## zaproxy/zap-extensions — zest-v48.8.0…zest-v48.9.0

_290+ commits._

### Features
- **Release add-on(s)** (921071c)
- **Release add-on(s)** (7c016e3)
- **ascanrules & ascanrulesBeta: Add notes about behavior of OAST alerts** (b0ac61c)
- **portscan: remove add-on** (d478bdd)
- **dev: Add mock MS auth app** (8994d8a)
- **authhelper: add GUI to manage auth diags** (7b51b9a)
- **ascanrules: Path Traversal add details for dir match Alerts & reduce FPs** (a2d4edd)
- **ascanrules: Add unit tests for some rXSS alert situations** (016220d)
- **authhelper: add MS login handling to BBA** (ff33300)
- **authhelper: BBA to support HTTP auth** (56a34ac)
- **automation: Support active scan URL parameter** (379a844)
- **authhelper: import ctx use defaults for new BBA and CSA properties** (02aaf7b)
- **authhelper: BBA add Step Delay option** (738a420)
- **Release add-on(s)** (d73330a)
- **ascanrules: XPath Injection add Custom Payloads support** (e66ea6a)

### Fixes
- **Merge pull request #6701 from thc202/authhelper/fix-test** (beee973)
- **Fix proxy errors during CSA** (b991ee1)
- **Merge pull request #6651 from kingthorin/llm-review-fix** (5c2d73e)

### Backend
- **Merge pull request #6706 from zapbot/release** (8bf9f74)
- **Merge pull request #6705 from psiinon/client/ext-0.1.6** (a11c553)
- **client: Update to extensions 0.1.6** (e15f36d)
- **Merge pull request #6698 from thc202/authhelper/diags/save-screens** (8368d11)
- **Merge pull request #6652 from ricekot/automation/ascan-tags-policy-simple** (b0dcf6a)
- **authhelper: allow to export diags screenshots** (f4c170a)
- **Merge pull request #6704 from zaproxy/dependabot/npm_and_yarn/addOns/webuipoc/src/main/pocs/reactWebUI/brace-expansion-1.1.12** (0e58441)
- **Merge pull request #6700 from thc202/authhelper/import-rtt** (49bd329)
- **Merge pull request #6684 from thc202/authhelper/diags-af-plan** (217fcbc)
- **Merge pull request #6697 from thc202/authhelper/ctx-af-diags** (4cea401)
- **Merge pull request #6702 from psiinon/client/af-pscan** (73e260f)
- **Merge pull request #6703 from zaproxy/dependabot/github_actions/gha-02740c4fb1** (76263ce)
- **authhelper: read rtt from auth diags** (e1f2e7f)
- **Client: configure pscan rules via passiveScan-config job** (a89d1c9)
- **authhelper: correct test expectations** (82e07ee)
- **authhelper: allow to include AF plan in diags** (1d36ec2)
- **Merge pull request #6699 from zapbot/techs-update** (a6802cc)
- **Tech Detection Update 2025-08-30** (c0dc08a)
- **Merge pull request #6696 from thc202/authhelper/diags-script-headless** (3426486)
- **automation: use context auth method diags** (2f8ea72)
- **authhelper: import CSA script as non-headless** (a2ec5d7)
- **Merge pull request #6695 from zapbot/crowdin-update** (b27f91c)
- **Update localized resources** (d3d4f94)
- **Merge pull request #6694 from zapbot/bump-version** (9181f8b)
- **Prepare next dev iteration(s)** (84275b6)
- **Merge pull request #6693 from zapbot/release** (2b27282)
- **automation: Allow selecting rules via Alert Tags** (22e16af)
- **Merge pull request #6691 from zapbot/bump-version** (d9af8d6)
- **Prepare next dev iteration(s)** (b7ea610)
- **Merge pull request #6690 from zapbot/webdriver-update** (6a83a6a)
- **Webdriver Update** (77bdc51)
- **Merge pull request #6663 from kingthorin/oast-doc-tweaks** (fa2c195)
- **Merge pull request #6682 from kingthorin/ext-redir-patt-compile** (5523e9c)
- **Merge pull request #6689 from thc202/portscan/rm** (3fd18c6)
- **ascanrules: Ext Redirect rule maint** (13eb49d)
- **Merge pull request #6685 from psiinon/auto/stop** (f1f1321)
- **automation: Stop plan option** (104e4f7)
- **Merge pull request #6683 from thc202/bruteforce/replace-regex** (4572c81)
- **bruteforce: address performance issue** (54ce2a9)
- **Merge pull request #6650 from thc202/authhelper/manage-diags** (7ca63a1)
- **Merge pull request #6662 from psiinon/dev/sso-ms** (854a7d9)
- **Merge pull request #6668 from thc202/authhelper/ms-proof-skip** (2dbce26)
- **Merge pull request #6681 from thc202/authhelper/diags-rtt** (b99ea8f)
- **Merge pull request #6680 from psiinon/auto/enable** (0478411)
- **authhelper: include messages' RTT in auth report** (91eeccc)
- **automation: Do not warn if "enabled" property specified** (0c98a7d)
- **authhelper: skip MS login proof** (bd7fa41)
- **Merge pull request #6679 from thc202/csa-proxy-error** (8a7c26f)
- **Merge pull request #6676 from thc202/client/pscan-tree-href** (24b9939)
- **Merge pull request #6674 from thc202/selenium/sm-fx-bin** (4eb1d69)
- **Merge pull request #6678 from zapbot/crowdin-update** (8988832)
- **Update localized resources** (0cb3cd2)
- **Merge pull request #6675 from thc202/authhelper/diags-storage-error** (8f1a661)
- **client: use Sites tree for history references** (fa564b1)
- **authhelper: handle errors in auth diag collection** (67c91d9)
- **selenium: prevent use of no Firefox binary** (c001a13)
- **Merge pull request #6671 from thc202/authhelper/login-priority** (12a02cb)
- **Merge pull request #6673 from zapbot/bump-version** (1f19fbe)
- **Prepare next dev iteration(s)** (05e1218)
- **Merge pull request #6672 from zapbot/webdriver-update** (27c07c4)
- **Webdriver Update** (f796fa6)
- **authhelper: use login URLs for verification** (a5d3357)
- **Merge pull request #6670 from kingthorin/tip-irc** (5049c7d)
- **tips: Replace IRC with Slack** (4ff8635)
- **Merge pull request #6669 from thc202/authhelper/no-evidence** (71e38aa)
- **authhelper: require indicators for poll config** (ba67799)
- **Merge pull request #5824 from kingthorin/pathtrav-details** (d8bc6a1)
- **Merge pull request #6667 from zapbot/crowdin-update** (7bed6b9)
- **Update localized resources** (71786c5)
- **Merge pull request #6638 from kingthorin/rxss-tests** (6982c65)
- **Merge pull request #6664 from thc202/authhelper/bba-ms-login** (bdbcd47)
- **Merge pull request #6646 from kingthorin/td-maint** (de42f37)
- **tech detection: Make load time human readable & maint** (5e7c438)
- **Merge pull request #6660 from zapbot/bump-version** (a0de070)
- **Merge pull request #6665 from zapbot/crowdin-update** (540ff63)
- **Update localized resources** (2fbd643)
- **Merge pull request #6647 from kingthorin/issue-9022** (b096a8d)
- **Merge pull request #6661 from thc202/selenium/update-4.35.0** (720e22d)
- **selenium: update Selenium library** (0c55c3d)
- **Prepare next dev iteration(s)** (75deee8)
- **Merge pull request #6658 from zapbot/webdriver-update** (c409c35)
- **Merge pull request #6659 from zaproxy/dependabot/github_actions/gha-4429cd7018** (6a77554)
- **Webdriver Update** (9835eec)
- **Merge pull request #6656 from kingthorin/llm-infra** (897f71b)
- **Merge pull request #6657 from thc202/reports/af-state** (0f98eee)
- **llm: Minor Refactoring** (21988f5)
- **reports: include AF state in json-plus report** (0fd8f3b)
- **Merge pull request #6655 from thc202/authhelper/more-info** (87e7224)
- **Merge pull request #6641 from psiinon/authhelper/httpauth-3** (49cf3a7)
- **authhelper: record more diags on error** (e89581b)
- **Merge pull request #6654 from thc202/authhelper/record-error** (bd8eec8)
- **Merge pull request #6653 from kingthorin/llm-work** (1e08f21)
- **authhelper: record auth step on error** (7238fbd)
- **pass otherinfo to llm** (72c2ba0)
- **llm: Correct LlmCommunicationService#isPreviouslyReviewed** (e4940e2)
- **Merge pull request #6640 from psiinon/automation/ascan-url** (c26ccf7)
- **Merge pull request #6648 from zapbot/crowdin-update** (2134216)
- **Update localized resources** (0f3c097)
- **Merge pull request #6531 from JohannesLks/Remove-requirement-to-set-a-header-value-for-headerBasedSessionManagement** (8c1132e)
- **authhelper: allow empty header list** (ab8977f)
- **Merge pull request #6643 from zapbot/bump-version** (00275ce)
- **Prepare next dev iteration(s)** (3c3a451)
- **Merge pull request #6642 from zapbot/webdriver-update** (d780c97)
- **Webdriver Update** (4214199)
- **Merge pull request #6628 from psiinon/automation/wraplines** (6a9af37)
- **automation: refer to output panel for errors** (52d71c1)
- **Merge pull request #6635 from psiinon/pscan/del-old-stats** (9a5436c)
- **pscan: Remove the name based stats** (97a1679)
- **Merge pull request #6639 from psiinon/authhelper/minwaitfor** (86a1d8d)
- **authhelper: CSA minWaitFor** (b9314da)
- **Merge pull request #6619 from psiinon/authhelper-stepwait** (9700f72)
- **Merge pull request #6637 from thc202/authhelper/track-auth** (2d1532f)
- **authhelper: track headers during auth** (c9d85e5)
- **Merge pull request #6636 from zapbot/crowdin-update** (417a580)
- **Update localized resources** (98761fa)
- **Merge pull request #6634 from zapbot/bump-version** (ffcfe0e)
- **Prepare next dev iteration(s)** (90d58bf)
- **Merge pull request #6633 from zapbot/webdriver-update** (6dcad75)
- **Webdriver Update** (7c2c43c)
- **Merge pull request #6465 from kingthorin/cp-moar** (a6573c5)
- **Merge pull request #6632 from zapbot/bump-version** (64b7f3a)
- **Prepare next dev iteration(s)** (a275f0e)
- **Merge pull request #6631 from zapbot/release** (19fac11)
- **Merge pull request #6458 from kingthorin/ext-redir-enum** (864d479)
- **ascanrules: Tiddy up ExternalRedirectScanRule** (07531d6)
- **Merge pull request #6629 from psiinon/client/ext-0.1.5** (ce3c805)
- **client: Update to extensions 0.1.5** (ab27dce)
- **Merge pull request #6605 from kingthorin/inj-maint** (3b50c83)
- **ascanrules: SAST (SonarLint) Fixes** (195c211)

### Chore
- **build(deps): bump brace-expansion** (8cede44)
- **build(deps): bump actions/setup-java from 4 to 5 in the gha group** (9a137e0)
- **build(deps): bump the gha group with 2 updates** (55d45a3)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/zaproxy/zap-extensions?utm_source=github-action)._