From 2298d4a3f881abe9e2266195f764b60d34af07eb Mon Sep 17 00:00:00 2001 From: Prowler Bot Date: Fri, 24 Jul 2026 12:22:40 +0200 Subject: [PATCH] chore(changelog): v5.36.0 (#12109) Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com> --- api/CHANGELOG.md | 22 ++++++++++++++ ...nce-overview-single-transaction.changed.md | 1 - ...ns-hidden-providers-disclosure.security.md | 1 - .../integrations-limited-visibility.fixed.md | 1 - .../integrations-object-scoping.security.md | 1 - .../integrations-provider-scoping.security.md | 1 - ...ernetes-auth-provider-cmd-path.security.md | 1 - ...ci-regionless-api-legacy-region.changed.md | 1 - .../output-generation-duplicate-rows.fixed.md | 1 - .../synthetic-resource-cache-miss.fixed.md | 1 - prowler/CHANGELOG.md | 17 +++++++++++ ...acloud-security-group-policy-case.fixed.md | 1 - .../bucket-validation-syntaxwarning.fixed.md | 1 - .../grouped-jira-dispatch.changed.md | 1 - .../sagemaker-notebook-no-secrets.added.md | 1 - ui/CHANGELOG.md | 29 +++++++++++++++++++ ...attack-paths-filter-empty-queries.added.md | 1 - ...organizations-ou-hint-error-color.fixed.md | 1 - .../enterprise-billing-navigation.fixed.md | 1 - .../findings-timeline-y-axis.fixed.md | 1 - .../grouped-jira-dispatch-ui.added.md | 1 - ...ernetes-auth-provider-cmd-path.security.md | 1 - .../next-auth-critical-advisories.security.md | 1 - ui/changelog.d/nextjs-16.2.11.security.md | 1 - .../oci-regionless-provider-e2e.fixed.md | 1 - .../overview-agents-banner.added.md | 1 - ...er-2254-cloud-upgrade-modal-flash.fixed.md | 1 - .../sidebar-logo-top-padding.fixed.md | 1 - .../tenant-switch-permissions.fixed.md | 1 - .../ui-sentry-actionability.fixed.md | 1 - ...i-trivy-cve-2026-59873-npm-tar.security.md | 1 - ...est-browser-file-access-bypass.security.md | 1 - 32 files changed, 68 insertions(+), 29 deletions(-) delete mode 100644 api/changelog.d/compliance-overview-single-transaction.changed.md delete mode 100644 api/changelog.d/integrations-hidden-providers-disclosure.security.md delete mode 100644 api/changelog.d/integrations-limited-visibility.fixed.md delete mode 100644 api/changelog.d/integrations-object-scoping.security.md delete mode 100644 api/changelog.d/integrations-provider-scoping.security.md delete mode 100644 api/changelog.d/kubernetes-auth-provider-cmd-path.security.md delete mode 100644 api/changelog.d/oci-regionless-api-legacy-region.changed.md delete mode 100644 api/changelog.d/output-generation-duplicate-rows.fixed.md delete mode 100644 api/changelog.d/synthetic-resource-cache-miss.fixed.md delete mode 100644 prowler/changelog.d/alibabacloud-security-group-policy-case.fixed.md delete mode 100644 prowler/changelog.d/bucket-validation-syntaxwarning.fixed.md delete mode 100644 prowler/changelog.d/grouped-jira-dispatch.changed.md delete mode 100644 prowler/changelog.d/sagemaker-notebook-no-secrets.added.md delete mode 100644 ui/changelog.d/attack-paths-filter-empty-queries.added.md delete mode 100644 ui/changelog.d/aws-organizations-ou-hint-error-color.fixed.md delete mode 100644 ui/changelog.d/enterprise-billing-navigation.fixed.md delete mode 100644 ui/changelog.d/findings-timeline-y-axis.fixed.md delete mode 100644 ui/changelog.d/grouped-jira-dispatch-ui.added.md delete mode 100644 ui/changelog.d/kubernetes-auth-provider-cmd-path.security.md delete mode 100644 ui/changelog.d/next-auth-critical-advisories.security.md delete mode 100644 ui/changelog.d/nextjs-16.2.11.security.md delete mode 100644 ui/changelog.d/oci-regionless-provider-e2e.fixed.md delete mode 100644 ui/changelog.d/overview-agents-banner.added.md delete mode 100644 ui/changelog.d/prowler-2254-cloud-upgrade-modal-flash.fixed.md delete mode 100644 ui/changelog.d/sidebar-logo-top-padding.fixed.md delete mode 100644 ui/changelog.d/tenant-switch-permissions.fixed.md delete mode 100644 ui/changelog.d/ui-sentry-actionability.fixed.md delete mode 100644 ui/changelog.d/ui-trivy-cve-2026-59873-npm-tar.security.md delete mode 100644 ui/changelog.d/ui-vitest-browser-file-access-bypass.security.md diff --git a/api/CHANGELOG.md b/api/CHANGELOG.md index 1b26c2b014..bf196f6328 100644 --- a/api/CHANGELOG.md +++ b/api/CHANGELOG.md @@ -4,6 +4,28 @@ All notable changes to the **Prowler API** are documented in this file. +## [1.37.0] (Prowler v5.36.0) + +### 🔄 Changed + +- OCI provider secrets no longer require `region`; legacy `region` input is accepted for backwards compatibility but ignored before storing or scanning [(#11741)](https://github.com/prowler-cloud/prowler/pull/11741) +- Compliance overview ingest now runs in a single transaction per scan with a configurable `COPY` batch size (`DJANGO_COMPLIANCE_COPY_BATCH_SIZE`, default 2000), reducing write pressure on the database [(#11875)](https://github.com/prowler-cloud/prowler/pull/11875) + +### 🐞 Fixed + +- Scan findings now recover resources missing from the in-memory cache after resource pre-resolution, preventing valid findings from being skipped [(#12002)](https://github.com/prowler-cloud/prowler/pull/12002) +- Tenant-wide integrations that are not attached to any provider, such as Jira, are now visible and manageable by roles with `manage_integrations` and without unlimited visibility [(#12060)](https://github.com/prowler-cloud/prowler/pull/12060) +- Output generation now removes the scan's temporary output directory before writing, so a re-run of the task for the same scan (e.g. broker redelivery after a worker is killed mid-run) no longer appends to the previous run's files and duplicates finding rows in the exported CSV and other outputs [(#12097)](https://github.com/prowler-cloud/prowler/pull/12097) + +### 🔐 Security + +- Integration responses no longer disclose providers outside the visibility of the role, including the resources sideloaded through `?include=providers` [(#12060)](https://github.com/prowler-cloud/prowler/pull/12060) +- Integration connection checks, Jira issue type lookups and Jira dispatches now resolve the integration through the provider visibility of the role instead of the whole tenant [(#12060)](https://github.com/prowler-cloud/prowler/pull/12060) +- Roles without unlimited visibility can no longer attach an integration to providers they cannot see, nor edit or delete an integration bound to them [(#12060)](https://github.com/prowler-cloud/prowler/pull/12060) +- Kubernetes kubeconfig validation now rejects legacy `auth-provider.config.cmd-path` command authentication in Prowler Cloud/API [(#12091)](https://github.com/prowler-cloud/prowler/pull/12091) + +--- + ## [1.36.0] (Prowler v5.35.0) ### 🐞 Fixed diff --git a/api/changelog.d/compliance-overview-single-transaction.changed.md b/api/changelog.d/compliance-overview-single-transaction.changed.md deleted file mode 100644 index 0e7a6714b3..0000000000 --- a/api/changelog.d/compliance-overview-single-transaction.changed.md +++ /dev/null @@ -1 +0,0 @@ -Compliance overview ingest now runs in a single transaction per scan with a configurable `COPY` batch size (`DJANGO_COMPLIANCE_COPY_BATCH_SIZE`, default 2000), reducing write pressure on the database diff --git a/api/changelog.d/integrations-hidden-providers-disclosure.security.md b/api/changelog.d/integrations-hidden-providers-disclosure.security.md deleted file mode 100644 index 4ea169d4fe..0000000000 --- a/api/changelog.d/integrations-hidden-providers-disclosure.security.md +++ /dev/null @@ -1 +0,0 @@ -Integration responses no longer disclose providers outside the visibility of the role, including the resources sideloaded through `?include=providers` diff --git a/api/changelog.d/integrations-limited-visibility.fixed.md b/api/changelog.d/integrations-limited-visibility.fixed.md deleted file mode 100644 index c8f7e2c450..0000000000 --- a/api/changelog.d/integrations-limited-visibility.fixed.md +++ /dev/null @@ -1 +0,0 @@ -Tenant-wide integrations that are not attached to any provider, such as Jira, are now visible and manageable by roles with `manage_integrations` and without unlimited visibility diff --git a/api/changelog.d/integrations-object-scoping.security.md b/api/changelog.d/integrations-object-scoping.security.md deleted file mode 100644 index 877190fc1b..0000000000 --- a/api/changelog.d/integrations-object-scoping.security.md +++ /dev/null @@ -1 +0,0 @@ -Integration connection checks, Jira issue type lookups and Jira dispatches now resolve the integration through the provider visibility of the role instead of the whole tenant diff --git a/api/changelog.d/integrations-provider-scoping.security.md b/api/changelog.d/integrations-provider-scoping.security.md deleted file mode 100644 index eec84285a4..0000000000 --- a/api/changelog.d/integrations-provider-scoping.security.md +++ /dev/null @@ -1 +0,0 @@ -Roles without unlimited visibility can no longer attach an integration to providers they cannot see, nor edit or delete an integration bound to them diff --git a/api/changelog.d/kubernetes-auth-provider-cmd-path.security.md b/api/changelog.d/kubernetes-auth-provider-cmd-path.security.md deleted file mode 100644 index 68ccd007e7..0000000000 --- a/api/changelog.d/kubernetes-auth-provider-cmd-path.security.md +++ /dev/null @@ -1 +0,0 @@ -Kubernetes kubeconfig validation now rejects legacy `auth-provider.config.cmd-path` command authentication in Prowler Cloud/API diff --git a/api/changelog.d/oci-regionless-api-legacy-region.changed.md b/api/changelog.d/oci-regionless-api-legacy-region.changed.md deleted file mode 100644 index 087b027c88..0000000000 --- a/api/changelog.d/oci-regionless-api-legacy-region.changed.md +++ /dev/null @@ -1 +0,0 @@ -OCI provider secrets no longer require `region`; legacy `region` input is accepted for backwards compatibility but ignored before storing or scanning diff --git a/api/changelog.d/output-generation-duplicate-rows.fixed.md b/api/changelog.d/output-generation-duplicate-rows.fixed.md deleted file mode 100644 index a503a56a03..0000000000 --- a/api/changelog.d/output-generation-duplicate-rows.fixed.md +++ /dev/null @@ -1 +0,0 @@ -Output generation now removes the scan's temporary output directory before writing, so a re-run of the task for the same scan (e.g. broker redelivery after a worker is killed mid-run) no longer appends to the previous run's files and duplicates finding rows in the exported CSV and other outputs diff --git a/api/changelog.d/synthetic-resource-cache-miss.fixed.md b/api/changelog.d/synthetic-resource-cache-miss.fixed.md deleted file mode 100644 index 743ac7379b..0000000000 --- a/api/changelog.d/synthetic-resource-cache-miss.fixed.md +++ /dev/null @@ -1 +0,0 @@ -Scan findings now recover resources missing from the in-memory cache after resource pre-resolution, preventing valid findings from being skipped diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index 408c76d3e1..82495c340b 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -4,6 +4,23 @@ All notable changes to the **Prowler SDK** are documented in this file. +## [5.36.0] (Prowler v5.36.0) + +### 🚀 Added + +- `sagemaker_notebook_instance_no_secrets` check for AWS provider, scanning SageMaker notebook instance lifecycle configuration scripts (`OnCreate` and `OnStart`) for hardcoded secrets such as API keys, passwords, tokens, and connection strings [(#11843)](https://github.com/prowler-cloud/prowler/pull/11843) + +### 🔄 Changed + +- Jira output rendering supports grouped Finding Group issues with caller-provided links and capped or uncapped finding copy [(#12035)](https://github.com/prowler-cloud/prowler/pull/12035) + +### 🐞 Fixed + +- Fix invalid escape sequence `SyntaxWarning` raised on startup by the S3 bucket name validation regex [(#12041)](https://github.com/prowler-cloud/prowler/pull/12041) +- Alibaba Cloud SSH and RDP security group checks no longer produce false negatives when allowed rules use capitalized `Policy="Accept"` values [(#12049)](https://github.com/prowler-cloud/prowler/pull/12049) + +--- + ## [5.35.0] (Prowler v5.35.0) ### 🚀 Added diff --git a/prowler/changelog.d/alibabacloud-security-group-policy-case.fixed.md b/prowler/changelog.d/alibabacloud-security-group-policy-case.fixed.md deleted file mode 100644 index cef4ff076c..0000000000 --- a/prowler/changelog.d/alibabacloud-security-group-policy-case.fixed.md +++ /dev/null @@ -1 +0,0 @@ -Alibaba Cloud SSH and RDP security group checks no longer produce false negatives when allowed rules use capitalized `Policy="Accept"` values diff --git a/prowler/changelog.d/bucket-validation-syntaxwarning.fixed.md b/prowler/changelog.d/bucket-validation-syntaxwarning.fixed.md deleted file mode 100644 index ceba09541c..0000000000 --- a/prowler/changelog.d/bucket-validation-syntaxwarning.fixed.md +++ /dev/null @@ -1 +0,0 @@ -Fix invalid escape sequence `SyntaxWarning` raised on startup by the S3 bucket name validation regex diff --git a/prowler/changelog.d/grouped-jira-dispatch.changed.md b/prowler/changelog.d/grouped-jira-dispatch.changed.md deleted file mode 100644 index 8dd2e43ab5..0000000000 --- a/prowler/changelog.d/grouped-jira-dispatch.changed.md +++ /dev/null @@ -1 +0,0 @@ -Jira output rendering supports grouped Finding Group issues with caller-provided links and capped or uncapped finding copy diff --git a/prowler/changelog.d/sagemaker-notebook-no-secrets.added.md b/prowler/changelog.d/sagemaker-notebook-no-secrets.added.md deleted file mode 100644 index 4789aa6aaf..0000000000 --- a/prowler/changelog.d/sagemaker-notebook-no-secrets.added.md +++ /dev/null @@ -1 +0,0 @@ -`sagemaker_notebook_instance_no_secrets` check for AWS provider, scanning SageMaker notebook instance lifecycle configuration scripts (`OnCreate` and `OnStart`) for hardcoded secrets such as API keys, passwords, tokens, and connection strings diff --git a/ui/CHANGELOG.md b/ui/CHANGELOG.md index 40cb61691f..c3dba27145 100644 --- a/ui/CHANGELOG.md +++ b/ui/CHANGELOG.md @@ -4,6 +4,35 @@ All notable changes to the **Prowler UI** are documented in this file. +## [1.36.0] (Prowler v5.36.0) + +### 🚀 Added + +- Finding Groups and grouped selections can be sent to Jira in Cloud with deep links, filter chip display, and Jira feedback toasts [(#12001)](https://github.com/prowler-cloud/prowler/pull/12001) +- In Prowler Cloud, the Attack Paths query selector now lists only queries that returned data for the selected scan, hiding empty ones [(#12010)](https://github.com/prowler-cloud/prowler/pull/12010) +- Overview banner linking to the AI agents documentation, shown next to the Lighthouse AI banner in Cloud and full width on self-hosted deployments [(#12074)](https://github.com/prowler-cloud/prowler/pull/12074) + +### 🐞 Fixed + +- Findings Severity Over Time chart Y-axis labels no longer overflow for large findings counts [(#11545)](https://github.com/prowler-cloud/prowler/pull/11545) +- UI Sentry alerts now suppress non-actionable warnings and expected API/control-flow noise while preserving actionable runtime failures [(#11665)](https://github.com/prowler-cloud/prowler/pull/11665) +- OCI provider E2E tests no longer require or submit a region when adding or updating credentials [(#11741)](https://github.com/prowler-cloud/prowler/pull/11741) +- Billing navigation is hidden when Cloud billing is disabled, including Enterprise deployments [(#12047)](https://github.com/prowler-cloud/prowler/pull/12047) +- AWS Organizations setup modal now shows the "Enter a valid Organizational Unit or Root ID" hint in the error color, clarifying why the deployment button is disabled [(#12063)](https://github.com/prowler-cloud/prowler/pull/12063) +- Sidebar logo top spacing in the main app sidebar [(#12066)](https://github.com/prowler-cloud/prowler/pull/12066) +- Contextual Cloud upgrade modal content remains stable throughout the closing animation [(#12067)](https://github.com/prowler-cloud/prowler/pull/12067) +- Tenant switches now refresh session user permissions for the selected tenant [(#12087)](https://github.com/prowler-cloud/prowler/pull/12087) + +### 🔐 Security + +- Removed the unused `npm` CLI from the UI container image, eliminating the bundled `node-tar` `CVE-2026-59873` (and future bundled-npm CVEs); the image builds with `pnpm` via `corepack` and does not use `npm` [(#12065)](https://github.com/prowler-cloud/prowler/pull/12065) +- Bumped `vitest` and `@vitest/browser`, `@vitest/browser-playwright`, `@vitest/coverage-v8` from `4.1.8` to `4.1.10`, resolving the critical `@vitest/browser` Browser Mode file-access permission bypass (`GHSA-p63j-vcc4-9vmv`) flagged by `pnpm audit`; dev dependencies only, no runtime impact [(#12077)](https://github.com/prowler-cloud/prowler/pull/12077) +- Kubernetes credential forms now reject kubeconfig files using legacy `auth-provider.config.cmd-path` command authentication [(#12091)](https://github.com/prowler-cloud/prowler/pull/12091) +- Next.js from 16.2.9 to 16.2.11, patching 4 high- and 5 medium-severity vulnerabilities [(#12093)](https://github.com/prowler-cloud/prowler/pull/12093) +- next-auth from 5.0.0-beta.30 to 5.0.0-beta.32, patching 2 critical Auth.js advisories (GHSA-8fpg-xm3f-6cx3 fail-open auth checks, GHSA-7rqj-j65f-68wh email homoglyph bypass) [(#12108)](https://github.com/prowler-cloud/prowler/pull/12108) + +--- + ## [1.35.0] (Prowler v5.35.0) ### 🔄 Changed diff --git a/ui/changelog.d/attack-paths-filter-empty-queries.added.md b/ui/changelog.d/attack-paths-filter-empty-queries.added.md deleted file mode 100644 index b9087b0ff4..0000000000 --- a/ui/changelog.d/attack-paths-filter-empty-queries.added.md +++ /dev/null @@ -1 +0,0 @@ -In Prowler Cloud, the Attack Paths query selector now lists only queries that returned data for the selected scan, hiding empty ones diff --git a/ui/changelog.d/aws-organizations-ou-hint-error-color.fixed.md b/ui/changelog.d/aws-organizations-ou-hint-error-color.fixed.md deleted file mode 100644 index d6601faf8c..0000000000 --- a/ui/changelog.d/aws-organizations-ou-hint-error-color.fixed.md +++ /dev/null @@ -1 +0,0 @@ -AWS Organizations setup modal now shows the "Enter a valid Organizational Unit or Root ID" hint in the error color, clarifying why the deployment button is disabled diff --git a/ui/changelog.d/enterprise-billing-navigation.fixed.md b/ui/changelog.d/enterprise-billing-navigation.fixed.md deleted file mode 100644 index 0ea2b4d31e..0000000000 --- a/ui/changelog.d/enterprise-billing-navigation.fixed.md +++ /dev/null @@ -1 +0,0 @@ -Billing navigation is hidden when Cloud billing is disabled, including Enterprise deployments diff --git a/ui/changelog.d/findings-timeline-y-axis.fixed.md b/ui/changelog.d/findings-timeline-y-axis.fixed.md deleted file mode 100644 index 4dd338070f..0000000000 --- a/ui/changelog.d/findings-timeline-y-axis.fixed.md +++ /dev/null @@ -1 +0,0 @@ -Findings Severity Over Time chart Y-axis labels no longer overflow for large findings counts diff --git a/ui/changelog.d/grouped-jira-dispatch-ui.added.md b/ui/changelog.d/grouped-jira-dispatch-ui.added.md deleted file mode 100644 index e314c0547b..0000000000 --- a/ui/changelog.d/grouped-jira-dispatch-ui.added.md +++ /dev/null @@ -1 +0,0 @@ -Finding Groups and grouped selections can be sent to Jira in Cloud with deep links, filter chip display, and Jira feedback toasts diff --git a/ui/changelog.d/kubernetes-auth-provider-cmd-path.security.md b/ui/changelog.d/kubernetes-auth-provider-cmd-path.security.md deleted file mode 100644 index b7cb540243..0000000000 --- a/ui/changelog.d/kubernetes-auth-provider-cmd-path.security.md +++ /dev/null @@ -1 +0,0 @@ -Kubernetes credential forms now reject kubeconfig files using legacy `auth-provider.config.cmd-path` command authentication diff --git a/ui/changelog.d/next-auth-critical-advisories.security.md b/ui/changelog.d/next-auth-critical-advisories.security.md deleted file mode 100644 index b4fb8b02c8..0000000000 --- a/ui/changelog.d/next-auth-critical-advisories.security.md +++ /dev/null @@ -1 +0,0 @@ -next-auth from 5.0.0-beta.30 to 5.0.0-beta.32, patching 2 critical Auth.js advisories (GHSA-8fpg-xm3f-6cx3 fail-open auth checks, GHSA-7rqj-j65f-68wh email homoglyph bypass) diff --git a/ui/changelog.d/nextjs-16.2.11.security.md b/ui/changelog.d/nextjs-16.2.11.security.md deleted file mode 100644 index 2f38485f2d..0000000000 --- a/ui/changelog.d/nextjs-16.2.11.security.md +++ /dev/null @@ -1 +0,0 @@ -Next.js from 16.2.9 to 16.2.11, patching 4 high- and 5 medium-severity vulnerabilities diff --git a/ui/changelog.d/oci-regionless-provider-e2e.fixed.md b/ui/changelog.d/oci-regionless-provider-e2e.fixed.md deleted file mode 100644 index 2e413a6fa8..0000000000 --- a/ui/changelog.d/oci-regionless-provider-e2e.fixed.md +++ /dev/null @@ -1 +0,0 @@ -OCI provider E2E tests no longer require or submit a region when adding or updating credentials diff --git a/ui/changelog.d/overview-agents-banner.added.md b/ui/changelog.d/overview-agents-banner.added.md deleted file mode 100644 index 9bd386d4e9..0000000000 --- a/ui/changelog.d/overview-agents-banner.added.md +++ /dev/null @@ -1 +0,0 @@ -Overview banner linking to the AI agents documentation, shown next to the Lighthouse AI banner in Cloud and full width on self-hosted deployments diff --git a/ui/changelog.d/prowler-2254-cloud-upgrade-modal-flash.fixed.md b/ui/changelog.d/prowler-2254-cloud-upgrade-modal-flash.fixed.md deleted file mode 100644 index ec0b5fd863..0000000000 --- a/ui/changelog.d/prowler-2254-cloud-upgrade-modal-flash.fixed.md +++ /dev/null @@ -1 +0,0 @@ -Contextual Cloud upgrade modal content remains stable throughout the closing animation diff --git a/ui/changelog.d/sidebar-logo-top-padding.fixed.md b/ui/changelog.d/sidebar-logo-top-padding.fixed.md deleted file mode 100644 index c9a3dc6ef8..0000000000 --- a/ui/changelog.d/sidebar-logo-top-padding.fixed.md +++ /dev/null @@ -1 +0,0 @@ -Sidebar logo top spacing in the main app sidebar diff --git a/ui/changelog.d/tenant-switch-permissions.fixed.md b/ui/changelog.d/tenant-switch-permissions.fixed.md deleted file mode 100644 index b268fad2dd..0000000000 --- a/ui/changelog.d/tenant-switch-permissions.fixed.md +++ /dev/null @@ -1 +0,0 @@ -Tenant switches now refresh session user permissions for the selected tenant diff --git a/ui/changelog.d/ui-sentry-actionability.fixed.md b/ui/changelog.d/ui-sentry-actionability.fixed.md deleted file mode 100644 index 7a4b8ce2ca..0000000000 --- a/ui/changelog.d/ui-sentry-actionability.fixed.md +++ /dev/null @@ -1 +0,0 @@ -UI Sentry alerts now suppress non-actionable warnings and expected API/control-flow noise while preserving actionable runtime failures diff --git a/ui/changelog.d/ui-trivy-cve-2026-59873-npm-tar.security.md b/ui/changelog.d/ui-trivy-cve-2026-59873-npm-tar.security.md deleted file mode 100644 index d446e6c2b5..0000000000 --- a/ui/changelog.d/ui-trivy-cve-2026-59873-npm-tar.security.md +++ /dev/null @@ -1 +0,0 @@ -Removed the unused `npm` CLI from the UI container image, eliminating the bundled `node-tar` `CVE-2026-59873` (and future bundled-npm CVEs); the image builds with `pnpm` via `corepack` and does not use `npm` diff --git a/ui/changelog.d/ui-vitest-browser-file-access-bypass.security.md b/ui/changelog.d/ui-vitest-browser-file-access-bypass.security.md deleted file mode 100644 index 667a41d2c1..0000000000 --- a/ui/changelog.d/ui-vitest-browser-file-access-bypass.security.md +++ /dev/null @@ -1 +0,0 @@ -Bumped `vitest` and `@vitest/browser`, `@vitest/browser-playwright`, `@vitest/coverage-v8` from `4.1.8` to `4.1.10`, resolving the critical `@vitest/browser` Browser Mode file-access permission bypass (`GHSA-p63j-vcc4-9vmv`) flagged by `pnpm audit`; dev dependencies only, no runtime impact