[sodle-splunk]

Summary

• verify MISP server certificates by default
• bound run query pagination and reject zero maximum results
• attach malware sample bytes with sanitized file names
• fail tag updates when PyMISP reports in-body errors
• report event lookup failures as action errors
• upgrade PyMISP and remove obsolete packaged dependencies, including setuptools

Tracking

• PAPP-38251
• PSAAS-30844
• PSAAS-32047
• PSAAS-32100
• PSAAS-32305
• PSAAS-32312
• Parent epic: ESPM-5228

Quality gate

• local pre-commit: passed
• hosted pre-commit: passed
• hosted compile: passed
• integration setup: passed; remaining shared-infrastructure checks are non-blocking

Written by Codex.

Release impact

This PR contains a breaking configuration change and must ship as a major release. MISP now verifies server certificates by default; existing assets must trust the server certificate chain or explicitly disable verification. The corresponding functional commit includes a parseable BREAKING CHANGE: trailer for semantic-release.

Merge strategy: merge commit only; do not squash

Release-impact note added by Codex.

[github-actions]

Merging this PR will release 3.0.0 with the following release notes:

3.0.0 (2026-07-29)

Connector release changes

• Verify MISP server certificates by default.
• Bound run query pagination and reject zero maximum results.
• Attach downloaded malware sample bytes with sanitized file names.
• Fail tag updates when PyMISP reports an in-body error.
• Report MISP event lookup failures as action errors.

[sodle-splunk]

Codex breaking-change review: this PR needs to be redone as a breaking/major release before merge.

Reason: it changes verify_server_cert default/fallback from false to true. Under the updated connector release guidance, changing secure transport/config defaults in a way that can make existing assets fail where they previously succeeded is a breaking change. If the secure default is intentional, please preserve it but add major-release treatment: a parseable BREAKING CHANGE: trailer (or equivalent breaking Conventional Commit), release notes that call out the behavior change and migration impact, and any required PR description updates. If this should remain a non-major release, preserve the previous runtime default instead and document the opt-in secure setting.

Commented by Codex.

[splunk-soar-semantic-release]

🎉 This PR is included in version 3.0.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀