This release adds a beta GraphQL API endpoint, stops storing re-test data for Low and Information issues to reduce database growth, and fixes a number of bugs.
Try beta GraphQL API features
You can now use beta features of the GraphQL API by sending requests to your-web-server-url/graphql/beta. This endpoint accepts the same API keys and serves everything in /graphql/v1, plus beta features. Beta features may change or be removed in any release, without a deprecation period.
The /graphql/v1 endpoint now serves only the public schema. Requests that use fields not in the GraphQL API documentation, or fields marked Beta, now fail on /graphql/v1 with a validation error. Send requests that use beta fields to /graphql/beta.
The GraphQL API documentation now has its own page for each query, as well as each mutation, most with worked examples. It marks beta features with a Beta badge.
For more information, see Getting started with the GraphQL API.
Smaller databases
Burp Suite DAST no longer stores re-test data for Low and Information issues. After you upgrade, it gradually removes the re-test data it has already stored for these issues in the background.
As a result, you can re-test only issues whose current severity is Medium or High. For Low and Information issues, the Re-test issue button is disabled.
For more information, see Re-testing issues.
Other improvements
We made the following improvements:
- Simpler ticket text. Tickets that Burp Suite DAST raises no longer repeat the scan reference and site name everywhere. The description now starts with "Latest scan: Ref #N", the latest scan that found the issue. Jira remote links, Trello attachments and GitLab note headings now use just the issue title.
- Faster crawling of pages with large forms. Crawling pages with large forms or many links is faster. Links inside a form no longer carry copies of the form's fields, which also speeds up the audit, because it waits for the crawl.
Bug fixes
We fixed the following bugs:
- The hourly database clean-up no longer fails when a large number of unused schedule items has built up. Previously, the failure also stopped the clean-up steps that came after it.
- Scans no longer fail with "Unable to verify successful log in" when a recorded login uses an authentication status check on a site that keeps its login in the browser's session storage.
- Scans that run BChecks no longer fail intermittently with an error while setting up passive checks.