StylusFrost
cf99e02ceb
Merge branch 'master' into PROWLER-1391-provider-contract-dynamic-discovery
2026-05-05 08:57:11 +02:00
Pepe Fagoaga
703a33108c
chore(changelog): prepare for v5.25.2 ( #10991 )
2026-05-05 08:47:28 +02:00
Pepe Fagoaga and Andoni A.
7c6d658154
fix(k8s): match RBAC rules by apiGroup, not just core ( #10969 )
...
Co-authored-by: Andoni A. <14891798+andoniaf@users.noreply.github.com >
2026-05-04 19:54:03 +02:00
Pepe Fagoaga
21d7d08b4b
fix(timeline): Return a compact actor name from CloudTrail events ( #10986 )
2026-05-04 19:39:17 +02:00
Pepe Fagoaga and Andoni A.
f314725f4d
fix(k8s): deduplicate RBAC findings by unique subject ( #10242 )
...
Co-authored-by: Andoni A. <14891798+andoniaf@users.noreply.github.com >
2026-05-04 18:11:38 +02:00
Rubén De la Torre Vico
02f43a7ad6
docs: add Prowler Studio page and remove check-kreator pages ( #10981 )
2026-05-04 17:51:02 +02:00
Daniel Barranquero
0dd8981ee4
feat: add issue template for creating new checks ( #10976 )
2026-05-04 17:47:39 +02:00
Rubén De la Torre Vico
269e51259d
docs: add troubleshooting guide for stuck scans after worker crash ( #10938 )
2026-05-04 17:24:09 +02:00
Hugo Pereira Brito
f4afdf0541
chore(ui): decrement changelog entry version to 1.25.2 ( #10974 )
2026-05-04 14:59:27 +01:00
Hugo Pereira Brito
652cb69216
fix(ui): compliance card layout polish ( #10939 )
2026-05-04 12:59:06 +01:00
Daniel Barranquero
921f49a0de
feat(aws): add bedrock_prompt_management_exists security check ( #10878 )
2026-05-04 12:38:15 +02:00
Hugo Pereira Brito
6cb770fcc8
fix(ui): clean up findings expanded resource row layout ( #10949 )
2026-05-04 11:17:54 +01:00
Daniel Barranquero
86449fb99d
chore(vercel): add disclaimer for checks depending on billing plan ( #10663 )
2026-05-04 08:56:50 +02:00
Andoni Alonso
40dd0e640b
fix(sdk): strip http(s):// scheme from image registry URLs ( #10950 )
2026-05-04 08:37:46 +02:00
StylusFrost
9681901174
style(sdk): satisfy black and vulture in test_dynamic_provider_loading
...
Two unrelated lint blockers that CI surfaced once the file was in scope
of `black --check .` and `vulture` on the changed-file path:
- Reformat one if/and conditional that black wanted on a single line.
- Underscore-prefix unused parameter names on FakeProvider stub methods
(from_cli_args, get_output_options, display_compliance_table,
generate_compliance_output, FakePureContractProvider.from_cli_args)
and the throwaway **kw in a MagicMock side_effect lambda. These are
test fixtures whose method bodies don't reference those args; the
signatures must match the abstract contract on Provider, so we keep
positions/types and just rename to indicate intentional non-use.
No logic change.
2026-05-03 22:55:24 +02:00
StylusFrost
bbe3a7dbf8
refactor(sdk): extract is_builtin_provider to leaf module to break import cycle
...
CodeQL flagged a cyclic import after `prowler/lib/check/utils.py` and
`prowler/lib/check/check.py` started importing `Provider` from
`prowler.providers.common.provider`. That module transitively imports
`prowler.config.config`, which imports back into `prowler.lib.check.*`
(`compliance_models`, `external_tool_providers`) — closing the cycle.
Apply the same pattern already used for `is_tool_wrapper_provider`:
extract the predicate to a leaf module, `prowler.providers.common.builtin`,
that depends only on `importlib.util`. `Provider.is_builtin` delegates to
the leaf, and call sites in `prowler.lib.check.*` now import directly
from the leaf — no more cycle.
Also underscore-prefix unused parameters on the abstract stubs in
`Provider` (get_finding_output_data, generate_compliance_output,
display_compliance_table) so vulture stops flagging them now that the
file is in the diff.
2026-05-03 22:46:00 +02:00
StylusFrost
0672c80563
fix(sdk): guard find_spec with is_builtin for external provider discovery
...
Calling importlib.util.find_spec on prowler.providers.{provider}.services
for an external provider propagates ModuleNotFoundError when the parent
package prowler.providers.{provider} does not exist, instead of returning
None. This caused recover_checks_from_provider, _resolve_check_module and
Scan.scan to fail with "No module named 'prowler.providers.{external}'"
even though the plug-in registered its checks via entry points correctly.
Gate the built-in branch on Provider.is_builtin (which already wraps the
find_spec in try/except) and reuse _resolve_check_module from Scan.scan
so external providers fall through to the entry-point lookup.
2026-05-03 22:31:31 +02:00
StylusFrost
92d7ea2170
Merge remote-tracking branch 'origin/master' into PROWLER-1391-provider-contract-dynamic-discovery
...
# Conflicts:
# prowler/config/config.py
2026-05-03 19:41:25 +02:00
StylusFrost
c7aa536896
fix(sdk): built-in wins on plug-in collision for providers and checks
2026-04-30 19:50:19 +02:00
Hugo Pereira Brito
8db3a89669
ci: remove andoniaf from prowler-cloud ( #10926 )
2026-04-30 18:07:25 +02:00
Danny Lyubenov and Daniel Barranquero
c802dc8a36
feat(codebuild): use batched API calls to prevent throttling and false positives ( #10639 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2026-04-30 17:19:21 +02:00
Pedro Martín
3ab9a4efa5
chore(changelog): update with latest changes ( #10948 )
2026-04-30 14:13:40 +02:00
Pepe Fagoaga
36b8aa1b79
fix(boto3): pass config to clients ( #10944 )
2026-04-30 14:11:29 +02:00
StylusFrost
e7f23bb13f
fix(sdk): propagate provider argument from report to stdout_report
2026-04-30 14:06:17 +02:00
Pedro Martín
e821e07d7d
docs(rbac): add Manage Alerts permission ( #10947 )
2026-04-30 13:58:17 +02:00
StylusFrost
82132a9341
fix(sdk): use find_spec to distinguish missing vs broken built-ins
2026-04-30 13:53:06 +02:00
228fe6d579
feat: add ASD Essential Eight compliance framework for AWS ( #10808 )
...
Co-authored-by: Boon <boon@security8.work >
Co-authored-by: pedrooot <pedromarting3@gmail.com >
2026-04-30 13:49:08 +02:00
Pedro Martín
578186aa40
feat(sdk): integrate universal compliance into CLI pipeline ( #10301 )
2026-04-30 13:49:00 +02:00
Andoni Alonso
4608e45c8a
fix(image): block parser-mismatch SSRF in registry auth ( #10945 )
2026-04-30 12:56:35 +02:00
Pedro Martín
5987651aee
chore(README): update with latest changes ( #10946 )
2026-04-30 12:56:06 +02:00
Adrián Tomás and Claude Opus 4.6
85800f2ddd
chore(pre-commit): add priority tiers to .pre-commit-config.yaml ( #10842 )
...
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
2026-04-30 12:33:09 +02:00
StylusFrost
5e876579f8
fix(sdk): use is_tool_wrapper_provider for compliance framework gate
2026-04-30 10:12:24 +02:00
Pablo Fernandez Guerra (PFE) and Pablo F.G
4fb5272362
refactor(ui): unify DataTable pagination into a single callback ( #10863 )
...
Co-authored-by: Pablo F.G <pablo.fernandez@prowler.com >
2026-04-30 08:58:11 +02:00
Pepe Fagoaga
85d38b5f71
feat(scans): Reset resource failed findings to 0 for ephemeral resources ( #10929 )
2026-04-29 19:08:16 +02:00
Prowler Bot and prowler-bot
59dcdb87c4
chore(docs): Bump version to v5.25.1 ( #10940 )
...
Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com >
2026-04-29 18:44:12 +02:00
Josema Camacho
9297453b8a
fix(sdk): add autouse mock_aws fixture and leak detector to prevent AWS test leaks ( #10605 )
2026-04-29 17:49:40 +02:00
Davlet Dzhakishev
dd37f4ee1f
fix(azure): update flow log compliance text for NSG retirement ( #10937 )
2026-04-29 16:45:58 +02:00
Pepe Fagoaga
20f36f7c84
chore: changelog v5.25.1 ( #10934 )
2026-04-29 14:00:53 +02:00
ec4d27746f
fix(ui): reposition compliance card export menu ( #10918 )
...
Co-authored-by: Pablo F.G <pablo.fernandez@prowler.com >
Co-authored-by: Pedro Martín <pedromarting3@gmail.com >
Co-authored-by: Pepe Fagoaga <pepe@prowler.com >
2026-04-29 13:52:36 +02:00
Andoni Alonso and Pepe Fagoaga
7076900fb1
fix(kubernetes): use cluster name as provider_uid in OCSF output ( #10483 )
...
Co-authored-by: Pepe Fagoaga <pepe@prowler.com >
2026-04-29 13:45:49 +02:00
Josema Camacho
5d90352a0f
fix(api): redirect scan report and compliance downloads to presigned S3 URLs ( #10927 )
2026-04-29 13:19:19 +02:00
Hugo Pereira Brito
a981dc64a7
docs(sdk): link route53 changelog entry to PR ( #10928 )
2026-04-29 12:24:27 +02:00
Josema Camacho
d2086cad3f
fix(api): Attack Paths AWS region fallback and stale SCHEDULED cleanup ( #10917 )
2026-04-29 12:20:43 +02:00
Hugo Pereira Brito
380b89cfb6
fix(sdk): cover CNAME → dangling S3 in route53 takeover check ( #10920 )
2026-04-29 11:14:33 +01:00
Pablo Fernandez Guerra (PFE) and Pablo F.G
13b04d339b
test(ui): add E2E tests for invitation accept smart router ( #10814 )
...
Co-authored-by: Pablo F.G <pablo.fernandez@prowler.com >
2026-04-29 10:27:30 +02:00
Pepe Fagoaga
be3c5fb3c1
fix(cli): generate compliance after scan ( #10919 )
2026-04-28 17:18:30 +02:00
Davlet Dzhakishev and Daniel Barranquero
1de01bcb78
fix(azure): tighten flow log workspace checks ( #10645 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2026-04-28 16:57:04 +02:00
StylusFrost
be49fd8c4e
Merge branch 'master' into PROWLER-1391-provider-contract-dynamic-discovery
2026-04-28 14:48:21 +02:00
StylusFrost
15d8f1642e
test(sdk): unit tests for tool_wrapper leaf module
2026-04-28 14:45:07 +02:00
baggers27
13d983450c
fix(azure): broken link for minimum TLS version ( #10916 )
2026-04-28 14:23:00 +02:00
StylusFrost