Release 3.1.0

.github/dependabot.yml

@@ -2,16 +2,69 @@ version: 2
 updates:
   - package-ecosystem: "uv"
     directory: "/"
+    target-branch: "dev"
     schedule:
       interval: "weekly"
+    groups:
+      uv-minor-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+      uv-major:
+        patterns:
+          - "*"
+        update-types:
+          - "major"
+  - package-ecosystem: "github-actions"
+    directory: "/"
     target-branch: "dev"
-    open-pull-requests-limit: 10
-  - package-ecosystem: github-actions
-    directory: /
+    schedule:
+      interval: "weekly"
     groups:
-      github-actions:
+      github-actions-minor-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+      github-actions-major:
         patterns:
-          - "*"  # Group all Actions updates into a single larger pull request
+          - "*"
+        update-types:
+          - "major"
+  - package-ecosystem: "docker"
+    directory: "/"
+    target-branch: "dev"
     schedule:
-      interval: weekly
-    target-branch: "dev" 
+      interval: "weekly"
+    groups:
+      docker-minor-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+      docker-major:
+        patterns:
+          - "*"
+        update-types:
+          - "major"
+  - package-ecosystem: "pre-commit"
+    directory: "/"
+    target-branch: "dev"
+    schedule:
+      interval: "weekly"
+    groups:
+      pre-commit-minor-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+      pre-commit-major:
+        patterns:
+          - "*"
+        update-types:
+          - "major"

.github/workflows/benchmark.yml

@@ -14,10 +14,11 @@ concurrency:
 permissions:
   contents: read
   pull-requests: write
+  issues: write
 
 jobs:
   benchmark:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
     - uses: actions/checkout@v7
@@ -40,21 +41,24 @@ jobs:
         sudo apt-get update
         sudo apt-get install -y libmagic1
 
-    # Generate benchmark comparison report using our branch-based script
+    # HEAD is the PR merge commit and HEAD^1 its base, so the two runs differ only by
+    # the PR's changes. Both commits are present on fork PRs too, unlike the head branch.
     - name: Generate benchmark comparison report
       env:
-        BASE_REF: ${{ github.base_ref }}
-        HEAD_REF: ${{ github.head_ref }}
+        BASE_LABEL: ${{ github.base_ref }}
+        CURRENT_LABEL: ${{ github.head_ref }}
       run: |
         uv run python bbot/scripts/benchmark_report.py \
-          --base "$BASE_REF" \
-          --current "$HEAD_REF" \
+          --base HEAD^1 \
+          --current HEAD \
+          --base-label "$BASE_LABEL" \
+          --current-label "$CURRENT_LABEL" \
           --output benchmark_report.md \
           --keep-results
-      continue-on-error: true
 
     # Upload benchmark results as artifacts
     - name: Upload benchmark results
+      if: ${{ !cancelled() }}
       uses: actions/upload-artifact@v7
       with:
         name: benchmark-results
@@ -70,7 +74,7 @@ jobs:
     # attempt fails the whole job with a 403. The report is still in the uploaded
     # artifact either way.
     - name: Comment benchmark results on PR
-      if: github.event.pull_request.head.repo.full_name == github.repository
+      if: ${{ !cancelled() && github.event.pull_request.head.repo.full_name == github.repository }}
       uses: actions/github-script@v9
       with:
         script: |

.github/workflows/cla.yml

@@ -6,10 +6,12 @@ on:
     types: [opened, closed, synchronize]
 
 permissions:
+  contents: read
   pull-requests: write
   statuses: write
 
 jobs:
   cla:
-    uses: blacklanternsecurity/CLA/.github/workflows/cla-reusable.yml@main
+    name: check the CLA is signed
+    uses: blacklanternsecurity/CLA/.github/workflows/cla-reusable.yml@4f85d3c525483f0f846ef4384a8ece24a3c74375 # 2026-09-29
     secrets: inherit

.github/workflows/codeql.yml

@@ -21,13 +21,13 @@ on:
 
 jobs:
   analyze:
-    name: Analyze (${{ matrix.language }})
+    name: scan ${{ matrix.language }} for security issues
     # Runner size impacts CodeQL analysis time. To learn more, please see:
     #   - https://gh.io/recommended-hardware-resources-for-running-codeql
     #   - https://gh.io/supported-runners-and-hardware-resources
     #   - https://gh.io/using-larger-runners (GitHub.com only)
     # Consider using larger runners or machines with greater resources for possible analysis time improvements.
-    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
+    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-24.04' }}
     permissions:
       # required for all workflows
       security-events: write

.github/workflows/dependabot-auto-merge.yml

@@ -0,0 +1,12 @@
+name: Dependabot auto-merge
+on: pull_request
+
+permissions: {}
+
+jobs:
+  auto-merge:
+    permissions:
+      contents: write
+      pull-requests: write
+      checks: read
+    uses: blacklanternsecurity/CLA/.github/workflows/dependabot-auto-merge.yml@e532142ee9e7322888f6edc80d9a89e2f8c0d96d # 2026-10-03

.github/workflows/distro_tests.yml

@@ -8,7 +8,7 @@ concurrency:
 
 jobs:
   test-distros:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     container:
       image: ${{ matrix.os }}
     strategy:
@@ -51,7 +51,10 @@ jobs:
           uv python install 3.12
           uv python pin 3.12
           uv sync --group dev
-          uv run pytest --reruns 2 --exitfirst -o timeout_func_only=true --timeout 1200 --disable-warnings --log-cli-level=INFO .
+          uv run pytest -n $(uv run python bbot/test/worker_count.py) --dist loadgroup --reruns 2 --exitfirst -o timeout_func_only=true --timeout 1200 --disable-warnings --log-cli-level=INFO \
+            bbot/test/test_step_1/test_e2e.py \
+            bbot/test/test_step_1/test_depsinstaller.py \
+            bbot/test/test_step_1/test_command.py
       - name: Upload Debug Logs
         if: always()
         uses: actions/upload-artifact@v7

.github/workflows/docs_updater.yml

@@ -7,7 +7,7 @@ on:
 
 jobs:
   update_docs:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v7
         with:

.github/workflows/tests.yml

@@ -12,12 +12,12 @@ concurrency:
 
 jobs:
   test:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     strategy:
       # if one python version fails, let the others finish
       fail-fast: false
       matrix:
-        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
+        python-version: ["3.11", "3.12", "3.13", "3.14", "3.15"]
     steps:
       - uses: actions/checkout@v7
       - name: Set up Python
@@ -51,9 +51,23 @@ jobs:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: ./cov.xml
           verbose: true
+
+  test_matrix:
+    name: test matrix passed
+    if: always()
+    needs: [test]
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Fail unless every dependency succeeded
+        uses: re-actors/alls-green@b5b5b37504aa4183270bd3d855c52a67f212be35 # v1.3.0
+        with:
+          allowed-skips: test
+          jobs: ${{ toJSON(needs) }}
+
   publish_code:
+    name: publish package and docker images
     needs: test
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: github.event_name == 'push' && (github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/stable')
     continue-on-error: true
     steps:
@@ -200,8 +214,9 @@ jobs:
     outputs:
       BBOT_VERSION: ${{ steps.version.outputs.BBOT_VERSION }}
   tag_commit:
+    name: tag the release commit
     needs: publish_code
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: github.event_name == 'push' && (github.ref == 'refs/heads/stable' || github.ref == 'refs/heads/dev')
     steps:
       - uses: actions/checkout@v7
@@ -222,7 +237,7 @@ jobs:
           git push origin "$VERSION"
 
   publish_docs:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: github.event_name == 'push' && (github.ref == 'refs/heads/stable' || github.ref == 'refs/heads/dev')
     steps:
       - uses: actions/checkout@v7

.github/workflows/version_updater.yml

@@ -1,4 +1,4 @@
-name: Version Updater
+name: Tool Version Updater
 on:
   schedule:
     # Runs at 00:00 every day
@@ -7,7 +7,7 @@ on:
 
 jobs:
   update-nuclei-version:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v7
         with:
@@ -59,7 +59,7 @@ jobs:
           author: blsaccess <info@blacklanternsecurity.com>
           assignees: "TheTechromancer"
   update-trufflehog-version:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v7
         with: