ben.carrasco/prowler
1
0 Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-10-11 14:04:17 +00:00
Code Issues Packages Projects Releases Wiki Activity
9,249 Commits 579 Branches 224 Tags
ea7e5f1fb006eaee53598735f6ce7e76a94e0176
Commit Graph
9249 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
alejandrobailo ea7e5f1fb0 docs: note the union exception and the eight-model limit outcome 2026-10-08 14:42:41 +02:00
alejandrobailo ffe4989f38 docs: document credential schemas for external providers 
External providers describe their credentials through
get_credentials_schema(), but nothing explained what the credentials
form accepts. Document the supported fields and the discriminated union
that offers several authentication methods within one secret type.
 2026-10-08 14:16:00 +02:00
César Arroba 92216f1597 ci(release): auto-create minor release branch and lift freeze on publish 
Create the minor release branch automatically in the release preparation workflow, check versions before creating it, match the version literally, and lift the release freeze when the release is published.
 2026-10-08 12:47:38 +02:00
Alejandro Bailo b5a709664d fix(ui): show only the chosen registry credential variant (#12966) 2026-10-07 16:35:20 +02:00
Alejandro Bailo 9d8060adc5 test(ui): stabilize invite-teammate roles-unavailable test (#12973) 2026-10-07 16:14:23 +02:00
StylusFrost f1e822f7df chore(trivy): suppress @modelcontextprotocol/sdk CVE-2026-104850 (#12967) 2026-10-07 12:27:44 +02:00
StylusFrost 22bc834c09 chore(grype): suppress zlib CVE-2026-85091 until base images ship the fix (#12970) 2026-10-07 12:16:04 +02:00
StylusFrost 3f893176ba fix(ui): bump sharp to 0.35.5 to patch the librsvg advisory (#12968) 2026-10-07 11:48:19 +02:00
César Arroba d38e04dd3e chore(github): move code ownership from platform to engineering (#12958) 2026-10-06 10:42:52 +02:00
Pedro Martín 7ccdf7c0e6 fix(deps): patch pymongo CVEs and ignore proxy-addr (#12955) 2026-10-06 10:34:58 +02:00
Alejandro Bailo bee60c5471 fix(ui): stop reporting client-aborted RSC streams to Sentry (#12956) 2026-10-06 10:23:07 +02:00
Alejandro Bailo f850199645 fix(ui): pin proxy-addr to 2.0.8 to patch the IP spoofing advisory (#12957) 2026-10-06 10:10:17 +02:00
Pedro Martín 0321a4f167 fix(deps): patch Django, urllib3 and dulwich CVEs (#12953) 2026-10-06 08:48:54 +02:00
Alejandro Bailo 383a9bf903 fix(ui): bump Next.js to 16.3.6 to patch the next/og RCE advisory (#12922) 2026-10-01 11:54:44 +02:00
Alejandro Bailo 4605d9a770 feat(ui): invite a teammate from the AWS connect step (#12917) 2026-10-01 09:50:10 +02:00
César Arroba f0da33f451 revert(api): release providers blocked by scans whose worker died (#12915) 2026-09-30 13:00:50 +02:00
Alejandro Bailo a44a725507 fix(ui): retry the first-run redirect until the add-provider wizard opens (#12914) 2026-09-30 12:34:52 +02:00
César Arroba b8ca30400b fix(api): stop sending personal data to Sentry (#12912) 2026-09-30 12:28:42 +02:00
César Arroba a006525e78 fix(api): release providers blocked by scans whose worker died (#12899) 2026-09-30 11:09:21 +02:00
Pedro Martín ed510e217d chore(deps): bump pyjwt to 2.14.0 for osv-scanner (#12911) 2026-09-30 10:21:11 +02:00
Alejandro Bailo 04511f339e test(ui): stabilize attack-paths refit integration test (#12896) 2026-09-29 18:42:19 +02:00
Pedro Martín f418b32c81 fix(oci): use home region for identity bootstrap (#12865) 2026-09-29 17:50:54 +02:00
Pedro Martín 65fb146e76 chore(trivy): suppress fast-uri CVE-2026-84292 (#12907) 2026-09-29 17:04:46 +02:00
Prowler Botandprowler-bot 5ea363d582 chore(release): Bump versions to v5.45.0 (#12905) 
Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com>
 2026-09-29 16:31:16 +02:00
Prowler Botandprowler-bot 3ec379a75a chore(changelog): v5.44.0 (#12900) 
Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com>
 2026-09-29 13:32:41 +02:00
Pedro Martín ea020ed46e chore(changelog): v5.44.0 highlights (#12897) 2026-09-29 13:32:13 +02:00
Alejandro Bailo 60b936005c test(ui): scope E2E delete dialog and scans table locators (#12898) 2026-09-29 12:32:55 +02:00
Pedro Martín 03502c2426 fix(api): require operation permission to revoke tasks (#12893) 2026-09-28 17:15:39 +02:00
Alejandro Bailo e6320b178a fix(ui): bundle all icons so the UI renders without internet access (#12892) 2026-09-28 15:58:32 +02:00
Alejandro Bailo 4195a4f818 test(ui): add AWS provider in one step in the E2E helper (#12895) 2026-09-28 15:38:47 +02:00
César Arroba 8d003c60d0 fix(api): skip unconfigured attack paths sinks on provider deletion (#12894) 
Provider deletion now skips attack path graph cleanup for a sink whose connection settings have already been removed, instead of failing. The skip is logged as a warning, while the configured active sink still raises on error as before.
 2026-09-28 14:33:44 +02:00
Alejandro Bailo d5136f364c perf(ui): stream the findings page and load the Finding Group filter on open (#12891) 2026-09-28 12:21:13 +02:00
Rubén De la Torre Vico 453c953f37 fix(api): avoid field-named annotation in attack surface aggregation (#12889) 2026-09-28 11:39:36 +02:00
César Arroba c114aa304b fix(api): stop locking the API key row on every authenticated request (#12882) 2026-09-28 11:16:13 +02:00
Alejandro Bailo c2b8092461 feat(ui): hint the resource re-check beside Last seen (#12883) 2026-09-25 14:55:21 +02:00
Pedro Martín 26d9d24e5d docs(introduction): list UI and API support for Okta (#12881) 2026-09-25 10:16:53 +02:00
Alejandro Bailo ee59e35bc2 fix(ui): stop offering reports and compliance for partial scans (#12880) 2026-09-25 10:09:33 +02:00
César Arroba e0fa23b9ee fix(ui): show API error message when mute rule creation fails (#12853) 2026-09-24 15:35:19 +02:00
Alejandro Bailo 4dbc3c7e74 feat(ui): re-check a resource with a partial scan from the findings actions (#12879) 2026-09-24 13:54:15 +02:00
César Arroba 576433d85d fix(api): reap orphaned attack paths temp Neo4j databases (#12832) 2026-09-24 13:23:36 +02:00
Rubén De la Torre Vico bf179212a5 fix(api): return the new scan id when a scan is created (#12878) 2026-09-24 13:12:44 +02:00
César Arroba 60f936a10b fix(ui): wait for the full provider connection check before reporting a result (#12869) 2026-09-24 11:23:56 +02:00
César Arroba 15630f54d2 fix(aws): reuse the STS region that answered and add PROWLER_AWS_BOTO3_RETRIES_MAX_ATTEMPTS (#12870) 2026-09-24 10:24:44 +02:00
César Arroba 706603fe4d feat(api): add an explicit endpoint for S3-compatible scan output storage (#12871) 2026-09-24 10:24:19 +02:00
Pedro Martínandalejandrobailo dc67fe4f37 feat(ui): connect and test AWS accounts in one step (#12876) 
Co-authored-by: alejandrobailo <alejandrobailo94@gmail.com>
 2026-09-24 09:57:59 +02:00
Prowler Botandprowler-bot 2c233c2f6c chore(release): Bump versions to v5.44.0 (#12860) 
Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com>
 2026-09-23 13:11:45 +02:00
Alejandro Bailo 69e1d19abe feat(ui): open the paid plan upgrade modal from report downloads (#12875) 2026-09-23 13:08:49 +02:00
Alejandro Bailo 859421b0ec fix(ui): read the persisted sidebar mode without a hydration mismatch (#12873) 2026-09-23 13:03:28 +02:00
Pedro Martínandalejandrobailo ea36f12a01 feat(ui): connect AWS accounts in a single wizard step (#12852) 
Co-authored-by: alejandrobailo <alejandrobailo94@gmail.com>
 2026-09-22 18:21:55 +02:00
Pujitha Paladugu 50a9138bea fix(api): sign report download URLs with SigV4 when the bucket region is set (#12746) 
When DJANGO_OUTPUT_S3_AWS_DEFAULT_REGION is set, get_s3_presign_client() signs download URLs with SigV4, path-style, against the regional host, so SSE-KMS buckets no longer reject them with InvalidArgument. Without a region or a public endpoint, URLs are signed as before, and get_s3_client() is unchanged.

Fixes #12734
 2026-09-22 16:12:44 +02:00