Back to milestones

4.0.0

Open

No due date

•Last updated Nov 9, 2026

Blockers for the 4.0.0 release. Checklist and release steps: #979.

69% complete

[EPIC] Convert challenge/lesson servlets to try-with-resources (connection-leak cleanup)
OWASP/SecurityShepherd#857 · opened on May 29, 2026 · 4.0.0
3
4.0.0 release checklist
OWASP/SecurityShepherd#979 · opened on Oct 24, 2026 · 4.0.0
1
[BUG] New Password Logged in Admin Password Reset Flow
OWASP/SecurityShepherd#571 · opened on Feb 1, 2021 · 4.0.0
fix: stop logging plaintext new password in admin password reset
Unread
#918 opened Sep 2, 2026 · Updated Nov 9, 2026
2
Timezone bug: suspended user can authenticate on non-UTC JVM deployments
OWASP/SecurityShepherd#841 · opened on May 11, 2026 · 4.0.0
Default TZ to UTC instead of Europe/Dublin
OWASP/SecurityShepherd#970 · opened on Oct 24, 2026 · 4.0.0
jtidy r938 in FindXSS is affected by CVE-2023-34623 (stack overflow on nested input); no drop-in replacement
OWASP/SecurityShepherd#960 · opened on Oct 24, 2026 · 4.0.0
1
Upgrade vendored jQuery 1.7.1 / jQuery UI 1.8 + 1.11 and other front-end libraries
OWASP/SecurityShepherd#957 · opened on Oct 24, 2026 · 4.0.0
Upgrade MongoDB server 4.1.13 → 8.0 and Java driver 3.12 → 5.x
OWASP/SecurityShepherd#958 · opened on Oct 24, 2026 · 4.0.0
Modernize MongoDatabase off legacy com.mongodb.DB API + Testcontainers; rescue disabled MongoDatabaseIT tests
OWASP/SecurityShepherd#876 · opened on Jun 4, 2026 · 4.0.0
1
it-test profile tags its Mongo build as mongo:${MONGODB_VERSION}, breaking the next local IT run
OWASP/SecurityShepherd#938 · opened on Oct 22, 2026 · 4.0.0
1
[BUG] SQL Injection Challenges 1,2,3,4 and 5 Stop Working After Several Queries
Bug
OWASP/SecurityShepherd#931 · opened on Oct 8, 2026 · 4.0.0
fix: JDBC Resource Leaks in SQL Injection Challenges
Unread
#932 opened Oct 9, 2026 · Updated Nov 1, 2026
3
[BUG] XXE levels don't create solution file when opened
OWASP/SecurityShepherd#654 · opened on May 26, 2022 · 4.0.0
1
Validate.validateLanguage rejects every two-letter language code, so module i18n always falls back to en_GB
OWASP/SecurityShepherd#937 · opened on Oct 22, 2026 · 4.0.0
feat(mobile): add unified Security Shepherd Android app
Unread
#894 opened Jun 12, 2026 · Updated Nov 9, 2026
3
Remove old mobile content + Replace with new unified app
Feature
OWASP/SecurityShepherd#829 · opened on Mar 31, 2026 · 4.0.0
Add Mobile Lessons / Challenges to platform
Feature
OWASP/SecurityShepherd#830 · opened on Apr 1, 2026 · 4.0.0
Mobile - Update JSP pages for all mobile lessons and challenges
Task
OWASP/SecurityShepherd#895 · opened on Jun 12, 2026 · 4.0.0
Mobile - Test mobile Lessons + Challenges
Task
OWASP/SecurityShepherd#896 · opened on Jun 12, 2026 · 4.0.0
Test New Mobile Reverse Engineering Lessons/Challenges
Feature
OWASP/SecurityShepherd#922 · opened on Sep 20, 2026 · 4.0.0
Test New Mobile Poor Authentication Lessons/Challenges
Feature
OWASP/SecurityShepherd#923 · opened on Sep 20, 2026 · 4.0.0
Test New Mobile Insecure Authorization Levels
Feature
OWASP/SecurityShepherd#924 · opened on Sep 20, 2026 · 4.0.0
Test New Supply Chain Security Levels
Feature
OWASP/SecurityShepherd#925 · opened on Sep 20, 2026 · 4.0.0
Test New Mobile Insecure Communication Levels
Feature
OWASP/SecurityShepherd#926 · opened on Sep 20, 2026 · 4.0.0