OWASP Juice Shop Files

This release contains an important policy or licensing change (📜) that might impact your interaction with the project as a user or contributor. This release furthermore contains breaking changes or renamings (⚠️) which might require updating existing customization files.

🎯 Challenges

• [#2964]: Added Password Hash Leak ⭐⭐-challenge (kudos to @tghosth)
• 6db9f294d7548728580991edc70d49a5a8ebe0d6: Added coding challenge for Wallet Depletion challenge
• c3defc748beeaee890a75ef54624f1fb45a5f92e: Added coding challenge for Mint the Honeypot challenge

🎨 User Interface

• Various usability enhancements for Coding Challenges
• [#2875]: Added Jump to related coding challenge button to challenge-solved notifications (kudos to @sawankshrma)
• 3d19b63beab36c7d66d77a63b1d45222919d9814: Make enabled coding challenge button visually distinct on Score Board
• 7ce1352984fb8ac75d3713065df2382ab6ddad8f: Locked/unlocked icons of Find It and Fit It phase of Coding Challenges are now handled seperately
• 3ae7dce07bb58f38649499ecae7fb145cbe34d94: Opening a Coding Challenge now scrolls to Fix It tab if Find It was already solved
• [#2876]: Payloads in challenge descriptions on the Score Board can now be copied to clipboard by clicking on them (kudos to @abhay-codes07)
• [#2932]: Immediately refresh the hint tooltip when unlocking a new hint (kudos to @sawankshrma)
• [#2982]: Language dropdown list now includes backend strings in its translation gauge and percentage (kudos to @rajeshuchil)
• [#3077]: Add support for displaying ctf system wide notifications from MultiJuicer and other CTF Systems via a configurable endpoint

🎭 Customization

• Removed option challenges.showFeedbackButtons from all configurations (⚠️)

📋 SBOM

• [#2859]: Updated to CycloneDX 1.6 SBOMs (kudos to @jkowalleck)
• [#3084]: Only generate JSON SBOMs, no more XML SBOMs

🏦 Technical Debt

• Fixed accidental deviations of coding challenge snippets after refactorings
• [#2872]: Extracted all inline CSS style into class declarations (kudos to @agrim-rai)
• Various accessibility enhancements (kudos to @bogminic, @caffeine-rohit, @this-is-varunxyz, @agrim-rai, @JwCwn et al.)
• Various code refactorings and added test cases (kudos to @rajeshuchil, @HishamHR5, @ishwarthecodddr et al.)
• [#3084]: Migrated to newer Angular Application Build Infrastructure using esbuild instead of webpack

🐳 Docker

• Official Docker image now uses Node.js 24.x base images

🐛 Bugfixes

• Fixed visual glitch of search field in navigation bar (kudos to @abhay-codes07)

🤝 Code of Conduct

• Replaced Contributor Covenant 2.0-based CODE_OF_CONDUCT.md with a custom version based on and referring to the OWASP Code of Conduct (📜)