From 6d7b1ef153e9389dbd20a8c2079b4e6170faaa59 Mon Sep 17 00:00:00 2001 From: Prowler Bot Date: Tue, 4 Aug 2026 12:11:35 +0200 Subject: [PATCH] chore(changelog): v5.37.1 (#12321) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com> Co-authored-by: CΓ©sar Arroba --- api/CHANGELOG.md | 18 +++++++++++++++ ...-container-high-severity-bumps.security.md | 1 - .../api-container-keep-wget.fixed.md | 1 - ...api-container-purge-build-only.security.md | 1 - .../api-container-purge-git.security.md | 1 - .../api-container-remove-pip.security.md | 1 - .../api-container-trixie.security.md | 1 - ...api-deps-cryptography-48-chain.security.md | 1 - .../api-deps-cve-bumps.security.md | 1 - .../api-integration-branch-sdk-pin.fixed.md | 1 - .../entra-guest-user-types-empty.fixed.md | 1 - mcp_server/CHANGELOG.md | 8 +++++++ .../mcp-transitive-cve-bumps.security.md | 1 - prowler/CHANGELOG.md | 23 +++++++++++++++++++ .../compose-infra-pin-alignment.security.md | 1 - .../container-high-severity-bumps.security.md | 1 - ...iner-purge-build-only-packages.security.md | 1 - .../container-remove-pip.security.md | 1 - .../entra-guest-user-types-empty.fixed.md | 1 - ...hecks-builtin-provider-resolution.fixed.md | 1 - ...uaweicloud-exception-code-range.changed.md | 1 - .../sdk-container-trixie.security.md | 1 - .../sdk-cryptography-48.security.md | 1 - .../sdk-deps-cve-bumps.security.md | 1 - ui/CHANGELOG.md | 12 ++++++++++ .../ui-container-musl-zlib-sharp.security.md | 1 - .../ui-sharp-standalone-tracing.fixed.md | 1 - 27 files changed, 61 insertions(+), 23 deletions(-) delete mode 100644 api/changelog.d/api-container-high-severity-bumps.security.md delete mode 100644 api/changelog.d/api-container-keep-wget.fixed.md delete mode 100644 api/changelog.d/api-container-purge-build-only.security.md delete mode 100644 api/changelog.d/api-container-purge-git.security.md delete mode 100644 api/changelog.d/api-container-remove-pip.security.md delete mode 100644 api/changelog.d/api-container-trixie.security.md delete mode 100644 api/changelog.d/api-deps-cryptography-48-chain.security.md delete mode 100644 api/changelog.d/api-deps-cve-bumps.security.md delete mode 100644 api/changelog.d/api-integration-branch-sdk-pin.fixed.md delete mode 100644 api/changelog.d/entra-guest-user-types-empty.fixed.md delete mode 100644 mcp_server/changelog.d/mcp-transitive-cve-bumps.security.md delete mode 100644 prowler/changelog.d/compose-infra-pin-alignment.security.md delete mode 100644 prowler/changelog.d/container-high-severity-bumps.security.md delete mode 100644 prowler/changelog.d/container-purge-build-only-packages.security.md delete mode 100644 prowler/changelog.d/container-remove-pip.security.md delete mode 100644 prowler/changelog.d/entra-guest-user-types-empty.fixed.md delete mode 100644 prowler/changelog.d/external-checks-builtin-provider-resolution.fixed.md delete mode 100644 prowler/changelog.d/huaweicloud-exception-code-range.changed.md delete mode 100644 prowler/changelog.d/sdk-container-trixie.security.md delete mode 100644 prowler/changelog.d/sdk-cryptography-48.security.md delete mode 100644 prowler/changelog.d/sdk-deps-cve-bumps.security.md delete mode 100644 ui/changelog.d/ui-container-musl-zlib-sharp.security.md delete mode 100644 ui/changelog.d/ui-sharp-standalone-tracing.fixed.md diff --git a/api/CHANGELOG.md b/api/CHANGELOG.md index 6697844e94..3fb567e6a0 100644 --- a/api/CHANGELOG.md +++ b/api/CHANGELOG.md @@ -4,6 +4,24 @@ All notable changes to the **Prowler API** are documented in this file. +## [1.38.1] (Prowler v5.37.1) + +### 🐞 Fixed + +- Entra Conditional Access guest-user checks no longer report false FAILs in M365 scans: microsoft-kiota packages overridden to 1.9.10 so `guestOrExternalUserTypes` (a flags enum Graph serializes as a comma-separated string) deserializes correctly instead of returning an empty list [(#12315)](https://github.com/prowler-cloud/prowler/pull/12315) + +### πŸ” Security + +- The API container image now builds on Debian 13 (trixie), taking its critical CVE count from 18 to 4 [(#12311)](https://github.com/prowler-cloud/prowler/pull/12311) +- Bumped PowerShell, Trivy and uv in the API container image, clearing 14 high-severity CVEs [(#12311)](https://github.com/prowler-cloud/prowler/pull/12311) +- Bumped `workos` and `pyopenssl` so the API can move to `cryptography` 48.0.1 [(#12311)](https://github.com/prowler-cloud/prowler/pull/12311) +- Removed `gnupg` and `apt-transport-https` from the API container image [(#12311)](https://github.com/prowler-cloud/prowler/pull/12311) +- The API container image no longer ships `git`; removing it also dropped `perl`, `perl-modules`, `libperl` and `liberror-perl`, clearing 12 critical CVEs. Only `perl-base` remains, which Debian marks Essential and cannot be removed [(#12311)](https://github.com/prowler-cloud/prowler/pull/12311) +- Removed `pip` from the API container image, clearing two high-severity CVEs in the vendored copies of `setuptools` and `msgpack` [(#12311)](https://github.com/prowler-cloud/prowler/pull/12311) +- Bumped `pillow` to 12.3.0, `httplib2` to 0.32.0 and `pyasn1` to 0.6.4 to resolve known CVEs [(#12311)](https://github.com/prowler-cloud/prowler/pull/12311) + +--- + ## [1.38.0] (Prowler v5.37.0) ### πŸš€ Added diff --git a/api/changelog.d/api-container-high-severity-bumps.security.md b/api/changelog.d/api-container-high-severity-bumps.security.md deleted file mode 100644 index ff5aff0048..0000000000 --- a/api/changelog.d/api-container-high-severity-bumps.security.md +++ /dev/null @@ -1 +0,0 @@ -Bumped PowerShell, Trivy and uv in the API container image, clearing 14 high-severity CVEs diff --git a/api/changelog.d/api-container-keep-wget.fixed.md b/api/changelog.d/api-container-keep-wget.fixed.md deleted file mode 100644 index fadb4e8c77..0000000000 --- a/api/changelog.d/api-container-keep-wget.fixed.md +++ /dev/null @@ -1 +0,0 @@ -Restored `wget` in the API container image, which the Compose healthcheck depends on diff --git a/api/changelog.d/api-container-purge-build-only.security.md b/api/changelog.d/api-container-purge-build-only.security.md deleted file mode 100644 index fd7678700c..0000000000 --- a/api/changelog.d/api-container-purge-build-only.security.md +++ /dev/null @@ -1 +0,0 @@ -Removed `gnupg` and `apt-transport-https` from the API container image; `wget` is retained because the Compose healthcheck invokes it diff --git a/api/changelog.d/api-container-purge-git.security.md b/api/changelog.d/api-container-purge-git.security.md deleted file mode 100644 index a757a17ab3..0000000000 --- a/api/changelog.d/api-container-purge-git.security.md +++ /dev/null @@ -1 +0,0 @@ -The API container image no longer ships `git`; removing it also dropped `perl`, `perl-modules`, `libperl` and `liberror-perl`, clearing 12 critical CVEs. Only `perl-base` remains, which Debian marks Essential and cannot be removed diff --git a/api/changelog.d/api-container-remove-pip.security.md b/api/changelog.d/api-container-remove-pip.security.md deleted file mode 100644 index 70948d2a8d..0000000000 --- a/api/changelog.d/api-container-remove-pip.security.md +++ /dev/null @@ -1 +0,0 @@ -Removed `pip` from the API container image, clearing two high-severity CVEs in the copies of `setuptools` and `msgpack` that pip vendors. `uv` is retained because the entrypoint runs every command through `uv run` diff --git a/api/changelog.d/api-container-trixie.security.md b/api/changelog.d/api-container-trixie.security.md deleted file mode 100644 index 3d0ddaeba9..0000000000 --- a/api/changelog.d/api-container-trixie.security.md +++ /dev/null @@ -1 +0,0 @@ -The API container image now builds on Debian 13 (trixie), taking its critical CVE count from 18 to 4 diff --git a/api/changelog.d/api-deps-cryptography-48-chain.security.md b/api/changelog.d/api-deps-cryptography-48-chain.security.md deleted file mode 100644 index 196a8079c4..0000000000 --- a/api/changelog.d/api-deps-cryptography-48-chain.security.md +++ /dev/null @@ -1 +0,0 @@ -Bumped `workos` and `pyopenssl`, which capped `cryptography` below 47, so the API can move to `cryptography` 48.0.1 alongside the SDK diff --git a/api/changelog.d/api-deps-cve-bumps.security.md b/api/changelog.d/api-deps-cve-bumps.security.md deleted file mode 100644 index 2d708a10ec..0000000000 --- a/api/changelog.d/api-deps-cve-bumps.security.md +++ /dev/null @@ -1 +0,0 @@ -Bumped `pillow` to 12.3.0, `httplib2` to 0.32.0 and `pyasn1` to 0.6.4 to resolve known CVEs diff --git a/api/changelog.d/api-integration-branch-sdk-pin.fixed.md b/api/changelog.d/api-integration-branch-sdk-pin.fixed.md deleted file mode 100644 index 4151203355..0000000000 --- a/api/changelog.d/api-integration-branch-sdk-pin.fixed.md +++ /dev/null @@ -1 +0,0 @@ -Pointed the SDK dependency at the integration branch so the API image builds while the dependency bumps are in flight diff --git a/api/changelog.d/entra-guest-user-types-empty.fixed.md b/api/changelog.d/entra-guest-user-types-empty.fixed.md deleted file mode 100644 index 8962a1c20b..0000000000 --- a/api/changelog.d/entra-guest-user-types-empty.fixed.md +++ /dev/null @@ -1 +0,0 @@ -Entra Conditional Access guest-user checks no longer report false FAILs in M365 scans: microsoft-kiota packages overridden to 1.9.10 so `guestOrExternalUserTypes` (a flags enum Graph serializes as a comma-separated string) deserializes correctly instead of returning an empty list diff --git a/mcp_server/CHANGELOG.md b/mcp_server/CHANGELOG.md index e407d8eca6..b267f9c12d 100644 --- a/mcp_server/CHANGELOG.md +++ b/mcp_server/CHANGELOG.md @@ -4,6 +4,14 @@ All notable changes to the **Prowler MCP Server** are documented in this file. +## [0.9.1] (Prowler v5.37.1) + +### πŸ” Security + +- Bumped `fastmcp` and pinned `cryptography`, `joserfc`, `mcp` and `python-multipart`, clearing all 7 high-severity CVEs from the MCP image [(#12307)](https://github.com/prowler-cloud/prowler/pull/12307) + +--- + ## [0.9.0] (Prowler v5.37.0) ### πŸš€ Added diff --git a/mcp_server/changelog.d/mcp-transitive-cve-bumps.security.md b/mcp_server/changelog.d/mcp-transitive-cve-bumps.security.md deleted file mode 100644 index 719a18a0c6..0000000000 --- a/mcp_server/changelog.d/mcp-transitive-cve-bumps.security.md +++ /dev/null @@ -1 +0,0 @@ -Bumped `fastmcp` and pinned `cryptography`, `joserfc`, `mcp` and `python-multipart`, clearing all 7 high-severity CVEs from the MCP image diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index 87aecf71c2..ea98e3e34d 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -4,6 +4,29 @@ All notable changes to the **Prowler SDK** are documented in this file. +## [5.37.1] (Prowler v5.37.1) + +### πŸ”„ Changed + +- Huawei Cloud exception codes moved from `19000`-`19007` to `20000`-`20007`, resolving a collision with E2E Networks which reserves `19000`-`19999` [(#12306)](https://github.com/prowler-cloud/prowler/pull/12306) + +### 🐞 Fixed + +- Checks registered through the `prowler.checks.` entry-point group can now run against built-in providers. The built-in probe in `_resolve_check_module` used a bare `find_spec`, which imports the parent package to search it and so raised `ModuleNotFoundError` for a plug-in check instead of returning `None`, aborting the lookup before the entry points were consulted. Such a check was discovered, listed and selected for execution, then silently produced no findings. [(#12312)](https://github.com/prowler-cloud/prowler/pull/12312) +- Entra Conditional Access guest-user checks no longer report false FAILs: microsoft-kiota packages bumped to 1.9.10 so `guestOrExternalUserTypes` (a flags enum Graph serializes as a comma-separated string) deserializes correctly instead of returning an empty list [(#12315)](https://github.com/prowler-cloud/prowler/pull/12315) + +### πŸ” Security + +- Bumped the Compose `postgres` and `valkey` images, clearing 10 critical CVEs [(#12307)](https://github.com/prowler-cloud/prowler/pull/12307) +- Bumped PowerShell, Trivy, uv and `joserfc` in the container images, clearing 14 high-severity CVEs from the SDK and API images [(#12307)](https://github.com/prowler-cloud/prowler/pull/12307) +- Bumped `httplib2` to 0.32.0 and `pyasn1` to 0.6.4 to resolve known CVEs [(#12307)](https://github.com/prowler-cloud/prowler/pull/12307) +- The SDK container image now builds on Debian 13 (trixie), clearing the unfixable `libsqlite3-0` and `zlib1g` criticals [(#12307)](https://github.com/prowler-cloud/prowler/pull/12307) +- Bumped `cryptography` to 48.0.1 to resolve GHSA-537c-gmf6-5ccf, along with the `oci`, `alibabacloud-tea-openapi`, `darabonba-core` and `py-ocsf-models` bumps it requires [(#12307)](https://github.com/prowler-cloud/prowler/pull/12307) +- Removed `pip` from the SDK container image, clearing two high-severity CVEs in the vendored copies of `setuptools` and `msgpack` [(#12307)](https://github.com/prowler-cloud/prowler/pull/12307) +- Removed `wget`, `gnupg` and `apt-transport-https` from the SDK runtime image [(#12307)](https://github.com/prowler-cloud/prowler/pull/12307) + +--- + ## [5.37.0] (Prowler v5.37.0) ### πŸš€ Added diff --git a/prowler/changelog.d/compose-infra-pin-alignment.security.md b/prowler/changelog.d/compose-infra-pin-alignment.security.md deleted file mode 100644 index c58900e1ce..0000000000 --- a/prowler/changelog.d/compose-infra-pin-alignment.security.md +++ /dev/null @@ -1 +0,0 @@ -Aligned the `postgres` and `valkey` image pins in the compose files with the rest of the estate, clearing 10 criticals diff --git a/prowler/changelog.d/container-high-severity-bumps.security.md b/prowler/changelog.d/container-high-severity-bumps.security.md deleted file mode 100644 index bbbb3a29b4..0000000000 --- a/prowler/changelog.d/container-high-severity-bumps.security.md +++ /dev/null @@ -1 +0,0 @@ -Bumped PowerShell, Trivy, uv and `joserfc` in the container images, clearing 14 high-severity CVEs from the SDK and API images diff --git a/prowler/changelog.d/container-purge-build-only-packages.security.md b/prowler/changelog.d/container-purge-build-only-packages.security.md deleted file mode 100644 index 87ca6182e6..0000000000 --- a/prowler/changelog.d/container-purge-build-only-packages.security.md +++ /dev/null @@ -1 +0,0 @@ -Removed `wget`, `gnupg` and `apt-transport-https` from the SDK runtime image; the API image keeps `wget` because its Compose healthcheck invokes it diff --git a/prowler/changelog.d/container-remove-pip.security.md b/prowler/changelog.d/container-remove-pip.security.md deleted file mode 100644 index d3265191e4..0000000000 --- a/prowler/changelog.d/container-remove-pip.security.md +++ /dev/null @@ -1 +0,0 @@ -Removed `pip` from the SDK container image, clearing two high-severity CVEs in the copies of `setuptools` and `msgpack` that pip vendors. The entrypoint runs the prepared virtualenv directly, so nothing at runtime needs pip; `uv` is retained diff --git a/prowler/changelog.d/entra-guest-user-types-empty.fixed.md b/prowler/changelog.d/entra-guest-user-types-empty.fixed.md deleted file mode 100644 index 29258dd491..0000000000 --- a/prowler/changelog.d/entra-guest-user-types-empty.fixed.md +++ /dev/null @@ -1 +0,0 @@ -Entra Conditional Access guest-user checks no longer report false FAILs: microsoft-kiota packages bumped to 1.9.10 so `guestOrExternalUserTypes` (a flags enum Graph serializes as a comma-separated string) deserializes correctly instead of returning an empty list diff --git a/prowler/changelog.d/external-checks-builtin-provider-resolution.fixed.md b/prowler/changelog.d/external-checks-builtin-provider-resolution.fixed.md deleted file mode 100644 index 2720644613..0000000000 --- a/prowler/changelog.d/external-checks-builtin-provider-resolution.fixed.md +++ /dev/null @@ -1 +0,0 @@ -Checks registered through the `prowler.checks.` entry-point group can now run against built-in providers. The built-in probe in `_resolve_check_module` used a bare `find_spec`, which imports the parent package to search it and so raised `ModuleNotFoundError` for a plug-in check instead of returning `None`, aborting the lookup before the entry points were consulted. Such a check was discovered, listed and selected for execution, then silently produced no findings. diff --git a/prowler/changelog.d/huaweicloud-exception-code-range.changed.md b/prowler/changelog.d/huaweicloud-exception-code-range.changed.md deleted file mode 100644 index 72b194c4f6..0000000000 --- a/prowler/changelog.d/huaweicloud-exception-code-range.changed.md +++ /dev/null @@ -1 +0,0 @@ -Huawei Cloud exception codes moved from `19000`-`19007` to `20000`-`20007`, resolving a collision with E2E Networks which reserves `19000`-`19999` diff --git a/prowler/changelog.d/sdk-container-trixie.security.md b/prowler/changelog.d/sdk-container-trixie.security.md deleted file mode 100644 index c1052108ff..0000000000 --- a/prowler/changelog.d/sdk-container-trixie.security.md +++ /dev/null @@ -1 +0,0 @@ -The SDK container image now builds on Debian 13 (trixie), clearing the unfixable `libsqlite3-0` and `zlib1g` criticals diff --git a/prowler/changelog.d/sdk-cryptography-48.security.md b/prowler/changelog.d/sdk-cryptography-48.security.md deleted file mode 100644 index 0005801337..0000000000 --- a/prowler/changelog.d/sdk-cryptography-48.security.md +++ /dev/null @@ -1 +0,0 @@ -Bumped `cryptography` to 48.0.1 to resolve GHSA-537c-gmf6-5ccf, along with the `oci`, `alibabacloud-tea-openapi`, `darabonba-core` and `py-ocsf-models` bumps it requires diff --git a/prowler/changelog.d/sdk-deps-cve-bumps.security.md b/prowler/changelog.d/sdk-deps-cve-bumps.security.md deleted file mode 100644 index b6cf7ff7b1..0000000000 --- a/prowler/changelog.d/sdk-deps-cve-bumps.security.md +++ /dev/null @@ -1 +0,0 @@ -Bumped `httplib2` to 0.32.0 and `pyasn1` to 0.6.4 to resolve known CVEs diff --git a/ui/CHANGELOG.md b/ui/CHANGELOG.md index 5d3de7ef32..87fcddcf71 100644 --- a/ui/CHANGELOG.md +++ b/ui/CHANGELOG.md @@ -4,6 +4,18 @@ All notable changes to the **Prowler UI** are documented in this file. +## [1.37.1] (Prowler v5.37.1) + +### 🐞 Fixed + +- Fixed image optimization in the production container: Next.js standalone tracing omitted `sharp`'s native `libvips` library, so every image was served unoptimized [(#12307)](https://github.com/prowler-cloud/prowler/pull/12307) + +### πŸ” Security + +- The UI container image now patches musl and zlib alongside OpenSSL, and `sharp` is pinned to 0.35.3, clearing the image's remaining CVEs [(#12307)](https://github.com/prowler-cloud/prowler/pull/12307) + +--- + ## [1.37.0] (Prowler v5.37.0) ### πŸš€ Added diff --git a/ui/changelog.d/ui-container-musl-zlib-sharp.security.md b/ui/changelog.d/ui-container-musl-zlib-sharp.security.md deleted file mode 100644 index d76f483109..0000000000 --- a/ui/changelog.d/ui-container-musl-zlib-sharp.security.md +++ /dev/null @@ -1 +0,0 @@ -The UI container image now patches musl and zlib alongside OpenSSL, and `sharp` is pinned to 0.35.3, clearing the image's remaining CVEs diff --git a/ui/changelog.d/ui-sharp-standalone-tracing.fixed.md b/ui/changelog.d/ui-sharp-standalone-tracing.fixed.md deleted file mode 100644 index ba987a671f..0000000000 --- a/ui/changelog.d/ui-sharp-standalone-tracing.fixed.md +++ /dev/null @@ -1 +0,0 @@ -Fixed image optimization in the production container: Next.js standalone tracing omitted `sharp`'s native `libvips` library, so every image was served unoptimized