chore(changelog): v5.37.1 forward-sync to master (#12322)

Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com>
Co-authored-by: César Arroba <cesar@prowler.com>

api/CHANGELOG.md

@@ -4,6 +4,24 @@ All notable changes to the **Prowler API** are documented in this file.
 
 <!-- changelog: release notes start -->
 
+## [1.38.1] (Prowler v5.37.1)
+
+### 🐞 Fixed
+
+- Entra Conditional Access guest-user checks no longer report false FAILs in M365 scans: microsoft-kiota packages overridden to 1.9.10 so `guestOrExternalUserTypes` (a flags enum Graph serializes as a comma-separated string) deserializes correctly instead of returning an empty list [(#12315)](https://github.com/prowler-cloud/prowler/pull/12315)
+
+### 🔐 Security
+
+- The API container image now builds on Debian 13 (trixie), taking its critical CVE count from 18 to 4 [(#12311)](https://github.com/prowler-cloud/prowler/pull/12311)
+- Bumped PowerShell, Trivy and uv in the API container image, clearing 14 high-severity CVEs [(#12311)](https://github.com/prowler-cloud/prowler/pull/12311)
+- Bumped `workos` and `pyopenssl` so the API can move to `cryptography` 48.0.1 [(#12311)](https://github.com/prowler-cloud/prowler/pull/12311)
+- Removed `gnupg` and `apt-transport-https` from the API container image [(#12311)](https://github.com/prowler-cloud/prowler/pull/12311)
+- The API container image no longer ships `git`; removing it also dropped `perl`, `perl-modules`, `libperl` and `liberror-perl`, clearing 12 critical CVEs. Only `perl-base` remains, which Debian marks Essential and cannot be removed [(#12311)](https://github.com/prowler-cloud/prowler/pull/12311)
+- Removed `pip` from the API container image, clearing two high-severity CVEs in the vendored copies of `setuptools` and `msgpack` [(#12311)](https://github.com/prowler-cloud/prowler/pull/12311)
+- Bumped `pillow` to 12.3.0, `httplib2` to 0.32.0 and `pyasn1` to 0.6.4 to resolve known CVEs [(#12311)](https://github.com/prowler-cloud/prowler/pull/12311)
+
+---
+
 ## [1.38.0] (Prowler v5.37.0)
 
 ### 🚀 Added

api/changelog.d/api-container-high-severity-bumps.security.md

@@ -1 +0,0 @@
-Bumped PowerShell, Trivy and uv in the API container image, clearing 14 high-severity CVEs

api/changelog.d/api-container-keep-wget.fixed.md

@@ -1 +0,0 @@
-Restored `wget` in the API container image, which the Compose healthcheck depends on

api/changelog.d/api-container-purge-build-only.security.md

@@ -1 +0,0 @@
-Removed `gnupg` and `apt-transport-https` from the API container image; `wget` is retained because the Compose healthcheck invokes it

api/changelog.d/api-container-purge-git.security.md

@@ -1 +0,0 @@
-The API container image no longer ships `git`; removing it also dropped `perl`, `perl-modules`, `libperl` and `liberror-perl`, clearing 12 critical CVEs. Only `perl-base` remains, which Debian marks Essential and cannot be removed

api/changelog.d/api-container-remove-pip.security.md

@@ -1 +0,0 @@
-Removed `pip` from the API container image, clearing two high-severity CVEs in the copies of `setuptools` and `msgpack` that pip vendors. `uv` is retained because the entrypoint runs every command through `uv run`

api/changelog.d/api-container-trixie.security.md

@@ -1 +0,0 @@
-The API container image now builds on Debian 13 (trixie), taking its critical CVE count from 18 to 4

api/changelog.d/api-deps-cryptography-48-chain.security.md

@@ -1 +0,0 @@
-Bumped `workos` and `pyopenssl`, which capped `cryptography` below 47, so the API can move to `cryptography` 48.0.1 alongside the SDK

api/changelog.d/api-deps-cve-bumps.security.md

@@ -1 +0,0 @@
-Bumped `pillow` to 12.3.0, `httplib2` to 0.32.0 and `pyasn1` to 0.6.4 to resolve known CVEs

api/changelog.d/api-integration-branch-sdk-pin.fixed.md

@@ -1 +0,0 @@
-Pointed the SDK dependency at the integration branch so the API image builds while the dependency bumps are in flight

api/changelog.d/entra-guest-user-types-empty.fixed.md

@@ -1 +0,0 @@
-Entra Conditional Access guest-user checks no longer report false FAILs in M365 scans: microsoft-kiota packages overridden to 1.9.10 so `guestOrExternalUserTypes` (a flags enum Graph serializes as a comma-separated string) deserializes correctly instead of returning an empty list

mcp_server/CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to the **Prowler MCP Server** are documented in this file.
 
 <!-- changelog: release notes start -->
 
+## [0.9.1] (Prowler v5.37.1)
+
+### 🔐 Security
+
+- Bumped `fastmcp` and pinned `cryptography`, `joserfc`, `mcp` and `python-multipart`, clearing all 7 high-severity CVEs from the MCP image [(#12307)](https://github.com/prowler-cloud/prowler/pull/12307)
+
+---
+
 ## [0.9.0] (Prowler v5.37.0)
 
 ### 🚀 Added

mcp_server/changelog.d/mcp-transitive-cve-bumps.security.md

@@ -1 +0,0 @@
-Bumped `fastmcp` and pinned `cryptography`, `joserfc`, `mcp` and `python-multipart`, clearing all 7 high-severity CVEs from the MCP image

prowler/CHANGELOG.md

@@ -4,6 +4,29 @@ All notable changes to the **Prowler SDK** are documented in this file.
 
 <!-- changelog: release notes start -->
 
+## [5.37.1] (Prowler v5.37.1)
+
+### 🔄 Changed
+
+- Huawei Cloud exception codes moved from `19000`-`19007` to `20000`-`20007`, resolving a collision with E2E Networks which reserves `19000`-`19999` [(#12306)](https://github.com/prowler-cloud/prowler/pull/12306)
+
+### 🐞 Fixed
+
+- Checks registered through the `prowler.checks.<provider>` entry-point group can now run against built-in providers. The built-in probe in `_resolve_check_module` used a bare `find_spec`, which imports the parent package to search it and so raised `ModuleNotFoundError` for a plug-in check instead of returning `None`, aborting the lookup before the entry points were consulted. Such a check was discovered, listed and selected for execution, then silently produced no findings. [(#12312)](https://github.com/prowler-cloud/prowler/pull/12312)
+- Entra Conditional Access guest-user checks no longer report false FAILs: microsoft-kiota packages bumped to 1.9.10 so `guestOrExternalUserTypes` (a flags enum Graph serializes as a comma-separated string) deserializes correctly instead of returning an empty list [(#12315)](https://github.com/prowler-cloud/prowler/pull/12315)
+
+### 🔐 Security
+
+- Bumped the Compose `postgres` and `valkey` images, clearing 10 critical CVEs [(#12307)](https://github.com/prowler-cloud/prowler/pull/12307)
+- Bumped PowerShell, Trivy, uv and `joserfc` in the container images, clearing 14 high-severity CVEs from the SDK and API images [(#12307)](https://github.com/prowler-cloud/prowler/pull/12307)
+- Bumped `httplib2` to 0.32.0 and `pyasn1` to 0.6.4 to resolve known CVEs [(#12307)](https://github.com/prowler-cloud/prowler/pull/12307)
+- The SDK container image now builds on Debian 13 (trixie), clearing the unfixable `libsqlite3-0` and `zlib1g` criticals [(#12307)](https://github.com/prowler-cloud/prowler/pull/12307)
+- Bumped `cryptography` to 48.0.1 to resolve GHSA-537c-gmf6-5ccf, along with the `oci`, `alibabacloud-tea-openapi`, `darabonba-core` and `py-ocsf-models` bumps it requires [(#12307)](https://github.com/prowler-cloud/prowler/pull/12307)
+- Removed `pip` from the SDK container image, clearing two high-severity CVEs in the vendored copies of `setuptools` and `msgpack` [(#12307)](https://github.com/prowler-cloud/prowler/pull/12307)
+- Removed `wget`, `gnupg` and `apt-transport-https` from the SDK runtime image [(#12307)](https://github.com/prowler-cloud/prowler/pull/12307)
+
+---
+
 ## [5.37.0] (Prowler v5.37.0)
 
 ### 🚀 Added

prowler/changelog.d/compose-infra-pin-alignment.security.md

@@ -1 +0,0 @@
-Aligned the `postgres` and `valkey` image pins in the compose files with the rest of the estate, clearing 10 criticals

prowler/changelog.d/container-high-severity-bumps.security.md

@@ -1 +0,0 @@
-Bumped PowerShell, Trivy, uv and `joserfc` in the container images, clearing 14 high-severity CVEs from the SDK and API images

prowler/changelog.d/container-purge-build-only-packages.security.md

@@ -1 +0,0 @@
-Removed `wget`, `gnupg` and `apt-transport-https` from the SDK runtime image; the API image keeps `wget` because its Compose healthcheck invokes it

prowler/changelog.d/container-remove-pip.security.md

@@ -1 +0,0 @@
-Removed `pip` from the SDK container image, clearing two high-severity CVEs in the copies of `setuptools` and `msgpack` that pip vendors. The entrypoint runs the prepared virtualenv directly, so nothing at runtime needs pip; `uv` is retained

prowler/changelog.d/entra-guest-user-types-empty.fixed.md

@@ -1 +0,0 @@
-Entra Conditional Access guest-user checks no longer report false FAILs: microsoft-kiota packages bumped to 1.9.10 so `guestOrExternalUserTypes` (a flags enum Graph serializes as a comma-separated string) deserializes correctly instead of returning an empty list

prowler/changelog.d/external-checks-builtin-provider-resolution.fixed.md

@@ -1 +0,0 @@
-Checks registered through the `prowler.checks.<provider>` entry-point group can now run against built-in providers. The built-in probe in `_resolve_check_module` used a bare `find_spec`, which imports the parent package to search it and so raised `ModuleNotFoundError` for a plug-in check instead of returning `None`, aborting the lookup before the entry points were consulted. Such a check was discovered, listed and selected for execution, then silently produced no findings.

prowler/changelog.d/huaweicloud-exception-code-range.changed.md

@@ -1 +0,0 @@
-Huawei Cloud exception codes moved from `19000`-`19007` to `20000`-`20007`, resolving a collision with E2E Networks which reserves `19000`-`19999`

prowler/changelog.d/sdk-container-trixie.security.md

@@ -1 +0,0 @@
-The SDK container image now builds on Debian 13 (trixie), clearing the unfixable `libsqlite3-0` and `zlib1g` criticals

prowler/changelog.d/sdk-cryptography-48.security.md

@@ -1 +0,0 @@
-Bumped `cryptography` to 48.0.1 to resolve GHSA-537c-gmf6-5ccf, along with the `oci`, `alibabacloud-tea-openapi`, `darabonba-core` and `py-ocsf-models` bumps it requires

prowler/changelog.d/sdk-deps-cve-bumps.security.md

@@ -1 +0,0 @@
-Bumped `httplib2` to 0.32.0 and `pyasn1` to 0.6.4 to resolve known CVEs

ui/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to the **Prowler UI** are documented in this file.
 
 <!-- changelog: release notes start -->
 
+## [1.37.1] (Prowler v5.37.1)
+
+### 🐞 Fixed
+
+- Fixed image optimization in the production container: Next.js standalone tracing omitted `sharp`'s native `libvips` library, so every image was served unoptimized [(#12307)](https://github.com/prowler-cloud/prowler/pull/12307)
+
+### 🔐 Security
+
+- The UI container image now patches musl and zlib alongside OpenSSL, and `sharp` is pinned to 0.35.3, clearing the image's remaining CVEs [(#12307)](https://github.com/prowler-cloud/prowler/pull/12307)
+
+---
+
 ## [1.37.0] (Prowler v5.37.0)
 
 ### 🚀 Added

ui/changelog.d/ui-container-musl-zlib-sharp.security.md

@@ -1 +0,0 @@
-The UI container image now patches musl and zlib alongside OpenSSL, and `sharp` is pinned to 0.35.3, clearing the image's remaining CVEs

ui/changelog.d/ui-sharp-standalone-tracing.fixed.md

@@ -1 +0,0 @@
-Fixed image optimization in the production container: Next.js standalone tracing omitted `sharp`'s native `libvips` library, so every image was served unoptimized