diff --git a/api/CHANGELOG.md b/api/CHANGELOG.md index 7a7857a6b0..cdcca8dd27 100644 --- a/api/CHANGELOG.md +++ b/api/CHANGELOG.md @@ -4,6 +4,14 @@ All notable changes to the **Prowler API** are documented in this file. +## [1.48.0] (Prowler v5.47.0) + +### 🔐 Security + +- pymongo to 4.18.3, dnspython to 2.9.0 and oauthlib to 4.0.0 in the API container image, with django-allauth from 65.15.0 to 65.19.7 because earlier releases cap oauthlib below 4, patching the BSON decoding and DNS compression pointer denial of service advisories and the OAuth device flow token disclosure [(#13185)](https://github.com/prowler-cloud/prowler/pull/13185) + +--- + ## [1.47.0] (Prowler v5.46.0) ### 🐞 Fixed diff --git a/api/changelog.d/api-image-pymongo-dnspython-oauthlib.security.md b/api/changelog.d/api-image-pymongo-dnspython-oauthlib.security.md deleted file mode 100644 index 7e4dccc834..0000000000 --- a/api/changelog.d/api-image-pymongo-dnspython-oauthlib.security.md +++ /dev/null @@ -1 +0,0 @@ -pymongo to 4.18.3, dnspython to 2.9.0 and oauthlib to 4.0.0 in the API container image, with django-allauth from 65.15.0 to 65.19.7 because earlier releases cap oauthlib below 4, patching the BSON decoding and DNS compression pointer denial of service advisories and the OAuth device flow token disclosure diff --git a/mcp_server/CHANGELOG.md b/mcp_server/CHANGELOG.md index aeb38d3f4a..f78644fbff 100644 --- a/mcp_server/CHANGELOG.md +++ b/mcp_server/CHANGELOG.md @@ -4,6 +4,18 @@ All notable changes to the **Prowler MCP Server** are documented in this file. +## [0.13.0] (Prowler v5.47.0) + +### 🚀 Added + +- `readOnlyHint` and `destructiveHint` annotations on every MCP tool, with mute rule and mutelist writes marked destructive [(#13196)](https://github.com/prowler-cloud/prowler/pull/13196) + +### 🔐 Security + +- Authlib from 1.7.2 to 1.9.1 and dnspython from 2.8.0 to 2.9.0 in the MCP Server container image, patching CVE-2026-96760 (critical), CVE-2026-114615, CVE-2026-114616 and CVE-2026-114605 [(#13186)](https://github.com/prowler-cloud/prowler/pull/13186) + +--- + ## [0.12.4] (Prowler v5.46.0) ### 🔐 Security diff --git a/mcp_server/changelog.d/authlib-dnspython-bump.security.md b/mcp_server/changelog.d/authlib-dnspython-bump.security.md deleted file mode 100644 index f905b67ce0..0000000000 --- a/mcp_server/changelog.d/authlib-dnspython-bump.security.md +++ /dev/null @@ -1 +0,0 @@ -Authlib from 1.7.2 to 1.9.1 and dnspython from 2.8.0 to 2.9.0 in the MCP Server container image, patching CVE-2026-96760 (critical), CVE-2026-114615, CVE-2026-114616 and CVE-2026-114605 diff --git a/mcp_server/changelog.d/tool-annotations.added.md b/mcp_server/changelog.d/tool-annotations.added.md deleted file mode 100644 index 8bad9f0521..0000000000 --- a/mcp_server/changelog.d/tool-annotations.added.md +++ /dev/null @@ -1 +0,0 @@ -`readOnlyHint` and `destructiveHint` annotations on every MCP tool, with mute rule and mutelist writes marked destructive diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index 32b4b89382..5555a40c6e 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -4,6 +4,23 @@ All notable changes to the **Prowler SDK** are documented in this file. +## [5.47.0] (Prowler v5.47.0) + +### 🚀 Added + +- `iam_subscription_owners_between_2_and_3` check for Azure provider, verifying each subscription has between 2 and 3 principals with the Owner role, including owners inherited from management groups, mapped to CIS 5.0 and 6.0 [(#13145)](https://github.com/prowler-cloud/prowler/pull/13145) +- `network_application_gateway_waf_enabled` and `network_application_gateway_http2_enabled` checks for Azure provider, with Application Gateway and WAF policy collection in the network service, mapped to CIS 5.0 and 6.0 [(#13160)](https://github.com/prowler-cloud/prowler/pull/13160) + +### 🐞 Fixed + +- Security group internet exposure checks now treat CIDRs in one ingress rule that together cover 0.0.0.0/0 or ::/0 as open to the internet [(#13191)](https://github.com/prowler-cloud/prowler/pull/13191) + +### 🔐 Security + +- pymongo to 4.18.3, dnspython to 2.9.0 and oauthlib to 4.0.0 in the SDK, patching the BSON decoding and DNS compression pointer denial of service advisories and the OAuth device flow token disclosure; dnspython stays on 2.8.0 for Python 3.10, which 2.9.0 no longer supports [(#13185)](https://github.com/prowler-cloud/prowler/pull/13185) + +--- + ## [5.46.0] (Prowler v5.46.0) ### 🚀 Added diff --git a/prowler/changelog.d/azure-application-gateway-waf-http2.added.md b/prowler/changelog.d/azure-application-gateway-waf-http2.added.md deleted file mode 100644 index 972165d936..0000000000 --- a/prowler/changelog.d/azure-application-gateway-waf-http2.added.md +++ /dev/null @@ -1 +0,0 @@ -`network_application_gateway_waf_enabled` and `network_application_gateway_http2_enabled` checks for Azure provider, with Application Gateway and WAF policy collection in the network service, mapped to CIS 5.0 and 6.0 diff --git a/prowler/changelog.d/azure-iam-subscription-owner-count.added.md b/prowler/changelog.d/azure-iam-subscription-owner-count.added.md deleted file mode 100644 index bf39bb545a..0000000000 --- a/prowler/changelog.d/azure-iam-subscription-owner-count.added.md +++ /dev/null @@ -1 +0,0 @@ -`iam_subscription_owners_between_2_and_3` check for Azure provider, verifying each subscription has between 2 and 3 principals with the Owner role, including owners inherited from management groups, mapped to CIS 5.0 and 6.0 diff --git a/prowler/changelog.d/ec2-sg-split-cidrs-any-address.fixed.md b/prowler/changelog.d/ec2-sg-split-cidrs-any-address.fixed.md deleted file mode 100644 index ee4cc6d9a1..0000000000 --- a/prowler/changelog.d/ec2-sg-split-cidrs-any-address.fixed.md +++ /dev/null @@ -1 +0,0 @@ -Security group internet exposure checks now treat CIDRs in one ingress rule that together cover 0.0.0.0/0 or ::/0 as open to the internet diff --git a/prowler/changelog.d/sdk-image-pymongo-dnspython-oauthlib.security.md b/prowler/changelog.d/sdk-image-pymongo-dnspython-oauthlib.security.md deleted file mode 100644 index 6e73ce0618..0000000000 --- a/prowler/changelog.d/sdk-image-pymongo-dnspython-oauthlib.security.md +++ /dev/null @@ -1 +0,0 @@ -pymongo to 4.18.3, dnspython to 2.9.0 and oauthlib to 4.0.0 in the SDK, patching the BSON decoding and DNS compression pointer denial of service advisories and the OAuth device flow token disclosure; dnspython stays on 2.8.0 for Python 3.10, which 2.9.0 no longer supports diff --git a/ui/CHANGELOG.md b/ui/CHANGELOG.md index b627016689..998403ad70 100644 --- a/ui/CHANGELOG.md +++ b/ui/CHANGELOG.md @@ -4,6 +4,26 @@ All notable changes to the **Prowler UI** are documented in this file. +## [1.47.0] (Prowler v5.47.0) + +### 🚀 Added + +- Icon for the NATO D32 compliance framework on the compliance cards [(#13174)](https://github.com/prowler-cloud/prowler/pull/13174) + +### 🔄 Changed + +- Invitations page uses `Status` instead of `State` in the filter, table column and invitation details, and the Invitations and Roles filters show capitalized options [(#13175)](https://github.com/prowler-cloud/prowler/pull/13175) +- Product tours and the guided onboarding sequence are no longer shown; new tenants still land on the add-provider wizard [(#13176)](https://github.com/prowler-cloud/prowler/pull/13176) +- Add provider wizard connects every provider in one step, saving the account and credentials and testing the connection together, with teammate invitations for every provider and Lighthouse AI help beside the steps [(#13181)](https://github.com/prowler-cloud/prowler/pull/13181) + +### 🐞 Fixed + +- User avatar requesting the current page as an image on every load, which rendered each page twice [(#13177)](https://github.com/prowler-cloud/prowler/pull/13177) +- Lighthouse AI reply blanking out for a frame when the response finishes streaming, which made the whole text blink and reappear [(#13180)](https://github.com/prowler-cloud/prowler/pull/13180) +- Compliance cross-provider tab no longer blanks out when a single catalog page or framework fails to load; it shows the frameworks that loaded with a warning instead [(#13183)](https://github.com/prowler-cloud/prowler/pull/13183) + +--- + ## [1.46.0] (Prowler v5.46.0) ### 🚀 Added diff --git a/ui/changelog.d/avatar-self-request.fixed.md b/ui/changelog.d/avatar-self-request.fixed.md deleted file mode 100644 index c233140cc1..0000000000 --- a/ui/changelog.d/avatar-self-request.fixed.md +++ /dev/null @@ -1 +0,0 @@ -User avatar requesting the current page as an image on every load, which rendered each page twice diff --git a/ui/changelog.d/compliance-partial-catalog.fixed.md b/ui/changelog.d/compliance-partial-catalog.fixed.md deleted file mode 100644 index 3dbbca0c0f..0000000000 --- a/ui/changelog.d/compliance-partial-catalog.fixed.md +++ /dev/null @@ -1 +0,0 @@ -Compliance cross-provider tab no longer blanks out when a single catalog page or framework fails to load; it shows the frameworks that loaded with a warning instead diff --git a/ui/changelog.d/invitations-roles-filter-labels.changed.md b/ui/changelog.d/invitations-roles-filter-labels.changed.md deleted file mode 100644 index 376e4e29a1..0000000000 --- a/ui/changelog.d/invitations-roles-filter-labels.changed.md +++ /dev/null @@ -1 +0,0 @@ -Invitations page uses `Status` instead of `State` in the filter, table column and invitation details, and the Invitations and Roles filters show capitalized options diff --git a/ui/changelog.d/lighthouse-stream-end-flicker.fixed.md b/ui/changelog.d/lighthouse-stream-end-flicker.fixed.md deleted file mode 100644 index 008c589084..0000000000 --- a/ui/changelog.d/lighthouse-stream-end-flicker.fixed.md +++ /dev/null @@ -1 +0,0 @@ -Lighthouse AI reply blanking out for a frame when the response finishes streaming, which made the whole text blink and reappear diff --git a/ui/changelog.d/nato-d32-compliance-icon.added.md b/ui/changelog.d/nato-d32-compliance-icon.added.md deleted file mode 100644 index 9838e54ff5..0000000000 --- a/ui/changelog.d/nato-d32-compliance-icon.added.md +++ /dev/null @@ -1 +0,0 @@ -Icon for the NATO D32 compliance framework on the compliance cards diff --git a/ui/changelog.d/provider-wizard-one-step.changed.md b/ui/changelog.d/provider-wizard-one-step.changed.md deleted file mode 100644 index 85acf6ff63..0000000000 --- a/ui/changelog.d/provider-wizard-one-step.changed.md +++ /dev/null @@ -1 +0,0 @@ -Add provider wizard connects every provider in one step, saving the account and credentials and testing the connection together, with teammate invitations for every provider and Lighthouse AI help beside the steps diff --git a/ui/changelog.d/remove-onboarding.changed.md b/ui/changelog.d/remove-onboarding.changed.md deleted file mode 100644 index 6933a0354d..0000000000 --- a/ui/changelog.d/remove-onboarding.changed.md +++ /dev/null @@ -1 +0,0 @@ -Product tours and the guided onboarding sequence are no longer shown; new tenants still land on the add-provider wizard