diff --git a/api/CHANGELOG.md b/api/CHANGELOG.md
index 4a0d6037ad..7a7857a6b0 100644
--- a/api/CHANGELOG.md
+++ b/api/CHANGELOG.md
@@ -4,6 +4,25 @@ All notable changes to the **Prowler API** are documented in this file.
 
 <!-- changelog: release notes start -->
 
+## [1.47.0] (Prowler v5.46.0)
+
+### 🐞 Fixed
+
+- Compliance report PDF cover table wraps every value, so long account IDs such as OCI tenancy OCIDs no longer overflow their cell [(#13063)](https://github.com/prowler-cloud/prowler/pull/13063)
+- Scan ingestion compares the serialized resource metadata with the stored value and serializes sets in a stable order, so unchanged resources no longer get their metadata, details and updated_at rewritten on every scan [(#13148)](https://github.com/prowler-cloud/prowler/pull/13148)
+- Report generation shares the parsed resource metadata between the findings of a batch and releases each batch before building the next one [(#13149)](https://github.com/prowler-cloud/prowler/pull/13149)
+
+### 🔐 Security
+
+- `GET /resources/metadata`, `GET /resources/metadata/latest`, `GET /findings/metadata` and `GET /findings/metadata/latest` now honour the provider groups of the caller role instead of aggregating every provider in the tenant [(#12964)](https://github.com/prowler-cloud/prowler/pull/12964)
+- Trivy from 0.75.0 to 0.76.0 in the API container image, built with Go 1.27.2 and x/net 0.60.0, patching the HTTP/2 and TLS CVEs bundled in Trivy 0.75.0 [(#13064)](https://github.com/prowler-cloud/prowler/pull/13064)
+- Pillow from 12.3.0 to 13.0.0, certifi to 2026.10.19, aiohttp to 3.14.5 with yarl 1.25.1, uv to 0.13.4 and Trivy to 0.76.1 in the API container image, patching the Pillow JPEG decoder heap overflow, the compromised emSign root CAs bundled in certifi and uv, the aiohttp resource exhaustion advisories and the Go 1.27.2 stdlib CVE in the Trivy binary [(#13107)](https://github.com/prowler-cloud/prowler/pull/13107)
+- Attack Paths custom queries strip block comments before the blocked-operation check and drop APOC virtual nodes and relationships from results, so `LOAD CSV` can no longer be split with a comment nor its response returned under a forged provider label [(#13120)](https://github.com/prowler-cloud/prowler/pull/13120)
+- SAML SSO configuration endpoints require the `manage_account` permission instead of `manage_integrations`, since the configured IdP controls who signs in and which role they receive [(#13121)](https://github.com/prowler-cloud/prowler/pull/13121)
+- djangorestframework from 3.15.2 to 3.18.3 in the API, patching the JSON parser charset and Accept header denial of service and the TokenProxy revocation bypass, and the API container image no longer ships the MicrosoftTeams build SBOM that Trivy read as installed zod and body-parser [(#13157)](https://github.com/prowler-cloud/prowler/pull/13157)
+
+---
+
 ## [1.46.0] (Prowler v5.45.0)
 
 ### 🐞 Fixed
diff --git a/api/changelog.d/api-drf-3-18-3.security.md b/api/changelog.d/api-drf-3-18-3.security.md
deleted file mode 100644
index 9c769fcdc9..0000000000
--- a/api/changelog.d/api-drf-3-18-3.security.md
+++ /dev/null
@@ -1 +0,0 @@
-djangorestframework from 3.15.2 to 3.18.3 in the API, patching the JSON parser charset and Accept header denial of service and the TokenProxy revocation bypass, and the API container image no longer ships the MicrosoftTeams build SBOM that Trivy read as installed zod and body-parser
diff --git a/api/changelog.d/api-image-pillow-certifi-aiohttp-uv-trivy.security.md b/api/changelog.d/api-image-pillow-certifi-aiohttp-uv-trivy.security.md
deleted file mode 100644
index db74554077..0000000000
--- a/api/changelog.d/api-image-pillow-certifi-aiohttp-uv-trivy.security.md
+++ /dev/null
@@ -1 +0,0 @@
-Pillow from 12.3.0 to 13.0.0, certifi to 2026.10.19, aiohttp to 3.14.5 with yarl 1.25.1, uv to 0.13.4 and Trivy to 0.76.1 in the API container image, patching the Pillow JPEG decoder heap overflow, the compromised emSign root CAs bundled in certifi and uv, the aiohttp resource exhaustion advisories and the Go 1.27.2 stdlib CVE in the Trivy binary
diff --git a/api/changelog.d/api-image-trivy-0-76-0.security.md b/api/changelog.d/api-image-trivy-0-76-0.security.md
deleted file mode 100644
index 59473ad497..0000000000
--- a/api/changelog.d/api-image-trivy-0-76-0.security.md
+++ /dev/null
@@ -1 +0,0 @@
-Trivy from 0.75.0 to 0.76.0 in the API container image, built with Go 1.27.2 and x/net 0.60.0, patching the HTTP/2 and TLS CVEs bundled in Trivy 0.75.0
diff --git a/api/changelog.d/attack-paths-custom-query-comment-bypass.security.md b/api/changelog.d/attack-paths-custom-query-comment-bypass.security.md
deleted file mode 100644
index 6d7576e0d2..0000000000
--- a/api/changelog.d/attack-paths-custom-query-comment-bypass.security.md
+++ /dev/null
@@ -1 +0,0 @@
-Attack Paths custom queries strip block comments before the blocked-operation check and drop APOC virtual nodes and relationships from results, so `LOAD CSV` can no longer be split with a comment nor its response returned under a forged provider label
diff --git a/api/changelog.d/metadata-endpoints-provider-scope.security.md b/api/changelog.d/metadata-endpoints-provider-scope.security.md
deleted file mode 100644
index 64059c28ea..0000000000
--- a/api/changelog.d/metadata-endpoints-provider-scope.security.md
+++ /dev/null
@@ -1 +0,0 @@
-`GET /resources/metadata`, `GET /resources/metadata/latest`, `GET /findings/metadata` and `GET /findings/metadata/latest` now honour the provider groups of the caller role instead of aggregating every provider in the tenant
diff --git a/api/changelog.d/pdf-report-account-id-overflow.fixed.md b/api/changelog.d/pdf-report-account-id-overflow.fixed.md
deleted file mode 100644
index d97d9bc41d..0000000000
--- a/api/changelog.d/pdf-report-account-id-overflow.fixed.md
+++ /dev/null
@@ -1 +0,0 @@
-Compliance report PDF cover table wraps every value, so long account IDs such as OCI tenancy OCIDs no longer overflow their cell
diff --git a/api/changelog.d/report-metadata-memory.fixed.md b/api/changelog.d/report-metadata-memory.fixed.md
deleted file mode 100644
index 3262a67552..0000000000
--- a/api/changelog.d/report-metadata-memory.fixed.md
+++ /dev/null
@@ -1 +0,0 @@
-Report generation shares the parsed resource metadata between the findings of a batch and releases each batch before building the next one
diff --git a/api/changelog.d/resource-metadata-comparison.fixed.md b/api/changelog.d/resource-metadata-comparison.fixed.md
deleted file mode 100644
index 1b95b11865..0000000000
--- a/api/changelog.d/resource-metadata-comparison.fixed.md
+++ /dev/null
@@ -1 +0,0 @@
-Scan ingestion compares the serialized resource metadata with the stored value and serializes sets in a stable order, so unchanged resources no longer get their metadata, details and updated_at rewritten on every scan
diff --git a/api/changelog.d/saml-config-requires-manage-account.security.md b/api/changelog.d/saml-config-requires-manage-account.security.md
deleted file mode 100644
index 23fc926c7d..0000000000
--- a/api/changelog.d/saml-config-requires-manage-account.security.md
+++ /dev/null
@@ -1 +0,0 @@
-SAML SSO configuration endpoints require the `manage_account` permission instead of `manage_integrations`, since the configured IdP controls who signs in and which role they receive
diff --git a/mcp_server/CHANGELOG.md b/mcp_server/CHANGELOG.md
index 4f50280aeb..aeb38d3f4a 100644
--- a/mcp_server/CHANGELOG.md
+++ b/mcp_server/CHANGELOG.md
@@ -4,6 +4,14 @@ All notable changes to the **Prowler MCP Server** are documented in this file.
 
 <!-- changelog: release notes start -->
 
+## [0.12.4] (Prowler v5.46.0)
+
+### 🔐 Security
+
+- certifi from 2026.4.22 to 2026.10.19 in the MCP Server container image, dropping the emSign root CAs whose intermediate keys were compromised [(#13107)](https://github.com/prowler-cloud/prowler/pull/13107)
+
+---
+
 ## [0.12.3] (Prowler v5.45.0)
 
 ### 🔐 Security
diff --git a/mcp_server/changelog.d/mcp-image-certifi-2026-10-19.security.md b/mcp_server/changelog.d/mcp-image-certifi-2026-10-19.security.md
deleted file mode 100644
index 4887dbd829..0000000000
--- a/mcp_server/changelog.d/mcp-image-certifi-2026-10-19.security.md
+++ /dev/null
@@ -1 +0,0 @@
-certifi from 2026.4.22 to 2026.10.19 in the MCP Server container image, dropping the emSign root CAs whose intermediate keys were compromised
diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index 5b43d32051..32b4b89382 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -4,6 +4,46 @@ All notable changes to the **Prowler SDK** are documented in this file.
 
 <!-- changelog: release notes start -->
 
+## [5.46.0] (Prowler v5.46.0)
+
+### 🚀 Added
+
+- `cognito_user_pool_account_recovery_sms_not_preferred` check verifying Cognito user pools do not rank SMS first for account recovery [(#12251)](https://github.com/prowler-cloud/prowler/pull/12251)
+- `bedrock_guardrail_sensitive_information_filter_enforced` check for AWS provider, flagging Bedrock guardrails whose PII entities or custom regexes take no action on the output path, so a detected match is reported in the trace and still delivered to the caller [(#12663)](https://github.com/prowler-cloud/prowler/pull/12663)
+- `bedrock_model_invocation_logging_text_data_enabled` check for AWS provider, verifying that model invocation logging delivers prompt and response text rather than naming a destination while excluding request and response bodies [(#12663)](https://github.com/prowler-cloud/prowler/pull/12663)
+- Vertex AI service for GCP provider, including the `vertexai_workbench_instance_public_ip_disabled` and `vertexai_workbench_instance_root_access_disabled` checks mapped to PCI DSS 4.0 [(#13062)](https://github.com/prowler-cloud/prowler/pull/13062)
+- `vertexai_workbench_instance_terminal_access_disabled`, `vertexai_workbench_instance_file_download_disabled` and `vertexai_workbench_instance_auto_upgrade_enabled` checks for GCP provider, with Vertex AI Workbench checks mapped to CCC MLDE requirements [(#13077)](https://github.com/prowler-cloud/prowler/pull/13077)
+- Google Workspace findings state when a feature is not sold on the tenant edition: Drive DLP rules, Google session control and the shared drive sharing settings on Business Starter; reading editions needs the optional `apps.licensing` scope [(#13113)](https://github.com/prowler-cloud/prowler/pull/13113)
+- `wafv2_webacl_managed_rule_groups_enabled` check to verify WAFv2 Web ACLs reference at least one managed rule group [(#13127)](https://github.com/prowler-cloud/prowler/pull/13127)
+- `appengine` GCP service and `appengine_version_php_runtime_supported` check to flag App Engine serving versions on PHP runtimes without security fixes [(#13127)](https://github.com/prowler-cloud/prowler/pull/13127)
+- `elasticbeanstalk_environment_php_platform_updated` check to flag Elastic Beanstalk PHP environments on branches without security fixes or on platform versions older than the one bundling the fixed PHP release [(#13127)](https://github.com/prowler-cloud/prowler/pull/13127)
+- `lightsail_instance_php_blueprint_updated` check to flag Lightsail instances created from PHP blueprints for manual verification of the PHP release [(#13127)](https://github.com/prowler-cloud/prowler/pull/13127)
+
+### 🔄 Changed
+
+- Google Workspace checks for Chat, Drive, Gmail, Calendar and Groups pass with the reason stated when the app is turned off for everyone and no organizational unit or group turns it back on. The rule covers settings that only act while the app is on: Drive sharing settings and the settings of existing groups keep being evaluated because existing shares and groups stay reachable, and only group creation is exempt when Groups for Business is off [(#13117)](https://github.com/prowler-cloud/prowler/pull/13117)
+- Default `php_latest_version` for `app_ensure_php_version_is_latest` raised from `8.2` to `8.5`, the newest PHP runtime on Azure App Service for Linux, following the PHP2Shell (CVE-2026-109618, CVE-2026-109619) security release [(#13128)](https://github.com/prowler-cloud/prowler/pull/13128)
+
+### 🐞 Fixed
+
+- `bedrock_api_key_no_long_term_credentials` now reports a Bedrock long-term API key that never expires; IAM only returns `ExpirationDate` for keys created with an expiration period, so keys created without one were skipped and produced no finding at all [(#12663)](https://github.com/prowler-cloud/prowler/pull/12663)
+- `drive_desktop_access_disabled` remediation steps for Google Workspace now point to the Google Drive for desktop card in the Admin console instead of Features and Applications [(#13113)](https://github.com/prowler-cloud/prowler/pull/13113)
+- Gmail spoofing checks read each protection action from its own Policy API field; the inbound domain spoofing check could never pass and the similar domain names check reported the inbound action [(#13114)](https://github.com/prowler-cloud/prowler/pull/13114)
+- Google Workspace `drive_publishing_files_disabled` passes when sharing outside the organization is limited to allowlisted domains or off, since publishing to the web only exists with sharing on [(#13115)](https://github.com/prowler-cloud/prowler/pull/13115)
+- Google Workspace checks now read the policy Google applies (greatest sortOrder) instead of the last policy the Cloud Identity Policy API lists, which reported default values over admin-configured ones [(#13117)](https://github.com/prowler-cloud/prowler/pull/13117)
+- Azure App Service runtime checks (`app_ensure_php_version_is_latest`, `app_ensure_python_version_is_latest`, `app_ensure_java_version_is_latest`) now pass any runtime at or above the configured minimum instead of failing every version newer than the configured one [(#13127)](https://github.com/prowler-cloud/prowler/pull/13127)
+- Scan report generation parses each resource's metadata once per batch and sanitizes it once per finding, so providers with very large resource metadata no longer exhaust the worker memory [(#13149)](https://github.com/prowler-cloud/prowler/pull/13149)
+
+### 🔐 Security
+
+- OpenStack auth_url resolving to loopback, private or otherwise non-public hosts rejected before the SDK connects, on both the connection test and the scan [(#12962)](https://github.com/prowler-cloud/prowler/pull/12962)
+- Trivy from 0.75.0 to 0.76.0 in the SDK container image, built with Go 1.27.2 and x/net 0.60.0, patching the HTTP/2 and TLS CVEs bundled in Trivy 0.75.0 [(#13064)](https://github.com/prowler-cloud/prowler/pull/13064)
+- certifi to 2026.10.19 and aiohttp to 3.14.5 with yarl 1.25.1 in the SDK, plus uv 0.13.4 and Trivy 0.76.1 in its container image, patching the compromised emSign root CAs bundled in certifi and uv, the aiohttp resource exhaustion advisories and the Go 1.27.2 stdlib CVE in the Trivy binary [(#13107)](https://github.com/prowler-cloud/prowler/pull/13107)
+- Resource metadata attached to findings no longer carries the values that secrets checks scan (CloudFormation outputs, Lambda environment variables, EC2 user data and similar fields); they are replaced with `REDACTED` before reaching the Evidence tab, the API and the output files [(#13129)](https://github.com/prowler-cloud/prowler/pull/13129)
+- black from 26.3.1 to 26.10.1 and graphql-core from 3.2.8 to 3.2.12 in the SDK, and libbrotli1 1.1.0-2+deb13u1 in its container image, which no longer ships the MicrosoftTeams build SBOM that Trivy read as installed zod and body-parser [(#13135)](https://github.com/prowler-cloud/prowler/pull/13135)
+
+---
+
 ## [5.45.0] (Prowler v5.45.0)
 
 ### 🚀 Added
diff --git a/prowler/changelog.d/aws-elasticbeanstalk-php-platform-updated.added.md b/prowler/changelog.d/aws-elasticbeanstalk-php-platform-updated.added.md
deleted file mode 100644
index 9deea477b6..0000000000
--- a/prowler/changelog.d/aws-elasticbeanstalk-php-platform-updated.added.md
+++ /dev/null
@@ -1 +0,0 @@
-`elasticbeanstalk_environment_php_platform_updated` check to flag Elastic Beanstalk PHP environments on branches without security fixes or on platform versions older than the one bundling the fixed PHP release
diff --git a/prowler/changelog.d/aws-lightsail-php-blueprint-updated.added.md b/prowler/changelog.d/aws-lightsail-php-blueprint-updated.added.md
deleted file mode 100644
index 668e01bd43..0000000000
--- a/prowler/changelog.d/aws-lightsail-php-blueprint-updated.added.md
+++ /dev/null
@@ -1 +0,0 @@
-`lightsail_instance_php_blueprint_updated` check to flag Lightsail instances created from PHP blueprints for manual verification of the PHP release
diff --git a/prowler/changelog.d/aws-wafv2-managed-rule-groups-enabled.added.md b/prowler/changelog.d/aws-wafv2-managed-rule-groups-enabled.added.md
deleted file mode 100644
index f954356ee0..0000000000
--- a/prowler/changelog.d/aws-wafv2-managed-rule-groups-enabled.added.md
+++ /dev/null
@@ -1 +0,0 @@
-`wafv2_webacl_managed_rule_groups_enabled` check to verify WAFv2 Web ACLs reference at least one managed rule group
diff --git a/prowler/changelog.d/azure-app-runtime-minimum-version.fixed.md b/prowler/changelog.d/azure-app-runtime-minimum-version.fixed.md
deleted file mode 100644
index 4c5f3a7a43..0000000000
--- a/prowler/changelog.d/azure-app-runtime-minimum-version.fixed.md
+++ /dev/null
@@ -1 +0,0 @@
-Azure App Service runtime checks (`app_ensure_php_version_is_latest`, `app_ensure_python_version_is_latest`, `app_ensure_java_version_is_latest`) now pass any runtime at or above the configured minimum instead of failing every version newer than the configured one
diff --git a/prowler/changelog.d/azure-php-latest-version-8-5.changed.md b/prowler/changelog.d/azure-php-latest-version-8-5.changed.md
deleted file mode 100644
index 61bef33839..0000000000
--- a/prowler/changelog.d/azure-php-latest-version-8-5.changed.md
+++ /dev/null
@@ -1 +0,0 @@
-Default `php_latest_version` for `app_ensure_php_version_is_latest` raised from `8.2` to `8.5`, the newest PHP runtime on Azure App Service for Linux, following the PHP2Shell (CVE-2026-109618, CVE-2026-109619) security release
diff --git a/prowler/changelog.d/bedrock-api-key-never-expiring-skipped.fixed.md b/prowler/changelog.d/bedrock-api-key-never-expiring-skipped.fixed.md
deleted file mode 100644
index bf86185feb..0000000000
--- a/prowler/changelog.d/bedrock-api-key-never-expiring-skipped.fixed.md
+++ /dev/null
@@ -1 +0,0 @@
-`bedrock_api_key_no_long_term_credentials` now reports a Bedrock long-term API key that never expires; IAM only returns `ExpirationDate` for keys created with an expiration period, so keys created without one were skipped and produced no finding at all
diff --git a/prowler/changelog.d/bedrock-guardrail-sensitive-information-enforced.added.md b/prowler/changelog.d/bedrock-guardrail-sensitive-information-enforced.added.md
deleted file mode 100644
index 8aca193462..0000000000
--- a/prowler/changelog.d/bedrock-guardrail-sensitive-information-enforced.added.md
+++ /dev/null
@@ -1 +0,0 @@
-`bedrock_guardrail_sensitive_information_filter_enforced` check for AWS provider, flagging Bedrock guardrails whose PII entities or custom regexes take no action on the output path, so a detected match is reported in the trace and still delivered to the caller
diff --git a/prowler/changelog.d/bedrock-model-invocation-logging-text-data.added.md b/prowler/changelog.d/bedrock-model-invocation-logging-text-data.added.md
deleted file mode 100644
index 3692fb3bc7..0000000000
--- a/prowler/changelog.d/bedrock-model-invocation-logging-text-data.added.md
+++ /dev/null
@@ -1 +0,0 @@
-`bedrock_model_invocation_logging_text_data_enabled` check for AWS provider, verifying that model invocation logging delivers prompt and response text rather than naming a destination while excluding request and response bodies
diff --git a/prowler/changelog.d/cognito-user-pool-account-recovery-sms-not-preferred.added.md b/prowler/changelog.d/cognito-user-pool-account-recovery-sms-not-preferred.added.md
deleted file mode 100644
index 7a8deb4082..0000000000
--- a/prowler/changelog.d/cognito-user-pool-account-recovery-sms-not-preferred.added.md
+++ /dev/null
@@ -1 +0,0 @@
-`cognito_user_pool_account_recovery_sms_not_preferred` check verifying Cognito user pools do not rank SMS first for account recovery
diff --git a/prowler/changelog.d/gcp-appengine-php-runtime-supported.added.md b/prowler/changelog.d/gcp-appengine-php-runtime-supported.added.md
deleted file mode 100644
index c6579fa87f..0000000000
--- a/prowler/changelog.d/gcp-appengine-php-runtime-supported.added.md
+++ /dev/null
@@ -1 +0,0 @@
-`appengine` GCP service and `appengine_version_php_runtime_supported` check to flag App Engine serving versions on PHP runtimes without security fixes
diff --git a/prowler/changelog.d/gcp-vertexai-workbench-checks.added.md b/prowler/changelog.d/gcp-vertexai-workbench-checks.added.md
deleted file mode 100644
index 99fb7a246c..0000000000
--- a/prowler/changelog.d/gcp-vertexai-workbench-checks.added.md
+++ /dev/null
@@ -1 +0,0 @@
-Vertex AI service for GCP provider, including the `vertexai_workbench_instance_public_ip_disabled` and `vertexai_workbench_instance_root_access_disabled` checks mapped to PCI DSS 4.0
diff --git a/prowler/changelog.d/gcp-vertexai-workbench-mlde-checks.added.md b/prowler/changelog.d/gcp-vertexai-workbench-mlde-checks.added.md
deleted file mode 100644
index 193e9925ef..0000000000
--- a/prowler/changelog.d/gcp-vertexai-workbench-mlde-checks.added.md
+++ /dev/null
@@ -1 +0,0 @@
-`vertexai_workbench_instance_terminal_access_disabled`, `vertexai_workbench_instance_file_download_disabled` and `vertexai_workbench_instance_auto_upgrade_enabled` checks for GCP provider, with Vertex AI Workbench checks mapped to CCC MLDE requirements
diff --git a/prowler/changelog.d/googleworkspace-drive-desktop-remediation.fixed.md b/prowler/changelog.d/googleworkspace-drive-desktop-remediation.fixed.md
deleted file mode 100644
index 16eafd22e7..0000000000
--- a/prowler/changelog.d/googleworkspace-drive-desktop-remediation.fixed.md
+++ /dev/null
@@ -1 +0,0 @@
-`drive_desktop_access_disabled` remediation steps for Google Workspace now point to the Google Drive for desktop card in the Admin console instead of Features and Applications
diff --git a/prowler/changelog.d/googleworkspace-drive-publishing-mode.fixed.md b/prowler/changelog.d/googleworkspace-drive-publishing-mode.fixed.md
deleted file mode 100644
index 0dfc6acff2..0000000000
--- a/prowler/changelog.d/googleworkspace-drive-publishing-mode.fixed.md
+++ /dev/null
@@ -1 +0,0 @@
-Google Workspace `drive_publishing_files_disabled` passes when sharing outside the organization is limited to allowlisted domains or off, since publishing to the web only exists with sharing on
diff --git a/prowler/changelog.d/googleworkspace-edition-rationale.added.md b/prowler/changelog.d/googleworkspace-edition-rationale.added.md
deleted file mode 100644
index d4ffbd9e69..0000000000
--- a/prowler/changelog.d/googleworkspace-edition-rationale.added.md
+++ /dev/null
@@ -1 +0,0 @@
-Google Workspace findings state when a feature is not sold on the tenant edition: Drive DLP rules, Google session control and the shared drive sharing settings on Business Starter; reading editions needs the optional `apps.licensing` scope
diff --git a/prowler/changelog.d/googleworkspace-gmail-spoofing-fields.fixed.md b/prowler/changelog.d/googleworkspace-gmail-spoofing-fields.fixed.md
deleted file mode 100644
index 7ec9c0e189..0000000000
--- a/prowler/changelog.d/googleworkspace-gmail-spoofing-fields.fixed.md
+++ /dev/null
@@ -1 +0,0 @@
-Gmail spoofing checks read each protection action from its own Policy API field; the inbound domain spoofing check could never pass and the similar domain names check reported the inbound action
diff --git a/prowler/changelog.d/googleworkspace-policy-precedence.fixed.md b/prowler/changelog.d/googleworkspace-policy-precedence.fixed.md
deleted file mode 100644
index 20f08f766f..0000000000
--- a/prowler/changelog.d/googleworkspace-policy-precedence.fixed.md
+++ /dev/null
@@ -1 +0,0 @@
-Google Workspace checks now read the policy Google applies (greatest sortOrder) instead of the last policy the Cloud Identity Policy API lists, which reported default values over admin-configured ones
diff --git a/prowler/changelog.d/googleworkspace-service-off.changed.md b/prowler/changelog.d/googleworkspace-service-off.changed.md
deleted file mode 100644
index a1c578750f..0000000000
--- a/prowler/changelog.d/googleworkspace-service-off.changed.md
+++ /dev/null
@@ -1 +0,0 @@
-Google Workspace checks for Chat, Drive, Gmail, Calendar and Groups pass with the reason stated when the app is turned off for everyone and no organizational unit or group turns it back on. The rule covers settings that only act while the app is on: Drive sharing settings and the settings of existing groups keep being evaluated because existing shares and groups stay reachable, and only group creation is exempt when Groups for Business is off
diff --git a/prowler/changelog.d/openstack-auth-url-ssrf.security.md b/prowler/changelog.d/openstack-auth-url-ssrf.security.md
deleted file mode 100644
index f50f7e0ec2..0000000000
--- a/prowler/changelog.d/openstack-auth-url-ssrf.security.md
+++ /dev/null
@@ -1 +0,0 @@
-OpenStack auth_url resolving to loopback, private or otherwise non-public hosts rejected before the SDK connects, on both the connection test and the scan
diff --git a/prowler/changelog.d/redact-secret-fields-resource-metadata.security.md b/prowler/changelog.d/redact-secret-fields-resource-metadata.security.md
deleted file mode 100644
index 66daa56e5e..0000000000
--- a/prowler/changelog.d/redact-secret-fields-resource-metadata.security.md
+++ /dev/null
@@ -1 +0,0 @@
-Resource metadata attached to findings no longer carries the values that secrets checks scan (CloudFormation outputs, Lambda environment variables, EC2 user data and similar fields); they are replaced with `REDACTED` before reaching the Evidence tab, the API and the output files
diff --git a/prowler/changelog.d/report-metadata-memory.fixed.md b/prowler/changelog.d/report-metadata-memory.fixed.md
deleted file mode 100644
index 293920195e..0000000000
--- a/prowler/changelog.d/report-metadata-memory.fixed.md
+++ /dev/null
@@ -1 +0,0 @@
-Scan report generation parses each resource's metadata once per batch and sanitizes it once per finding, so providers with very large resource metadata no longer exhaust the worker memory
diff --git a/prowler/changelog.d/sdk-image-black-graphql-brotli.security.md b/prowler/changelog.d/sdk-image-black-graphql-brotli.security.md
deleted file mode 100644
index 92d71d465a..0000000000
--- a/prowler/changelog.d/sdk-image-black-graphql-brotli.security.md
+++ /dev/null
@@ -1 +0,0 @@
-black from 26.3.1 to 26.10.1 and graphql-core from 3.2.8 to 3.2.12 in the SDK, and libbrotli1 1.1.0-2+deb13u1 in its container image, which no longer ships the MicrosoftTeams build SBOM that Trivy read as installed zod and body-parser
diff --git a/prowler/changelog.d/sdk-image-certifi-aiohttp-uv-trivy.security.md b/prowler/changelog.d/sdk-image-certifi-aiohttp-uv-trivy.security.md
deleted file mode 100644
index d6784ea3a6..0000000000
--- a/prowler/changelog.d/sdk-image-certifi-aiohttp-uv-trivy.security.md
+++ /dev/null
@@ -1 +0,0 @@
-certifi to 2026.10.19 and aiohttp to 3.14.5 with yarl 1.25.1 in the SDK, plus uv 0.13.4 and Trivy 0.76.1 in its container image, patching the compromised emSign root CAs bundled in certifi and uv, the aiohttp resource exhaustion advisories and the Go 1.27.2 stdlib CVE in the Trivy binary
diff --git a/prowler/changelog.d/sdk-image-trivy-0-76-0.security.md b/prowler/changelog.d/sdk-image-trivy-0-76-0.security.md
deleted file mode 100644
index 99fd4c2c70..0000000000
--- a/prowler/changelog.d/sdk-image-trivy-0-76-0.security.md
+++ /dev/null
@@ -1 +0,0 @@
-Trivy from 0.75.0 to 0.76.0 in the SDK container image, built with Go 1.27.2 and x/net 0.60.0, patching the HTTP/2 and TLS CVEs bundled in Trivy 0.75.0
diff --git a/ui/CHANGELOG.md b/ui/CHANGELOG.md
index f65555d84e..b627016689 100644
--- a/ui/CHANGELOG.md
+++ b/ui/CHANGELOG.md
@@ -4,6 +4,26 @@ All notable changes to the **Prowler UI** are documented in this file.
 
 <!-- changelog: release notes start -->
 
+## [1.46.0] (Prowler v5.46.0)
+
+### 🚀 Added
+
+- Issues page and overview cards for Cloud deployments, with verdict filters, accessible issue details, and scoped finding evidence [(#13068)](https://github.com/prowler-cloud/prowler/pull/13068)
+- Outlined error badge variant with a visible border on error-colored surfaces [(#13111)](https://github.com/prowler-cloud/prowler/pull/13111)
+
+### 🔄 Changed
+
+- "Launch an initial scan now" is ticked by default on the provider and organization setup launch steps, so saving a schedule also runs a first scan unless the box is unticked [(#13104)](https://github.com/prowler-cloud/prowler/pull/13104)
+- SAML SSO integration card on the profile page is shown to roles with the Manage Account permission, matching the API requirement [(#13121)](https://github.com/prowler-cloud/prowler/pull/13121)
+- Default `php_latest_version` in the scan configuration template raised from `8.2` to `8.5` [(#13128)](https://github.com/prowler-cloud/prowler/pull/13128)
+
+### 🔐 Security
+
+- Node.js from 24.18.1 to 24.22.1 LTS in the UI container image and `.nvmrc`, patching the eight CVEs of the October 2026 security release that affect the 24.x line, including the Brotli decoder remote code execution (CVE-2026-111497); the base image moves to Alpine 3.24, so the targeted `libcrypto3` / `libssl3` upgrade is no longer needed [(#13126)](https://github.com/prowler-cloud/prowler/pull/13126)
+- Next.js from 16.3.8 to 16.4.1, `@sentry/nextjs` from 10.65.0 to 10.75.2 and the transitive DOMPurify pin to 3.4.17, closing four critical advisories: two unauthenticated remote code executions in Next.js (Image Optimization with SVG files, GHSA-2464-fhr4-w9xw; `use cache` functions returning typed arrays, GHSA-673q-mjm6-r5xr), the Sentry middleware bypass through the tunnel route (GHSA-mchm-gjx6-7h55) and the DOMPurify `SAFE_FOR_TEMPLATES` bypass (GHSA-cg2g-xh64-v4q7) [(#13135)](https://github.com/prowler-cloud/prowler/pull/13135)
+
+---
+
 ## [1.45.0] (Prowler v5.45.0)
 
 ### 🚀 Added
diff --git a/ui/changelog.d/azure-php-latest-version-8-5.changed.md b/ui/changelog.d/azure-php-latest-version-8-5.changed.md
deleted file mode 100644
index 1afb00fc7d..0000000000
--- a/ui/changelog.d/azure-php-latest-version-8-5.changed.md
+++ /dev/null
@@ -1 +0,0 @@
-Default `php_latest_version` in the scan configuration template raised from `8.2` to `8.5`
diff --git a/ui/changelog.d/badge-error-outline.added.md b/ui/changelog.d/badge-error-outline.added.md
deleted file mode 100644
index ae6f0c63d0..0000000000
--- a/ui/changelog.d/badge-error-outline.added.md
+++ /dev/null
@@ -1 +0,0 @@
-Outlined error badge variant with a visible border on error-colored surfaces
diff --git a/ui/changelog.d/initial-scan-default-after-setup.changed.md b/ui/changelog.d/initial-scan-default-after-setup.changed.md
deleted file mode 100644
index faacee88a2..0000000000
--- a/ui/changelog.d/initial-scan-default-after-setup.changed.md
+++ /dev/null
@@ -1 +0,0 @@
-"Launch an initial scan now" is ticked by default on the provider and organization setup launch steps, so saving a schedule also runs a first scan unless the box is unticked
diff --git a/ui/changelog.d/issues-exploitability.added.md b/ui/changelog.d/issues-exploitability.added.md
deleted file mode 100644
index 6f94d9b250..0000000000
--- a/ui/changelog.d/issues-exploitability.added.md
+++ /dev/null
@@ -1 +0,0 @@
-Issues page and overview cards for Cloud deployments, with verdict filters, accessible issue details, and scoped finding evidence
diff --git a/ui/changelog.d/next-16.4.1-critical-advisories.security.md b/ui/changelog.d/next-16.4.1-critical-advisories.security.md
deleted file mode 100644
index 06bfa27b97..0000000000
--- a/ui/changelog.d/next-16.4.1-critical-advisories.security.md
+++ /dev/null
@@ -1 +0,0 @@
-Next.js from 16.3.8 to 16.4.1, `@sentry/nextjs` from 10.65.0 to 10.75.2 and the transitive DOMPurify pin to 3.4.17, closing four critical advisories: two unauthenticated remote code executions in Next.js (Image Optimization with SVG files, GHSA-2464-fhr4-w9xw; `use cache` functions returning typed arrays, GHSA-673q-mjm6-r5xr), the Sentry middleware bypass through the tunnel route (GHSA-mchm-gjx6-7h55) and the DOMPurify `SAFE_FOR_TEMPLATES` bypass (GHSA-cg2g-xh64-v4q7)
diff --git a/ui/changelog.d/node-24.22.1-bump.security.md b/ui/changelog.d/node-24.22.1-bump.security.md
deleted file mode 100644
index 702345872a..0000000000
--- a/ui/changelog.d/node-24.22.1-bump.security.md
+++ /dev/null
@@ -1 +0,0 @@
-Node.js from 24.18.1 to 24.22.1 LTS in the UI container image and `.nvmrc`, patching the eight CVEs of the October 2026 security release that affect the 24.x line, including the Brotli decoder remote code execution (CVE-2026-111497); the base image moves to Alpine 3.24, so the targeted `libcrypto3` / `libssl3` upgrade is no longer needed
diff --git a/ui/changelog.d/saml-card-requires-manage-account.changed.md b/ui/changelog.d/saml-card-requires-manage-account.changed.md
deleted file mode 100644
index 6042b0b319..0000000000
--- a/ui/changelog.d/saml-card-requires-manage-account.changed.md
+++ /dev/null
@@ -1 +0,0 @@
-SAML SSO integration card on the profile page is shown to roles with the Manage Account permission, matching the API requirement