From 226504982b1d1fb9887f00f2773aafc9adf2a2a8 Mon Sep 17 00:00:00 2001 From: Prowler Bot Date: Thu, 6 Aug 2026 13:25:12 +0200 Subject: [PATCH] chore(changelog): v5.38.0 (#12373) Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com> --- api/CHANGELOG.md | 25 ++++++++++++ .../api-aiohttp-cve-2026-69244.security.md | 1 - .../api-cryptography-50.security.md | 1 - .../api-restore-sdk-master-pin.fixed.md | 1 - .../api-sbom-attestations.added.md | 1 - api/changelog.d/api-trivy-0720-pin.changed.md | 1 - ...api-verify-downloaded-binaries.security.md | 1 - .../attack-paths-query-outcome.added.md | 1 - ...ding-attack-paths-service-queries.added.md | 1 - .../report-output-dir-error-grouping.fixed.md | 1 - mcp_server/CHANGELOG.md | 19 +++++++++ .../changelog.d/integrations-tests.added.md | 1 - .../jira-dispatch-safe-to-retry.changed.md | 1 - ...st-integrations-sparse-fieldset.changed.md | 1 - .../mcp-cryptography-50.security.md | 1 - .../mcp-sbom-attestations.added.md | 1 - .../changelog.d/mcp-test-foundation.added.md | 1 - prowler/CHANGELOG.md | 40 +++++++++++++++++++ .../aiohttp-cve-2026-69244.security.md | 1 - ...ibabacloud-sts-connection-retries.fixed.md | 1 - .../changelog.d/cryptography-50.security.md | 1 - .../delegated-admin-unknown-manual.changed.md | 1 - .../changelog.d/dozerdb-5-26-27.security.md | 1 - .../guardduty-delegated-admin-lookup.fixed.md | 1 - .../kingfisher-jdbc-false-positive.fixed.md | 1 - ...5-application-access-policy-noise.fixed.md | 1 - .../m365-cis7-admincenter.added.md | 1 - .../changelog.d/m365-cis7-defender.added.md | 1 - ...65-cis7-entra-device-registration.added.md | 1 - .../changelog.d/m365-cis7-exchange.added.md | 1 - prowler/changelog.d/m365-cis7-teams.added.md | 1 - .../m365-risk-field-formatting.changed.md | 1 - ...-dynamic-group-null-matching-rule.fixed.md | 1 - .../pathfinding-privesc-combos.added.md | 1 - .../changelog.d/sbom-attestations.added.md | 1 - ...curityhub-admin-lookup-per-region.fixed.md | 1 - ...ecurityhub-delegated-admin-fields.fixed.md | 1 - .../shellcheck-workflow-quoting.changed.md | 1 - .../shellcheck-workflows-complete.changed.md | 1 - prowler/changelog.d/trivy-0720-pin.changed.md | 1 - .../trivyignore-yaml-migration.changed.md | 1 - .../verify-downloaded-binaries.security.md | 1 - ui/CHANGELOG.md | 31 ++++++++++++++ .../compliance-task-response.fixed.md | 1 - ui/changelog.d/compliance-watchlist.added.md | 1 - .../display-imported-scans.fixed.md | 1 - .../feedback-widget-overlap.fixed.md | 1 - ...cp-organization-credential-labels.fixed.md | 1 - .../organization-bulk-scan.fixed.md | 1 - .../overview-metric-breakpoint.fixed.md | 1 - ui/changelog.d/overview-metric-row.fixed.md | 1 - .../overview-threatscore-layout.fixed.md | 1 - ...der-wizard-step-aware-docs-link.changed.md | 1 - ui/changelog.d/saml-multiple-domains.added.md | 1 - .../table-page-size-selector.fixed.md | 1 - .../ui-reproducible-base.security.md | 1 - ui/changelog.d/ui-sbom-attestations.added.md | 1 - .../user-sign-in-method-indicators.added.md | 1 - 58 files changed, 115 insertions(+), 54 deletions(-) delete mode 100644 api/changelog.d/api-aiohttp-cve-2026-69244.security.md delete mode 100644 api/changelog.d/api-cryptography-50.security.md delete mode 100644 api/changelog.d/api-restore-sdk-master-pin.fixed.md delete mode 100644 api/changelog.d/api-sbom-attestations.added.md delete mode 100644 api/changelog.d/api-trivy-0720-pin.changed.md delete mode 100644 api/changelog.d/api-verify-downloaded-binaries.security.md delete mode 100644 api/changelog.d/attack-paths-query-outcome.added.md delete mode 100644 api/changelog.d/pathfinding-attack-paths-service-queries.added.md delete mode 100644 api/changelog.d/report-output-dir-error-grouping.fixed.md delete mode 100644 mcp_server/changelog.d/integrations-tests.added.md delete mode 100644 mcp_server/changelog.d/jira-dispatch-safe-to-retry.changed.md delete mode 100644 mcp_server/changelog.d/list-integrations-sparse-fieldset.changed.md delete mode 100644 mcp_server/changelog.d/mcp-cryptography-50.security.md delete mode 100644 mcp_server/changelog.d/mcp-sbom-attestations.added.md delete mode 100644 mcp_server/changelog.d/mcp-test-foundation.added.md delete mode 100644 prowler/changelog.d/aiohttp-cve-2026-69244.security.md delete mode 100644 prowler/changelog.d/alibabacloud-sts-connection-retries.fixed.md delete mode 100644 prowler/changelog.d/cryptography-50.security.md delete mode 100644 prowler/changelog.d/delegated-admin-unknown-manual.changed.md delete mode 100644 prowler/changelog.d/dozerdb-5-26-27.security.md delete mode 100644 prowler/changelog.d/guardduty-delegated-admin-lookup.fixed.md delete mode 100644 prowler/changelog.d/kingfisher-jdbc-false-positive.fixed.md delete mode 100644 prowler/changelog.d/m365-application-access-policy-noise.fixed.md delete mode 100644 prowler/changelog.d/m365-cis7-admincenter.added.md delete mode 100644 prowler/changelog.d/m365-cis7-defender.added.md delete mode 100644 prowler/changelog.d/m365-cis7-entra-device-registration.added.md delete mode 100644 prowler/changelog.d/m365-cis7-exchange.added.md delete mode 100644 prowler/changelog.d/m365-cis7-teams.added.md delete mode 100644 prowler/changelog.d/m365-risk-field-formatting.changed.md delete mode 100644 prowler/changelog.d/oci-dynamic-group-null-matching-rule.fixed.md delete mode 100644 prowler/changelog.d/pathfinding-privesc-combos.added.md delete mode 100644 prowler/changelog.d/sbom-attestations.added.md delete mode 100644 prowler/changelog.d/securityhub-admin-lookup-per-region.fixed.md delete mode 100644 prowler/changelog.d/securityhub-delegated-admin-fields.fixed.md delete mode 100644 prowler/changelog.d/shellcheck-workflow-quoting.changed.md delete mode 100644 prowler/changelog.d/shellcheck-workflows-complete.changed.md delete mode 100644 prowler/changelog.d/trivy-0720-pin.changed.md delete mode 100644 prowler/changelog.d/trivyignore-yaml-migration.changed.md delete mode 100644 prowler/changelog.d/verify-downloaded-binaries.security.md delete mode 100644 ui/changelog.d/compliance-task-response.fixed.md delete mode 100644 ui/changelog.d/compliance-watchlist.added.md delete mode 100644 ui/changelog.d/display-imported-scans.fixed.md delete mode 100644 ui/changelog.d/feedback-widget-overlap.fixed.md delete mode 100644 ui/changelog.d/gcp-organization-credential-labels.fixed.md delete mode 100644 ui/changelog.d/organization-bulk-scan.fixed.md delete mode 100644 ui/changelog.d/overview-metric-breakpoint.fixed.md delete mode 100644 ui/changelog.d/overview-metric-row.fixed.md delete mode 100644 ui/changelog.d/overview-threatscore-layout.fixed.md delete mode 100644 ui/changelog.d/provider-wizard-step-aware-docs-link.changed.md delete mode 100644 ui/changelog.d/saml-multiple-domains.added.md delete mode 100644 ui/changelog.d/table-page-size-selector.fixed.md delete mode 100644 ui/changelog.d/ui-reproducible-base.security.md delete mode 100644 ui/changelog.d/ui-sbom-attestations.added.md delete mode 100644 ui/changelog.d/user-sign-in-method-indicators.added.md diff --git a/api/CHANGELOG.md b/api/CHANGELOG.md index 3fb567e6a0..b119fbaafc 100644 --- a/api/CHANGELOG.md +++ b/api/CHANGELOG.md @@ -4,6 +4,31 @@ All notable changes to the **Prowler API** are documented in this file. +## [1.39.0] (Prowler v5.38.0) + +### 🚀 Added + +- Attack Paths adds 20 AWS privilege-escalation detection queries from pathfinding.cloud, covering service PassRole escalations (Batch, Braket, Cognito Identity, ECS, EMR, EMR Serverless, GameLift, Glue, EC2 Image Builder, Kinesis Analytics, HealthOmics, EventBridge Scheduler, SSM, Step Functions), CodeDeploy and Step Functions existing-resource abuse, role permissions-boundary removal with role assumption, and IAM Identity Center permission-set policy injection [(#12237)](https://github.com/prowler-cloud/prowler/pull/12237) +- Attack Paths query metadata now carries an outcome (Code execution, Privilege escalation, Public exposure, or Resource inventory), exposed on the queries endpoint so the graph can show a terminal outcome node [(#12344)](https://github.com/prowler-cloud/prowler/pull/12344) +- Container images now ship an SBOM and build provenance as OCI attestations [(#12352)](https://github.com/prowler-cloud/prowler/pull/12352) + +### 🔄 Changed + +- Pin the container vulnerability scanner to Trivy v0.72.0, matching prowler-registry and partner-portal [(#12346)](https://github.com/prowler-cloud/prowler/pull/12346) + +### 🐞 Fixed + +- Compliance report output directory failures are now logged with the exception attached and fingerprinted by `errno` in Sentry, so `ENOSPC`, `ENOENT` and `EACCES` no longer share a single issue [(#12142)](https://github.com/prowler-cloud/prowler/pull/12142) +- Restored the SDK dependency to `@master` now that the dependency bumps have landed there, and regenerated the lock. The API image no longer builds against a temporary integration branch [(#12309)](https://github.com/prowler-cloud/prowler/pull/12309) + +### 🔐 Security + +- The API container image now verifies the checksum of every third-party binary it downloads (PowerShell, Trivy, zizmor) before installing it [(#12334)](https://github.com/prowler-cloud/prowler/pull/12334) +- Upgrade aiohttp to 3.14.3 to pick up the fix for CVE-2026-69244 [(#12340)](https://github.com/prowler-cloud/prowler/pull/12340) +- Upgrade cryptography to 50.0.0, closing CVE-2026-69247 and CVE-2026-69249 [(#12356)](https://github.com/prowler-cloud/prowler/pull/12356) + +--- + ## [1.38.1] (Prowler v5.37.1) ### 🐞 Fixed diff --git a/api/changelog.d/api-aiohttp-cve-2026-69244.security.md b/api/changelog.d/api-aiohttp-cve-2026-69244.security.md deleted file mode 100644 index 58de7b0493..0000000000 --- a/api/changelog.d/api-aiohttp-cve-2026-69244.security.md +++ /dev/null @@ -1 +0,0 @@ -Upgrade aiohttp to 3.14.3 to pick up the fix for CVE-2026-69244 diff --git a/api/changelog.d/api-cryptography-50.security.md b/api/changelog.d/api-cryptography-50.security.md deleted file mode 100644 index 3b4540ef2d..0000000000 --- a/api/changelog.d/api-cryptography-50.security.md +++ /dev/null @@ -1 +0,0 @@ -Upgrade cryptography to 50.0.0, closing CVE-2026-69247 and CVE-2026-69249 diff --git a/api/changelog.d/api-restore-sdk-master-pin.fixed.md b/api/changelog.d/api-restore-sdk-master-pin.fixed.md deleted file mode 100644 index e12b3a57a1..0000000000 --- a/api/changelog.d/api-restore-sdk-master-pin.fixed.md +++ /dev/null @@ -1 +0,0 @@ -Restored the SDK dependency to `@master` now that the dependency bumps have landed there, and regenerated the lock. The API image no longer builds against a temporary integration branch diff --git a/api/changelog.d/api-sbom-attestations.added.md b/api/changelog.d/api-sbom-attestations.added.md deleted file mode 100644 index b2361d151d..0000000000 --- a/api/changelog.d/api-sbom-attestations.added.md +++ /dev/null @@ -1 +0,0 @@ -Container images now ship an SBOM and build provenance as OCI attestations diff --git a/api/changelog.d/api-trivy-0720-pin.changed.md b/api/changelog.d/api-trivy-0720-pin.changed.md deleted file mode 100644 index 5e399341c5..0000000000 --- a/api/changelog.d/api-trivy-0720-pin.changed.md +++ /dev/null @@ -1 +0,0 @@ -Pin the container vulnerability scanner to Trivy v0.72.0, matching prowler-registry and partner-portal diff --git a/api/changelog.d/api-verify-downloaded-binaries.security.md b/api/changelog.d/api-verify-downloaded-binaries.security.md deleted file mode 100644 index 1b4e1d3b1d..0000000000 --- a/api/changelog.d/api-verify-downloaded-binaries.security.md +++ /dev/null @@ -1 +0,0 @@ -The API container image now verifies the checksum of every third-party binary it downloads (PowerShell, Trivy, zizmor) before installing it diff --git a/api/changelog.d/attack-paths-query-outcome.added.md b/api/changelog.d/attack-paths-query-outcome.added.md deleted file mode 100644 index 898d33dc66..0000000000 --- a/api/changelog.d/attack-paths-query-outcome.added.md +++ /dev/null @@ -1 +0,0 @@ -Attack Paths query metadata now carries an outcome (Code execution, Privilege escalation, Public exposure, or Resource inventory), exposed on the queries endpoint so the graph can show a terminal outcome node diff --git a/api/changelog.d/pathfinding-attack-paths-service-queries.added.md b/api/changelog.d/pathfinding-attack-paths-service-queries.added.md deleted file mode 100644 index 5a3a328875..0000000000 --- a/api/changelog.d/pathfinding-attack-paths-service-queries.added.md +++ /dev/null @@ -1 +0,0 @@ -Attack Paths adds 20 AWS privilege-escalation detection queries from pathfinding.cloud, covering service PassRole escalations (Batch, Braket, Cognito Identity, ECS, EMR, EMR Serverless, GameLift, Glue, EC2 Image Builder, Kinesis Analytics, HealthOmics, EventBridge Scheduler, SSM, Step Functions), CodeDeploy and Step Functions existing-resource abuse, role permissions-boundary removal with role assumption, and IAM Identity Center permission-set policy injection diff --git a/api/changelog.d/report-output-dir-error-grouping.fixed.md b/api/changelog.d/report-output-dir-error-grouping.fixed.md deleted file mode 100644 index f2a499f910..0000000000 --- a/api/changelog.d/report-output-dir-error-grouping.fixed.md +++ /dev/null @@ -1 +0,0 @@ -Compliance report output directory failures are now logged with the exception attached and fingerprinted by `errno` in Sentry, so `ENOSPC`, `ENOENT` and `EACCES` no longer share a single issue diff --git a/mcp_server/CHANGELOG.md b/mcp_server/CHANGELOG.md index b267f9c12d..c040aa17e7 100644 --- a/mcp_server/CHANGELOG.md +++ b/mcp_server/CHANGELOG.md @@ -4,6 +4,25 @@ All notable changes to the **Prowler MCP Server** are documented in this file. +## [0.10.0] (Prowler v5.38.0) + +### 🚀 Added + +- Test foundation for the MCP server with shared fixtures, JSON:API builders, mocked HTTP transports and CI coverage reporting [(#12291)](https://github.com/prowler-cloud/prowler/pull/12291) +- Test coverage for the integrations tools and models, pinning the connection-check choreography and the Jira dispatch retry safety [(#12343)](https://github.com/prowler-cloud/prowler/pull/12343) +- Container images now ship an SBOM and build provenance as OCI attestations [(#12352)](https://github.com/prowler-cloud/prowler/pull/12352) + +### 🔄 Changed + +- `prowler_send_findings_to_jira` now reports `safe_to_retry` on every outcome, true only when Prowler knows no Jira work item was created: a dispatch the API refused is retryable, one that failed on the server or got no answer is not [(#12343)](https://github.com/prowler-cloud/prowler/pull/12343) +- `prowler_list_integrations` no longer requests the `configuration` it discards, now that the API tolerates a sparse fieldset without it [(#12343)](https://github.com/prowler-cloud/prowler/pull/12343) + +### 🔐 Security + +- Upgrade cryptography to 50.0.0, closing CVE-2026-69247 and CVE-2026-69249 [(#12356)](https://github.com/prowler-cloud/prowler/pull/12356) + +--- + ## [0.9.1] (Prowler v5.37.1) ### 🔐 Security diff --git a/mcp_server/changelog.d/integrations-tests.added.md b/mcp_server/changelog.d/integrations-tests.added.md deleted file mode 100644 index a349f9af7a..0000000000 --- a/mcp_server/changelog.d/integrations-tests.added.md +++ /dev/null @@ -1 +0,0 @@ -Test coverage for the integrations tools and models, pinning the connection-check choreography and the Jira dispatch retry safety diff --git a/mcp_server/changelog.d/jira-dispatch-safe-to-retry.changed.md b/mcp_server/changelog.d/jira-dispatch-safe-to-retry.changed.md deleted file mode 100644 index 88bfe44c7c..0000000000 --- a/mcp_server/changelog.d/jira-dispatch-safe-to-retry.changed.md +++ /dev/null @@ -1 +0,0 @@ -`prowler_send_findings_to_jira` now reports `safe_to_retry` on every outcome, true only when Prowler knows no Jira work item was created: a dispatch the API refused is retryable, one that failed on the server or got no answer is not diff --git a/mcp_server/changelog.d/list-integrations-sparse-fieldset.changed.md b/mcp_server/changelog.d/list-integrations-sparse-fieldset.changed.md deleted file mode 100644 index 032b729f07..0000000000 --- a/mcp_server/changelog.d/list-integrations-sparse-fieldset.changed.md +++ /dev/null @@ -1 +0,0 @@ -`prowler_list_integrations` no longer requests the `configuration` it discards, now that the API tolerates a sparse fieldset without it diff --git a/mcp_server/changelog.d/mcp-cryptography-50.security.md b/mcp_server/changelog.d/mcp-cryptography-50.security.md deleted file mode 100644 index 3b4540ef2d..0000000000 --- a/mcp_server/changelog.d/mcp-cryptography-50.security.md +++ /dev/null @@ -1 +0,0 @@ -Upgrade cryptography to 50.0.0, closing CVE-2026-69247 and CVE-2026-69249 diff --git a/mcp_server/changelog.d/mcp-sbom-attestations.added.md b/mcp_server/changelog.d/mcp-sbom-attestations.added.md deleted file mode 100644 index b2361d151d..0000000000 --- a/mcp_server/changelog.d/mcp-sbom-attestations.added.md +++ /dev/null @@ -1 +0,0 @@ -Container images now ship an SBOM and build provenance as OCI attestations diff --git a/mcp_server/changelog.d/mcp-test-foundation.added.md b/mcp_server/changelog.d/mcp-test-foundation.added.md deleted file mode 100644 index 914c9fce24..0000000000 --- a/mcp_server/changelog.d/mcp-test-foundation.added.md +++ /dev/null @@ -1 +0,0 @@ -Test foundation for the MCP server with shared fixtures, JSON:API builders, mocked HTTP transports and CI coverage reporting diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index ea98e3e34d..c019e8d087 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -4,6 +4,46 @@ All notable changes to the **Prowler SDK** are documented in this file. +## [5.38.0] (Prowler v5.38.0) + +### 🚀 Added + +- `admincenter_shared_bookings_disabled` check for M365 provider, covering CIS Microsoft 365 Foundations Benchmark v7.0.0 control 1.3.9 [(#12147)](https://github.com/prowler-cloud/prowler/pull/12147) +- `defender_priority_account_protection_enabled` and `defender_strict_preset_security_policy_enabled` checks for M365 provider, covering CIS Microsoft 365 Foundations Benchmark v7.0.0 controls 2.4.1 and 2.4.2 [(#12148)](https://github.com/prowler-cloud/prowler/pull/12148) +- `exchange_owa_mailbox_policy_personal_accounts_disabled` and `exchange_organization_reject_direct_send_enabled` checks for M365 provider, covering CIS Microsoft 365 Foundations Benchmark v7.0.0 controls 6.3.2 and 6.5.5 [(#12149)](https://github.com/prowler-cloud/prowler/pull/12149) +- `teams_external_access_trial_tenants_blocked` check for M365 provider, verifying that Teams external access with trial-only tenants is blocked, covering CIS Microsoft 365 Foundations Benchmark v7.0.0 control 8.2.4 [(#12151)](https://github.com/prowler-cloud/prowler/pull/12151) +- `entra_device_registration_join_restricted`, `entra_device_registration_max_devices_per_user_limited`, `entra_device_registration_global_admins_not_local_admins`, `entra_device_registration_registering_user_not_local_admin`, `entra_device_registration_laps_enabled` and `entra_policy_default_user_cannot_read_bitlocker_keys` checks for M365 provider, covering CIS Microsoft 365 Foundations Benchmark v7.0.0 device registration controls (5.1.4.x) [(#12152)](https://github.com/prowler-cloud/prowler/pull/12152) +- The IAM privilege-escalation check now detects 22 additional pathfinding.cloud escalation paths across AWS Batch, Braket, CodeDeploy, Cognito Identity, ECS, EMR, EMR Serverless, GameLift, Glue, EC2 Image Builder, Kinesis Analytics, HealthOmics, EventBridge Scheduler, SSM Automation, Step Functions, IAM permissions boundaries, and IAM Identity Center (SSO) [(#12237)](https://github.com/prowler-cloud/prowler/pull/12237) +- Container images now ship an SBOM and build provenance as OCI attestations [(#12352)](https://github.com/prowler-cloud/prowler/pull/12352) + +### 🔄 Changed + +- Highlighted key security terms in the Risk description of 8 existing M365 checks [(#12156)](https://github.com/prowler-cloud/prowler/pull/12156) +- Moved the Trivy suppressions from the classic `.trivyignore` to `.trivyignore.yaml`, so each entry is scoped to the package it names instead of suppressing its CVE across the whole image [(#12314)](https://github.com/prowler-cloud/prowler/pull/12314) +- The `securityhub_delegated_admin_enabled_all_regions`, `guardduty_delegated_admin_enabled_all_regions` and `config_delegated_admin_and_org_aggregator_all_regions` checks now report MANUAL instead of FAIL when the delegated administrator status cannot be read and no independent misconfiguration is detected, which happens on member accounts that are not registered as delegated administrators because the API is restricted to the organization management account and to delegated administrator accounts [(#12319)](https://github.com/prowler-cloud/prowler/pull/12319) +- Pin the container vulnerability scanner to Trivy v0.72.0, matching prowler-registry and partner-portal [(#12346)](https://github.com/prowler-cloud/prowler/pull/12346) +- Quote the unquoted shell expansions in the release and build workflows [(#12365)](https://github.com/prowler-cloud/prowler/pull/12365) +- Fix the remaining shellcheck findings in workflows and enable the check [(#12367)](https://github.com/prowler-cloud/prowler/pull/12367) + +### 🐞 Fixed + +- Spurious error log output from `Get-ApplicationAccessPolicy` on M365 tenants without application access policies [(#12149)](https://github.com/prowler-cloud/prowler/pull/12149) +- Secret checks no longer report credential-free JDBC connection strings as embedded credentials [(#12288)](https://github.com/prowler-cloud/prowler/pull/12288) +- A failed `ListOrganizationAdminAccounts` lookup in one region no longer marks the Security Hub delegated administrator status as undetermined in every other region [(#12319)](https://github.com/prowler-cloud/prowler/pull/12319) +- `securityhub_delegated_admin_enabled_all_regions` no longer reports FAIL with `delegated administrator status could not be determined` on accounts that do have a Security Hub delegated administrator; `ListOrganizationAdminAccounts` responses are now parsed with the `AccountId` and `Status` fields the API actually returns [(#12319)](https://github.com/prowler-cloud/prowler/pull/12319) +- `guardduty_delegated_admin_enabled_all_regions` no longer reports `no delegated administrator configured` when the lookup was denied or failed, which asserted absence where there was only lack of visibility [(#12319)](https://github.com/prowler-cloud/prowler/pull/12319) +- OCI Identity service no longer drops the whole dynamic groups, groups, policies or users listing when the OCI API returns null optional fields such as `matching_rule` [(#12327)](https://github.com/prowler-cloud/prowler/pull/12327) +- Alibaba Cloud STS credential validation retries transient connection failures and reports exhausted attempts as connection errors instead of invalid credentials [(#12353)](https://github.com/prowler-cloud/prowler/pull/12353) + +### 🔐 Security + +- Bumped the Compose DozerDB image from 5.26.3.0 to 5.26.27.0, which moves it off Debian 11 and onto Debian 13 [(#12320)](https://github.com/prowler-cloud/prowler/pull/12320) +- The SDK container image now verifies the checksum of every third-party binary it downloads (PowerShell, Trivy, zizmor) before installing it [(#12334)](https://github.com/prowler-cloud/prowler/pull/12334) +- Upgrade aiohttp to 3.14.3 to pick up the fix for CVE-2026-69244 [(#12340)](https://github.com/prowler-cloud/prowler/pull/12340) +- Upgrade cryptography to 50.0.0, closing CVE-2026-69247 and CVE-2026-69249 [(#12356)](https://github.com/prowler-cloud/prowler/pull/12356) + +--- + ## [5.37.1] (Prowler v5.37.1) ### 🔄 Changed diff --git a/prowler/changelog.d/aiohttp-cve-2026-69244.security.md b/prowler/changelog.d/aiohttp-cve-2026-69244.security.md deleted file mode 100644 index 58de7b0493..0000000000 --- a/prowler/changelog.d/aiohttp-cve-2026-69244.security.md +++ /dev/null @@ -1 +0,0 @@ -Upgrade aiohttp to 3.14.3 to pick up the fix for CVE-2026-69244 diff --git a/prowler/changelog.d/alibabacloud-sts-connection-retries.fixed.md b/prowler/changelog.d/alibabacloud-sts-connection-retries.fixed.md deleted file mode 100644 index 6ce2472724..0000000000 --- a/prowler/changelog.d/alibabacloud-sts-connection-retries.fixed.md +++ /dev/null @@ -1 +0,0 @@ -Alibaba Cloud STS credential validation retries transient connection failures and reports exhausted attempts as connection errors instead of invalid credentials diff --git a/prowler/changelog.d/cryptography-50.security.md b/prowler/changelog.d/cryptography-50.security.md deleted file mode 100644 index 3b4540ef2d..0000000000 --- a/prowler/changelog.d/cryptography-50.security.md +++ /dev/null @@ -1 +0,0 @@ -Upgrade cryptography to 50.0.0, closing CVE-2026-69247 and CVE-2026-69249 diff --git a/prowler/changelog.d/delegated-admin-unknown-manual.changed.md b/prowler/changelog.d/delegated-admin-unknown-manual.changed.md deleted file mode 100644 index ecb3a1e15e..0000000000 --- a/prowler/changelog.d/delegated-admin-unknown-manual.changed.md +++ /dev/null @@ -1 +0,0 @@ -The `securityhub_delegated_admin_enabled_all_regions`, `guardduty_delegated_admin_enabled_all_regions` and `config_delegated_admin_and_org_aggregator_all_regions` checks now report MANUAL instead of FAIL when the delegated administrator status cannot be read and no independent misconfiguration is detected, which happens on member accounts that are not registered as delegated administrators because the API is restricted to the organization management account and to delegated administrator accounts diff --git a/prowler/changelog.d/dozerdb-5-26-27.security.md b/prowler/changelog.d/dozerdb-5-26-27.security.md deleted file mode 100644 index bb6c5938aa..0000000000 --- a/prowler/changelog.d/dozerdb-5-26-27.security.md +++ /dev/null @@ -1 +0,0 @@ -Bumped the Compose DozerDB image from 5.26.3.0 to 5.26.27.0, which moves it off Debian 11 and onto Debian 13 diff --git a/prowler/changelog.d/guardduty-delegated-admin-lookup.fixed.md b/prowler/changelog.d/guardduty-delegated-admin-lookup.fixed.md deleted file mode 100644 index dc229a1a5d..0000000000 --- a/prowler/changelog.d/guardduty-delegated-admin-lookup.fixed.md +++ /dev/null @@ -1 +0,0 @@ -`guardduty_delegated_admin_enabled_all_regions` no longer reports `no delegated administrator configured` when the lookup was denied or failed, which asserted absence where there was only lack of visibility diff --git a/prowler/changelog.d/kingfisher-jdbc-false-positive.fixed.md b/prowler/changelog.d/kingfisher-jdbc-false-positive.fixed.md deleted file mode 100644 index e94de00bfc..0000000000 --- a/prowler/changelog.d/kingfisher-jdbc-false-positive.fixed.md +++ /dev/null @@ -1 +0,0 @@ -Secret checks no longer report credential-free JDBC connection strings as embedded credentials diff --git a/prowler/changelog.d/m365-application-access-policy-noise.fixed.md b/prowler/changelog.d/m365-application-access-policy-noise.fixed.md deleted file mode 100644 index 76071d0e9c..0000000000 --- a/prowler/changelog.d/m365-application-access-policy-noise.fixed.md +++ /dev/null @@ -1 +0,0 @@ -Spurious error log output from `Get-ApplicationAccessPolicy` on M365 tenants without application access policies diff --git a/prowler/changelog.d/m365-cis7-admincenter.added.md b/prowler/changelog.d/m365-cis7-admincenter.added.md deleted file mode 100644 index 730a71b998..0000000000 --- a/prowler/changelog.d/m365-cis7-admincenter.added.md +++ /dev/null @@ -1 +0,0 @@ -`admincenter_shared_bookings_disabled` check for M365 provider, covering CIS Microsoft 365 Foundations Benchmark v7.0.0 control 1.3.9 diff --git a/prowler/changelog.d/m365-cis7-defender.added.md b/prowler/changelog.d/m365-cis7-defender.added.md deleted file mode 100644 index 673d3af01d..0000000000 --- a/prowler/changelog.d/m365-cis7-defender.added.md +++ /dev/null @@ -1 +0,0 @@ -`defender_priority_account_protection_enabled` and `defender_strict_preset_security_policy_enabled` checks for M365 provider, covering CIS Microsoft 365 Foundations Benchmark v7.0.0 controls 2.4.1 and 2.4.2 diff --git a/prowler/changelog.d/m365-cis7-entra-device-registration.added.md b/prowler/changelog.d/m365-cis7-entra-device-registration.added.md deleted file mode 100644 index cd81d1e4eb..0000000000 --- a/prowler/changelog.d/m365-cis7-entra-device-registration.added.md +++ /dev/null @@ -1 +0,0 @@ -`entra_device_registration_join_restricted`, `entra_device_registration_max_devices_per_user_limited`, `entra_device_registration_global_admins_not_local_admins`, `entra_device_registration_registering_user_not_local_admin`, `entra_device_registration_laps_enabled` and `entra_policy_default_user_cannot_read_bitlocker_keys` checks for M365 provider, covering CIS Microsoft 365 Foundations Benchmark v7.0.0 device registration controls (5.1.4.x) diff --git a/prowler/changelog.d/m365-cis7-exchange.added.md b/prowler/changelog.d/m365-cis7-exchange.added.md deleted file mode 100644 index 9f76544b42..0000000000 --- a/prowler/changelog.d/m365-cis7-exchange.added.md +++ /dev/null @@ -1 +0,0 @@ -`exchange_owa_mailbox_policy_personal_accounts_disabled` and `exchange_organization_reject_direct_send_enabled` checks for M365 provider, covering CIS Microsoft 365 Foundations Benchmark v7.0.0 controls 6.3.2 and 6.5.5 diff --git a/prowler/changelog.d/m365-cis7-teams.added.md b/prowler/changelog.d/m365-cis7-teams.added.md deleted file mode 100644 index 7cd7f7816d..0000000000 --- a/prowler/changelog.d/m365-cis7-teams.added.md +++ /dev/null @@ -1 +0,0 @@ -`teams_external_access_trial_tenants_blocked` check for M365 provider, verifying that Teams external access with trial-only tenants is blocked, covering CIS Microsoft 365 Foundations Benchmark v7.0.0 control 8.2.4 diff --git a/prowler/changelog.d/m365-risk-field-formatting.changed.md b/prowler/changelog.d/m365-risk-field-formatting.changed.md deleted file mode 100644 index 7ae20169b9..0000000000 --- a/prowler/changelog.d/m365-risk-field-formatting.changed.md +++ /dev/null @@ -1 +0,0 @@ -Highlighted key security terms in the Risk description of 8 existing M365 checks diff --git a/prowler/changelog.d/oci-dynamic-group-null-matching-rule.fixed.md b/prowler/changelog.d/oci-dynamic-group-null-matching-rule.fixed.md deleted file mode 100644 index 0bdfef8240..0000000000 --- a/prowler/changelog.d/oci-dynamic-group-null-matching-rule.fixed.md +++ /dev/null @@ -1 +0,0 @@ -OCI Identity service no longer drops the whole dynamic groups, groups, policies or users listing when the OCI API returns null optional fields such as `matching_rule` diff --git a/prowler/changelog.d/pathfinding-privesc-combos.added.md b/prowler/changelog.d/pathfinding-privesc-combos.added.md deleted file mode 100644 index f2dab5dba9..0000000000 --- a/prowler/changelog.d/pathfinding-privesc-combos.added.md +++ /dev/null @@ -1 +0,0 @@ -The IAM privilege-escalation check now detects 22 additional pathfinding.cloud escalation paths across AWS Batch, Braket, CodeDeploy, Cognito Identity, ECS, EMR, EMR Serverless, GameLift, Glue, EC2 Image Builder, Kinesis Analytics, HealthOmics, EventBridge Scheduler, SSM Automation, Step Functions, IAM permissions boundaries, and IAM Identity Center (SSO) diff --git a/prowler/changelog.d/sbom-attestations.added.md b/prowler/changelog.d/sbom-attestations.added.md deleted file mode 100644 index b2361d151d..0000000000 --- a/prowler/changelog.d/sbom-attestations.added.md +++ /dev/null @@ -1 +0,0 @@ -Container images now ship an SBOM and build provenance as OCI attestations diff --git a/prowler/changelog.d/securityhub-admin-lookup-per-region.fixed.md b/prowler/changelog.d/securityhub-admin-lookup-per-region.fixed.md deleted file mode 100644 index bccb6ebde8..0000000000 --- a/prowler/changelog.d/securityhub-admin-lookup-per-region.fixed.md +++ /dev/null @@ -1 +0,0 @@ -A failed `ListOrganizationAdminAccounts` lookup in one region no longer marks the Security Hub delegated administrator status as undetermined in every other region diff --git a/prowler/changelog.d/securityhub-delegated-admin-fields.fixed.md b/prowler/changelog.d/securityhub-delegated-admin-fields.fixed.md deleted file mode 100644 index 958850bb27..0000000000 --- a/prowler/changelog.d/securityhub-delegated-admin-fields.fixed.md +++ /dev/null @@ -1 +0,0 @@ -`securityhub_delegated_admin_enabled_all_regions` no longer reports FAIL with `delegated administrator status could not be determined` on accounts that do have a Security Hub delegated administrator; `ListOrganizationAdminAccounts` responses are now parsed with the `AccountId` and `Status` fields the API actually returns diff --git a/prowler/changelog.d/shellcheck-workflow-quoting.changed.md b/prowler/changelog.d/shellcheck-workflow-quoting.changed.md deleted file mode 100644 index 48ee6c9e71..0000000000 --- a/prowler/changelog.d/shellcheck-workflow-quoting.changed.md +++ /dev/null @@ -1 +0,0 @@ -Quote the unquoted shell expansions in the release and build workflows diff --git a/prowler/changelog.d/shellcheck-workflows-complete.changed.md b/prowler/changelog.d/shellcheck-workflows-complete.changed.md deleted file mode 100644 index 4df36b32d7..0000000000 --- a/prowler/changelog.d/shellcheck-workflows-complete.changed.md +++ /dev/null @@ -1 +0,0 @@ -Fix the remaining shellcheck findings in workflows and enable the check diff --git a/prowler/changelog.d/trivy-0720-pin.changed.md b/prowler/changelog.d/trivy-0720-pin.changed.md deleted file mode 100644 index 5e399341c5..0000000000 --- a/prowler/changelog.d/trivy-0720-pin.changed.md +++ /dev/null @@ -1 +0,0 @@ -Pin the container vulnerability scanner to Trivy v0.72.0, matching prowler-registry and partner-portal diff --git a/prowler/changelog.d/trivyignore-yaml-migration.changed.md b/prowler/changelog.d/trivyignore-yaml-migration.changed.md deleted file mode 100644 index 5f3dae1632..0000000000 --- a/prowler/changelog.d/trivyignore-yaml-migration.changed.md +++ /dev/null @@ -1 +0,0 @@ -Moved the Trivy suppressions from the classic `.trivyignore` to `.trivyignore.yaml`, so each entry is scoped to the package it names instead of suppressing its CVE across the whole image diff --git a/prowler/changelog.d/verify-downloaded-binaries.security.md b/prowler/changelog.d/verify-downloaded-binaries.security.md deleted file mode 100644 index 609f754f29..0000000000 --- a/prowler/changelog.d/verify-downloaded-binaries.security.md +++ /dev/null @@ -1 +0,0 @@ -The SDK container image now verifies the checksum of every third-party binary it downloads (PowerShell, Trivy, zizmor) before installing it diff --git a/ui/CHANGELOG.md b/ui/CHANGELOG.md index 87fcddcf71..8f59e42a59 100644 --- a/ui/CHANGELOG.md +++ b/ui/CHANGELOG.md @@ -4,6 +4,37 @@ All notable changes to the **Prowler UI** are documented in this file. +## [1.38.0] (Prowler v5.38.0) + +### 🚀 Added + +- Sign-in method indicators in the Prowler Cloud Users table, including linked SAML domains [(#12268)](https://github.com/prowler-cloud/prowler/pull/12268) +- Compliance watchlist: pin frameworks from any compliance view and filter every view down to the pinned ones, including the overview card and a finding's compliance chips (Prowler Cloud only) [(#12300)](https://github.com/prowler-cloud/prowler/pull/12300) +- Multiple verified email domains in a single SAML configuration for Prowler Cloud [(#12332)](https://github.com/prowler-cloud/prowler/pull/12332) +- Container images now ship an SBOM and build provenance as OCI attestations [(#12352)](https://github.com/prowler-cloud/prowler/pull/12352) + +### 🔄 Changed + +- `Add Provider` wizard documentation link targeting each provider's credentials section and selected authentication method [(#12218)](https://github.com/prowler-cloud/prowler/pull/12218) + +### 🐞 Fixed + +- Imported scans now appear on the Scans page even when no provider is connected [(#12025)](https://github.com/prowler-cloud/prowler/pull/12025) +- Feedback widget no longer obscures page and side-panel actions [(#12282)](https://github.com/prowler-cloud/prowler/pull/12282) +- Rows-per-page selector no longer disappears when the chosen page size collapses a table to a single page [(#12299)](https://github.com/prowler-cloud/prowler/pull/12299) +- Overview ThreatScore card no longer leaves unused horizontal space at responsive layout boundaries [(#12317)](https://github.com/prowler-cloud/prowler/pull/12317) +- Overview metric cards stack below the desktop layout threshold and preserve readable widths when aligned [(#12323)](https://github.com/prowler-cloud/prowler/pull/12323) +- Overview metric cards now align horizontally at medium desktop widths [(#12323)](https://github.com/prowler-cloud/prowler/pull/12323) +- AWS and GCP organization onboarding launches all linked provider scans through one bulk operation [(#12350)](https://github.com/prowler-cloud/prowler/pull/12350) +- `/compliance` no longer fails while compliance overview data is still being generated [(#12358)](https://github.com/prowler-cloud/prowler/pull/12358) +- `Client Secret` and `Refresh Token` labels in the GCP organization authentication form [(#12362)](https://github.com/prowler-cloud/prowler/pull/12362) + +### 🔐 Security + +- Removed the `apk upgrade` from the UI image and moved the base digest forward instead, so the image is reproducible from its pin rather than from whatever Alpine serves at build time [(#12313)](https://github.com/prowler-cloud/prowler/pull/12313) + +--- + ## [1.37.1] (Prowler v5.37.1) ### 🐞 Fixed diff --git a/ui/changelog.d/compliance-task-response.fixed.md b/ui/changelog.d/compliance-task-response.fixed.md deleted file mode 100644 index c691464485..0000000000 --- a/ui/changelog.d/compliance-task-response.fixed.md +++ /dev/null @@ -1 +0,0 @@ -`/compliance` no longer fails while compliance overview data is still being generated diff --git a/ui/changelog.d/compliance-watchlist.added.md b/ui/changelog.d/compliance-watchlist.added.md deleted file mode 100644 index e818b405a7..0000000000 --- a/ui/changelog.d/compliance-watchlist.added.md +++ /dev/null @@ -1 +0,0 @@ -Compliance watchlist: pin frameworks from any compliance view and filter every view down to the pinned ones, including the overview card and a finding's compliance chips (Prowler Cloud only) diff --git a/ui/changelog.d/display-imported-scans.fixed.md b/ui/changelog.d/display-imported-scans.fixed.md deleted file mode 100644 index 9b8e01fdb0..0000000000 --- a/ui/changelog.d/display-imported-scans.fixed.md +++ /dev/null @@ -1 +0,0 @@ -Imported scans now appear on the Scans page even when no provider is connected diff --git a/ui/changelog.d/feedback-widget-overlap.fixed.md b/ui/changelog.d/feedback-widget-overlap.fixed.md deleted file mode 100644 index c9ea96a44c..0000000000 --- a/ui/changelog.d/feedback-widget-overlap.fixed.md +++ /dev/null @@ -1 +0,0 @@ -Feedback widget no longer obscures page and side-panel actions diff --git a/ui/changelog.d/gcp-organization-credential-labels.fixed.md b/ui/changelog.d/gcp-organization-credential-labels.fixed.md deleted file mode 100644 index 48617dafbf..0000000000 --- a/ui/changelog.d/gcp-organization-credential-labels.fixed.md +++ /dev/null @@ -1 +0,0 @@ -`Client Secret` and `Refresh Token` labels in the GCP organization authentication form diff --git a/ui/changelog.d/organization-bulk-scan.fixed.md b/ui/changelog.d/organization-bulk-scan.fixed.md deleted file mode 100644 index 547f595d76..0000000000 --- a/ui/changelog.d/organization-bulk-scan.fixed.md +++ /dev/null @@ -1 +0,0 @@ -AWS and GCP organization onboarding launches all linked provider scans through one bulk operation diff --git a/ui/changelog.d/overview-metric-breakpoint.fixed.md b/ui/changelog.d/overview-metric-breakpoint.fixed.md deleted file mode 100644 index 2f1386efe6..0000000000 --- a/ui/changelog.d/overview-metric-breakpoint.fixed.md +++ /dev/null @@ -1 +0,0 @@ -Overview metric cards stack below the desktop layout threshold and preserve readable widths when aligned diff --git a/ui/changelog.d/overview-metric-row.fixed.md b/ui/changelog.d/overview-metric-row.fixed.md deleted file mode 100644 index b80c2e4ee8..0000000000 --- a/ui/changelog.d/overview-metric-row.fixed.md +++ /dev/null @@ -1 +0,0 @@ -Overview metric cards now align horizontally at medium desktop widths diff --git a/ui/changelog.d/overview-threatscore-layout.fixed.md b/ui/changelog.d/overview-threatscore-layout.fixed.md deleted file mode 100644 index ffea0c2644..0000000000 --- a/ui/changelog.d/overview-threatscore-layout.fixed.md +++ /dev/null @@ -1 +0,0 @@ -Overview ThreatScore card no longer leaves unused horizontal space at responsive layout boundaries diff --git a/ui/changelog.d/provider-wizard-step-aware-docs-link.changed.md b/ui/changelog.d/provider-wizard-step-aware-docs-link.changed.md deleted file mode 100644 index 23875532ad..0000000000 --- a/ui/changelog.d/provider-wizard-step-aware-docs-link.changed.md +++ /dev/null @@ -1 +0,0 @@ -`Add Provider` wizard documentation link targeting each provider's credentials section and selected authentication method diff --git a/ui/changelog.d/saml-multiple-domains.added.md b/ui/changelog.d/saml-multiple-domains.added.md deleted file mode 100644 index f0fb239a7e..0000000000 --- a/ui/changelog.d/saml-multiple-domains.added.md +++ /dev/null @@ -1 +0,0 @@ -Multiple verified email domains in a single SAML configuration for Prowler Cloud diff --git a/ui/changelog.d/table-page-size-selector.fixed.md b/ui/changelog.d/table-page-size-selector.fixed.md deleted file mode 100644 index a0d8137b00..0000000000 --- a/ui/changelog.d/table-page-size-selector.fixed.md +++ /dev/null @@ -1 +0,0 @@ -Rows-per-page selector no longer disappears when the chosen page size collapses a table to a single page diff --git a/ui/changelog.d/ui-reproducible-base.security.md b/ui/changelog.d/ui-reproducible-base.security.md deleted file mode 100644 index 9b0a10b837..0000000000 --- a/ui/changelog.d/ui-reproducible-base.security.md +++ /dev/null @@ -1 +0,0 @@ -Removed the `apk upgrade` from the UI image and moved the base digest forward instead, so the image is reproducible from its pin rather than from whatever Alpine serves at build time diff --git a/ui/changelog.d/ui-sbom-attestations.added.md b/ui/changelog.d/ui-sbom-attestations.added.md deleted file mode 100644 index b2361d151d..0000000000 --- a/ui/changelog.d/ui-sbom-attestations.added.md +++ /dev/null @@ -1 +0,0 @@ -Container images now ship an SBOM and build provenance as OCI attestations diff --git a/ui/changelog.d/user-sign-in-method-indicators.added.md b/ui/changelog.d/user-sign-in-method-indicators.added.md deleted file mode 100644 index 0b1bd856e1..0000000000 --- a/ui/changelog.d/user-sign-in-method-indicators.added.md +++ /dev/null @@ -1 +0,0 @@ -Sign-in method indicators in the Prowler Cloud Users table, including linked SAML domains