[briangreunke]

Summary

Raise the badsecrets and baddns pins in attack-surface-management to the versions bbot 3.0.2 requests. This moves Django from 4.2.30 (CVE-2025-27556, CVE-2026-15307) to 5.2.18, which has no known OSV advisories.

Package	Before	After
badsecrets	~=0.13.47	~=1.2.1
baddns	~=1.12.294	~=2.4.0

Linear: ENG-8929

Changes

• capability.yaml — two pins; version 2.0.3 → 2.0.4
• pyproject.toml — same two pins; version 2.0.3 → 2.0.4
• mcp/bbot.py — same two pins in the PEP 723 header

No other dependency lines change. pyOpenSSL, dnspython, and tldextract are untouched.

Acceptance evidence

Python 3.13, linux/amd64, in capabilities/attack-surface-management:

• uv export --script mcp/bbot.py --python 3.13 --no-hashes → baddns==2.4.1, badsecrets==1.2.1, django==5.2.18
• Sandbox install from capability.yaml dependencies.python → Django 5.2.18; OSV query returns {}
• uv run --python 3.13 --extra dev bbot -t example.com -m badsecrets baddns --no-deps --dry-run -y → Setup succeeded for 14/14 modules., no [ERRR]

Regression evidence

• uv run --python 3.13 --extra dev pytest tests -q → 15 passed
• just validate strict=true → 26 validated: 20 ok, 6 warn, 0 failed. The warnings are missing local binaries (tlsx, alterx, asnmap, uncover, interactsh-client, protoscope).

Notes

• Local pre-commit ruff-format wanted to reformat about 115 lines of mcp/bbot.py. That happens only in a dreadnode-tiger submodule checkout, where ruff uses dreadnode-tiger's pyproject.toml (line-length 120). With this repo's own settings, mcp/bbot.py is already formatted. Those changes were left out.
• Out of scope: the xmltodict conflict (CAP-1201) and the dreadnode-tiger submodule bump.

Base: main@03504f72a00d3305af44884f870730b9430adfd9
Head: 01b30c81d9ea8c4dff9f37d77ef7a6bb0b650048

🤖 Generated with Claude Code

[briangreunke]

Automated agent review — not a human approval.

[REVIEW] — APPROVE

Base: main@03504f72a00d3305af44884f870730b9430adfd9
Head: 01b30c81d9ea8c4dff9f37d77ef7a6bb0b650048

No blocking findings. The diff changes only the pin and version lines that ENG-8929 R1–R4 name.

Independent checks (Python 3.13, linux/amd64):

• uv export --script mcp/bbot.py → baddns 2.4.1, badsecrets 1.2.1, django 5.2.18, bbot 3.0.2
• Sandbox install from capability.yaml → Django 5.2.18; OSV query returns {}
• bbot dry-run → Loaded 3/3 scan modules (baddns,badsecrets,http), Setup succeeded for 14/14 modules., no [ERRR]
• Library smoke test: badsecrets.base.carve_all_modules runs on a sample ViewState body; baddns.base.get_all_modules() returns 11 modules
• pytest tests -q → 15 passed
• just validate strict=true → 20 ok, 6 warn (missing local binaries), 0 failed
• CI on head: all checks pass

[Copilot]

🟢 Approval recommended

The changes are narrow and consistent, with reported dependency resolution, smoke tests, and regression checks supporting compatibility.

No open issues 🎉

What changed in this PR

Updates attack-surface-management dependencies to align with BBOT 3.0.2 and address the reported Django vulnerabilities.

Changes:

• Raises badsecrets and baddns constraints consistently across all three installation paths.
• Bumps the capability and project versions to 2.0.4.

File	Description
capabilities/​attack-surface-management/​pyproject.toml	Updates dependency constraints and project version.
capabilities/​attack-surface-management/​mcp/​bbot.py	Matches inline script dependency constraints.
capabilities/​attack-surface-management/​capability.yaml	Updates sandbox dependencies and capability version.

_{Review effort: Balanced}