- Remove dead docker login/pull/logout code and exceptions
- Fix finding metadata: empty RelatedUrl, Categories per finding type
- Replace SystemExit(0) with _listing_only flag in registry listing
- Use dynamic prowler_version in User-Agent header
- Normalize image UID by stripping protocol prefix on save
- Skip compliance and attack surface tasks for Image and IaC providers
- Add tests for scan_per_image and IMAGE scan path
Cloudflare bot management on Docker Hub blocks the default
python-requests User-Agent from container IPs, returning HTTP 500.
Add a Prowler/1.0 User-Agent header to all registry requests and
include truncated response body in 5xx retry logs for diagnostics.
- Add server error retry with exponential backoff in _request_with_retry
- Include truncated response body in Docker Hub login errors
- Add debug logging for login attempts
Add early return in _resolve_basic_credentials when password is None
to prevent TypeError on base64.b64decode. Move DockerHubAdapter import
from local scope to top-level in image_provider.py per PEP 8. Add
one-time 401 retry with token refresh in _authed_request to handle
per-repository-scoped bearer tokens on strict OCI registries.
Remove unused detect_registry_type() function and _ECR_PATTERN constant
from factory.py, along with their corresponding tests. Move requests
import behind TYPE_CHECKING guard in oci_adapter.py and
dockerhub_adapter.py since it is only used for type annotations.
- Fix shared dict mutation in ImageBaseException (thread-safety)
- Handle unexpected status codes in OCI adapter auth flow
- Force TLS verification for Docker Hub endpoints
- Add credential-safe __repr__ to RegistryAdapter
- Rename _next_page_url override to _next_tag_page_url in DockerHubAdapter
- Distinguish rate-limit from connection errors in retry logic
- Add type hints to all public adapter methods
- Remove unused imports in test files (flake8)
Update test patches from adapter-level to base-level module paths since
requests and time are now imported in base.py. Consolidate separate
requests.post/requests.get patches into requests.request since all HTTP
calls now go through _request_with_retry.
- Add test_registry_list_without_registry_fails: validates that
--registry-list without --registry returns an error
- Add test_registry_list_with_registry_passes: validates the happy path
- Add clarifying comment in factory.py about ECR using OCI adapter
- Use public /v2/repositories/{ns}/ endpoint when unauthenticated
- Fall back to namespace API when JWT is available for private repos
- Add test for unauthenticated public namespace listing
Add --registry-list flag that enumerates registry repositories and tags,
then prints a structured listing and exits without scanning. This helps
users discover available images before building --image-filter or
--tag-filter regexes.
Add pluggable registry adapter pattern for enumerating and scanning all
container images in a private registry. Supports:
- Generic OCI registries (Harbor, GitLab, JFrog) via /v2/_catalog
- Docker Hub via Hub REST API with namespace-based enumeration
- AWS ECR via standard OCI endpoints with ECR auth token
New CLI flags: --registry, --image-filter, --tag-filter, --max-images,
--registry-insecure
Andoni A.