Version 1.1.0

[liquidsec]

1.1.0 release

Tooling: Poetry → uv (#390)

• [tool.poetry] → PEP 621 [project] + [dependency-groups].
• Build backend: poetry-core + poetry-dynamic-versioning → hatchling.
• Static version pinned in badsecrets/__version__.py (mirrors baddns; major/minor bumps trigger PyPI publish).
• CI rewritten to astral-sh/setup-uv@v6 + uv sync / uv run / uv build.
• uv.lock replaces poetry.lock.

HTTP: httpx → blasthttp (#391)

• Replace httpx with blasthttp (Rust-backed async client). httpx and respx are dropped entirely.
• base.py: rename the httpx_response= kwarg to http_response=. Carve now duck-types — works with anything exposing .text / .headers / .cookies. bbot's existing call surface (carve_all_modules(body=, headers=, cookies=, url=, …)) is unchanged.
• probe_all_modules() accepts an optional http_client= so callers (CLI, bbot) can share a client.
• Active modules (shiro_rememberme, ltpa_token, globalprotect) switch to blasthttp.BlastHTTP and accept http_client= for injection.
• All four CLI scripts converted: cli.py, telerik_knownkey.py, blacklist3r.py, symfony_knownkey.py.
• Tests: respx replaced by blasthttp.mock.BlasthttpMock; new tests/conftest.py exposes a bh_mock fixture that auto-patches each CLI script's BlastHTTP import.

Library: surface IdentifyOnly results from cookies and manual product mode (#393)

Closes the long-standing gap where badsecrets -u <laravel-protected-site> printed No secrets found :( even though the cookie was correctly identified — only the APP_KEY wasn't in the wordlist.

• carve() cookies branch: adds an IdentifyOnly fallback gated on validate_carve, mirroring the headers/body branches.
• check_all_modules() (the badsecrets <product> path) returns a list of dicts (each tagged SecretFound or IdentifyOnly), matching carve_all_modules()'s shape.
• carve_all_modules() and check_all_modules() suppress every IdentifyOnly result whenever any SecretFound exists — actionable hits outrank recognition-only candidates.
• Per-module IdentifyOnly dedup inside carve() and per-detecting_module dedup across CLI fetches: one LaravelSignedCookies IdentifyOnly per module per scan, not one per cookie per response.
• Tightened identify_regex on the loose-base64 modules (laravel_signedcookies, ltpa_token, shiro_rememberme, peoplesoft_pstoken, telerik_hashkey, telerik_encryptionkey) to anchor on actual format prefixes and exclude eyJ-prefixed values from the encrypted-base64 patterns.
• cli.py product-mode iterates the new list and dispatches SecretFound vs IdentifyOnly to the appropriate report. URL-mode unchanged.

Cleanup

• Deprecate the blacklist3r CLI tool (deprecate the blacklist3r CLI tool #392, deprecate the blacklist3r CLI tool #394). Capabilities are now covered by the main viewstate modules; standalone tool was dead-weight maintenance burden.
• Test fixes for Python 3.13+ stricter base64.b64decode: test_PBKDF2_crypt and test_PBKDF1_MS_crypt slice URL-encoded fixtures correctly (664f690, b28c38d).
• Various dependabot bumps: cryptography, django, pytest, respx (later removed), pygments, poetry-core.

bbot compatibility

bbot only imports carve_all_modules, which already returned a list. No bbot-side changes required for this release.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 96.49123% with 6 lines in your changes missing coverage. Please review.
✅ Project coverage is 99.70%. Comparing base (6a7aa49) to head (b13587a).

Files with missing lines	Patch %	Lines
badsecrets/examples/telerik_knownkey.py	91.83%	4 Missing ⚠️
badsecrets/__version__.py	0.00%	1 Missing ⚠️
badsecrets/base.py	97.91%	1 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff             @@
##              main     #374      +/-   ##
===========================================
- Coverage   100.00%   99.70%   -0.30%     
===========================================
  Files           30       30              
  Lines         3084     3081       -3     
===========================================
- Hits          3084     3072      -12     
- Misses           0        9       +9     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

0 out of 2 committers have signed the CLA.
❌ @liquidsec
❌ @vortexau
_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}

[liquidsec]

recheck