* Introduce jadx decompilation timeout with env var
- exception for timeout
- replace subprocess.call for run


Co-authored-by: Ajin Abraham <ajin25@gmail.com>

Co-authored-by: Ajin Abraham <ajin25@gmail.com>

* Update quark-engine from 22.2.1 to 22.3.1

* update lief

Co-authored-by: Ajin Abraham <ajin25@gmail.com>

Co-authored-by: Ajin Abraham <ajin25@gmail.com>

* update jadx to 1.3.4
* update lief
* update jadx and requirements

* Update ip2location from 8.7.3 to 8.7.4

* Update quark-engine from 22.4.1 to 22.5.1

* Update frida from 15.1.17 to 15.1.23

* Update tldextract from 3.2.1 to 3.3.0

* Check the GitHub releases page for latest version number

* Update utils.py

Only log distro if not empty (or spaces)

Co-authored-by: Ajin Abraham <ajin25@gmail.com>

* Update cert_analysis.py

Flag on MD5 hash algorithm in signer certificate

* Update cert_analysis.py

Co-authored-by: Ajin Abraham <ajin25@gmail.com>

Co-authored-by: Ajin Abraham <ajin25@gmail.com>

* Allow iOS IPA download

* Code QA

…ents to manifest analysis (MobSF#1905)

* Add the checking of the parent element of the permission-related elements to manifest analysis

Co-authored-by: Ajin Abraham <ajin25@gmail.com>

…ted elements to manifest analysis (MobSF#1905)" (MobSF#1984)

HOTFIX: Revert MobSF#1905

* Update ip2location from 8.7.4 to 8.8.0

* Update frida from 15.1.24 to 15.1.27

* Update frida from 15.1.27 to 15.1.28

* Update tldextract from 3.3.0 to 3.3.1

add Badge App

…uces false positives in iOS. (MobSF#2023)

Co-authored-by: Toor <toor@DES-macOS-pentest.local>
Co-authored-by: Ajin Abraham <ajin25@gmail.com>

* Save only unique intent priorities in findings

* Save only unique intent priorities in findings

* Save only unique intent priorities in findings

* Save only unique intent priorities in findings

---------

Co-authored-by: Dmitry Maryushkin <dmmaryushkin@ozon.ru>
Co-authored-by: Ajin Abraham <ajin25@gmail.com>

* Add files list in scorecard desc
* fix lint

---------

Co-authored-by: Dmitry Maryushkin <dmmaryushkin@ozon.ru>
Co-authored-by: Ajin Abraham <ajin25@gmail.com>

* Fix for missing 'packaging.metadata module

Changed the packaging version to 24.2

Co-authored-by: ByteSnipers GmbH <55362478+ByteSnipers@users.noreply.github.com>

* Fix false positives caused in Android manifest analysis
* Dep bumps + Support HTTPS upgrade for Assetlinks check
* MobSF version bump to 4.3.0

---------

Co-authored-by: Nick Lupien <github@worg.io>

…e Technologies researchers (MobSF#2488)

* Fix Stored XSS in iOS Dynamic Analysis, GHSA-cxqq-w3x5-7ph3
* Fix DOS by loose re_path check and strict check inside function, GHSA-jrm8-xgf3-fwqr
* Fix API Key leakage, replace REST API with authenticated endpoint, GHSA-79f6-p65j-3m2m
* Update SECURITY.md

* add SSO groups mapping

* typo corrected

---------

Co-authored-by: Khabarov Konstantin Olegovich <kkhabarov@ozon.ru>
Co-authored-by: Ajin Abraham <ajin25@gmail.com>

* Dependency bump
* Strict firebaseio domain check
* Fix frida server download proxy SSL verify config
* Fix CI build on mac

…MobSF#2510)

* Improved SSRF checks (credential checks, length check, port check, path, query, and params check, ipv6, ipv4 coverage, handle possible decimal or hex IP bypasses)
* Add additional strict path check for Applink well known path
* Moved `valid_host` to `security.py`
* Update `security.md`
* Bump dependencies
* Fix docker build

Fixed an issue where the average CVSS score calculation was incorrect due to improper access to the findings key within the JSON structure. The calculation logic was bypassing the findings key and therefore failing to extract valid CVSS scores.

Co-authored-by: Ajin Abraham <ajin25@gmail.com>

* Fix GHSA-mwfg-948f-2cc5

* stricter email case validation

* Fix GHSA-c5vg-26p8-q8cr

* Bump deps

* Lint QA

* Breaking change: Frida 17+ support and script updates
* Breaking change: Corellium iOS device must install frida >=17
* Updated Frida scripts for logging, ssl/cert pinning bypass
* Added bridges support to frida
* Poetry dependency updates
* Fix Frida Code Editor code alignment issues
* Fix Google Play Scrapper timeout issues behind proxy
* Apply MobSF proxy settings to standalone tools_download.py

…obSF#2533)

* fix(ios_analyzer): Correctly resolve executable path in .app bundles

The previous method for locating the executable within an IPA file was failing for apps with spaces in their `.app` bundle name. The logic incorrectly performed a string replacement on the full path of the bundle, resulting in an invalid path to the binary.

This commit refactors the path resolution logic to use `pathlib` features correctly. It now finds the `.app` directory as a `Path` object and uses the `.stem` attribute to reliably determine the executable's name. This approach is more robust, properly handles spaces and special characters in filenames, and avoids fragile string manipulation.

* Add doc string back

* Update mobsf/StaticAnalyzer/views/ios/binary_analysis.py

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Ajin Abraham <ajin25@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Bump dependencies
Fix Security Vulnerabilities reported by @noname1337h1
GHSA-9gh8-9r95-3fc3
GHSA-ccc3-fvfx-mw3v