diff --git a/rulesets.json b/rulesets.json
index d2c239d..3117fc9 100644
--- a/rulesets.json
+++ b/rulesets.json
@@ -1,5 +1,5 @@
 {
-  "build_datetime": "2026-11-04T01:01:56Z",
+  "build_datetime": "2026-11-04T02:29:48Z",
   "owasp_top_10": {
     "version": "2025",
     "url": "https://owasp.org/Top10/2025/",
@@ -109,32 +109,11 @@
       "name": "CRS Protocol Enforcement",
       "version": "4.30.0",
       "source": "owasp-crs",
-      "description": "OWASP CRS v4.30.0 — CRS Protocol Enforcement (9 rules)",
+      "description": "OWASP CRS v4.30.0 — CRS Protocol Enforcement (8 rules)",
       "author": "OWASP CRS Project",
       "priority": 15,
       "enabled": true,
       "rules": [
-        {
-          "id": "920100",
-          "name": "Invalid HTTP Request Line",
-          "pattern": "(?i)^(?:connect (?:(?:[0-9]{1,3}\\.){3}[0-9]{1,3}\\.?(?::[0-9]+)?|[\\--9A-Z_a-z]+:[0-9]+)|options \\*|[a-z]{3,10}[\\s\\x0b]+(?:[0-9A-Z_a-z]{3,7}?://[\\--9A-Z_a-z]*(?::[0-9]+)?)?/[^#\\?]*(?:\\?[^\\s\\x0b#]*)?(?:#[^\\s\\x0b]*)?)[\\s\\x0b]+[\\.-9A-Z_a-z]+$",
-          "targets": [
-            "uri"
-          ],
-          "action": "block",
-          "score": 5,
-          "severity": "medium",
-          "category": "protocol",
-          "enabled": true,
-          "tags": [
-            "attack-protocol",
-            "paranoia-level/1",
-            "OWASP_CRS",
-            "OWASP_CRS/PROTOCOL-ENFORCEMENT",
-            "capec/1000/210/272"
-          ],
-          "paranoia_level": 1
-        },
         {
           "id": "920120",
           "name": "Attempted multipart/form-data bypass",
@@ -147,6 +126,7 @@
           "severity": "critical",
           "category": "protocol",
           "enabled": true,
+          "negate": true,
           "tags": [
             "attack-protocol",
             "paranoia-level/1",
@@ -727,7 +707,7 @@
       "name": "CRS Remote Code Execution (RCE)",
       "version": "4.30.0",
       "source": "owasp-crs",
-      "description": "OWASP CRS v4.30.0 — CRS Remote Code Execution (RCE) (40 rules)",
+      "description": "OWASP CRS v4.30.0 — CRS Remote Code Execution (RCE) (39 rules)",
       "author": "OWASP CRS Project",
       "priority": 3,
       "enabled": true,
@@ -1028,27 +1008,6 @@
           ],
           "paranoia_level": 1
         },
-        {
-          "id": "932180",
-          "name": "Restricted File Upload Attempt",
-          "pattern": "(?i)(?:\\b|^)(?:\\.(?:a(?:ddressbook|iignore|sh(?:_history|rc))|b(?:ashrc|o(?:to|werrc))|c(?:o(?:ndarc|verage)|(?:redential|v)s|sh(?:_history|rc)|ur(?:lrc|sorignore))|d(?:bshell|igrc|ocker(?:env|ignore))|e(?:ditorconfig|nv(?:rc)?|slint(?:ignore|rc))|f(?:bcindex|ish|orward|tpconfig)|g(?:emrc|it(?:(?:attribut|modul)es|config|ignore|keep)|oogle_authenticator)|h(?:gignore|t(?:access|digest|passwd))|i(?:dea|rb_history)|(?:jshint|offlineimap|yarn)rc|k(?:otlinc_history|sh(?:_history|rc))|l(?:esshst|ftprc|history|ighttpdpassword|ynx_cookies)|m(?:(?:bsync|smtp)rc|ys(?:cmserverinfo|ql_history))|n(?:ano(?:_history|rc)|(?:et|pm)rc|ode_repl_history|s(?:config|r))|p(?:ass(?:wd)?|e(?:arrc|rl(?:(?:_repl_)?history|db))|gpass|(?:hp|sql|ython)_history|inerc|lenv|r(?:ettierrc|o(?:c(?:log|mailrc)|file))|wd)|r(?:ediscli_history|h(?:istory|osts)|sync_exclude|ustup)|s(?:3cfg|creenrc|e(?:crets|lected_editor)|(?:h|ql(?:ite|plus))_history|vnignore)|t(?:csh(?:_history|rc)|erraformrc)|v(?:im(?:info|rc)|scode)|w(?:getrc|ww_?acl)|xauthority|z(?:history|sh(?:_history|env|rc)))|(?:Dockerfil|uptim)e|a(?:cpi|sound)|b(?:lock|ootconfig|uddyinfo)|c(?:(?:group|las|onsole)s|mdline|(?:puinf|rypt)o)|d(?:(?:evice|iskstat)s|(?:ock|riv)er|ynamic_debug)|execdomains|fi(?:(?:lesystem|sh_variable)s|rmware)|hypervisor|i(?:n(?:itial_root_password|terrupts)|o(?:mem|ports)|pmi)|k(?:allsyms|core|e(?:rnel|ys)|msg|page(?:c(?:group|ount)|flags))|l(?:atency_stats|o(?:adavg|cks))|m(?:dstat|eminfo|isc|o(?:dules?|unts)|trr)|p(?:a(?:getypeinfo|rtitions)|ower|ressure)|s(?:c(?:hed(?:_debug|stat)|si)|elf|labinfo|(?:oftirq|wap)s|slvpn_websession|tat|ysvipc)|timer_(?:list|stats)|v(?:ersion(?:_signature)?|m(?:allocinfo|stat))|zoneinfo)(?:[^0-9@-Z_a-z]|$)|\\.(?:a(?:(?:(?:cces|w)s|nydesk|tom|zure)/|ptitude/config)|b(?:ash_|(?:in|luemix)/|un(?:(?:dle)?/|fig\\.toml))|c(?:a(?:che/(?:notify-osd\\.log)?|rgo/)|(?:hocolatey|pan(?:el|plus)?|ups)/|o(?:nfig(?:\\.local\\.php|/)|veralls\\.yml))|d(?:(?:atadog-agent|bus|ocker|rush)/|eployment-secrets\\.txt)|(?:eclipse|i(?:bmcloud|(?:dle|rb)rc|pynb_checkpoints)|java|k(?:(?:aggl|ub)e|eras|onan)|v(?:agrant\\.d|i(?:dalia|m)|mware))/|g(?:(?:e(?:m|t(?:dns|mail))|ftp|n(?:ome(?:2|rc)?|upg)|radle|sutil)/|it(?:-credentials|/|lab-ci\\.yml))|h(?:g/|plip/hplip\\.conf)|l(?:(?:ftp|inode-cli|ocal/(?:bin|lib|s(?:har|tat)e))/|ldb-history)|m(?:(?:2|inikube)/|ongo(?:db/|shrc\\.js)|y(?:(?:login)?\\.cnf|py_cache/))|n(?:(?:ano|cftp|pm(?:-global)?|vm)/|ode-gyp)|o(?:ci/|h-my-|p(?:c/|en(?:ssl\\.cnf|vpn/)))|p(?:assword-store|g(?:_service\\.conf|admin/)|hp(?:_cs\\.dist|cs\\.xml(?:\\.dist)?)|(?:ip|(?:k|ulum)i|m2|ryrc|y(?:env|test_cache))/)|r(?:(?:benv|vm)/|e(?:dhat/|mote-sync\\.json)|ubocop\\.yml)|s(?:(?:(?:dkma|ubversio|v)n|ettings|nap|sh)/|ql\\.(?:(?:00|yz)1|[7bgx]?z|a(?:ce|rj)|cpio|l(?:ha|z)|(?:pe?|uh)a|r(?:0[0-9]|ar|ev)|t(?:a[rz]|[bgx]z))|tubby\\.yml)|t(?:(?:conn|hunderbird|o(?:ols|r))/|erraform(?:\\.(?:d/|lock\\.hcl)|/)|mux\\.conf|ravis\\.ya?ml)|u(?:nbound/|ser(?:\\.ini|min/))|w(?:eb\\.config\\.swp|get-hsts|(?:ine|p-cli)/)|yarnrc\\.yml)|/(?:\\.(?:DS_Store|ws_ftp\\.ini)|@(?:fs|id)/|(?:Web\\.confi|(?:debug|errors?)\\.lo)g|(?:auth|package(?:-lock|s)?)\\.json|composer\\.(?:json|lock)|(?:gruntfile|webpack\\.config)\\.js|npm-(?:debug\\.log|shrinkwrap\\.json)|yarn\\.lock)|(?:BlockCypher|yarn-(?:debug|error))\\.log|Desktop\\.ini|(?:META|WEB)-INF/|Thumbs\\.db|(?:aws(?:-key)?\\.ya?|user_secrets\\.y)ml|b(?:o(?:ot\\.ini|wer\\.json)|uild\\.zig\\.zon)|c(?:argo\\.toml|o(?:(?:mpose\\.ya?|verage\\.x)ml|nfig(?:[\\-_](?:dev|prod|sample|test)\\.(?:asp|ini|json|p(?:hp|[ly])|rb|t(?:oml|xt)|(?:x|ya?)ml)|\\.(?:asp|dev\\.(?:asp|ini|json|p(?:hp|[ly])|rb|t(?:oml|xt)|(?:x|ya?)ml)|fish|gz|in(?:c\\.php|i)|json|nu|p(?:hp|[ly]|rod\\.(?:asp|ini|json|p(?:hp|[ly])|rb|t(?:oml|xt)|(?:x|ya?)ml))|rb|sample\\.(?:asp|in(?:c\\.php|i)|json|p(?:hp|[ly])|rb|t(?:oml|xt)|(?:x|ya?)ml)|t(?:est\\.(?:asp|ini|json|p(?:hp|[ly])|rb|t(?:oml|xt)|(?:x|ya?)ml)|oml|xt)|(?:x|ya?)ml)))|redentials\\.json)|d(?:atabase\\.ya?ml|e(?:b(?:ian\\.cnf|ug\\.log)|fault(?:\\.settings|s\\.inc)\\.php))|env\\.php|ftp-sync\\.json|g(?:itlab(?:\\.rb|_config_)|o\\.(?:mod|sum))|key-users|l(?:dap-authentication-report\\.csv|o(?:cal\\.xm|gin\\.sq)l)|(?:my(?:sql(?:dump)?)?\\.cn|thread-sel)f|p(?:arameters\\.(?:php|yml)|hp(?:\\.ini|_errors?\\.log|cs\\.xml(?:\\.dist)?|info\\.php)|m2\\.log|y(?:project\\.toml|test\\.ini))|r(?:outing\\.yml|sync\\.log)|s(?:e(?:c(?:rets\\.(?:json|ya?ml)|urity\\.yml)|ndgrid\\.env|rvices\\.yml|t(?:tings\\.(?:(?:inc|local)\\.)?php|up\\.py))|ftp\\.json|ys(?:rq-trigger|tem\\.ini))|w(?:eblogic\\.xml|g-clients/|in\\.ini|p-config[\\-\\._])",
-          "targets": [
-            "filename"
-          ],
-          "action": "block",
-          "score": 10,
-          "severity": "critical",
-          "category": "rce",
-          "enabled": true,
-          "tags": [
-            "attack-rce",
-            "paranoia-level/1",
-            "OWASP_CRS",
-            "OWASP_CRS/ATTACK-RCE",
-            "capec/1000/152/248/88"
-          ],
-          "paranoia_level": 1
-        },
         {
           "id": "932370",
           "name": "Remote Command Execution: Windows Command Injection",