## projectdiscovery/nuclei — v3.11.0…v3.11.1

_65 commits._

### Features
- **feat(templates): bind js execution to verified content** (9de96e4)
- **add nuclei/http js client (#7568)** (e557207)
- **feat(lib): reuse metadata cache across thread-safe scans** (f239d6e)
- **feat(protocols): add duration fields to other events (#7428)** (679ee5e)
- **Render locators before element lookup** — Element locators are now rendered through the action renderer before being used to find elements on the page, supporting all lookup modes (selector, regex, XPath, JavaScript, and search). This ensures dynamic values in locators are properly processed before lookup and keeps rendered selectors cached to avoid redundant processing. (a1291fa)

### Fixes
- **Merge pull request #7616 from projectdiscovery/dwisiswant0/fix/loader/compile-requests-during-validation** (ba05210)
- **fix(loader): compile requests during validation** (479c818)
- **Merge pull request #7601 from DPS0340/fix/buildrequest-nil-request** (eb1bb88)
- **fix: avoid panic in BuildRequest when request response has no request** (6f5a8ec)
- **fix(openapi): exclusive bound checks** (16e4a7a)
- **fix(index): limit include-tags to matching tag exclusions (#7536)** (6d81cc3)
- **fix: stop busy-spinning hang monitor (#7559)** (be21943)
- **Fix case-insensitive word matcher missing dynamic (rendered) values (#7523)** (f447c23)
- **fix(progress): avoid panic for disabled stats interval (#7557)** (6d7a0fa)
- **Prevent crash on empty request bodies** — Fixed a bug where parsing raw HTTP requests with empty bodies could crash. The code now checks that the body has content before trying to access its last character, preventing an out-of-bounds error. (0888e62)
- **Fix form parameter prefix handling** — Fixed a bug where form parameters with names that shared a common prefix (like 'foo' and 'foobar') were being incorrectly merged together. The fix ensures that only exact parameter name matches are grouped, preserving the original structure of form data with duplicate or similarly-named parameters. (c928dcc)
- **Fix deprecated ECDSA key access** — Updated the signer to build cryptographic key fragments using the standard `PublicKey.Bytes()` method instead of directly accessing deprecated ECDSA coordinate internals. The change maintains backward compatibility by hashing the trimmed X-coordinate bytes the same way as before, and now properly handles and propagates key encoding errors through signing and verification operations. (bcd5807)

### Backend
- **Merge pull request #7641 from projectdiscovery/dev** (a8c88fe)
- **version update** (5bbca25)
- **Merge pull request #7635 from projectdiscovery/dependabot/github_actions/dev/workflows-84c3d95bcf** (64bc83e)
- **Merge pull request #7636 from dwisiswant0/dwisiswant0/feat/templates/bind-javascript-execution-to-verified-content** (37bba07)
- **Merge pull request #7632 from projectdiscovery/chore/bump-kin-openapi** (890147c)
- **rawhttp bump (#7593)** (4c7e168)
- **Improve MSSQL JS fingerprint via TDS prelogin (#7577)** (e6e558d)
- **Improve MySQL JS fingerprint with native handshake parsing (#7575)** (671b875)
- **extend js smb for #4707 (#7565)** (1f39f73)
- **Print config directories in -hc and verbose modes (#7578)** (437897d)
- **Merge pull request #7582 from projectdiscovery/5121-cli-leaktest** (3163621)
- **Merge pull request #7608 from projectdiscovery/dwisiswant0/feat/lib/reuse-metadata-cache-across-thread-safe-scans** (4d4b88f)
- **Merge pull request #7609 from projectdiscovery/dependabot/go_modules/go_modules-715adc688b** (e2e3574)
- **Merge pull request #7586 from projectdiscovery/5440-http-tls-metadata** (250c2a5)
- **serve errors** (06ff996)
- **flake tests** (62d6add)
- **cli: wire -max-time soft termination via goflags (#7589)** (89d4300)
- **typos whitelist** (60f7384)
- **Merge pull request #7587 from projectdiscovery/5651-sdk-result-callback** (6ecdb94)
- **sdk callback** (da2e691)
- **http tlsmeta** (a12f7fb)
- **cli leaktest** (35a87ba)
- **dnssec types (#7564)** (44e6f54)
- **Improving lua script with args and values (#6561)** (2710ba2)
- **Fix crash from negative regex groups** — Added validation to prevent crashes when regex extractors are configured with negative group indices. The system now rejects invalid negative groups during compilation and safely handles edge cases during extraction. (8171606)
- **Add gRPC support for JavaScript** — JavaScript SDK now supports gRPC protocol with full integration testing and method invocation capabilities. This enables JavaScript users to make gRPC calls alongside existing HTTP protocol support. (85723be)

### Tests
- **test(lib): reuse metadata index in BenchmarkExecuteNucleiWithOptsCtx** (6e99015)
- **test(lib): add BenchmarkExecuteNucleiWithOptsCtx** (6b66f91)

### Docs
- **docs: update syntax & JSON schema 🤖** (9d9012c)
- **docs: update syntax & JSON schema 🤖** (dd78cd5)
- **docs: missing CLI flags in README (#7596)** (63bfe19)
- **docs: update syntax & JSON schema 🤖** (bcf2089)
- **docs: update syntax & JSON schema 🤖** (1709267)

### Chore
- **chore(deps): bump the modules group with 3 updates (#7634)** (4a6f7c5)
- **chore(deps): bump actions/stale from 10 to 11 in the workflows group** (89c2054)
- **chore(deps): bump modules with known advisories** (938b19d)
- **chore(js): update memoized functions 🤖** (7936ec3)
- **chore(deps): bump the modules group with 5 updates (#7615)** (367dfdb)
- **chore(js): update memoized functions 🤖** (ad1447b)
- **chore(deps): bump github.com/getkin/kin-openapi** (c6ef995)
- **chore(deps): bump google.golang.org/grpc (#7594)** (7cab28d)
- **refactor: replace Split in loops with more efficient SplitSeq (#7278)** (ce470c3)
- **chore(deps): bump the modules group with 3 updates (#7554)** (4e422a9)
- **chore(deps): bump github.com/go-jose/go-jose/v4 (#7555)** (a360efc)
- **chore(deps): bump crate-ci/typos (#7529)** (435ae4c)
- **Update Go module dependencies** — Updated gRPC library from 1.72.2 to 1.79.3 and go-jose from 4.0.5 to 4.1.3, along with related dependency updates to maintain compatibility. (9c47e6c)
- **Updated five dependency packages** — Bumped versions of fastdialer, retryablehttp-go, httpx, wappalyzergo, and cdncheck to their latest releases, along with updates to several Go standard library modules for improved performance and compatibility. (23e7624)
- **Updated five module dependencies** — Bumped five internal ProjectDiscovery modules to their latest patch versions, including fastdialer, retryablehttp-go, networkpolicy, wappalyzergo, and cdncheck. These are routine maintenance updates to keep dependencies current. (25587f9)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/projectdiscovery/nuclei?utm_source=github-action)._