[pull] main from zaproxy:main

docker/CHANGELOG.md

@@ -1,6 +1,9 @@
 # Changelog
 All notable changes to the docker containers will be documented in this file.
 
+### 2026-07-06
+- Default to the Client Spider when -j (the modern option) specified.
+
 ### 2026-06-23
 - Added options to select the modern spider.
 

docker/tests/fixtures/baseline_plan_param_ajax_spider.yaml

@@ -0,0 +1,30 @@
+env:
+  contexts:
+  - excludePaths: []
+    name: baseline
+    urls:
+    - https://example.com/
+  parameters:
+    failOnError: true
+    progressToStdout: false
+jobs:
+- parameters:
+    enableTags: false
+    maxAlertsPerRule: 10
+  type: passiveScan-config
+- parameters:
+    maxDuration: 1
+    url: https://example.com/
+  type: spider
+- parameters:
+    maxDuration: 1
+    url: https://example.com/
+  type: spiderAjax
+- parameters:
+    maxDuration: 0
+  type: passiveScan-wait
+- parameters:
+    format: Long
+    summaryFile: {SUMMARY_FILE}
+  rules: []
+  type: outputSummary

docker/tests/fixtures/baseline_plan_param_lc_j.yaml

@@ -19,7 +19,7 @@ jobs:
 - parameters:
     maxDuration: 1
     url: https://example.com/
-  type: spiderAjax
+  type: spiderClient
 - parameters:
     maxDuration: 0
   type: passiveScan-wait

docker/tests/test_zap_baseline_plan.py

@@ -133,6 +133,10 @@ def test_param_j(self):
         args = ["--plan-only", "-t", self.target, "-j"]
         self.assert_plan_matches_fixture(args, "baseline_plan_param_lc_j.yaml")
 
+    def test_param_ajax_spider(self):
+        args = ["--plan-only", "-t", self.target, "-j", "--ajax-spider"]
+        self.assert_plan_matches_fixture(args, "baseline_plan_param_ajax_spider.yaml")
+
     def test_param_s(self):
         args = ["--plan-only", "-t", self.target, "-s"]
         self.assert_plan_matches_fixture(args, "baseline_plan_param_lc_s.yaml")

docker/zap-baseline.py

@@ -104,8 +104,8 @@ def usage():
     print('    --auto            use the automation framework if supported for the given parameters (this is now the default)')
     print('    --autooff         do not use the automation framework even if supported for the given parameters')
     print('    --plan-only       generate an automation framework plan but do not run it')
-    print('    --ajax-spider     use the Ajax spider when -j is specified (default)')
-    print('    --client-spider   use the client spider instead of the Ajax spider when -j is specified')
+    print('    --ajax-spider     use the Ajax spider instead of the Client spider when -j is specified')
+    print('    --client-spider   use the Client spider when -j is specified (default)')
     print('')
     print('For more details see https://www.zaproxy.org/docs/docker/baseline-scan/')
 
@@ -249,7 +249,7 @@ def main(argv):
     zap_alpha = False
     info_unspecified = False
     ajax = False
-    ajax_spider = True
+    ajax_spider = False
     base_dir = ''
     zap_ip = 'localhost'
     zap_options = ''

docker/zap-full-scan.py

@@ -100,8 +100,8 @@ def usage():
     print('    -U user           username to use for authenticated scans - must be defined in the given context file')
     print('    -z zap_options    ZAP command line options e.g. -z "-config aaa=bbb -config ccc=ddd"')
     print('    --hook            path to python file that define your custom hooks')
-    print('    --ajax-spider     use the Ajax spider when -j is specified (default)')
-    print('    --client-spider   use the client spider instead of the Ajax spider when -j is specified')
+    print('    --ajax-spider     use the Ajax spider instead of the Client spider when -j is specified')
+    print('    --client-spider   use the Client spider when -j is specified (default)')
     print('')
     print('For more details see https://www.zaproxy.org/docs/docker/full-scan/')
 
@@ -127,7 +127,7 @@ def main(argv):
     zap_alpha = False
     info_unspecified = False
     ajax = False
-    ajax_spider = True
+    ajax_spider = False
     base_dir = ''
     zap_ip = 'localhost'
     zap_options = ''