v1.8.0 Move DAST scans (OWASP ZAP) out of the bundle to the stack-agnostic Standard Security package so non-Symfony projects can use them

CHANGELOG.md

@@ -1,5 +1,22 @@
 CHANGELOG for 1.x
 ===================
+## v1.8.0 - (2026-09-23)
+### TODO When updating
+The DAST scans (OWASP ZAP) moved to the stack-agnostic Standard Security Gitlab Package
+(see [ADR](adr/20260923-dast-extraction-to-standard-security.md)). `composer recipes:install smartbooster/standard-bundle --reset --force`
+does not remove the files copied by previous versions, so on a project that used them :
+- Install standard-security to keep the `dast-*` targets (see its README), then add `include .standard-security/security.mk` to the project's `Makefile`
+- Delete the files copied by the previous recipe : `git rm make/security.mk dast_scan/build-plan.sh && git rm -r dast_scan/scripts`
+- Keep `dast_scan/targets.json` and `dast_scan/alert-filters.json`, their format is unchanged
+- On a project that did not use the DAST scans, just delete `make/security.mk`, `dast_scan/build-plan.sh` and `dast_scan/scripts/`
+
+### Removed
+- `make/security.mk`, `dast_scan/build-plan.sh`, `dast_scan/scripts/` and `docs/security.md`, now shipped by Standard Security
+- recipe `smartbooster.standard-bundle.1.8.json` : no longer copies `make/security.mk`, `dast_scan/build-plan.sh` and `dast_scan/scripts/`
+
+### Added
+- `adr/20260923-dast-extraction-to-standard-security.md`
+
 ## v1.7.2 - (2026-09-23)
 ### Changed
 - `docs/front_code_validation.md` : label each `eslint.config.mjs`/`prettier.config.mjs` code block with its file name, add the missing

README.md

@@ -7,7 +7,6 @@ Bundle grouping all dev vendor that we use for testing and coding with the SMART
 - All the development vendors that we use daily to check our code quality: 
   - static analysis with [PHPStan](docs/phpstan.md), 
   - security taint analysis with [Psalm](docs/psalm.md), 
-  - blackbox DAST scans of the running app with [OWASP ZAP](docs/security.md), 
   - checkstyle and coding standards with [PHP-CS-Fixer](https://github.com/php-cs-fixer/php-cs-fixer) 
   - native linters (php, twig, yaml, sf container)
   - tests bundle configuration for [PHPUnit](docs/phpunit.md)

adr/20260923-dast-extraction-to-standard-security.md

@@ -0,0 +1,28 @@
+# Extraction of the DAST scans (OWASP ZAP) to `smartbooster/standard-security`
+
+**Goal**: stop shipping the blackbox DAST scans from this bundle, and ship them instead from a package that any project can install,
+whatever its stack.
+
+**Context**: the DAST scans (`make/security.mk`, `dast_scan/build-plan.sh`, `dast_scan/scripts/*.js`, `docs/security.md`) were added in
+v1.6.0 and hardened in v1.7.x. Unlike the rest of the bundle, nothing in them is PHP or Symfony specific: a set of shell/JS scripts and
+config driven by `make` and run in Docker against a URL. Front-only projects (VitePress, VuePress, Astro sites ...) need the same scans but cannot install
+a Symfony bundle, so the files ended up copied by hand into those projects, and already started to drift from the bundle version.
+
+**Selected solution**: move the DAST scans to a dedicated internal package repository on Gitlab,
+a stack-agnostic package installed by copying its `packages/` folder into the project's `.standard-security/` directory at a given git tag,
+with a `standard-security.lock` tracking the installed version and a `make security-fetch` target to update it (same approach as the
+`symfony-docker.lock` / `make docker-fetch` of smartbooster/symfony-docker).
+
+Discarded alternatives:
+- keeping the files in this bundle and copying them by hand into non-Symfony projects: two copies to maintain, which already diverged;
+- one package per stack (composer + npm): the same scripts published twice, for tooling that has no language dependency at all;
+- git submodule / subtree, or a templating tool (copier, cruft): extra tooling or workflow for files that are never customised per project
+  (the project-specific part is data, `dast_scan/targets.json` and `dast_scan/alert-filters.json`, not a templated file).
+
+## Impact
+
+- `make/security.mk`, `dast_scan/build-plan.sh`, `dast_scan/scripts/` and `docs/security.md` removed from the bundle
+- new recipe manifest `smartbooster.standard-bundle.1.8.json`, without the three DAST entries of `copy-from-package`
+- the recipe reset does not remove files copied by a previous version: projects have to delete them by hand and install
+  standard-security to keep the scans (see the v1.8.0 entry of the CHANGELOG)
+- project-owned files (`dast_scan/targets.json`, `dast_scan/alert-filters.json`) keep their format and location