chore(changelog): v5.38.0 (#12373)

Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com>
2026-08-19 09:30:21 +00:00 · 2026-08-06 13:25:12 +02:00
parent a700865340
commit 226504982b
58 changed files with 115 additions and 54 deletions
@@ -4,6 +4,31 @@ All notable changes to the **Prowler API** are documented in this file.
 <!-- changelog: release notes start -->
 ## [1.39.0] (Prowler v5.38.0)
 ### 🚀 Added
 - Attack Paths adds 20 AWS privilege-escalation detection queries from pathfinding.cloud, covering service PassRole escalations (Batch, Braket, Cognito Identity, ECS, EMR, EMR Serverless, GameLift, Glue, EC2 Image Builder, Kinesis Analytics, HealthOmics, EventBridge Scheduler, SSM, Step Functions), CodeDeploy and Step Functions existing-resource abuse, role permissions-boundary removal with role assumption, and IAM Identity Center permission-set policy injection [(#12237)](https://github.com/prowler-cloud/prowler/pull/12237)
 - Attack Paths query metadata now carries an outcome (Code execution, Privilege escalation, Public exposure, or Resource inventory), exposed on the queries endpoint so the graph can show a terminal outcome node [(#12344)](https://github.com/prowler-cloud/prowler/pull/12344)
 - Container images now ship an SBOM and build provenance as OCI attestations [(#12352)](https://github.com/prowler-cloud/prowler/pull/12352)
 ### 🔄 Changed
 - Pin the container vulnerability scanner to Trivy v0.72.0, matching prowler-registry and partner-portal [(#12346)](https://github.com/prowler-cloud/prowler/pull/12346)
 ### 🐞 Fixed
 - Compliance report output directory failures are now logged with the exception attached and fingerprinted by `errno` in Sentry, so `ENOSPC`, `ENOENT` and `EACCES` no longer share a single issue [(#12142)](https://github.com/prowler-cloud/prowler/pull/12142)
 - Restored the SDK dependency to `@master` now that the dependency bumps have landed there, and regenerated the lock. The API image no longer builds against a temporary integration branch [(#12309)](https://github.com/prowler-cloud/prowler/pull/12309)
 ### 🔐 Security
 - The API container image now verifies the checksum of every third-party binary it downloads (PowerShell, Trivy, zizmor) before installing it [(#12334)](https://github.com/prowler-cloud/prowler/pull/12334)
 - Upgrade aiohttp to 3.14.3 to pick up the fix for CVE-2026-69244 [(#12340)](https://github.com/prowler-cloud/prowler/pull/12340)
 - Upgrade cryptography to 50.0.0, closing CVE-2026-69247 and CVE-2026-69249 [(#12356)](https://github.com/prowler-cloud/prowler/pull/12356)
 ---
 ## [1.38.1] (Prowler v5.37.1)
 ### 🐞 Fixed
@@ -1 +0,0 @@
 Upgrade aiohttp to 3.14.3 to pick up the fix for CVE-2026-69244
@@ -1 +0,0 @@
 Upgrade cryptography to 50.0.0, closing CVE-2026-69247 and CVE-2026-69249
@@ -1 +0,0 @@
 Restored the SDK dependency to `@master` now that the dependency bumps have landed there, and regenerated the lock. The API image no longer builds against a temporary integration branch
@@ -1 +0,0 @@
 Container images now ship an SBOM and build provenance as OCI attestations
@@ -1 +0,0 @@
 Pin the container vulnerability scanner to Trivy v0.72.0, matching prowler-registry and partner-portal
@@ -1 +0,0 @@
 The API container image now verifies the checksum of every third-party binary it downloads (PowerShell, Trivy, zizmor) before installing it
@@ -1 +0,0 @@
 Attack Paths query metadata now carries an outcome (Code execution, Privilege escalation, Public exposure, or Resource inventory), exposed on the queries endpoint so the graph can show a terminal outcome node
@@ -1 +0,0 @@
 Attack Paths adds 20 AWS privilege-escalation detection queries from pathfinding.cloud, covering service PassRole escalations (Batch, Braket, Cognito Identity, ECS, EMR, EMR Serverless, GameLift, Glue, EC2 Image Builder, Kinesis Analytics, HealthOmics, EventBridge Scheduler, SSM, Step Functions), CodeDeploy and Step Functions existing-resource abuse, role permissions-boundary removal with role assumption, and IAM Identity Center permission-set policy injection
@@ -1 +0,0 @@
 Compliance report output directory failures are now logged with the exception attached and fingerprinted by `errno` in Sentry, so `ENOSPC`, `ENOENT` and `EACCES` no longer share a single issue
@@ -4,6 +4,25 @@ All notable changes to the **Prowler MCP Server** are documented in this file.
 <!-- changelog: release notes start -->
 ## [0.10.0] (Prowler v5.38.0)
 ### 🚀 Added
 - Test foundation for the MCP server with shared fixtures, JSON:API builders, mocked HTTP transports and CI coverage reporting [(#12291)](https://github.com/prowler-cloud/prowler/pull/12291)
 - Test coverage for the integrations tools and models, pinning the connection-check choreography and the Jira dispatch retry safety [(#12343)](https://github.com/prowler-cloud/prowler/pull/12343)
 - Container images now ship an SBOM and build provenance as OCI attestations [(#12352)](https://github.com/prowler-cloud/prowler/pull/12352)
 ### 🔄 Changed
 - `prowler_send_findings_to_jira` now reports `safe_to_retry` on every outcome, true only when Prowler knows no Jira work item was created: a dispatch the API refused is retryable, one that failed on the server or got no answer is not [(#12343)](https://github.com/prowler-cloud/prowler/pull/12343)
 - `prowler_list_integrations` no longer requests the `configuration` it discards, now that the API tolerates a sparse fieldset without it [(#12343)](https://github.com/prowler-cloud/prowler/pull/12343)
 ### 🔐 Security
 - Upgrade cryptography to 50.0.0, closing CVE-2026-69247 and CVE-2026-69249 [(#12356)](https://github.com/prowler-cloud/prowler/pull/12356)
 ---
 ## [0.9.1] (Prowler v5.37.1)
 ### 🔐 Security
@@ -1 +0,0 @@
 Test coverage for the integrations tools and models, pinning the connection-check choreography and the Jira dispatch retry safety
@@ -1 +0,0 @@
 `prowler_send_findings_to_jira` now reports `safe_to_retry` on every outcome, true only when Prowler knows no Jira work item was created: a dispatch the API refused is retryable, one that failed on the server or got no answer is not
@@ -1 +0,0 @@
 `prowler_list_integrations` no longer requests the `configuration` it discards, now that the API tolerates a sparse fieldset without it
@@ -1 +0,0 @@
 Upgrade cryptography to 50.0.0, closing CVE-2026-69247 and CVE-2026-69249
@@ -1 +0,0 @@
 Container images now ship an SBOM and build provenance as OCI attestations
@@ -1 +0,0 @@
 Test foundation for the MCP server with shared fixtures, JSON:API builders, mocked HTTP transports and CI coverage reporting
@@ -4,6 +4,46 @@ All notable changes to the **Prowler SDK** are documented in this file.
 <!-- changelog: release notes start -->
 ## [5.38.0] (Prowler v5.38.0)
 ### 🚀 Added
 - `admincenter_shared_bookings_disabled` check for M365 provider, covering CIS Microsoft 365 Foundations Benchmark v7.0.0 control 1.3.9 [(#12147)](https://github.com/prowler-cloud/prowler/pull/12147)
 - `defender_priority_account_protection_enabled` and `defender_strict_preset_security_policy_enabled` checks for M365 provider, covering CIS Microsoft 365 Foundations Benchmark v7.0.0 controls 2.4.1 and 2.4.2 [(#12148)](https://github.com/prowler-cloud/prowler/pull/12148)
 - `exchange_owa_mailbox_policy_personal_accounts_disabled` and `exchange_organization_reject_direct_send_enabled` checks for M365 provider, covering CIS Microsoft 365 Foundations Benchmark v7.0.0 controls 6.3.2 and 6.5.5 [(#12149)](https://github.com/prowler-cloud/prowler/pull/12149)
 - `teams_external_access_trial_tenants_blocked` check for M365 provider, verifying that Teams external access with trial-only tenants is blocked, covering CIS Microsoft 365 Foundations Benchmark v7.0.0 control 8.2.4 [(#12151)](https://github.com/prowler-cloud/prowler/pull/12151)
 - `entra_device_registration_join_restricted`, `entra_device_registration_max_devices_per_user_limited`, `entra_device_registration_global_admins_not_local_admins`, `entra_device_registration_registering_user_not_local_admin`, `entra_device_registration_laps_enabled` and `entra_policy_default_user_cannot_read_bitlocker_keys` checks for M365 provider, covering CIS Microsoft 365 Foundations Benchmark v7.0.0 device registration controls (5.1.4.x) [(#12152)](https://github.com/prowler-cloud/prowler/pull/12152)
 - The IAM privilege-escalation check now detects 22 additional pathfinding.cloud escalation paths across AWS Batch, Braket, CodeDeploy, Cognito Identity, ECS, EMR, EMR Serverless, GameLift, Glue, EC2 Image Builder, Kinesis Analytics, HealthOmics, EventBridge Scheduler, SSM Automation, Step Functions, IAM permissions boundaries, and IAM Identity Center (SSO) [(#12237)](https://github.com/prowler-cloud/prowler/pull/12237)
 - Container images now ship an SBOM and build provenance as OCI attestations [(#12352)](https://github.com/prowler-cloud/prowler/pull/12352)
 ### 🔄 Changed
 - Highlighted key security terms in the Risk description of 8 existing M365 checks [(#12156)](https://github.com/prowler-cloud/prowler/pull/12156)
 - Moved the Trivy suppressions from the classic `.trivyignore` to `.trivyignore.yaml`, so each entry is scoped to the package it names instead of suppressing its CVE across the whole image [(#12314)](https://github.com/prowler-cloud/prowler/pull/12314)
 - The `securityhub_delegated_admin_enabled_all_regions`, `guardduty_delegated_admin_enabled_all_regions` and `config_delegated_admin_and_org_aggregator_all_regions` checks now report MANUAL instead of FAIL when the delegated administrator status cannot be read and no independent misconfiguration is detected, which happens on member accounts that are not registered as delegated administrators because the API is restricted to the organization management account and to delegated administrator accounts [(#12319)](https://github.com/prowler-cloud/prowler/pull/12319)
 - Pin the container vulnerability scanner to Trivy v0.72.0, matching prowler-registry and partner-portal [(#12346)](https://github.com/prowler-cloud/prowler/pull/12346)
 - Quote the unquoted shell expansions in the release and build workflows [(#12365)](https://github.com/prowler-cloud/prowler/pull/12365)
 - Fix the remaining shellcheck findings in workflows and enable the check [(#12367)](https://github.com/prowler-cloud/prowler/pull/12367)
 ### 🐞 Fixed
 - Spurious error log output from `Get-ApplicationAccessPolicy` on M365 tenants without application access policies [(#12149)](https://github.com/prowler-cloud/prowler/pull/12149)
 - Secret checks no longer report credential-free JDBC connection strings as embedded credentials [(#12288)](https://github.com/prowler-cloud/prowler/pull/12288)
 - A failed `ListOrganizationAdminAccounts` lookup in one region no longer marks the Security Hub delegated administrator status as undetermined in every other region [(#12319)](https://github.com/prowler-cloud/prowler/pull/12319)
 - `securityhub_delegated_admin_enabled_all_regions` no longer reports FAIL with `delegated administrator status could not be determined` on accounts that do have a Security Hub delegated administrator; `ListOrganizationAdminAccounts` responses are now parsed with the `AccountId` and `Status` fields the API actually returns [(#12319)](https://github.com/prowler-cloud/prowler/pull/12319)
 - `guardduty_delegated_admin_enabled_all_regions` no longer reports `no delegated administrator configured` when the lookup was denied or failed, which asserted absence where there was only lack of visibility [(#12319)](https://github.com/prowler-cloud/prowler/pull/12319)
 - OCI Identity service no longer drops the whole dynamic groups, groups, policies or users listing when the OCI API returns null optional fields such as `matching_rule` [(#12327)](https://github.com/prowler-cloud/prowler/pull/12327)
 - Alibaba Cloud STS credential validation retries transient connection failures and reports exhausted attempts as connection errors instead of invalid credentials [(#12353)](https://github.com/prowler-cloud/prowler/pull/12353)
 ### 🔐 Security
 - Bumped the Compose DozerDB image from 5.26.3.0 to 5.26.27.0, which moves it off Debian 11 and onto Debian 13 [(#12320)](https://github.com/prowler-cloud/prowler/pull/12320)
 - The SDK container image now verifies the checksum of every third-party binary it downloads (PowerShell, Trivy, zizmor) before installing it [(#12334)](https://github.com/prowler-cloud/prowler/pull/12334)
 - Upgrade aiohttp to 3.14.3 to pick up the fix for CVE-2026-69244 [(#12340)](https://github.com/prowler-cloud/prowler/pull/12340)
 - Upgrade cryptography to 50.0.0, closing CVE-2026-69247 and CVE-2026-69249 [(#12356)](https://github.com/prowler-cloud/prowler/pull/12356)
 ---
 ## [5.37.1] (Prowler v5.37.1)
 ### 🔄 Changed
@@ -1 +0,0 @@
 Upgrade aiohttp to 3.14.3 to pick up the fix for CVE-2026-69244
@@ -1 +0,0 @@
 Alibaba Cloud STS credential validation retries transient connection failures and reports exhausted attempts as connection errors instead of invalid credentials
@@ -1 +0,0 @@
 Upgrade cryptography to 50.0.0, closing CVE-2026-69247 and CVE-2026-69249
@@ -1 +0,0 @@
 The `securityhub_delegated_admin_enabled_all_regions`, `guardduty_delegated_admin_enabled_all_regions` and `config_delegated_admin_and_org_aggregator_all_regions` checks now report MANUAL instead of FAIL when the delegated administrator status cannot be read and no independent misconfiguration is detected, which happens on member accounts that are not registered as delegated administrators because the API is restricted to the organization management account and to delegated administrator accounts
@@ -1 +0,0 @@
 Bumped the Compose DozerDB image from 5.26.3.0 to 5.26.27.0, which moves it off Debian 11 and onto Debian 13
@@ -1 +0,0 @@
 `guardduty_delegated_admin_enabled_all_regions` no longer reports `no delegated administrator configured` when the lookup was denied or failed, which asserted absence where there was only lack of visibility
@@ -1 +0,0 @@
 Secret checks no longer report credential-free JDBC connection strings as embedded credentials
@@ -1 +0,0 @@
 Spurious error log output from `Get-ApplicationAccessPolicy` on M365 tenants without application access policies
@@ -1 +0,0 @@
 `admincenter_shared_bookings_disabled` check for M365 provider, covering CIS Microsoft 365 Foundations Benchmark v7.0.0 control 1.3.9
@@ -1 +0,0 @@
 `defender_priority_account_protection_enabled` and `defender_strict_preset_security_policy_enabled` checks for M365 provider, covering CIS Microsoft 365 Foundations Benchmark v7.0.0 controls 2.4.1 and 2.4.2
@@ -1 +0,0 @@
 `entra_device_registration_join_restricted`, `entra_device_registration_max_devices_per_user_limited`, `entra_device_registration_global_admins_not_local_admins`, `entra_device_registration_registering_user_not_local_admin`, `entra_device_registration_laps_enabled` and `entra_policy_default_user_cannot_read_bitlocker_keys` checks for M365 provider, covering CIS Microsoft 365 Foundations Benchmark v7.0.0 device registration controls (5.1.4.x)
@@ -1 +0,0 @@
 `exchange_owa_mailbox_policy_personal_accounts_disabled` and `exchange_organization_reject_direct_send_enabled` checks for M365 provider, covering CIS Microsoft 365 Foundations Benchmark v7.0.0 controls 6.3.2 and 6.5.5
@@ -1 +0,0 @@
 `teams_external_access_trial_tenants_blocked` check for M365 provider, verifying that Teams external access with trial-only tenants is blocked, covering CIS Microsoft 365 Foundations Benchmark v7.0.0 control 8.2.4
@@ -1 +0,0 @@
 Highlighted key security terms in the Risk description of 8 existing M365 checks
@@ -1 +0,0 @@
 OCI Identity service no longer drops the whole dynamic groups, groups, policies or users listing when the OCI API returns null optional fields such as `matching_rule`
@@ -1 +0,0 @@
 The IAM privilege-escalation check now detects 22 additional pathfinding.cloud escalation paths across AWS Batch, Braket, CodeDeploy, Cognito Identity, ECS, EMR, EMR Serverless, GameLift, Glue, EC2 Image Builder, Kinesis Analytics, HealthOmics, EventBridge Scheduler, SSM Automation, Step Functions, IAM permissions boundaries, and IAM Identity Center (SSO)
@@ -1 +0,0 @@
 Container images now ship an SBOM and build provenance as OCI attestations
@@ -1 +0,0 @@
 A failed `ListOrganizationAdminAccounts` lookup in one region no longer marks the Security Hub delegated administrator status as undetermined in every other region
@@ -1 +0,0 @@
 `securityhub_delegated_admin_enabled_all_regions` no longer reports FAIL with `delegated administrator status could not be determined` on accounts that do have a Security Hub delegated administrator; `ListOrganizationAdminAccounts` responses are now parsed with the `AccountId` and `Status` fields the API actually returns
@@ -1 +0,0 @@
 Quote the unquoted shell expansions in the release and build workflows
@@ -1 +0,0 @@
 Fix the remaining shellcheck findings in workflows and enable the check
@@ -1 +0,0 @@
 Pin the container vulnerability scanner to Trivy v0.72.0, matching prowler-registry and partner-portal
@@ -1 +0,0 @@
 Moved the Trivy suppressions from the classic `.trivyignore` to `.trivyignore.yaml`, so each entry is scoped to the package it names instead of suppressing its CVE across the whole image
@@ -1 +0,0 @@
 The SDK container image now verifies the checksum of every third-party binary it downloads (PowerShell, Trivy, zizmor) before installing it
@@ -4,6 +4,37 @@ All notable changes to the **Prowler UI** are documented in this file.
 <!-- changelog: release notes start -->
 ## [1.38.0] (Prowler v5.38.0)
 ### 🚀 Added
 - Sign-in method indicators in the Prowler Cloud Users table, including linked SAML domains [(#12268)](https://github.com/prowler-cloud/prowler/pull/12268)
 - Compliance watchlist: pin frameworks from any compliance view and filter every view down to the pinned ones, including the overview card and a finding's compliance chips (Prowler Cloud only) [(#12300)](https://github.com/prowler-cloud/prowler/pull/12300)
 - Multiple verified email domains in a single SAML configuration for Prowler Cloud [(#12332)](https://github.com/prowler-cloud/prowler/pull/12332)
 - Container images now ship an SBOM and build provenance as OCI attestations [(#12352)](https://github.com/prowler-cloud/prowler/pull/12352)
 ### 🔄 Changed
 - `Add Provider` wizard documentation link targeting each provider's credentials section and selected authentication method [(#12218)](https://github.com/prowler-cloud/prowler/pull/12218)
 ### 🐞 Fixed
 - Imported scans now appear on the Scans page even when no provider is connected [(#12025)](https://github.com/prowler-cloud/prowler/pull/12025)
 - Feedback widget no longer obscures page and side-panel actions [(#12282)](https://github.com/prowler-cloud/prowler/pull/12282)
 - Rows-per-page selector no longer disappears when the chosen page size collapses a table to a single page [(#12299)](https://github.com/prowler-cloud/prowler/pull/12299)
 - Overview ThreatScore card no longer leaves unused horizontal space at responsive layout boundaries [(#12317)](https://github.com/prowler-cloud/prowler/pull/12317)
 - Overview metric cards stack below the desktop layout threshold and preserve readable widths when aligned [(#12323)](https://github.com/prowler-cloud/prowler/pull/12323)
 - Overview metric cards now align horizontally at medium desktop widths [(#12323)](https://github.com/prowler-cloud/prowler/pull/12323)
 - AWS and GCP organization onboarding launches all linked provider scans through one bulk operation [(#12350)](https://github.com/prowler-cloud/prowler/pull/12350)
 - `/compliance` no longer fails while compliance overview data is still being generated [(#12358)](https://github.com/prowler-cloud/prowler/pull/12358)
 - `Client Secret` and `Refresh Token` labels in the GCP organization authentication form [(#12362)](https://github.com/prowler-cloud/prowler/pull/12362)
 ### 🔐 Security
 - Removed the `apk upgrade` from the UI image and moved the base digest forward instead, so the image is reproducible from its pin rather than from whatever Alpine serves at build time [(#12313)](https://github.com/prowler-cloud/prowler/pull/12313)
 ---
 ## [1.37.1] (Prowler v5.37.1)
 ### 🐞 Fixed
@@ -1 +0,0 @@
 `/compliance` no longer fails while compliance overview data is still being generated
@@ -1 +0,0 @@
 Compliance watchlist: pin frameworks from any compliance view and filter every view down to the pinned ones, including the overview card and a finding's compliance chips (Prowler Cloud only)
@@ -1 +0,0 @@
 Imported scans now appear on the Scans page even when no provider is connected
@@ -1 +0,0 @@
 Feedback widget no longer obscures page and side-panel actions
@@ -1 +0,0 @@
 `Client Secret` and `Refresh Token` labels in the GCP organization authentication form
@@ -1 +0,0 @@
 AWS and GCP organization onboarding launches all linked provider scans through one bulk operation
@@ -1 +0,0 @@
 Overview metric cards stack below the desktop layout threshold and preserve readable widths when aligned
@@ -1 +0,0 @@
 Overview metric cards now align horizontally at medium desktop widths
@@ -1 +0,0 @@
 Overview ThreatScore card no longer leaves unused horizontal space at responsive layout boundaries
@@ -1 +0,0 @@
 `Add Provider` wizard documentation link targeting each provider's credentials section and selected authentication method
@@ -1 +0,0 @@
 Multiple verified email domains in a single SAML configuration for Prowler Cloud
@@ -1 +0,0 @@
 Rows-per-page selector no longer disappears when the chosen page size collapses a table to a single page
@@ -1 +0,0 @@
 Removed the `apk upgrade` from the UI image and moved the base digest forward instead, so the image is reproducible from its pin rather than from whatever Alpine serves at build time
@@ -1 +0,0 @@
 Container images now ship an SBOM and build provenance as OCI attestations
@@ -1 +0,0 @@
 Sign-in method indicators in the Prowler Cloud Users table, including linked SAML domains
		`@@ -1 +0,0 @@`
			`Upgrade aiohttp to 3.14.3 to pick up the fix for CVE-2026-69244`
		`@@ -1 +0,0 @@`
			`Upgrade cryptography to 50.0.0, closing CVE-2026-69247 and CVE-2026-69249`
		`@@ -1 +0,0 @@`
			Restored the SDK dependency to `@master` now that the dependency bumps have landed there, and regenerated the lock. The API image no longer builds against a temporary integration branch
		`@@ -1 +0,0 @@`
			`Container images now ship an SBOM and build provenance as OCI attestations`
		`@@ -1 +0,0 @@`
			`Pin the container vulnerability scanner to Trivy v0.72.0, matching prowler-registry and partner-portal`
		`@@ -1 +0,0 @@`
			`The API container image now verifies the checksum of every third-party binary it downloads (PowerShell, Trivy, zizmor) before installing it`
		`@@ -1 +0,0 @@`
			`Attack Paths query metadata now carries an outcome (Code execution, Privilege escalation, Public exposure, or Resource inventory), exposed on the queries endpoint so the graph can show a terminal outcome node`
		`@@ -1 +0,0 @@`
			`Attack Paths adds 20 AWS privilege-escalation detection queries from pathfinding.cloud, covering service PassRole escalations (Batch, Braket, Cognito Identity, ECS, EMR, EMR Serverless, GameLift, Glue, EC2 Image Builder, Kinesis Analytics, HealthOmics, EventBridge Scheduler, SSM, Step Functions), CodeDeploy and Step Functions existing-resource abuse, role permissions-boundary removal with role assumption, and IAM Identity Center permission-set policy injection`
		`@@ -1 +0,0 @@`
			Compliance report output directory failures are now logged with the exception attached and fingerprinted by `errno` in Sentry, so `ENOSPC`, `ENOENT` and `EACCES` no longer share a single issue
		`@@ -1 +0,0 @@`
			`Test coverage for the integrations tools and models, pinning the connection-check choreography and the Jira dispatch retry safety`