Lydia Vilchez
721a80921b
fix(api): persist per-provider secret normalization and drop M365 scope creep
2026-09-01 15:15:26 +02:00
Lydia Vilchez
ef62731c0a
fix(api): tighten Azure certificate cap and route oversized/whitespace inputs through the typed error
2026-08-31 21:31:31 +02:00
Lydia Vilchez
f67cf7c3e5
fix(api): harden Azure certificate serializer and complete schema/tests
2026-08-31 18:22:57 +02:00
Lydia Vilchez
fcf06e148c
refactor(api): reuse SDK certificate validator and fix schema drift
...
Delete the API copy of `validate_certificate_bundle` and re-export the
SDK one. The local copy diverged: it missed `UnsupportedAlgorithm` on
PKCS#12 loading, `TypeError` on password-protected PEM keys, `DSA` and
`ENCRYPTED`/`OPENSSH` PEM label prefixes, and the leaf-first
normalization the SDK now depends on for azure-identity's thumbprint.
A single source keeps future SDK fixes from silently skipping the API.
Log the caught exception in `AzureProviderSecret.validate_certificate_content`
before raising the client-facing ValidationError so root-causing a bundle
parse failure doesn't need a rerun with debug on.
Drop `additionalProperties: false` from the two new Azure oneOf variants
in the ProviderSecretField schema. No other credential variant sets it,
so codegen'd clients that enforced the flag would reject payloads the
DRF serializer accepts.
2026-08-31 18:22:57 +02:00
Lydia Vilchez
a1e9d243be
feat(api): accept Azure certificate credentials and document the contract
...
Extend AzureProviderSecret to accept an optional certificate_content
field with mutual exclusion vs. client_secret, add a certificate
key-pair validator (PEM and PKCS#12), and update the public OpenAPI
schema so the two Azure credential shapes (client secret vs.
certificate content) are documented as mutually exclusive.
Consolidates #12518 into this PR.
2026-08-31 18:22:57 +02:00
Daniel Barranquero and Josema Camacho
587c47bfe2
feat(api): add finding labels, finding URL and tenant info to Jira issues ( #12540 )
...
Co-authored-by: Josema Camacho <josema@prowler.com >
2026-08-31 18:00:46 +02:00
Prowler Bot and prowler-bot
c923c58a39
chore(release): Bump versions to v5.41.0 ( #12647 )
...
Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com >
2026-08-28 13:16:00 +02:00
Prowler Bot and prowler-bot
4d13e8432e
chore(changelog): v5.40.0 ( #12642 )
...
Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com >
2026-08-28 11:51:30 +02:00
César Arroba
afefb8f333
fix(api): apply findings partition max age in months, not days ( #12580 )
2026-08-28 10:34:12 +02:00
Pedro Martín
6449f3a592
fix(container): patch the high OpenSSL CVEs for container img ( #12549 )
2026-08-26 11:10:55 +02:00
Hugo Pereira Brito
e3a3acc799
fix(api): upgrade sqlparse to 0.6.0 ( #12509 )
2026-08-24 08:47:29 +02:00
Prowler Bot and prowler-bot
f6defefb58
chore(changelog): v5.39.1 forward-sync to master ( #12483 )
...
Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com >
2026-08-18 11:32:20 +02:00
Pepe Fagoaga
450e6ba553
chore(api): drop temporary SDK pin overrides after cryptography cap bump ( #12473 )
2026-08-17 13:42:09 +02:00
Pepe Fagoaga
b6e9967da6
fix(deps): make published wheels installable and add package checks ( #12467 )
2026-08-17 12:34:11 +02:00
Adrián Peña
13ce9436b3
chore: update Trivy to 0.74.0 ( #12466 )
2026-08-17 10:25:28 +02:00
dd882c70e7
chore(release): Bump versions to v5.40.0 ( #12443 )
...
Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com >
Co-authored-by: Josema Camacho <josema@prowler.com >
2026-08-13 13:49:26 +02:00
Pedro Martín
ab996417e6
fix(ci): bump Trivy to v0.73.0 to fix CVE-2026-46600 ( #12444 )
2026-08-13 12:04:51 +02:00
Prowler Bot and prowler-bot
5f109bc00e
chore(changelog): v5.39.0 ( #12433 )
...
Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com >
2026-08-13 09:01:51 +02:00
Hugo Pereira Brito and Josema Camacho
de64df11b9
fix(api): normalize social account names ( #12413 )
...
Co-authored-by: Josema Camacho <josema@prowler.com >
2026-08-12 12:41:44 +01:00
Adrián Peña
34b4e6f016
fix(api): enforce POST on SAML ACS endpoint ( #12393 )
2026-08-07 14:24:45 +02:00
Josema Camacho
3672b17a00
feat(api): identify active membership in current user response ( #12388 )
2026-08-07 10:40:21 +02:00
Adrián Peña
cf558c5f0a
fix(api): make tenant deletion cleanup atomic ( #12379 )
2026-08-06 17:36:52 +02:00
Prowler Bot and prowler-bot
d8c8027215
chore(release): Bump versions to v5.39.0 ( #12376 )
...
Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com >
2026-08-06 15:59:35 +02:00
Prowler Bot and prowler-bot
226504982b
chore(changelog): v5.38.0 ( #12373 )
...
Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com >
2026-08-06 13:25:12 +02:00
César Arroba
d1a37039fd
fix(deps): upgrade cryptography to 50.0.0 ( #12356 )
2026-08-05 19:16:11 +02:00
César Arroba
f3c602a5ac
feat(container): ship an SBOM and provenance with the published images ( #12352 )
2026-08-05 16:19:42 +02:00
Daniel Barranquero
dd61c417b7
feat(attack-paths): add outcome to query metadata ( #12344 )
2026-08-05 14:13:24 +02:00
César Arroba
af757a4d69
ci(container): pin Trivy to v0.72.0 across the estate ( #12346 )
2026-08-05 13:12:24 +02:00
Pedro Martín and Alan Buscaglia
a6d5dbacd9
fix(api): log comp report output dir failures with exc_info ( #12142 )
...
Co-authored-by: Alan Buscaglia <gentlemanprogramming@gmail.com >
2026-08-05 11:12:35 +02:00
César Arroba
87bc1eceae
ci(container): scan images with Grype alongside Trivy, blocking on critical and high ( #12340 )
2026-08-04 18:49:53 +02:00
César Arroba
635e451d9b
fix(container): verify the checksum of downloaded third-party binaries ( #12334 )
2026-08-04 18:07:46 +02:00
c610d9ac31
chore(changelog): v5.37.1 forward-sync to master ( #12322 )
...
Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com >
Co-authored-by: César Arroba <cesar@prowler.com >
2026-08-04 12:12:15 +02:00
Daniel Barranquero
caf27de6ee
fix(m365): bump microsoft-kiota packages to 1.9.10 so guest-user CA checks parse guestOrExternalUserTypes ( #12280 )
2026-08-04 10:37:04 +02:00
César Arroba
f4d6cd8609
fix(deps): restore the SDK dependency to master (PROWLER-2328) ( #12309 )
2026-08-04 09:59:21 +02:00
César Arroba
8ebb4a1ee7
fix(container): clear the Private Cloud image vulnerabilities (PROWLER-2291) ( #12258 )
2026-08-04 09:41:47 +02:00
Daniel Barranquero
a19fd70001
feat(aws): add pathfinding.cloud privilege-escalation coverage ( #12237 )
2026-08-04 08:59:52 +02:00
Prowler Bot and prowler-bot
ce77eb7f41
chore(release): Bump versions to v5.38.0 ( #12302 )
...
Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com >
2026-08-03 18:20:09 +02:00
b9aa863e52
chore(changelog): v5.37.0 ( #12293 )
...
Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com >
Co-authored-by: Pepe Fagoaga <pepe@prowler.com >
2026-08-03 14:35:29 +02:00
Rubén De la Torre Vico
b08d2eb472
fix(api): prevent 500 on Jira integrations with sparse fieldsets ( #12261 )
2026-07-31 15:03:04 +02:00
88c666a0d2
feat(attack-paths): Add 4 IAM privilege escalation detection queries ( #11460 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
Co-authored-by: Josema Camacho <josema@prowler.com >
2026-07-31 10:29:28 +02:00
Adrián Peña
3dd6b29477
fix(api): make social signup transactional ( #12245 )
2026-07-30 16:28:45 +02:00
Daniel Barranquero
5c4b0ba1fe
fix(api): scope Attack Paths predefined queries with provider label ( #12167 )
2026-07-30 11:55:24 +02:00
Adrián Peña
8dac2a7ccf
fix(api): assign fallback role to SAML users ( #12223 )
2026-07-30 11:17:25 +02:00
Josema Camacho
f8be9afa7c
fix(api): safely decode stored Celery task arguments ( #12165 )
2026-07-30 10:30:19 +02:00
Adrián Peña
ecf7ec8e85
fix(api): respect provider group scope in provider actions ( #12216 )
2026-07-30 10:06:57 +02:00
Pedro Martín
976220dbf5
fix(api): reject API keys whose owning user was deleted ( #12210 )
2026-07-29 17:18:09 +02:00
Adrián Peña
03f2ab46c9
fix(api): refresh Security Hub connection status ( #12212 )
2026-07-29 11:17:25 +02:00
Daniel Barranquero
e9bbde2f01
fix(api): remove cartesian product in Attack Paths IAM privesc queries ( #12136 )
2026-07-28 11:12:10 +02:00
Prowler Bot and prowler-bot
da09ad9813
chore(release): Bump versions to v5.37.0 ( #12113 )
...
Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com >
2026-07-24 14:56:54 +02:00
Prowler Bot and prowler-bot
2298d4a3f8
chore(changelog): v5.36.0 ( #12109 )
...
Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com >
2026-07-24 12:22:40 +02:00
Lydia Vilchez