chore(changelog): v5.35.0 (#12038)

Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com>
2026-07-23 04:21:52 +00:00 · 2026-07-17 12:00:58 +02:00
parent 84c3c9ce0a
commit 1459046985
18 changed files with 54 additions and 14 deletions
@@ -4,6 +4,20 @@ All notable changes to the **Prowler API** are documented in this file.

 <!-- changelog: release notes start -->

+## [1.36.0] (Prowler v5.35.0)
+
+### 🐞 Fixed
+
+- `attack-paths-scan-perform` Celery tasks now use the configurable long-task time limits instead of the six-hour defaults [(#12009)](https://github.com/prowler-cloud/prowler/pull/12009)
+- Attack Paths scans handle provider deletion races cleanly, detect stale tasks after 16 hours, use backend-specific graph synchronization batches, and report exhausted Neptune write retries with the original database error [(#12019)](https://github.com/prowler-cloud/prowler/pull/12019)
+
+### 🔐 Security
+
+- Jira integration credentials only accept bare Atlassian site names containing letters, numbers, and hyphens [(#12012)](https://github.com/prowler-cloud/prowler/pull/12012)
+- Social account linking requires a verified matching email from both the identity provider and the existing user account without sending account connection notifications [(#12013)](https://github.com/prowler-cloud/prowler/pull/12013)
+
+---
+
 ## [1.35.0] (Prowler v5.34.0)

 ### 🐞 Fixed
@@ -1 +0,0 @@
-Attack Paths scans handle provider deletion races cleanly, detect stale tasks after 16 hours, use backend-specific graph synchronization batches, and report exhausted Neptune write retries with the original database error
@@ -1 +0,0 @@
-`attack-paths-scan-perform` Celery tasks now use the configurable long-task time limits instead of the six-hour defaults
@@ -1 +0,0 @@
-Jira integration credentials only accept bare Atlassian site names containing letters, numbers, and hyphens
@@ -1 +0,0 @@
-Social account linking requires a verified matching email from both the identity provider and the existing user account without sending account connection notifications
@@ -4,6 +4,14 @@ All notable changes to the **Prowler MCP Server** are documented in this file.

 <!-- changelog: release notes start -->

+## [0.8.0] (Prowler v5.35.0)
+
+### 🔄 Changed
+
+- Core Prowler tool namespace from the `prowler_app_*` prefix to `prowler_*` [(#12017)](https://github.com/prowler-cloud/prowler/pull/12017)
+
+---
+
 ## [0.7.2] (Prowler v5.28.1)

 ### 🐞 Fixed
@@ -1 +0,0 @@
-Core Prowler tool namespace from the `prowler_app_*` prefix to `prowler_*`
@@ -4,6 +4,18 @@ All notable changes to the **Prowler SDK** are documented in this file.

 <!-- changelog: release notes start -->

+## [5.35.0] (Prowler v5.35.0)
+
+### 🚀 Added
+
+- `excluded_checks` and `excluded_services` in scan configurations to narrow the execution scope [(#12028)](https://github.com/prowler-cloud/prowler/pull/12028)
+
+### 🔐 Security
+
+- Jira tenant information requests validate site names and do not follow redirects [(#12012)](https://github.com/prowler-cloud/prowler/pull/12012)
+
+---
+
 ## [5.34.0] (Prowler v5.34.0)

 ### 🚀 Added
@@ -1 +0,0 @@
-Jira tenant information requests validate site names and do not follow redirects
@@ -1 +0,0 @@
-`excluded_checks` and `excluded_services` in scan configurations to narrow the execution scope
@@ -4,6 +4,26 @@ All notable changes to the **Prowler UI** are documented in this file.

 <!-- changelog: release notes start -->

+## [1.35.0] (Prowler v5.35.0)
+
+### 🔄 Changed
+
+- AWS Organizations onboarding now deploys the management account role and the member-account StackSet from a single CloudFormation stack, replacing the manual StackSet console step [(#11927)](https://github.com/prowler-cloud/prowler/pull/11927)
+- Dynamic providers can now be renamed and deleted from the Providers table [(#11957)](https://github.com/prowler-cloud/prowler/pull/11957)
+- Sidebar navigation with grouped sections, clearer active states, and a responsive mobile overlay [(#11994)](https://github.com/prowler-cloud/prowler/pull/11994)
+- Core Prowler tools in Lighthouse use the `prowler_*` namespace while preserving legacy `prowler_app_*` compatibility [(#12017)](https://github.com/prowler-cloud/prowler/pull/12017)
+
+### 🐞 Fixed
+
+- The AWS S3 integration CloudFormation quick-create link now sets the bucket owner account ID, preventing a stack validation error when S3 integration is enabled [(#11927)](https://github.com/prowler-cloud/prowler/pull/11927)
+- `Scan ID` filter on the Findings page now shows the active scan when opening findings from a scan's `View Findings` action [(#11997)](https://github.com/prowler-cloud/prowler/pull/11997)
+
+### 🔐 Security
+
+- `js-yaml` to 4.3.0, `@sentry/nextjs` to 10.65.0 with `import-in-the-middle` 3.3.1, and transitive `hono`, `dompurify`, `ws`, `vite`, `@babel/core` and `@opentelemetry/core` to patched versions, resolving 13 npm audit advisories (3 high, 9 moderate, 1 low) plus `hono` CVE-2026-59896, published on NVD but not yet in the npm audit feed [(#12029)](https://github.com/prowler-cloud/prowler/pull/12029)
+
+---
+
 ## [1.34.0] (Prowler v5.34.0)

 ### 🚀 Added
@@ -1 +0,0 @@
-AWS Organizations onboarding now deploys the management account role and the member-account StackSet from a single CloudFormation stack, replacing the manual StackSet console step
@@ -1 +0,0 @@
-Dynamic providers can now be renamed and deleted from the Providers table
@@ -1 +0,0 @@
-`Scan ID` filter on the Findings page now shows the active scan when opening findings from a scan's `View Findings` action
@@ -1 +0,0 @@
-Core Prowler tools in Lighthouse use the `prowler_*` namespace while preserving legacy `prowler_app_*` compatibility
@@ -1 +0,0 @@
-The AWS S3 integration CloudFormation quick-create link now sets the bucket owner account ID, preventing a stack validation error when S3 integration is enabled
@@ -1 +0,0 @@
-Sidebar navigation with grouped sections, clearer active states, and a responsive mobile overlay
@@ -1 +0,0 @@
-`js-yaml` to 4.3.0, `@sentry/nextjs` to 10.65.0 with `import-in-the-middle` 3.3.1, and transitive `hono`, `dompurify`, `ws`, `vite`, `@babel/core` and `@opentelemetry/core` to patched versions, resolving 13 npm audit advisories (3 high, 9 moderate, 1 low) plus `hono` CVE-2026-59896, published on NVD but not yet in the npm audit feed
				`@@ -1 +0,0 @@`
				`Attack Paths scans handle provider deletion races cleanly, detect stale tasks after 16 hours, use backend-specific graph synchronization batches, and report exhausted Neptune write retries with the original database error`
				`@@ -1 +0,0 @@`
				`attack-paths-scan-perform` Celery tasks now use the configurable long-task time limits instead of the six-hour defaults
				`@@ -1 +0,0 @@`
				`Jira integration credentials only accept bare Atlassian site names containing letters, numbers, and hyphens`
				`@@ -1 +0,0 @@`
				`Social account linking requires a verified matching email from both the identity provider and the existing user account without sending account connection notifications`
				`@@ -1 +0,0 @@`
				Core Prowler tool namespace from the `prowler_app_` prefix to `prowler_`
				`@@ -1 +0,0 @@`
				`Jira tenant information requests validate site names and do not follow redirects`
				`@@ -1 +0,0 @@`
				`excluded_checks` and `excluded_services` in scan configurations to narrow the execution scope
				`@@ -1 +0,0 @@`
				`AWS Organizations onboarding now deploys the management account role and the member-account StackSet from a single CloudFormation stack, replacing the manual StackSet console step`
				`@@ -1 +0,0 @@`
				`Dynamic providers can now be renamed and deleted from the Providers table`
				`@@ -1 +0,0 @@`
				`Scan ID` filter on the Findings page now shows the active scan when opening findings from a scan's `View Findings` action