter app.

Improvements

• Now supporting scans against Ansible version 2.16.
• Preferred use of --no-color switch, removed --no-colors.
• CLI option descriptions now appear alongside options in help messages.
• Capitalized --help/-h message and usage message for all commands.
• Added short version -a for --ansible-version.
• Improved help description for --project-id.
• Removed --upload-values and --upload-metadata.
• New global switch --timeout TIMEOUT to set custom HTTP client request timeout in seconds.
• Enhanced console output to display where Spotter failed to apply suggestions.
• Refactored command code with reusable classes for better efficiency.

Fixes

• Fixed the issue W1100 - Transitioning from 'with_items' to 'loop' Warning incorrectly triggered in with_items using lookups.
• Fixed rewriting issues for input containing local_action and the module name in task's name.

---

2023-11-16 Release

• Spotter App version: 3.1.2

Fixes

• A critical bug has been fixed where a registration POST request might time out during the last step of the registration process. This resolution ensures a smoother and more reliable registration experience for all users.

---

2023-11-09 Release

• Spotter App version: 3.1.1

Improvements

• Renamed CLI docs to Documentation in the navigation sidebar for clearer and more direct access.
• Implemented cosmetic fixes to enhance the visual aspects and user experience of the registration flow views.

Fixes

• Fixed an issue where syntax errors occurred when using action/local_action syntax in checks.

---

2023-11-08 Release

• Spotter App version: 3.1.0

New checks

Introducing check results for custom policy errors:

• E2306 - Error originating from a custom OPA policy

• W2307 - Warning originating from a custom OPA policy

• H2308 - Hint originating from a custom OPA policy

New features

• Multi-step registration process
  • Introduced a new multi-step registration method.
• Seamless activation
  • Users automatically logged in when visiting the e-mail activation link, eliminating the need for username and password re-entry.
• Anchor points in catalog view
  • Enabled anchor points in the URL, like #E800, to enhance navigation in the catalog view.

Improvements

• Extended the logic for when expressions to include failed_when and changed_when.
• The CLI docs link in the navigation sidebar now redirects here.
• Added support for redirects, recognizing certain internal collection names that have changed.
• Added support for RHEL 9.2 in on-prem installations.
• Updated the Scraper to the new Galaxy NG API.
• Refactored dev.py's format, lint, and build commands into a reusable class structure.
• Updated dev.py admin subscription [set | update] to include an optional --recurrence RECURRENCE switch and allowed omission of the --end-date switch without errors.

Fixes

• Fixed E001- Unknown module parameter errors related to invalid syntax in vars for tasks or plays.
• Fixed a bug where Spotter ignored NOQA directives for custom checks.

---

2023-10-25 Release

• Spotter App version: 2.3.1

New checks

• E1204 - Tasks with null or empty arguments
  • Introduced error for tasks having null or empty arguments list, advising users to provide at least one argument.

New features

• Support for Almalinux 8.8, 9.1, and 9.2
  • Added support for on-prem installations of Almalinux versions 8.8, 9.1, and 9.2.

Improvements

• Enhanced performance of custom checks by eliminating a pre-check in OPA that slowed down with an increasing number of stored policies.
• Extended dokugen to utilize the 'seealso' type.
• The ./dev.py deployment make-installer command now includes a new switch --knowledge-version to specify the version
• Using the ./dev.py build python-obfuscate command's --expiration-date now assumes an offline pyarmor date check, so no NTP will be used on on-prem installs.

Fixes

• Fixed a hard-coded issue in the built-in library for rpmUtils.

---