Pedro Martín
f64e5e10ad
fix(container): bump Python base image to 3.12.16 ( #13215 )
2026-10-30 12:37:56 +01:00
Prowler Bot and prowler-bot
6999bbac9b
chore(release): Bump versions to v5.48.0 ( #13203 )
...
Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com >
2026-10-29 16:37:40 +01:00
Prowler Bot and prowler-bot
1a62d7d99a
chore(changelog): v5.47.0 ( #13201 )
...
Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com >
2026-10-29 14:01:05 +01:00
Pedro Martín
5a94fc798d
fix(container): patch pymongo, dnspython and oauthlib CVEs ( #13185 )
2026-10-28 13:44:41 +01:00
Prowler Bot and prowler-bot
b4bbb64c6b
chore(release): Bump versions to v5.47.0 ( #13165 )
...
Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com >
2026-10-26 20:55:18 +01:00
Prowler Bot and prowler-bot
fdb1bd6193
chore(changelog): v5.46.0 ( #13162 )
...
Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com >
2026-10-26 18:46:03 +01:00
Pedro Martín
be01a97789
fix(outputs): parse resource metadata once per batch ( #13149 )
2026-10-26 12:57:52 +01:00
Pedro Martín
c724840e6a
fix(api): compare serialized metadata on scan ingestion ( #13148 )
2026-10-26 12:13:02 +01:00
Pedro Martín
b52b8d3678
fix(api): bump djangorestframework to 3.18.3 ( #13157 )
2026-10-26 11:56:25 +01:00
Pedro Martín
13202b8a70
fix(api): require manage_account for SAML configuration ( #13121 )
2026-10-22 08:24:22 +02:00
Pedro Martín
a59eae7b24
fix(api): harden Attack Paths custom query sanitizer ( #13120 )
2026-10-22 01:05:45 +02:00
Pedro Martín
1e2f8f3cf7
fix(container): patch Pillow, certifi, uv, aiohttp and Trivy CVEs ( #13107 )
2026-10-21 16:26:59 +02:00
Pedro Martín
414dd64545
fix(api): scope metadata endpoints to role provider groups ( #12964 )
2026-10-19 17:15:09 +02:00
Pedro Martín
f45173997b
fix(api): wrap long account IDs in PDF report cover table ( #13063 )
2026-10-16 10:33:07 +02:00
Pedro Martín
de4db487d5
fix(container): bump Trivy to 0.76.0 in SDK and API images ( #13064 )
2026-10-16 09:55:18 +02:00
Prowler Bot and prowler-bot
f5aaec21cc
chore(release): Bump versions to v5.46.0 ( #13056 )
...
Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com >
2026-10-15 13:28:01 +02:00
Pedro Martín
64ce5a7503
fix(api): pin Redoc to 2.5.1 so the docs render ( #13053 )
2026-10-15 12:01:03 +02:00
Prowler Bot and prowler-bot
9b56a3b657
chore(changelog): v5.45.0 ( #13049 )
...
Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com >
2026-10-15 11:12:38 +02:00
César Arroba
1f8ca695e8
fix(api): recycle gunicorn workers to cap memory growth ( #13047 )
2026-10-15 09:36:33 +02:00
Pedro Martín
fbb22834f7
fix(container): bump PowerShell to 7.5.12 in SDK and API ( #13037 )
2026-10-14 10:09:18 +02:00
Pedro Martín
61d2cc55c4
fix(container): patch Trivy and MCP base image CVEs ( #13009 )
2026-10-09 18:17:48 +02:00
Pedro Martín
859a846147
fix(api): scope user memberships and roles to tenant ( #12965 )
2026-10-09 13:04:11 +02:00
Pedro Martín and alejandrobailo
f44ea4b6fa
fix(api): require inline kubeconfig credentials ( #12952 )
...
Co-authored-by: alejandrobailo <alejandrobailo94@gmail.com >
2026-10-08 18:15:10 +02:00
Pedro Martín
7ccdf7c0e6
fix(deps): patch pymongo CVEs and ignore proxy-addr ( #12955 )
2026-10-06 10:34:58 +02:00
Pedro Martín
0321a4f167
fix(deps): patch Django, urllib3 and dulwich CVEs ( #12953 )
2026-10-06 08:48:54 +02:00
César Arroba
f0da33f451
revert(api): release providers blocked by scans whose worker died ( #12915 )
2026-09-30 13:00:50 +02:00
César Arroba
b8ca30400b
fix(api): stop sending personal data to Sentry ( #12912 )
2026-09-30 12:28:42 +02:00
César Arroba
a006525e78
fix(api): release providers blocked by scans whose worker died ( #12899 )
2026-09-30 11:09:21 +02:00
Pedro Martín
ed510e217d
chore(deps): bump pyjwt to 2.14.0 for osv-scanner ( #12911 )
2026-09-30 10:21:11 +02:00
Pedro Martín
f418b32c81
fix(oci): use home region for identity bootstrap ( #12865 )
2026-09-29 17:50:54 +02:00
Prowler Bot and prowler-bot
5ea363d582
chore(release): Bump versions to v5.45.0 ( #12905 )
...
Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com >
2026-09-29 16:31:16 +02:00
Prowler Bot and prowler-bot
3ec379a75a
chore(changelog): v5.44.0 ( #12900 )
...
Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com >
2026-09-29 13:32:41 +02:00
Pedro Martín
03502c2426
fix(api): require operation permission to revoke tasks ( #12893 )
2026-09-28 17:15:39 +02:00
César Arroba
8d003c60d0
fix(api): skip unconfigured attack paths sinks on provider deletion ( #12894 )
...
Provider deletion now skips attack path graph cleanup for a sink whose connection settings have already been removed, instead of failing. The skip is logged as a warning, while the configured active sink still raises on error as before.
2026-09-28 14:33:44 +02:00
Rubén De la Torre Vico
453c953f37
fix(api): avoid field-named annotation in attack surface aggregation ( #12889 )
2026-09-28 11:39:36 +02:00
César Arroba
c114aa304b
fix(api): stop locking the API key row on every authenticated request ( #12882 )
2026-09-28 11:16:13 +02:00
César Arroba
576433d85d
fix(api): reap orphaned attack paths temp Neo4j databases ( #12832 )
2026-09-24 13:23:36 +02:00
Rubén De la Torre Vico
bf179212a5
fix(api): return the new scan id when a scan is created ( #12878 )
2026-09-24 13:12:44 +02:00
César Arroba
706603fe4d
feat(api): add an explicit endpoint for S3-compatible scan output storage ( #12871 )
2026-09-24 10:24:19 +02:00
Prowler Bot and prowler-bot
2c233c2f6c
chore(release): Bump versions to v5.44.0 ( #12860 )
...
Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com >
2026-09-23 13:11:45 +02:00
Pujitha Paladugu
50a9138bea
fix(api): sign report download URLs with SigV4 when the bucket region is set ( #12746 )
...
When DJANGO_OUTPUT_S3_AWS_DEFAULT_REGION is set, get_s3_presign_client() signs download URLs with SigV4, path-style, against the regional host, so SSE-KMS buckets no longer reject them with InvalidArgument. Without a region or a public endpoint, URLs are signed as before, and get_s3_client() is unchanged.
Fixes #12734
2026-09-22 16:12:44 +02:00
tejas_0007
09821e6328
fix(api): log Celery worker failures and restart compose services ( #12465 )
...
Declare the Celery worker, kombu, billiard and amqp loggers so fatal worker errors are no longer silenced by disable_existing_loggers, and log task failures from celery.app.trace at WARNING. Add restart: unless-stopped to the long-running services in docker-compose.yml.
Refs #12461
2026-09-22 12:23:51 +02:00
Rubén De la Torre Vico
8b35b69731
fix(api): make every endpoint resolve the same latest scan for a provider ( #12858 )
2026-09-21 17:38:11 +02:00
Prowler Bot and prowler-bot
81d90fc31e
chore(changelog): v5.43.0 ( #12856 )
...
Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com >
2026-09-21 15:30:24 +02:00
César Arroba
c9068515b2
fix(deps): bump anyio to 4.14.2 and accept unfixable CPython CVE-2026-82049 ( #12848 )
2026-09-21 12:51:41 +02:00
Pedro Martín
6c8d6994bb
fix(api): sign report URLs against public storage host ( #12552 )
2026-09-18 10:16:13 +02:00
Alejandro Bailo
5fe1a6713b
revert: remove the onboarding profile step ( #12818 ) ( #12838 )
2026-09-17 18:01:41 +02:00
Pedro Martín
f382400037
fix(invitations): expire lapsed invitations on re-invite ( #12831 )
2026-09-17 12:12:14 +02:00
Alejandro Bailo and Claude Opus 5
3069486549
feat: record the tenant profile declared at onboarding ( #12818 )
...
Co-authored-by: Claude Opus 5 <noreply@anthropic.com >
2026-09-17 10:03:59 +02:00
Pedro Martín
682353e054
fix(container): bump PowerShell to 7.5.11 in SDK and API ( #12811 )
2026-09-15 09:44:32 +02:00
Pedro Martín