chore(api): Update prowler dependency to v5.29 for release 5.29.0 (#11414)

Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com>

.env

@@ -6,20 +6,14 @@
 PROWLER_UI_VERSION="stable"
 AUTH_URL=http://localhost:3000
 API_BASE_URL=http://prowler-api:8080/api/v1
-# deprecated, use UI_API_BASE_URL
 NEXT_PUBLIC_API_BASE_URL=${API_BASE_URL}
-UI_API_BASE_URL=${API_BASE_URL}
-# deprecated, use UI_API_DOCS_URL
 NEXT_PUBLIC_API_DOCS_URL=http://prowler-api:8080/api/v1/docs
-UI_API_DOCS_URL=http://prowler-api:8080/api/v1/docs
 AUTH_TRUST_HOST=true
 UI_PORT=3000
 # openssl rand -base64 32
 AUTH_SECRET="N/c6mnaS5+SWq81+819OrzQZlmx1Vxtp/orjttJSmw8="
-# Google Tag Manager ID (empty/unset ⇒ GTM not loaded, zero egress)
-# deprecated, use UI_GOOGLE_TAG_MANAGER_ID
+# Google Tag Manager ID
 NEXT_PUBLIC_GOOGLE_TAG_MANAGER_ID=""
-UI_GOOGLE_TAG_MANAGER_ID=""
 
 #### MCP Server ####
 PROWLER_MCP_VERSION=stable
@@ -145,20 +139,13 @@ DJANGO_BROKER_VISIBILITY_TIMEOUT=86400
 DJANGO_SENTRY_DSN=
 DJANGO_THROTTLE_TOKEN_OBTAIN=50/minute
 
-# Sentry for the web app (server + browser). The UI_SENTRY_* values load only
-# when UI_SENTRY_ENABLE="true"; without it they are ignored (default off, zero
-# egress). The deprecated NEXT_PUBLIC_SENTRY_DSN still activates Sentry without
-# the flag. SENTRY_RELEASE (unprefixed) feeds the web app's server/edge SDKs.
-UI_SENTRY_DSN=
-UI_SENTRY_ENVIRONMENT=local
+# Sentry settings
+SENTRY_ENVIRONMENT=local
 SENTRY_RELEASE=local
-# Reserved runtime public config (registered now; no UI consumer yet)
-# UI_POSTHOG_KEY=
-# UI_POSTHOG_HOST=
-# REO_DEV_CLIENT_ID=
+NEXT_PUBLIC_SENTRY_ENVIRONMENT=${SENTRY_ENVIRONMENT}
 
 #### Prowler release version ####
-NEXT_PUBLIC_PROWLER_RELEASE_VERSION=v5.33.2
+NEXT_PUBLIC_PROWLER_RELEASE_VERSION=v5.29.0
 
 # Social login credentials
 SOCIAL_GOOGLE_OAUTH_CALLBACK_URL="${AUTH_URL}/api/auth/callback/google"

.github/CODEOWNERS

@@ -1,6 +1,7 @@
 # SDK
 /* @prowler-cloud/detection-remediation
 /prowler/ @prowler-cloud/detection-remediation
+/prowler/compliance/ @prowler-cloud/compliance
 /tests/ @prowler-cloud/detection-remediation
 /dashboard/ @prowler-cloud/detection-remediation
 /docs/ @prowler-cloud/detection-remediation

.github/actions/osv-scanner/action.yml

@@ -1,5 +1,5 @@
 name: 'OSV-Scanner'
-description: 'Install osv-scanner and scan a lockfile, failing on CRITICAL severity findings. Posts/updates a PR comment with findings on pull_request events (requires pull-requests: write).'
+description: 'Install osv-scanner and scan a lockfile, failing on HIGH/CRITICAL/UNKNOWN severity findings. Posts/updates a PR comment with findings on pull_request events (requires pull-requests: write).'
 author: 'Prowler'
 
 inputs:
@@ -7,9 +7,9 @@ inputs:
     description: 'Path to the lockfile to scan, relative to the repository root (e.g. uv.lock, api/uv.lock, ui/pnpm-lock.yaml).'
     required: true
   severity-levels:
-    description: 'Comma-separated severity levels that fail the scan. Default: CRITICAL.'
+    description: 'Comma-separated severity levels that fail the scan. Default: HIGH,CRITICAL,UNKNOWN.'
     required: false
-    default: 'CRITICAL'
+    default: 'HIGH,CRITICAL,UNKNOWN'
   version:
     description: 'osv-scanner release tag to install. When overriding, you MUST also override binary-sha256.'
     required: false

.github/actions/setup-python-uv/action.yml

@@ -43,17 +43,8 @@ runs:
       if: github.repository_owner == 'prowler-cloud' && github.repository != 'prowler-cloud/prowler'
       shell: bash
       working-directory: ${{ inputs.working-directory }}
-      env:
-        GITHUB_TOKEN: ${{ github.token }}
       run: |
-        LATEST_COMMIT=$(curl -sf --retry 3 --retry-all-errors --retry-delay 2 --retry-max-time 60 \
-          -H "Authorization: Bearer ${GITHUB_TOKEN}" \
-          -H "Accept: application/vnd.github+json" \
-          "https://api.github.com/repos/prowler-cloud/prowler/commits/master" \
-          | jq -er '.sha') || {
-          echo "::error::Failed to fetch latest prowler/master commit from the GitHub API (HTTP error or missing .sha). Check the GITHUB_TOKEN and API rate limits."
-          exit 1
-        }
+        LATEST_COMMIT=$(curl -s "https://api.github.com/repos/prowler-cloud/prowler/commits/master" | jq -r '.sha')
         echo "Latest commit hash: $LATEST_COMMIT"
         sed -i "s|\(git = \"https://github\.com/prowler-cloud/prowler\.git?rev=master\)#[a-f0-9]\{40\}\"|\1#${LATEST_COMMIT}\"|g" uv.lock
         echo "Updated uv.lock entry:"
@@ -63,17 +54,8 @@ runs:
       if: github.event_name == 'push' && github.ref == 'refs/heads/master' && github.repository == 'prowler-cloud/prowler'
       shell: bash
       working-directory: ${{ inputs.working-directory }}
-      env:
-        GITHUB_TOKEN: ${{ github.token }}
       run: |
-        LATEST_COMMIT=$(curl -sf --retry 3 --retry-all-errors --retry-delay 2 --retry-max-time 60 \
-          -H "Authorization: Bearer ${GITHUB_TOKEN}" \
-          -H "Accept: application/vnd.github+json" \
-          "https://api.github.com/repos/prowler-cloud/prowler/commits/master" \
-          | jq -er '.sha') || {
-          echo "::error::Failed to fetch latest prowler/master commit from the GitHub API (HTTP error or missing .sha). Check the GITHUB_TOKEN and API rate limits."
-          exit 1
-        }
+        LATEST_COMMIT=$(curl -s "https://api.github.com/repos/prowler-cloud/prowler/commits/master" | jq -r '.sha')
         echo "Latest commit hash: $LATEST_COMMIT"
         sed -i "s|\(git = \"https://github\.com/prowler-cloud/prowler\.git?rev=master\)#[a-f0-9]\{40\}\"|\1#${LATEST_COMMIT}\"|g" uv.lock
         echo "Updated uv.lock entry:"

.github/actions/trivy-scan/action.yml

@@ -63,7 +63,7 @@ runs:
         exit-code: '0'
         scanners: 'vuln'
         timeout: '5m'
-        version: 'v0.71.2'
+        version: 'v0.69.2'
 
     - name: Run Trivy vulnerability scan (SARIF)
       if: inputs.upload-sarif == 'true' && github.event_name == 'push'
@@ -76,7 +76,7 @@ runs:
         exit-code: '0'
         scanners: 'vuln'
         timeout: '5m'
-        version: 'v0.71.2'
+        version: 'v0.69.2'
 
     - name: Upload Trivy results to GitHub Security tab
       if: inputs.upload-sarif == 'true' && github.event_name == 'push'

.github/dependabot.yml

@@ -0,0 +1,138 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+  # v5
+  # - package-ecosystem: "pip"
+  #   directory: "/"
+  #   schedule:
+  #     interval: "monthly"
+  #   open-pull-requests-limit: 25
+  #   target-branch: master
+  #   labels:
+  #     - "dependencies"
+  #     - "pip"
+  #   cooldown:
+  #     default-days: 7
+
+  # Dependabot Updates are temporary disabled - 2025/03/19
+  # - package-ecosystem: "pip"
+  #   directory: "/api"
+  #   schedule:
+  #     interval: "daily"
+  #   open-pull-requests-limit: 10
+  #   target-branch: master
+  #   labels:
+  #     - "dependencies"
+  #     - "pip"
+  #     - "component/api"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    open-pull-requests-limit: 25
+    target-branch: master
+    labels:
+      - "dependencies"
+      - "github_actions"
+    cooldown:
+      default-days: 7
+
+  # Dependabot Updates are temporary disabled - 2025/03/19
+  # - package-ecosystem: "npm"
+  #   directory: "/ui"
+  #   schedule:
+  #     interval: "daily"
+  #   open-pull-requests-limit: 10
+  #   target-branch: master
+  #   labels:
+  #     - "dependencies"
+  #     - "npm"
+  #     - "component/ui"
+
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    open-pull-requests-limit: 25
+    target-branch: master
+    labels:
+      - "dependencies"
+      - "docker"
+    cooldown:
+      default-days: 7
+
+  # - package-ecosystem: "pre-commit"
+  #   directory: "/"
+  #   schedule:
+  #     interval: "monthly"
+  #   open-pull-requests-limit: 25
+  #   target-branch: master
+  #   labels:
+  #     - "dependencies"
+  #     - "pre-commit"
+  #   cooldown:
+  #     default-days: 7
+
+  # Dependabot Updates are temporary disabled - 2025/04/15
+  # v4.6
+  # - package-ecosystem: "pip"
+  #   directory: "/"
+  #   schedule:
+  #     interval: "weekly"
+  #   open-pull-requests-limit: 10
+  #   target-branch: v4.6
+  #   labels:
+  #     - "dependencies"
+  #     - "pip"
+  #     - "v4"
+
+  # - package-ecosystem: "github-actions"
+  #   directory: "/"
+  #   schedule:
+  #     interval: "weekly"
+  #   open-pull-requests-limit: 10
+  #   target-branch: v4.6
+  #   labels:
+  #     - "dependencies"
+  #     - "github_actions"
+  #     - "v4"
+
+  # - package-ecosystem: "docker"
+  #   directory: "/"
+  #   schedule:
+  #     interval: "weekly"
+  #   open-pull-requests-limit: 10
+  #   target-branch: v4.6
+  #   labels:
+  #     - "dependencies"
+  #     - "docker"
+  #     - "v4"
+
+  # Dependabot Updates are temporary disabled - 2025/03/19
+  # v3
+  # - package-ecosystem: "pip"
+  #   directory: "/"
+  #   schedule:
+  #     interval: "monthly"
+  #   open-pull-requests-limit: 10
+  #   target-branch: v3
+  #   labels:
+  #     - "dependencies"
+  #     - "pip"
+  #     - "v3"
+
+  # - package-ecosystem: "github-actions"
+  #   directory: "/"
+  #   schedule:
+  #     interval: "monthly"
+  #   open-pull-requests-limit: 10
+  #   target-branch: v3
+  #   labels:
+  #     - "dependencies"
+  #     - "github_actions"
+  #     - "v3"

.github/labeler.yml

@@ -77,11 +77,6 @@ provider/okta:
       - any-glob-to-any-file: "prowler/providers/okta/**"
       - any-glob-to-any-file: "tests/providers/okta/**"
 
-provider/linode:
-  - changed-files:
-      - any-glob-to-any-file: "prowler/providers/linode/**"
-      - any-glob-to-any-file: "tests/providers/linode/**"
-
 github_actions:
   - changed-files:
       - any-glob-to-any-file: ".github/workflows/*"

.github/pull_request_template.md

@@ -18,8 +18,8 @@ Please add a detailed description of how to review this PR.
 
 <summary><b>Community Checklist</b></summary>
 
-- [ ] This feature/issue is listed in the [open issues](https://github.com/prowler-cloud/prowler/issues?q=sort%3Aupdated-desc+is%3Aissue+is%3Aopen) or roadmap.prowler.com
-- [ ] Is it assigned to me, if not, request it via the [open issues](https://github.com/prowler-cloud/prowler/issues?q=sort%3Aupdated-desc+is%3Aissue+is%3Aopen) or [Prowler Community Slack](https://goto.prowler.com/slack)
+- [ ] This feature/issue is listed in [here](https://github.com/prowler-cloud/prowler/issues?q=sort%3Aupdated-desc+is%3Aissue+is%3Aopen) or roadmap.prowler.com
+- [ ] Is it assigned to me, if not, request it via the issue/feature in [here](https://github.com/prowler-cloud/prowler/issues?q=sort%3Aupdated-desc+is%3Aissue+is%3Aopen) or [Prowler Community Slack](goto.prowler.com/slack)
 
 </details>
 
@@ -28,7 +28,7 @@ Please add a detailed description of how to review this PR.
 - [ ] Review if code is being documented following this specification https://github.com/google/styleguide/blob/gh-pages/pyguide.md#38-comments-and-docstrings
 - [ ] Review if backport is needed.
 - [ ] Review if is needed to change the [Readme.md](https://github.com/prowler-cloud/prowler/blob/master/README.md)
-- [ ] Ensure a changelog fragment is added under [prowler/changelog.d/](https://github.com/prowler-cloud/prowler/tree/master/prowler/changelog.d), if applicable.
+- [ ] Ensure new entries are added to [CHANGELOG.md](https://github.com/prowler-cloud/prowler/blob/master/prowler/CHANGELOG.md), if applicable.
 
 #### SDK/CLI
 - Are there new checks included in this PR? Yes / No
@@ -40,7 +40,7 @@ Please add a detailed description of how to review this PR.
 - [ ] Screenshots/Video of the functionality flow (if applicable) - Mobile (X < 640px)
 - [ ] Screenshots/Video of the functionality flow (if applicable) - Table (640px > X < 1024px)
 - [ ] Screenshots/Video of the functionality flow (if applicable) - Desktop (X > 1024px)
-- [ ] Ensure a changelog fragment is added under [ui/changelog.d/](https://github.com/prowler-cloud/prowler/tree/master/ui/changelog.d), if applicable.
+- [ ] Ensure new entries are added to [CHANGELOG.md](https://github.com/prowler-cloud/prowler/blob/master/ui/CHANGELOG.md), if applicable.
 
 #### API
 - [ ] All issue/task requirements work as expected on the API
@@ -50,11 +50,7 @@ Please add a detailed description of how to review this PR.
 - [ ] Any other relevant evidence of the implementation (if applicable)
 - [ ] Verify if API specs need to be regenerated.
 - [ ] Check if version updates are required (e.g., specs, uv, etc.).
-- [ ] Ensure a changelog fragment is added under [api/changelog.d/](https://github.com/prowler-cloud/prowler/tree/master/api/changelog.d), if applicable.
-
-#### MCP Server
-- [ ] All issue/task requirements work as expected on the MCP Server
-- [ ] Ensure a changelog fragment is added under [mcp_server/changelog.d/](https://github.com/prowler-cloud/prowler/tree/master/mcp_server/changelog.d), if applicable.
+- [ ] Ensure new entries are added to [CHANGELOG.md](https://github.com/prowler-cloud/prowler/blob/master/api/CHANGELOG.md), if applicable.
 
 ### License
 

.github/renovate.json

@@ -38,7 +38,7 @@
       "schedule": [
         "* 22-23,0-5 1 * *"
       ],
-      "enabled": true
+      "enabled": false
     },
     {
       "description": "Minors: 8th of every 3 months, Madrid overnight window (22:00-06:00)",
@@ -48,7 +48,7 @@
       "schedule": [
         "* 22-23,0-5 8 */3 *"
       ],
-      "enabled": true
+      "enabled": false
     },
     {
       "description": "Majors: 15th of every 3 months, Madrid overnight window",
@@ -58,7 +58,7 @@
       "schedule": [
         "* 22-23,0-5 15 */3 *"
       ],
-      "enabled": true
+      "enabled": false
     },
     {
       "description": "GitHub Actions - single grouped PR, no changelog, scope=ci",

.github/scripts/changelog_attribution.py

@@ -1,154 +0,0 @@
-#!/usr/bin/env python3
-"""Rename changelog fragments to their PR number before running towncrier.
-
-For every <slug>.<type>.md in <component_dir>/changelog.d/, find the commit that
-added it, resolve its PR via the GitHub API (falling back to the squash-commit
-subject), and `git mv` it to <PR>.<type>.md so towncrier renders the PR link.
-Unresolvable fragments become +<slug>.<type>.md orphans (rendered without link).
-"""
-
-import argparse
-import json
-import os
-import re
-import subprocess
-import sys
-import urllib.error
-import urllib.request
-
-FRAGMENT_RE = re.compile(
-    r"^(?P<slug>[A-Za-z0-9][A-Za-z0-9._-]*?)"
-    r"\.(?P<type>added|changed|deprecated|removed|fixed|security)"
-    r"(?:\.(?P<counter>[0-9]+))?\.md$"
-)
-SUBJECT_PR_RE = re.compile(r" \(#([0-9]+)\)$")
-IGNORED_FILES = {".gitkeep", "README.md"}
-API_TIMEOUT_SECONDS = 10
-
-
-def git(*args: str) -> str:
-    result = subprocess.run(["git", *args], check=True, capture_output=True, text=True)
-    return result.stdout.strip()
-
-
-def find_adding_commit(path: str) -> str | None:
-    """Find the commit that added a file, following renames.
-
-    Falls back to a plain (no --follow) lookup: rename detection can lose the
-    add event for degenerate content (e.g. files identical to many others).
-    """
-    sha = git("log", "--follow", "--diff-filter=A", "--format=%H", "-1", "--", path)
-    if not sha:
-        sha = git("log", "--diff-filter=A", "--format=%H", "-1", "--", path)
-    return sha or None
-
-
-def pr_from_api(repo: str, sha: str) -> int | None:
-    """Resolve the PR associated with a commit via the GitHub API.
-
-    Returns None on any network/API failure so the caller can fall back to
-    parsing the squash-commit subject.
-    """
-    url = f"https://api.github.com/repos/{repo}/commits/{sha}/pulls"
-    headers = {
-        "Accept": "application/vnd.github+json",
-        "X-GitHub-Api-Version": "2022-11-28",
-        "User-Agent": "prowler-changelog-attribution",
-    }
-    token = os.environ.get("GITHUB_TOKEN")
-    if token:
-        headers["Authorization"] = f"Bearer {token}"
-    request = urllib.request.Request(url, headers=headers)
-    try:
-        with urllib.request.urlopen(request, timeout=API_TIMEOUT_SECONDS) as response:
-            pulls = json.load(response)
-    except (urllib.error.URLError, TimeoutError, json.JSONDecodeError):
-        return None
-    if isinstance(pulls, list) and pulls:
-        return pulls[0].get("number")
-    return None
-
-
-def pr_from_subject(sha: str) -> int | None:
-    subject = git("log", "-1", "--format=%s", sha)
-    match = SUBJECT_PR_RE.search(subject)
-    return int(match.group(1)) if match else None
-
-
-def unique_destination(directory: str, base_name: str, fragment_type: str) -> str:
-    """Return a non-colliding fragment path, appending a numeric counter if needed."""
-    candidate = os.path.join(directory, f"{base_name}.{fragment_type}.md")
-    counter = 0
-    while os.path.exists(candidate):
-        counter += 1
-        candidate = os.path.join(directory, f"{base_name}.{fragment_type}.{counter}.md")
-    return candidate
-
-
-def main() -> int:
-    parser = argparse.ArgumentParser(description=__doc__)
-    parser.add_argument("component_dir", help="Component directory, e.g. prowler")
-    parser.add_argument("--repo", default="prowler-cloud/prowler")
-    parser.add_argument(
-        "--no-api",
-        action="store_true",
-        help="Skip the GitHub API and resolve PRs from commit subjects only",
-    )
-    args = parser.parse_args()
-
-    fragments_dir = os.path.join(args.component_dir, "changelog.d")
-    if not os.path.isdir(fragments_dir):
-        print(f"::error::Fragments directory not found: {fragments_dir}")
-        return 1
-
-    malformed = []
-    to_process = []
-    for name in sorted(os.listdir(fragments_dir)):
-        if name in IGNORED_FILES or name.startswith("+"):
-            continue
-        match = FRAGMENT_RE.match(name)
-        if not match:
-            malformed.append(name)
-            continue
-        if match.group("slug").isdigit():
-            continue
-        to_process.append((name, match))
-
-    if malformed:
-        for name in malformed:
-            print(
-                f"::error::Malformed fragment filename in {fragments_dir}: {name} "
-                "(expected <slug>.<type>.md with type one of added|changed|"
-                "deprecated|removed|fixed|security)"
-            )
-        return 1
-
-    for name, match in to_process:
-        slug, fragment_type = match.group("slug"), match.group("type")
-
-        path = os.path.join(fragments_dir, name)
-        sha = find_adding_commit(path)
-        pr_number = None
-        if sha:
-            if not args.no_api:
-                pr_number = pr_from_api(args.repo, sha)
-            if pr_number is None:
-                pr_number = pr_from_subject(sha)
-
-        if pr_number is not None:
-            destination = unique_destination(
-                fragments_dir, str(pr_number), fragment_type
-            )
-        else:
-            destination = unique_destination(fragments_dir, f"+{slug}", fragment_type)
-            print(
-                f"::warning::Could not resolve a PR for {path}; renamed to "
-                f"{os.path.basename(destination)} (entry will render without a PR link)"
-            )
-        git("mv", path, destination)
-        print(f"{path} -> {destination}")
-    return 0
-
-
-if __name__ == "__main__":
-    sys.exit(main())

.github/scripts/osv-scan.sh

@@ -6,7 +6,8 @@
 #   - .github/workflows/api-security.yml, sdk-security.yml, ui-security.yml
 #
 # Severity levels (comma-separated) are read from OSV_SEVERITY_LEVELS.
-# Default: CRITICAL — only CVSS >= 9.0 findings fail the scan.
+# Default: HIGH,CRITICAL,UNKNOWN — preserves prior .safety-policy.yml policy
+#   (ignore-cvss-severity-below: 7 + ignore-cvss-unknown-severity: False).
 # osv-scanner has no native CVSS threshold (google/osv-scanner#1400, closed
 # not-planned). Severity is derived from $group.max_severity (numeric CVSS
 # score string) which osv-scanner emits per group.
@@ -32,7 +33,7 @@ set -euo pipefail
 
 ROOT="$(git rev-parse --show-toplevel)"
 CONFIG="${ROOT}/osv-scanner.toml"
-SEVERITY_LEVELS="${OSV_SEVERITY_LEVELS:-CRITICAL}"
+SEVERITY_LEVELS="${OSV_SEVERITY_LEVELS:-HIGH,CRITICAL,UNKNOWN}"
 
 for bin in osv-scanner jq; do
   if ! command -v "${bin}" >/dev/null 2>&1; then

.github/towncrier/template.md.jinja

@@ -1,13 +0,0 @@
-{% set category_order = definitions.keys() %}
-{% for section, _ in sections.items() %}
-{% for category in category_order if category in sections[section] %}
-### {{ definitions[category]['name'] }}
-
-{% for text, values in sections[section][category].items() -%}
-- {{ text }}{% if values %} {{ values|join(', ') }}{% endif %}{{ "\n" }}
-{%- endfor %}
-
-{% endfor %}
-{% endfor %}
----
-{{ "\n" }}

.github/workflows/api-code-quality.yml

@@ -62,7 +62,6 @@ jobs:
             api/docs/**
             api/README.md
             api/CHANGELOG.md
-            api/changelog.d/**
             api/AGENTS.md
 
       - name: Setup Python with uv

.github/workflows/api-codeql.yml

@@ -9,7 +9,6 @@ on:
       - 'api/**'
       - '.github/workflows/api-codeql.yml'
       - '.github/codeql/api-codeql-config.yml'
-      - '!api/CHANGELOG.md'
   pull_request:
     branches:
       - 'master'
@@ -18,7 +17,6 @@ on:
       - 'api/**'
       - '.github/workflows/api-codeql.yml'
       - '.github/codeql/api-codeql-config.yml'
-      - '!api/CHANGELOG.md'
   schedule:
     - cron: '00 12 * * *'
 

.github/workflows/api-container-build-push.yml

@@ -215,7 +215,7 @@ jobs:
 
       - name: Install regctl
         if: always()
-        uses: regclient/actions/regctl-installer@9a2d4216180dbb3e2dccfa60d2dd4afd98e42ec5 # main
+        uses: regclient/actions/regctl-installer@da9319db8e44e8b062b3a147e1dfb2f574d41a03 # main
 
       - name: Cleanup intermediate architecture tags
         if: always()
@@ -272,3 +272,27 @@ jobs:
           payload-file-path: "./.github/scripts/slack-messages/container-release-completed.json"
           step-outcome: ${{ steps.outcome.outputs.outcome }}
           update-ts: ${{ needs.notify-release-started.outputs.message-ts }}
+
+  trigger-deployment:
+    needs: [setup, container-build-push]
+    if: always() && github.event_name == 'push' && needs.setup.result == 'success' && needs.container-build-push.result == 'success'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        with:
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+
+      - name: Trigger API deployment
+        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
+        with:
+          token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }}
+          repository: ${{ secrets.CLOUD_DISPATCH }}
+          event-type: api-prowler-deployment
+          client-payload: '{"sha": "${{ github.sha }}", "short_sha": "${{ needs.setup.outputs.short-sha }}"}'

.github/workflows/api-container-checks.yml

@@ -12,6 +12,9 @@ on:
     branches:
       - 'master'
       - 'v5.*'
+    paths:
+      - 'api/**'
+      - '.github/workflows/api-container-checks.yml'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -108,7 +111,6 @@ jobs:
             api/docs/**
             api/README.md
             api/CHANGELOG.md
-            api/changelog.d/**
             api/AGENTS.md
 
       - name: Set up Docker Buildx
@@ -132,5 +134,5 @@ jobs:
         with:
           image-name: ${{ env.IMAGE_NAME }}
           image-tag: ${{ github.sha }}
-          fail-on-critical: 'true'
+          fail-on-critical: 'false'
           severity: 'CRITICAL'

.github/workflows/api-security.yml

@@ -16,6 +16,13 @@ on:
     branches:
       - "master"
       - "v5.*"
+    paths:
+      - 'api/**'
+      - '.github/workflows/api-tests.yml'
+      - '.github/workflows/api-security.yml'
+      - '.github/actions/setup-python-uv/**'
+      - '.github/actions/osv-scanner/**'
+      - '.github/scripts/osv-scan.sh'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -77,7 +84,6 @@ jobs:
             api/docs/**
             api/README.md
             api/CHANGELOG.md
-            api/changelog.d/**
             api/AGENTS.md
 
       - name: Setup Python with uv

.github/workflows/api-tests.yml

@@ -48,7 +48,7 @@ jobs:
 
     services:
       postgres:
-        image: postgres:17@sha256:5c855ad7b85e68e48a62f34662853f38b57c1c1d80f3a927ab58034fd6d31c5e
+        image: postgres:17@sha256:2cd82735a36356842d5eb1ef80db3ae8f1154172f0f653db48fde079b2a0b7f7
         env:
           POSTGRES_HOST: ${{ env.POSTGRES_HOST }}
           POSTGRES_PORT: ${{ env.POSTGRES_PORT }}
@@ -63,7 +63,7 @@ jobs:
           --health-timeout 5s
           --health-retries 5
       valkey:
-        image: valkey/valkey:7-alpine3.19@sha256:4054fe7fc607b9326ac7c4691ed26e9670d2ff17a9fb28c2577adecf928acbcc
+        image: valkey/valkey:7-alpine3.19
         env:
           VALKEY_HOST: ${{ env.VALKEY_HOST }}
           VALKEY_PORT: ${{ env.VALKEY_PORT }}
@@ -111,7 +111,6 @@ jobs:
             api/docs/**
             api/README.md
             api/CHANGELOG.md
-            api/changelog.d/**
             api/AGENTS.md
 
       - name: Setup Python with uv

.github/workflows/compile-changelogs.yml

@@ -1,527 +0,0 @@
-name: 'Tools: Compile Changelogs'
-
-run-name: 'Compile changelogs for Prowler ${{ inputs.prowler_version }}'
-
-on:
-  workflow_dispatch:
-    inputs:
-      prowler_version:
-        description: 'Prowler version being released (e.g., 5.31.0)'
-        required: true
-        type: string
-      target_branch:
-        description: 'Branch to compile on (master for minor releases, v5.X for patches)'
-        required: true
-        type: string
-      sdk_version:
-        description: 'SDK version override (empty = mirrors prowler_version; "skip" = hold this component back)'
-        required: false
-        type: string
-      api_version:
-        description: 'API version override (empty = auto-derive 1.<prowler_minor + 1>.<prowler_patch>; "skip" = hold back)'
-        required: false
-        type: string
-      ui_version:
-        description: 'UI version override (empty = auto-derive 1.<prowler_minor>.<prowler_patch>; "skip" = hold back)'
-        required: false
-        type: string
-      mcp_version:
-        description: 'MCP Server version override (empty = auto-derive from pending fragment types; "skip" = hold back)'
-        required: false
-        type: string
-
-concurrency:
-  group: ${{ github.workflow }}-${{ inputs.prowler_version }}
-  cancel-in-progress: false
-
-env:
-  PROWLER_VERSION: ${{ inputs.prowler_version }}
-  TARGET_BRANCH: ${{ inputs.target_branch }}
-  SDK_VERSION: ${{ inputs.sdk_version }}
-  API_VERSION: ${{ inputs.api_version }}
-  UI_VERSION: ${{ inputs.ui_version }}
-  MCP_VERSION: ${{ inputs.mcp_version }}
-
-permissions: {}
-
-jobs:
-  compile-changelogs:
-    if: github.event_name == 'workflow_dispatch' && github.repository == 'prowler-cloud/prowler'
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    permissions:
-      contents: write
-      pull-requests: write
-    steps:
-      - name: Harden the runner (Block outbound calls)
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: block
-          allowed-endpoints: >
-            api.github.com:443
-            github.com:443
-            objects.githubusercontent.com:443
-            pypi.org:443
-            files.pythonhosted.org:443
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          ref: ${{ inputs.target_branch }}
-          fetch-depth: 0 # PR attribution resolves each fragment's adding commit from history
-          token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }}
-          persist-credentials: false
-
-      - name: Set up Python
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
-        with:
-          python-version: '3.12'
-
-      - name: Install towncrier
-        run: pip install --no-cache-dir towncrier==25.8.0
-
-      - name: Configure Git
-        run: |
-          git config --global user.name 'prowler-bot'
-          git config --global user.email '179230569+prowler-bot@users.noreply.github.com'
-
-      - name: Validate version inputs
-        run: |
-          if [[ ! "$PROWLER_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            echo "::error::Invalid prowler_version syntax: '$PROWLER_VERSION' (must be N.N.N)"
-            exit 1
-          fi
-          if [ "$TARGET_BRANCH" != "master" ] && [[ ! "$TARGET_BRANCH" =~ ^v[0-9]+\.[0-9]+$ ]]; then
-            echo "::error::Invalid target_branch syntax: '$TARGET_BRANCH' (must be 'master' or vN.N, e.g. v5.31)"
-            exit 1
-          fi
-          IFS=. read -r prowler_major prowler_minor prowler_patch <<< "$PROWLER_VERSION"
-          prowler_major=$((10#$prowler_major))
-          prowler_minor=$((10#$prowler_minor))
-          prowler_patch=$((10#$prowler_patch))
-          if [ "$prowler_patch" -eq 0 ]; then
-            if [ "$TARGET_BRANCH" != "master" ]; then
-              echo "::error::target_branch must be 'master' for Prowler ${PROWLER_VERSION}; got '${TARGET_BRANCH}'"
-              exit 1
-            fi
-          else
-            expected_target_branch="v${prowler_major}.${prowler_minor}"
-            if [ "$TARGET_BRANCH" != "$expected_target_branch" ]; then
-              echo "::error::target_branch must be '${expected_target_branch}' for Prowler ${PROWLER_VERSION}; got '${TARGET_BRANCH}'"
-              exit 1
-            fi
-          fi
-          for pair in "sdk_version:$SDK_VERSION" "api_version:$API_VERSION" "ui_version:$UI_VERSION" "mcp_version:$MCP_VERSION"; do
-            input_name="${pair%%:*}"
-            input_value="${pair#*:}"
-            if [ -n "$input_value" ] && [ "$input_value" != "skip" ] && [[ ! "$input_value" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-              echo "::error::Invalid $input_name syntax: '$input_value' (must be N.N.N, empty for auto-derivation, or 'skip')"
-              exit 1
-            fi
-          done
-
-      - name: Compile changelogs
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -euo pipefail
-
-          component_input() {
-            case "$1" in
-              prowler) echo "$SDK_VERSION" ;;
-              api) echo "$API_VERSION" ;;
-              ui) echo "$UI_VERSION" ;;
-              mcp_server) echo "$MCP_VERSION" ;;
-            esac
-          }
-
-          version_key() {
-            local version="$1"
-            local major minor patch
-            IFS=. read -r major minor patch <<< "$version"
-            printf '%06d.%06d.%06d' "$((10#$major))" "$((10#$minor))" "$((10#$patch))"
-          }
-
-          pending_fragments() {
-            find "$1/changelog.d" -maxdepth 1 -type f ! -name '.gitkeep' ! -name 'README.md' | sort
-          }
-
-          # The component's last released version is the first stamped heading
-          # of its CHANGELOG.md, the same source prepare-release.yml greps.
-          latest_released_version() {
-            grep -m1 -E '^## \[v?[0-9]+\.[0-9]+\.[0-9]+\]' "$1/CHANGELOG.md" | sed -E 's/^## \[v?([0-9]+\.[0-9]+\.[0-9]+)\].*/\1/'
-          }
-
-          has_removed_fragments() {
-            echo "$1" | grep -qE '\.removed(\.[0-9]+)?\.md$'
-          }
-
-          # Resolve every component's effective version before compiling
-          # anything, so a wrong input cannot leave the tree half-compiled.
-          # Empty input = auto-derive (latest released version + semver bump
-          # from the pending fragment types). 'skip' = hold the component back.
-          errors=0
-          compiling=""
-          for component in prowler api ui mcp_server; do
-            input=$(component_input "$component")
-            fragments=$(pending_fragments "$component")
-
-            if [ "$input" = "skip" ]; then
-              if [ -n "$fragments" ]; then
-                echo "::warning::${component}: held back by request; these pending fragments stay for a future release:"
-                echo "$fragments"
-              fi
-              continue
-            fi
-            if [ -n "$input" ] && [ -z "$fragments" ]; then
-              echo "::error::${component}: version input '$input' provided but ${component}/changelog.d/ has no pending fragments (wrong input?)"
-              errors=1
-              continue
-            fi
-            if [ -z "$fragments" ]; then
-              continue
-            fi
-
-            removed_fragments=false
-            if has_removed_fragments "$fragments"; then
-              removed_fragments=true
-            fi
-            current=$(latest_released_version "$component")
-            if [ -z "$current" ]; then
-              echo "::error::${component}: could not read the latest released version from ${component}/CHANGELOG.md; restore the released heading before compiling"
-              errors=1
-              continue
-            fi
-
-            if [ -n "$input" ]; then
-              effective="$input"
-              mode="explicit"
-              current_key=$(version_key "$current")
-              effective_key=$(version_key "$effective")
-              if [[ "$effective_key" < "$current_key" || "$effective_key" == "$current_key" ]]; then
-                echo "::error::${component}: explicit version '${effective}' must be greater than the latest released version (${current})"
-                errors=1
-                continue
-              fi
-            else
-              if [ "$removed_fragments" = "true" ]; then
-                echo "::error::${component}: pending 'removed' fragments imply a major bump (breaking change); provide its version input explicitly"
-                errors=1
-                continue
-              fi
-              # SDK, UI, and API versions are deterministic mirrors of the
-              # Prowler version (the scheme bump-version.yml codifies): the SDK
-              # mirrors it directly, the UI tracks 1.<minor>.<patch>, and the
-              # API is the independent 1.<minor + 1>.<patch> stream. Only the
-              # MCP Server has its own cadence, derived from fragment types.
-              IFS=. read -r _ prowler_minor prowler_patch <<< "$PROWLER_VERSION"
-              prowler_minor=$((10#$prowler_minor))
-              prowler_patch=$((10#$prowler_patch))
-              case "$component" in
-                prowler) effective="$PROWLER_VERSION" ;;
-                ui) effective="1.${prowler_minor}.${prowler_patch}" ;;
-                api) effective="1.$((prowler_minor + 1)).${prowler_patch}" ;;
-                mcp_server)
-                  IFS=. read -r major minor patch <<< "$current"
-                  major=$((10#$major))
-                  minor=$((10#$minor))
-                  patch=$((10#$patch))
-                  # Prowler patch releases (vN.N target) are maintenance
-                  # releases, so the MCP Server bumps patch regardless of
-                  # fragment types; a deliberate exception needs the explicit
-                  # version input.
-                  if [ "$TARGET_BRANCH" != "master" ]; then
-                    effective="${major}.${minor}.$((patch + 1))"
-                    if echo "$fragments" | grep -qE '\.(added|deprecated)(\.[0-9]+)?\.md$'; then
-                      echo "::warning::${component}: 'added'/'deprecated' fragments are shipping in a Prowler patch; auto-derived a patch bump (${current} -> ${effective}), pass the version input to override"
-                    fi
-                  elif echo "$fragments" | grep -qE '\.(added|changed|deprecated)(\.[0-9]+)?\.md$'; then
-                    effective="${major}.$((minor + 1)).0"
-                  else
-                    effective="${major}.${minor}.$((patch + 1))"
-                  fi
-                  ;;
-              esac
-              current_key=$(version_key "$current")
-              effective_key=$(version_key "$effective")
-              if [[ "$effective_key" < "$current_key" || "$effective_key" == "$current_key" ]]; then
-                echo "::error::${component}: auto-derived version '${effective}' is not greater than the latest released version (${current}); check prowler_version or pass the version input explicitly"
-                errors=1
-                continue
-              fi
-              mode="auto"
-              echo "::notice::${component}: version auto-derived ${current} -> ${effective}"
-            fi
-
-            if [ "$removed_fragments" = "true" ]; then
-              IFS=. read -r current_major _ <<< "$current"
-              current_major=$((10#$current_major))
-              IFS=. read -r effective_major effective_minor effective_patch <<< "$effective"
-              effective_major=$((10#$effective_major))
-              effective_minor=$((10#$effective_minor))
-              effective_patch=$((10#$effective_patch))
-              if [ "$effective_major" -le "$current_major" ] || [ "$effective_minor" -ne 0 ] || [ "$effective_patch" -ne 0 ]; then
-                echo "::error::${component}: removed fragments require a major component release (${current} -> X.0.0 with X > ${current_major}); got ${effective}"
-                errors=1
-                continue
-              fi
-            fi
-
-            # Without the marker the build would insert the new block above the
-            # file header instead of below it.
-            if ! grep -q '^<!-- changelog: release notes start -->$' "$component/CHANGELOG.md"; then
-              echo "::error::${component}/CHANGELOG.md is missing the '<!-- changelog: release notes start -->' marker; restore it after the intro line before compiling"
-              errors=1
-              continue
-            fi
-            # A hand-written UNRELEASED block means someone followed the old
-            # convention; its entries would be left out of the compiled block
-            # and out of the release notes extraction.
-            if grep -q '(Prowler UNRELEASED)' "$component/CHANGELOG.md"; then
-              echo "::error::${component}/CHANGELOG.md contains a hand-written '(Prowler UNRELEASED)' block; convert its entries to fragments in ${component}/changelog.d/ and delete the block before compiling"
-              errors=1
-              continue
-            fi
-
-            echo "${effective} ${mode}" > "${RUNNER_TEMP}/version-${component}.txt"
-            compiling="${compiling}${component} "
-          done
-          if [ "$errors" -ne 0 ]; then
-            exit 1
-          fi
-          if [ -z "$compiling" ]; then
-            echo "::error::Nothing to compile: no component has pending fragments to release"
-            exit 1
-          fi
-
-          body_file="${RUNNER_TEMP}/compile-changelogs-pr-body.md"
-          {
-            echo "### Description"
-            echo ""
-            echo "Compiles the pending changelog fragments into the per-component \`CHANGELOG.md\` files for Prowler v${PROWLER_VERSION}, replacing the manual stamping PR."
-            echo ""
-            echo "| Component | Version | Fragments consumed |"
-            echo "|---|---|---|"
-          } > "$body_file"
-
-          compiled_components=""
-          for component in prowler api ui mcp_server; do
-            if [ ! -f "${RUNNER_TEMP}/version-${component}.txt" ]; then
-              echo "Skipping ${component} (no pending fragments or held back)"
-              echo "| \`${component}\` | - | 0 |" >> "$body_file"
-              continue
-            fi
-            read -r version mode < "${RUNNER_TEMP}/version-${component}.txt"
-            version_label="$version"
-            if [ "$mode" = "auto" ]; then
-              version_label="${version} (auto)"
-            fi
-
-            count=$(pending_fragments "$component" | wc -l | tr -d ' ')
-            echo "Compiling ${component} ${version} (${count} fragments, ${mode} version)..."
-
-            # Captured before attribution renames them: these original paths are
-            # what the forward-sync deletes on master (backports copy fragments
-            # verbatim, so filenames match across branches).
-            pending_fragments "$component" > "${RUNNER_TEMP}/consumed-${component}.txt"
-            pre_lines=$(wc -l < "$component/CHANGELOG.md")
-
-            # Attribution must run before the build: towncrier renders the
-            # first dotted segment of each filename as the PR number.
-            python .github/scripts/changelog_attribution.py "$component"
-            towncrier build --config "$component/towncrier.toml" --version "$version" --name "Prowler v${PROWLER_VERSION}" --yes
-
-            # The build only inserts lines right after the marker, so the new
-            # stamped block is exactly the added lines following it. Captured
-            # for the forward-sync to master.
-            post_lines=$(wc -l < "$component/CHANGELOG.md")
-            delta=$((post_lines - pre_lines))
-            marker_line=$(grep -n -m1 '^<!-- changelog: release notes start -->$' "$component/CHANGELOG.md" | cut -d: -f1)
-            sed -n "$((marker_line + 1)),$((marker_line + delta))p" "$component/CHANGELOG.md" > "${RUNNER_TEMP}/block-${component}.md"
-
-            compiled_components="${compiled_components}${component} "
-            echo "| \`${component}\` | ${version_label} | ${count} |" >> "$body_file"
-          done
-          echo "COMPILED_COMPONENTS=${compiled_components}" >> "$GITHUB_ENV"
-
-          {
-            echo ""
-            echo "Review that no pending fragment was dropped (the diff must delete every consumed fragment) and that each new version block is correct, then squash-merge."
-            echo ""
-            echo "### License"
-            echo ""
-            echo "By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license."
-          } >> "$body_file"
-
-          echo "PR_BODY_FILE=${body_file}" >> "$GITHUB_ENV"
-
-      - name: Create compile PR
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
-        with:
-          token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }}
-          commit-message: 'chore(changelog): v${{ env.PROWLER_VERSION }}'
-          branch: compile-changelogs-${{ env.PROWLER_VERSION }}
-          base: ${{ env.TARGET_BRANCH }}
-          title: 'chore(changelog): v${{ env.PROWLER_VERSION }}'
-          body-path: ${{ env.PR_BODY_FILE }}
-          author: prowler-bot <179230569+prowler-bot@users.noreply.github.com>
-          labels: |
-            no-changelog
-            skip-sync
-
-      # Patch compiles (target_branch = v5.X) leave master holding the consumed
-      # fragments and missing the new version block. This applies the equivalent
-      # change to master: insert the same stamped blocks under the marker and
-      # delete the consumed fragments, so the next minor compile cannot
-      # re-release entries that already shipped in the patch.
-      - name: Apply forward-sync to master
-        if: env.TARGET_BRANCH != 'master'
-        run: |
-          set -euo pipefail
-
-          git checkout -B master origin/master
-
-          version_key() {
-            local version="$1"
-            local major minor patch
-            IFS=. read -r major minor patch <<< "$version"
-            printf '%06d.%06d.%06d' "$((10#$major))" "$((10#$minor))" "$((10#$patch))"
-          }
-
-          release_from_heading() {
-            local heading="$1"
-            echo "$heading" | sed -E 's/^## \[[^]]+\] \(Prowler v?([0-9]+\.[0-9]+\.[0-9]+)\).*/\1/'
-          }
-
-          insert_changelog_block_ordered() {
-            local component="$1"
-            local block_file="$2"
-            local changelog="${component}/CHANGELOG.md"
-            local incoming_heading incoming_release incoming_key
-            local marker_line insertion_line duplicate_line total_lines
-            local line heading existing_release existing_key
-
-            marker_line=$(grep -n -m1 '^<!-- changelog: release notes start -->$' "$changelog" | cut -d: -f1)
-            incoming_heading=$(grep -m1 -E '^## \[[^]]+\] \(Prowler v?[0-9]+\.[0-9]+\.[0-9]+\)' "$block_file" || true)
-            if [ -z "$incoming_heading" ]; then
-              echo "::error::${block_file} does not contain a stamped Prowler release heading"
-              exit 1
-            fi
-
-            incoming_release=$(release_from_heading "$incoming_heading")
-            incoming_key=$(version_key "$incoming_release")
-            insertion_line=""
-            duplicate_line=""
-
-            while IFS=: read -r line heading; do
-              existing_release=$(release_from_heading "$heading")
-              existing_key=$(version_key "$existing_release")
-              if [[ "$incoming_key" == "$existing_key" ]]; then
-                duplicate_line="$line"
-                break
-              fi
-              if [[ "$incoming_key" > "$existing_key" ]]; then
-                insertion_line="$line"
-                break
-              fi
-            done < <(grep -n -E '^## \[[^]]+\] \(Prowler v?[0-9]+\.[0-9]+\.[0-9]+\)' "$changelog" || true)
-
-            if [ -n "$duplicate_line" ]; then
-              echo "::error::${changelog} already contains a block for Prowler v${incoming_release} at line ${duplicate_line}; refusing to insert a duplicate"
-              exit 1
-            fi
-            if [ -z "$insertion_line" ]; then
-              insertion_line=$(($(wc -l < "$changelog") + 1))
-            fi
-            if [ "$insertion_line" -le "$marker_line" ]; then
-              insertion_line=$((marker_line + 1))
-            fi
-
-            # The captured block window can be off by one blank line on either
-            # end (towncrier re-emits the blank after the marker), so strip the
-            # outer blank lines and pad exactly one on each side: the block
-            # must never glue to the marker above or the next heading below.
-            awk '
-              /[^[:space:]]/ { for (i = 0; i < pending; i++) print ""; pending = 0; print; started = 1; next }
-              started { pending++ }
-            ' "$block_file" > "${RUNNER_TEMP}/block-normalized.md"
-
-            total_lines=$(wc -l < "$changelog")
-            {
-              head -n "$((insertion_line - 1))" "$changelog"
-              if [ "$insertion_line" -gt 1 ] && [ -n "$(sed -n "$((insertion_line - 1))p" "$changelog")" ]; then
-                echo ""
-              fi
-              cat "${RUNNER_TEMP}/block-normalized.md"
-              if [ "$insertion_line" -le "$total_lines" ]; then
-                echo ""
-              fi
-              tail -n +"$insertion_line" "$changelog"
-            } > "${RUNNER_TEMP}/changelog.tmp"
-            mv "${RUNNER_TEMP}/changelog.tmp" "$changelog"
-
-            echo "::notice::Inserted ${component} changelog block for Prowler v${incoming_release} at line ${insertion_line}"
-          }
-
-          sync_body="${RUNNER_TEMP}/forward-sync-pr-body.md"
-          {
-            echo "### Description"
-            echo ""
-            echo "Forward-syncs the v${PROWLER_VERSION} compiled changelogs from \`${TARGET_BRANCH}\` to \`master\`: inserts the same stamped version blocks under the insertion marker and deletes the consumed fragments, so the next minor compile cannot re-release entries that already shipped in this patch. Opened automatically by the same run that opened the compile PR; review and squash-merge after it."
-            echo ""
-            echo "| Component | Fragments deleted on master | Skipped (only on ${TARGET_BRANCH}) |"
-            echo "|---|---|---|"
-          } > "$sync_body"
-
-          for component in $COMPILED_COMPONENTS; do
-            block_file="${RUNNER_TEMP}/block-${component}.md"
-            consumed_file="${RUNNER_TEMP}/consumed-${component}.txt"
-
-            if ! grep -qm1 '^<!-- changelog: release notes start -->$' "$component/CHANGELOG.md"; then
-              echo "::error::${component}/CHANGELOG.md on master is missing the insertion marker; cannot forward-sync"
-              exit 1
-            fi
-
-            deleted=0
-            skipped=0
-            while IFS= read -r fragment; do
-              if [ -z "$fragment" ]; then
-                continue
-              fi
-              if [ -f "$fragment" ]; then
-                git rm -q "$fragment"
-                deleted=$((deleted + 1))
-              else
-                echo "::notice::${fragment} does not exist on master (change landed only on ${TARGET_BRANCH}); skipping its deletion"
-                skipped=$((skipped + 1))
-              fi
-            done < "$consumed_file"
-
-            insert_changelog_block_ordered "$component" "$block_file"
-
-            echo "| \`${component}\` | ${deleted} | ${skipped} |" >> "$sync_body"
-          done
-
-          {
-            echo ""
-            echo "### License"
-            echo ""
-            echo "By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license."
-          } >> "$sync_body"
-
-          echo "SYNC_BODY_FILE=${sync_body}" >> "$GITHUB_ENV"
-
-      - name: Create forward-sync PR
-        if: env.TARGET_BRANCH != 'master'
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
-        with:
-          token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }}
-          commit-message: 'chore(changelog): v${{ env.PROWLER_VERSION }} forward-sync to master'
-          branch: forward-sync-changelogs-${{ env.PROWLER_VERSION }}
-          base: master
-          title: 'chore(changelog): v${{ env.PROWLER_VERSION }} forward-sync to master'
-          body-path: ${{ env.SYNC_BODY_FILE }}
-          author: prowler-bot <179230569+prowler-bot@users.noreply.github.com>
-          labels: |
-            no-changelog
-            skip-sync

.github/workflows/find-secrets.yml

@@ -29,11 +29,10 @@ jobs:
         with:
           # We can't block as Trufflehog needs to verify secrets against vendors
           egress-policy: audit
-          allowed-endpoints: >
-            github.com:443
-            ghcr.io:443
-            pkg-containers.githubusercontent.com:443
-            www.formbucket.com:443
+          # allowed-endpoints: >
+          #   github.com:443
+          #   ghcr.io:443
+          #   pkg-containers.githubusercontent.com:443
 
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

.github/workflows/mcp-container-build-push.yml

@@ -206,7 +206,7 @@ jobs:
 
       - name: Install regctl
         if: always()
-        uses: regclient/actions/regctl-installer@9a2d4216180dbb3e2dccfa60d2dd4afd98e42ec5 # main
+        uses: regclient/actions/regctl-installer@da9319db8e44e8b062b3a147e1dfb2f574d41a03 # main
 
       - name: Cleanup intermediate architecture tags
         if: always()
@@ -263,3 +263,27 @@ jobs:
           payload-file-path: "./.github/scripts/slack-messages/container-release-completed.json"
           step-outcome: ${{ steps.outcome.outputs.outcome }}
           update-ts: ${{ needs.notify-release-started.outputs.message-ts }}
+
+  trigger-deployment:
+    needs: [setup, container-build-push]
+    if: always() && github.event_name == 'push' && needs.setup.result == 'success' && needs.container-build-push.result == 'success'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        with:
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+
+      - name: Trigger MCP deployment
+        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
+        with:
+          token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }}
+          repository: ${{ secrets.CLOUD_DISPATCH }}
+          event-type: mcp-prowler-deployment
+          client-payload: '{"sha": "${{ github.sha }}", "short_sha": "${{ needs.setup.outputs.short-sha }}"}'

.github/workflows/mcp-container-checks.yml

@@ -12,6 +12,9 @@ on:
     branches:
       - 'master'
       - 'v5.*'
+    paths:
+      - 'mcp_server/**'
+      - '.github/workflows/mcp-container-checks.yml'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -102,7 +105,6 @@ jobs:
           files_ignore: |
             mcp_server/README.md
             mcp_server/CHANGELOG.md
-            mcp_server/changelog.d/**
 
       - name: Set up Docker Buildx
         if: steps.check-changes.outputs.any_changed == 'true'
@@ -125,5 +127,5 @@ jobs:
         with:
           image-name: ${{ env.IMAGE_NAME }}
           image-tag: ${{ github.sha }}
-          fail-on-critical: 'true'
+          fail-on-critical: 'false'
           severity: 'CRITICAL'

.github/workflows/mcp-security.yml

@@ -15,6 +15,12 @@ on:
     branches:
       - 'master'
       - 'v5.*'
+    paths:
+      - 'mcp_server/pyproject.toml'
+      - 'mcp_server/uv.lock'
+      - '.github/workflows/mcp-security.yml'
+      - '.github/actions/osv-scanner/**'
+      - '.github/scripts/osv-scan.sh'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -24,6 +30,7 @@ permissions: {}
 
 jobs:
   mcp-security-scans:
+    if: github.repository == 'prowler-cloud/prowler'
     runs-on: ubuntu-latest
     timeout-minutes: 15
     permissions:

.github/workflows/pr-check-changelog.yml

@@ -19,60 +19,6 @@ concurrency:
 permissions: {}
 
 jobs:
-  test-changelog-attribution:
-    if: github.repository == 'prowler-cloud/prowler'
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: read
-
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: block
-          allowed-endpoints: >
-            api.github.com:443
-            github.com:443
-            objects.githubusercontent.com:443
-            pypi.org:443
-            files.pythonhosted.org:443
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          fetch-depth: 1
-          persist-credentials: false
-
-      - name: Fetch PR base ref for tj-actions/changed-files
-        env:
-          BASE_REF: ${{ github.event.pull_request.base.ref }}
-        run: git fetch --depth=1 origin "${BASE_REF}"
-
-      - name: Get changed files
-        id: changed-files
-        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
-        with:
-          files: |
-            .github/scripts/changelog_attribution.py
-            .github/workflows/pr-check-changelog.yml
-            .github/workflows/compile-changelogs.yml
-            .github/towncrier/template.md.jinja
-            */towncrier.toml
-            tests/github/**
-
-      - name: Set up Python
-        if: steps.changed-files.outputs.any_changed == 'true'
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
-        with:
-          python-version: '3.12'
-
-      - name: Test changelog attribution
-        if: steps.changed-files.outputs.any_changed == 'true'
-        run: |
-          python3 -m pip install --user --disable-pip-version-check pytest==9.0.3 towncrier==25.8.0
-          python3 -m pytest tests/github
-
   check-changelog:
     if: contains(github.event.pull_request.labels.*.name, 'no-changelog') == false
     runs-on: ubuntu-latest
@@ -116,160 +62,53 @@ jobs:
             uv.lock
             pyproject.toml
 
-      - name: Check for folder changes and changelog fragment presence
+      - name: Check for folder changes and changelog presence
         id: check-folders
         run: |
-          fragment_name_re='^[A-Za-z0-9][A-Za-z0-9._-]*\.(added|changed|deprecated|removed|fixed|security)(\.[0-9]+)?\.md$'
-          manual_pr_link_re='(\[\(#[0-9]+\)\]|\[#[0-9]+\]\(|\(#[0-9]+\)|github\.com/[^[:space:]/]+/[^[:space:]/]+/(pull|issues)/[0-9]+)'
-          folder_alt=$(echo "$MONITORED_FOLDERS" | tr ' ' '|')
-
-          missing_fragments=""
-          invalid_fragments=""
-          linked_fragments=""
-          handwritten_changelogs=""
-
-          all_changed=$(echo "${STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES}" | tr ' ' '\n')
-          added=$(echo "${STEPS_CHANGED_FILES_OUTPUTS_ADDED_FILES}" | tr ' ' '\n')
-          added_or_renamed=$(printf '%s\n%s' "${STEPS_CHANGED_FILES_OUTPUTS_ADDED_FILES}" "${STEPS_CHANGED_FILES_OUTPUTS_RENAMED_FILES}" | tr ' ' '\n')
-          added_modified_or_renamed=$(printf '%s\n%s\n%s' "${STEPS_CHANGED_FILES_OUTPUTS_ADDED_FILES}" "${STEPS_CHANGED_FILES_OUTPUTS_MODIFIED_FILES}" "${STEPS_CHANGED_FILES_OUTPUTS_RENAMED_FILES}" | tr ' ' '\n')
-
-          # Returns success if the folder has a valid fragment added, modified, or renamed.
-          has_changelog_update() {
-            local folder="$1"
-            if echo "$added_modified_or_renamed" | grep "^${folder}/changelog.d/" | sed "s|^${folder}/changelog.d/||" | grep -qE "$fragment_name_re"; then
-              return 0
-            fi
-            return 1
-          }
+          missing_changelogs=""
 
           if [[ "${STEPS_CHANGED_FILES_OUTPUTS_ANY_CHANGED}" == "true" ]]; then
             # Check monitored folders
             for folder in $MONITORED_FOLDERS; do
-              if echo "$all_changed" | grep -q "^${folder}/CHANGELOG.md$"; then
-                echo "Direct CHANGELOG.md edits are not allowed for ${folder}/"
-                handwritten_changelogs="${handwritten_changelogs}- \`${folder}/CHANGELOG.md\`"$'\n'
-              fi
-
-              changed_in_folder=$(echo "$all_changed" | grep "^${folder}/" | grep -v "^${folder}/CHANGELOG.md$" || true)
+              # Get files changed in this folder
+              changed_in_folder=$(echo "${STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES}" | tr ' ' '\n' | grep "^${folder}/" || true)
 
               if [ -n "$changed_in_folder" ]; then
                 echo "Detected changes in ${folder}/"
 
-                if ! has_changelog_update "$folder"; then
-                  echo "No changelog fragment found for ${folder}/"
-                  missing_fragments="${missing_fragments}- \`${folder}\`"$'\n'
+                # Check if CHANGELOG.md was updated
+                if ! echo "$changed_in_folder" | grep -q "^${folder}/CHANGELOG.md$"; then
+                  echo "No changelog update found for ${folder}/"
+                  missing_changelogs="${missing_changelogs}- \`${folder}\`"$'\n'
                 fi
               fi
             done
 
             # Check root-level dependency files (uv.lock, pyproject.toml)
             # These are associated with the prowler folder changelog
-            root_deps_changed=$(echo "$all_changed" | grep -E "^(uv\.lock|pyproject\.toml)$" || true)
+            root_deps_changed=$(echo "${STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES}" | tr ' ' '\n' | grep -E "^(uv\.lock|pyproject\.toml)$" || true)
             if [ -n "$root_deps_changed" ]; then
               echo "Detected changes in root dependency files: $root_deps_changed"
-              if ! has_changelog_update "prowler"; then
+              # Check if prowler/CHANGELOG.md was already updated (might have been caught above)
+              prowler_changelog_updated=$(echo "${STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES}" | tr ' ' '\n' | grep "^prowler/CHANGELOG.md$" || true)
+              if [ -z "$prowler_changelog_updated" ]; then
                 # Only add if prowler wasn't already flagged
-                if ! echo "$missing_fragments" | grep -q "prowler"; then
-                  echo "No changelog fragment found for root dependency changes"
-                  missing_fragments="${missing_fragments}- \`prowler\` (root dependency files changed)"$'\n'
+                if ! echo "$missing_changelogs" | grep -q "prowler"; then
+                  echo "No changelog update found for root dependency changes"
+                  missing_changelogs="${missing_changelogs}- \`prowler\` (root dependency files changed)"$'\n'
                 fi
               fi
             fi
-
-            # Validate the filename of every fragment added by this PR
-            added_fragments=$(echo "$added_or_renamed" | grep -E "^(${folder_alt})/changelog\.d/" || true)
-            for fragment in $added_fragments; do
-              name=$(basename "$fragment")
-              if [ "$name" = ".gitkeep" ] || [ "$name" = "README.md" ]; then
-                continue
-              fi
-              if ! echo "$name" | grep -qE "$fragment_name_re"; then
-                echo "Invalid fragment filename: $fragment"
-                invalid_fragments="${invalid_fragments}- \`${fragment}\`"$'\n'
-              fi
-            done
-
-            # Lint fragment content: the PR link is attached automatically at
-            # compile time, so a hand-written PR or issue link would be wrong
-            touched_fragments=$(echo "$added_modified_or_renamed" | grep -E "^(${folder_alt})/changelog\.d/" || true)
-            for fragment in $touched_fragments; do
-              name=$(basename "$fragment")
-              if [ "$name" = ".gitkeep" ] || [ "$name" = "README.md" ] || [ ! -f "$fragment" ]; then
-                continue
-              fi
-              if grep -qE "$manual_pr_link_re" "$fragment"; then
-                echo "Fragment contains a hand-written PR or issue link: $fragment"
-                linked_fragments="${linked_fragments}- \`${fragment}\`"$'\n'
-              fi
-            done
           fi
 
-          # Suggest a slug derived from the branch name for the bot comment
-          suggested_slug=$(echo "$HEAD_REF" | tr '[:upper:]' '[:lower:]' | sed 's|.*/||; s/[^a-z0-9._-]/-/g; s/^[^a-z0-9]*//')
-          if [ -z "$suggested_slug" ]; then
-            suggested_slug="my-change"
-          fi
-
-          fragment_help="A changelog fragment is a small Markdown file named \`<slug>.<type>.md\` under \`<component>/changelog.d/\`, where \`<type>\` is one of \`added\`, \`changed\`, \`deprecated\`, \`removed\`, \`fixed\` or \`security\`. Its content is the changelog entry text, without the PR link (added automatically at release time) and without a trailing period. For example:
-
-          \`\`\`
-          echo 'Entry text describing the change' > <component>/changelog.d/${suggested_slug}.fixed.md
-          \`\`\`
-
-          If this PR does not need a changelog entry, add the \`no-changelog\` label instead."
-
-          if [ -n "$missing_fragments" ] || [ -n "$invalid_fragments" ] || [ -n "$linked_fragments" ] || [ -n "$handwritten_changelogs" ]; then
-            comment_body=""
-            if [ -n "$missing_fragments" ]; then
-              comment_body="⚠️ **Changes detected in the following folders without a changelog fragment:**"$'\n\n'"${missing_fragments}"$'\n'
-            fi
-            if [ -n "$invalid_fragments" ]; then
-              comment_body="${comment_body}⚠️ **Changelog fragment filenames that do not follow the naming convention:**"$'\n\n'"${invalid_fragments}"$'\n'
-            fi
-            if [ -n "$linked_fragments" ]; then
-              comment_body="${comment_body}⚠️ **Changelog fragments containing a hand-written PR or issue link (remove it; the PR link is attached automatically at release time):**"$'\n\n'"${linked_fragments}"$'\n'
-            fi
-            if [ -n "$handwritten_changelogs" ]; then
-              comment_body="${comment_body}⚠️ **Direct \`CHANGELOG.md\` edits are not allowed in regular PRs:**"$'\n\n'"${handwritten_changelogs}"$'\n'
-            fi
-            comment_body="${comment_body}${fragment_help}"
-          else
-            comment_body="✅ All required changelog fragments are present."
-          fi
-
-          write_multiline_output() {
-            local name="$1"
-            local value="$2"
-            local delimiter
-
-            while true; do
-              delimiter="EOF_$(openssl rand -hex 16)"
-              if ! grep -qxF "$delimiter" <<< "$value"; then
-                break
-              fi
-            done
-
-            {
-              echo "${name}<<${delimiter}"
-              if [ -n "$value" ]; then
-                printf '%s\n' "$value"
-              fi
-              echo "${delimiter}"
-            } >> "$GITHUB_OUTPUT"
-          }
-
-          write_multiline_output "missing_fragments" "$missing_fragments"
-          write_multiline_output "invalid_fragments" "$invalid_fragments"
-          write_multiline_output "linked_fragments" "$linked_fragments"
-          write_multiline_output "handwritten_changelogs" "$handwritten_changelogs"
-          write_multiline_output "comment_body" "$comment_body"
+          {
+            echo "missing_changelogs<<EOF"
+            echo -e "${missing_changelogs}"
+            echo "EOF"
+          } >> $GITHUB_OUTPUT
         env:
           STEPS_CHANGED_FILES_OUTPUTS_ANY_CHANGED: ${{ steps.changed-files.outputs.any_changed }}
           STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }}
-          STEPS_CHANGED_FILES_OUTPUTS_ADDED_FILES: ${{ steps.changed-files.outputs.added_files }}
-          STEPS_CHANGED_FILES_OUTPUTS_MODIFIED_FILES: ${{ steps.changed-files.outputs.modified_files }}
-          STEPS_CHANGED_FILES_OUTPUTS_RENAMED_FILES: ${{ steps.changed-files.outputs.renamed_files }}
-          HEAD_REF: ${{ github.event.pull_request.head.ref }}
 
       - name: Find existing changelog comment
         if: github.event.pull_request.head.repo.full_name == github.repository
@@ -289,10 +128,14 @@ jobs:
           edit-mode: replace
           body: |
             <!-- changelog-check -->
-            ${{ steps.check-folders.outputs.comment_body }}
+            ${{ steps.check-folders.outputs.missing_changelogs != '' && format('⚠️ **Changes detected in the following folders without a corresponding update to the `CHANGELOG.md`:**
 
-      - name: Fail if changelog fragment is missing or invalid
-        if: steps.check-folders.outputs.missing_fragments != '' || steps.check-folders.outputs.invalid_fragments != '' || steps.check-folders.outputs.linked_fragments != '' || steps.check-folders.outputs.handwritten_changelogs != ''
+            {0}
+
+            Please add an entry to the corresponding `CHANGELOG.md` file to maintain a clear history of changes.', steps.check-folders.outputs.missing_changelogs) || '✅ All necessary `CHANGELOG.md` files have been updated.' }}
+
+      - name: Fail if changelog is missing
+        if: steps.check-folders.outputs.missing_changelogs != ''
         run: |
-          echo "::error::Missing, invalid, or disallowed changelog updates"
+          echo "::error::Missing changelog updates in some folders"
           exit 1

.github/workflows/pr-conflict-checker.yml

@@ -37,7 +37,8 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 1
-          persist-credentials: false # No write token in the untrusted PR-head tree; public repo so base fetch/changed-files work unauthenticated
+          # zizmor: ignore[artipacked]
+          persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
 
       - name: Fetch PR base ref for tj-actions/changed-files
         env:
@@ -49,8 +50,6 @@ jobs:
         uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
         with:
           files: '**'
-          safe_output: false # Raw paths (list read via env var, injection-safe); default escaping backslash-quotes chars like () and breaks the -f test
-          separator: "\n" # Newline-delimited so the reader tolerates spaces and glob chars in paths
 
       - name: Check for conflict markers
         id: conflict-check
@@ -60,18 +59,19 @@ jobs:
           CONFLICT_FILES=""
           HAS_CONFLICTS=false
 
-          # Read newline-delimited paths so spaces/globs neither word-split nor glob-expand
-          while IFS= read -r file; do
-            [ -n "$file" ] || continue
-            [ -f "$file" ] || continue
-            echo "Checking file: $file"
+          # Check each changed file for conflict markers
+          for file in ${STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES}; do
+            if [ -f "$file" ]; then
+              echo "Checking file: $file"
 
-            if grep -qE '^(<<<<<<<|=======|>>>>>>>)' "$file" 2>/dev/null; then
-              echo "Conflict markers found in: $file"
-              CONFLICT_FILES="${CONFLICT_FILES}- \`${file}\`"$'\n'
-              HAS_CONFLICTS=true
+              # Look for conflict markers (more precise regex)
+              if grep -qE '^(<<<<<<<|=======|>>>>>>>)' "$file" 2>/dev/null; then
+                echo "Conflict markers found in: $file"
+                CONFLICT_FILES="${CONFLICT_FILES}- \`${file}\`"$'\n'
+                HAS_CONFLICTS=true
+              fi
             fi
-          done <<< "$STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES"
+          done
 
           if [ "$HAS_CONFLICTS" = true ]; then
             echo "has_conflicts=true" >> $GITHUB_OUTPUT
@@ -88,49 +88,18 @@ jobs:
         env:
           STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }}
 
-      - name: Check base-branch mergeability
-        id: merge-check
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          REPO: ${{ github.repository }}
-        run: |
-          MERGEABLE=null
-
-          # GitHub computes mergeability async, so .mergeable is null until ready; poll until resolved
-          for attempt in 1 2 3 4 5; do
-            MERGEABLE=$(gh api "repos/${REPO}/pulls/${PR_NUMBER}" --jq '.mergeable')
-            if [ "$MERGEABLE" != "null" ]; then
-              break
-            fi
-            echo "Attempt ${attempt}: mergeability not computed yet, retrying..."
-            sleep 3
-          done
-
-          # Keep 'unknown' distinct from 'clean' so we never assert a clean merge we could not confirm
-          case "$MERGEABLE" in
-            false) STATUS=conflict; echo "PR branch cannot be merged cleanly into its base branch" ;;
-            true)  STATUS=clean;    echo "PR branch merges cleanly into its base branch" ;;
-            *)     STATUS=unknown;  echo "::warning::Mergeability did not resolve after retries; leaving it undetermined" ;;
-          esac
-
-          echo "merge_status=${STATUS}" >> "$GITHUB_OUTPUT"
-
       - name: Manage conflict label
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
           HAS_CONFLICTS: ${{ steps.conflict-check.outputs.has_conflicts }}
-          MERGE_STATUS: ${{ steps.merge-check.outputs.merge_status }}
         run: |
           LABEL_NAME="has-conflicts"
 
-          if [ "$HAS_CONFLICTS" = "true" ] || [ "$MERGE_STATUS" = "conflict" ]; then
+          # Add or remove label based on conflict status
+          if [ "$HAS_CONFLICTS" = "true" ]; then
             echo "Adding conflict label to PR #${PR_NUMBER}..."
             gh pr edit "$PR_NUMBER" --add-label "$LABEL_NAME" --repo ${{ github.repository }} || true
-          elif [ "$MERGE_STATUS" = "unknown" ]; then
-            # Don't drop the label on an undetermined merge state; a later run will settle it
-            echo "Mergeability undetermined; leaving label unchanged"
           else
             echo "Removing conflict label from PR #${PR_NUMBER}..."
             gh pr edit "$PR_NUMBER" --remove-label "$LABEL_NAME" --repo ${{ github.repository }} || true
@@ -152,25 +121,20 @@ jobs:
           edit-mode: replace
           body: |
             <!-- conflict-checker-comment -->
-            ${{ (steps.conflict-check.outputs.has_conflicts == 'true' || steps.merge-check.outputs.merge_status == 'conflict') && '⚠️ **Conflicts Detected**' || (steps.merge-check.outputs.merge_status == 'unknown' && 'ℹ️ **Conflict Check Incomplete**' || '✅ **No Conflicts**') }}
-            ${{ steps.conflict-check.outputs.has_conflicts == 'true' && format('
-            **Conflict markers** are present in the following files:
+            ${{ steps.conflict-check.outputs.has_conflicts == 'true' && '⚠️ **Conflict Markers Detected**' || '✅ **Conflict Markers Resolved**' }}
+
+            ${{ steps.conflict-check.outputs.has_conflicts == 'true' && format('This pull request contains unresolved conflict markers in the following files:
 
             {0}
-            Resolve them by removing every `<<<<<<<`, `=======`, and `>>>>>>>` marker, then commit and push.', steps.conflict-check.outputs.conflict_files) || '' }}
-            ${{ steps.merge-check.outputs.merge_status == 'conflict' && '
-            **Merge conflict with the base branch.** This PR cannot be merged cleanly. Update your branch with the latest base (rebase or merge) and resolve the conflicts.' || '' }}
-            ${{ steps.merge-check.outputs.merge_status == 'unknown' && '
-            GitHub had not finished computing mergeability, so base-branch conflict status could not be verified on this run.' || '' }}
-            ${{ (steps.conflict-check.outputs.has_conflicts != 'true' && steps.merge-check.outputs.merge_status == 'clean') && '
-            No conflict markers, and the branch merges cleanly into its base.' || '' }}
+
+            Please resolve these conflicts by:
+            1. Locating the conflict markers: `<<<<<<<`, `=======`, and `>>>>>>>`
+            2. Manually editing the files to resolve the conflicts
+            3. Removing all conflict markers
+            4. Committing and pushing the changes', steps.conflict-check.outputs.conflict_files) || 'All conflict markers have been successfully resolved in this pull request.' }}
 
       - name: Fail workflow if conflicts detected
-        if: steps.conflict-check.outputs.has_conflicts == 'true' || steps.merge-check.outputs.merge_status == 'conflict'
-        env:
-          HAS_CONFLICTS: ${{ steps.conflict-check.outputs.has_conflicts }}
-          MERGE_STATUS: ${{ steps.merge-check.outputs.merge_status }}
+        if: steps.conflict-check.outputs.has_conflicts == 'true'
         run: |
-          [ "$HAS_CONFLICTS" = "true" ] && echo "::error::Conflict markers detected in changed files"
-          [ "$MERGE_STATUS" = "conflict" ] && echo "::error::PR branch has merge conflicts with the base branch"
+          echo "::error::Workflow failed due to conflict markers detected in the PR"
           exit 1

.github/workflows/pr-merged.yml

@@ -56,6 +56,6 @@ jobs:
               "PROWLER_PR_BODY": ${{ toJson(github.event.pull_request.body) }},
               "PROWLER_PR_URL": ${{ toJson(github.event.pull_request.html_url) }},
               "PROWLER_PR_MERGED_BY": "${{ github.event.pull_request.merged_by.login }}",
-              "PROWLER_PR_BASE_BRANCH": ${{ toJson(github.event.pull_request.base.ref) }},
-              "PROWLER_PR_HEAD_BRANCH": ${{ toJson(github.event.pull_request.head.ref) }}
+              "PROWLER_PR_BASE_BRANCH": "${{ github.event.pull_request.base.ref }}",
+              "PROWLER_PR_HEAD_BRANCH": "${{ github.event.pull_request.head.ref }}"
             }

.github/workflows/sdk-code-quality.yml

@@ -29,7 +29,6 @@ jobs:
           - '3.10'
           - '3.11'
           - '3.12'
-          - '3.13'
 
     steps:
       - name: Harden Runner
@@ -55,7 +54,6 @@ jobs:
           files_ignore: |
             .github/**
             prowler/CHANGELOG.md
-            prowler/changelog.d/**
             docs/**
             permissions/**
             api/**

.github/workflows/sdk-codeql.yml

@@ -12,7 +12,6 @@ on:
       - '.github/workflows/sdk-codeql.yml'
       - '.github/codeql/sdk-codeql-config.yml'
       - '!prowler/CHANGELOG.md'
-      - '!prowler/changelog.d/**'
   pull_request:
     branches:
       - 'master'
@@ -24,7 +23,6 @@ on:
       - '.github/workflows/sdk-codeql.yml'
       - '.github/codeql/sdk-codeql-config.yml'
       - '!prowler/CHANGELOG.md'
-      - '!prowler/changelog.d/**'
   schedule:
     - cron: '00 12 * * *'
 

.github/workflows/sdk-container-build-push.yml

@@ -138,7 +138,6 @@ jobs:
     permissions:
       contents: read
       packages: write
-      id-token: write
 
     steps:
       - name: Harden Runner
@@ -148,8 +147,6 @@ jobs:
           allowed-endpoints: >
             api.ecr-public.us-east-1.amazonaws.com:443
             public.ecr.aws:443
-            sts.amazonaws.com:443
-            sts.us-east-1.amazonaws.com:443
             registry-1.docker.io:443
             production.cloudflare.docker.com:443
             production.cloudfront.docker.com:443
@@ -176,16 +173,14 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - name: Configure AWS credentials (OIDC)
-        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
-        with:
-          aws-region: us-east-1
-          role-to-assume: ${{ secrets.PUBLIC_ECR_IAM_ROLE_ARN }}
-
       - name: Login to Public ECR
-        uses: aws-actions/amazon-ecr-login@d539f0932e70871a027e9d5a9d8fc38589180a64 # v2.1.6
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
-          registry-type: public
+          registry: public.ecr.aws
+          username: ${{ secrets.PUBLIC_ECR_AWS_ACCESS_KEY_ID }}
+          password: ${{ secrets.PUBLIC_ECR_AWS_SECRET_ACCESS_KEY }}
+        env:
+          AWS_REGION: ${{ env.AWS_REGION }}
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
@@ -211,7 +206,6 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
-      id-token: write
 
     steps:
       - name: Harden Runner
@@ -227,8 +221,6 @@ jobs:
             github.com:443
             release-assets.githubusercontent.com:443
             api.ecr-public.us-east-1.amazonaws.com:443
-            sts.amazonaws.com:443
-            sts.us-east-1.amazonaws.com:443
 
 
       - name: Login to DockerHub
@@ -237,16 +229,14 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - name: Configure AWS credentials (OIDC)
-        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
-        with:
-          aws-region: us-east-1
-          role-to-assume: ${{ secrets.PUBLIC_ECR_IAM_ROLE_ARN }}
-
       - name: Login to Public ECR
-        uses: aws-actions/amazon-ecr-login@d539f0932e70871a027e9d5a9d8fc38589180a64 # v2.1.6
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
-          registry-type: public
+          registry: public.ecr.aws
+          username: ${{ secrets.PUBLIC_ECR_AWS_ACCESS_KEY_ID }}
+          password: ${{ secrets.PUBLIC_ECR_AWS_SECRET_ACCESS_KEY }}
+        env:
+          AWS_REGION: ${{ env.AWS_REGION }}
 
       - name: Create and push manifests for push event
         if: github.event_name == 'push'
@@ -309,7 +299,7 @@ jobs:
 
       - name: Install regctl
         if: always()
-        uses: regclient/actions/regctl-installer@9a2d4216180dbb3e2dccfa60d2dd4afd98e42ec5 # main
+        uses: regclient/actions/regctl-installer@da9319db8e44e8b062b3a147e1dfb2f574d41a03 # main
 
       - name: Cleanup intermediate architecture tags
         if: always()

.github/workflows/sdk-container-checks.yml

@@ -15,6 +15,12 @@ on:
     branches:
       - 'master'
       - 'v5.*'
+    paths:
+      - 'prowler/**'
+      - 'Dockerfile*'
+      - 'pyproject.toml'
+      - 'uv.lock'
+      - '.github/workflows/sdk-container-checks.yml'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -105,15 +111,25 @@ jobs:
         id: check-changes
         uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
         with:
-          files: |
-            prowler/**
-            Dockerfile*
-            pyproject.toml
-            uv.lock
-            .github/workflows/sdk-container-checks.yml
+          files: ./**
           files_ignore: |
+            .github/**
             prowler/CHANGELOG.md
-            prowler/changelog.d/**
+            docs/**
+            permissions/**
+            api/**
+            ui/**
+            dashboard/**
+            mcp_server/**
+            skills/**
+            README.md
+            mkdocs.yml
+            .backportrc.json
+            .env
+            docker-compose*
+            examples/**
+            .gitignore
+            contrib/**
             **/AGENTS.md
 
       - name: Set up Docker Buildx
@@ -137,5 +153,5 @@ jobs:
         with:
           image-name: ${{ env.IMAGE_NAME }}
           image-tag: ${{ github.sha }}
-          fail-on-critical: 'true'
+          fail-on-critical: 'false'
           severity: 'CRITICAL'

.github/workflows/sdk-security.yml

@@ -19,6 +19,16 @@ on:
     branches:
       - 'master'
       - 'v5.*'
+    paths:
+      - 'prowler/**'
+      - 'tests/**'
+      - 'pyproject.toml'
+      - 'uv.lock'
+      - '.github/workflows/sdk-tests.yml'
+      - '.github/workflows/sdk-security.yml'
+      - '.github/actions/setup-python-uv/**'
+      - '.github/actions/osv-scanner/**'
+      - '.github/scripts/osv-scan.sh'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -61,19 +71,27 @@ jobs:
         id: check-changes
         uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
         with:
-          files: |
-            prowler/**
-            tests/**
-            pyproject.toml
-            uv.lock
-            .github/workflows/sdk-tests.yml
+          files:
+            ./**
             .github/workflows/sdk-security.yml
-            .github/actions/setup-python-uv/**
-            .github/actions/osv-scanner/**
-            .github/scripts/osv-scan.sh
           files_ignore: |
+            .github/**
             prowler/CHANGELOG.md
-            prowler/changelog.d/**
+            docs/**
+            permissions/**
+            api/**
+            ui/**
+            dashboard/**
+            mcp_server/**
+            skills/**
+            README.md
+            mkdocs.yml
+            .backportrc.json
+            .env
+            docker-compose*
+            examples/**
+            .gitignore
+            contrib/**
             **/AGENTS.md
 
       - name: Setup Python with uv

.github/workflows/sdk-tests.yml

@@ -29,7 +29,6 @@ jobs:
           - '3.10'
           - '3.11'
           - '3.12'
-          - '3.13'
 
     steps:
       - name: Harden Runner
@@ -77,7 +76,6 @@ jobs:
           files_ignore: |
             .github/**
             prowler/CHANGELOG.md
-            prowler/changelog.d/**
             docs/**
             permissions/**
             api/**
@@ -591,57 +589,6 @@ jobs:
           flags: prowler-py${{ matrix.python-version }}-stackit
           files: ./stackit_coverage.xml
 
-      # Linode Provider
-      - name: Check if Linode files changed
-        if: steps.check-changes.outputs.any_changed == 'true'
-        id: changed-linode
-        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
-        with:
-          files: |
-            ./prowler/**/linode/**
-            ./tests/**/linode/**
-            ./uv.lock
-
-      - name: Run Linode tests
-        if: steps.changed-linode.outputs.any_changed == 'true'
-        run: uv run pytest -n auto --cov=./prowler/providers/linode --cov-report=xml:linode_coverage.xml tests/providers/linode
-
-      - name: Upload Linode coverage to Codecov
-        if: steps.changed-linode.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-        with:
-          flags: prowler-py${{ matrix.python-version }}-linode
-          files: ./linode_coverage.xml
-
-      # External Provider (dynamic loading)
-      - name: Check if External Provider files changed
-        if: steps.check-changes.outputs.any_changed == 'true'
-        id: changed-external
-        uses: tj-actions/changed-files@22103cc46bda19c2b464ffe86db46df6922fd323 # v47.0.5
-        with:
-          files: |
-            ./prowler/providers/common/**
-            ./prowler/config/**
-            ./prowler/lib/**
-            ./tests/providers/external/**
-            ./uv.lock
-
-      - name: Run External Provider tests
-        if: steps.changed-external.outputs.any_changed == 'true'
-        run: uv run pytest -n auto --cov=./prowler/providers/common --cov=./prowler/config --cov=./prowler/lib --cov-report=xml:external_coverage.xml tests/providers/external
-
-      - name: Upload External Provider coverage to Codecov
-        if: steps.changed-external.outputs.any_changed == 'true'
-
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-        with:
-          flags: prowler-py${{ matrix.python-version }}-external
-          files: ./external_coverage.xml
-
       # Lib
       - name: Check if Lib files changed
         if: steps.check-changes.outputs.any_changed == 'true'

.github/workflows/test-impact-analysis.yml

@@ -73,7 +73,7 @@ jobs:
       - name: Setup Python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
-          python-version: '3.12.13'
+          python-version: '3.12'
 
       - name: Install PyYAML
         run: pip install pyyaml

.github/workflows/ui-codeql.yml

@@ -10,7 +10,6 @@ on:
       - '.github/workflows/ui-codeql.yml'
       - '.github/codeql/ui-codeql-config.yml'
       - '!ui/CHANGELOG.md'
-      - '!ui/changelog.d/**'
   pull_request:
     branches:
       - 'master'
@@ -20,7 +19,6 @@ on:
       - '.github/workflows/ui-codeql.yml'
       - '.github/codeql/ui-codeql-config.yml'
       - '!ui/CHANGELOG.md'
-      - '!ui/changelog.d/**'
   schedule:
     - cron: '00 12 * * *'
 

.github/workflows/ui-container-build-push.yml

@@ -32,6 +32,9 @@ env:
   PROWLERCLOUD_DOCKERHUB_REPOSITORY: prowlercloud
   PROWLERCLOUD_DOCKERHUB_IMAGE: prowler-ui
 
+  # Build args
+  NEXT_PUBLIC_API_BASE_URL: http://prowler-api:8080/api/v1
+
 permissions: {}
 
 jobs:
@@ -143,6 +146,7 @@ jobs:
           context: ${{ env.WORKING_DIRECTORY }}
           build-args: |
             NEXT_PUBLIC_PROWLER_RELEASE_VERSION=${{ (github.event_name == 'release' || github.event_name == 'workflow_dispatch') && format('v{0}', env.RELEASE_TAG) || needs.setup.outputs.short-sha }}
+            NEXT_PUBLIC_API_BASE_URL=${{ env.NEXT_PUBLIC_API_BASE_URL }}
           push: true
           platforms: ${{ matrix.platform }}
           tags: |
@@ -201,7 +205,7 @@ jobs:
 
       - name: Install regctl
         if: always()
-        uses: regclient/actions/regctl-installer@9a2d4216180dbb3e2dccfa60d2dd4afd98e42ec5 # main
+        uses: regclient/actions/regctl-installer@da9319db8e44e8b062b3a147e1dfb2f574d41a03 # main
 
       - name: Cleanup intermediate architecture tags
         if: always()
@@ -258,3 +262,27 @@ jobs:
           payload-file-path: "./.github/scripts/slack-messages/container-release-completed.json"
           step-outcome: ${{ steps.outcome.outputs.outcome }}
           update-ts: ${{ needs.notify-release-started.outputs.message-ts }}
+
+  trigger-deployment:
+    needs: [setup, container-build-push]
+    if: always() && github.event_name == 'push' && needs.setup.result == 'success' && needs.container-build-push.result == 'success'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        with:
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+
+      - name: Trigger UI deployment
+        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
+        with:
+          token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }}
+          repository: ${{ secrets.CLOUD_DISPATCH }}
+          event-type: ui-prowler-deployment
+          client-payload: '{"sha": "${{ github.sha }}", "short_sha": "${{ needs.setup.outputs.short-sha }}"}'

.github/workflows/ui-container-checks.yml

@@ -12,6 +12,9 @@ on:
     branches:
       - 'master'
       - 'v5.*'
+    paths:
+      - 'ui/**'
+      - '.github/workflows/ui-container-checks.yml'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -102,7 +105,6 @@ jobs:
           files: ui/**
           files_ignore: |
             ui/CHANGELOG.md
-            ui/changelog.d/**
             ui/README.md
             ui/AGENTS.md
 
@@ -130,5 +132,5 @@ jobs:
         with:
           image-name: ${{ env.IMAGE_NAME }}
           image-tag: ${{ github.sha }}
-          fail-on-critical: 'true'
+          fail-on-critical: 'false'
           severity: 'CRITICAL'

.github/workflows/ui-e2e-tests-v2.yml

@@ -14,8 +14,6 @@ on:
       - '.github/test-impact.yml'
       - 'ui/**'
       - 'api/**'  # API changes can affect UI E2E
-      - '!ui/CHANGELOG.md'
-      - '!api/CHANGELOG.md'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -42,8 +40,7 @@ jobs:
       AUTH_SECRET: 'fallback-ci-secret-for-testing'
       AUTH_TRUST_HOST: true
       NEXTAUTH_URL: 'http://localhost:3000'
-      AUTH_URL: 'http://localhost:3000'
-      UI_API_BASE_URL: 'http://localhost:8080/api/v1'
+      NEXT_PUBLIC_API_BASE_URL: 'http://localhost:8080/api/v1'
       E2E_ADMIN_USER: ${{ secrets.E2E_ADMIN_USER }}
       E2E_ADMIN_PASSWORD: ${{ secrets.E2E_ADMIN_PASSWORD }}
       E2E_AWS_PROVIDER_ACCOUNT_ID: ${{ secrets.E2E_AWS_PROVIDER_ACCOUNT_ID }}
@@ -80,14 +77,6 @@ jobs:
       E2E_ALIBABACLOUD_ACCESS_KEY_ID: ${{ secrets.E2E_ALIBABACLOUD_ACCESS_KEY_ID }}
       E2E_ALIBABACLOUD_ACCESS_KEY_SECRET: ${{ secrets.E2E_ALIBABACLOUD_ACCESS_KEY_SECRET }}
       E2E_ALIBABACLOUD_ROLE_ARN: ${{ secrets.E2E_ALIBABACLOUD_ROLE_ARN }}
-      E2E_OKTA_DOMAIN: ${{ secrets.E2E_OKTA_DOMAIN }}
-      E2E_OKTA_CLIENT_ID: ${{ secrets.E2E_OKTA_CLIENT_ID }}
-      E2E_OKTA_BASE64_PRIVATE_KEY: ${{ secrets.E2E_OKTA_BASE64_PRIVATE_KEY }}
-      E2E_GOOGLEWORKSPACE_CUSTOMER_ID: ${{ secrets.E2E_GOOGLEWORKSPACE_CUSTOMER_ID }}
-      E2E_GOOGLEWORKSPACE_SERVICE_ACCOUNT_JSON: ${{ secrets.E2E_GOOGLEWORKSPACE_SERVICE_ACCOUNT_JSON }}
-      E2E_GOOGLEWORKSPACE_DELEGATED_USER: ${{ secrets.E2E_GOOGLEWORKSPACE_DELEGATED_USER }}
-      E2E_VERCEL_TEAM_ID: ${{ secrets.E2E_VERCEL_TEAM_ID }}
-      E2E_VERCEL_API_TOKEN: ${{ secrets.E2E_VERCEL_API_TOKEN }}
       # Pass E2E paths from impact analysis
       E2E_TEST_PATHS: ${{ needs.impact-analysis.outputs.ui-e2e }}
       RUN_ALL_TESTS: ${{ needs.impact-analysis.outputs.run-all }}
@@ -145,17 +134,7 @@ jobs:
         # docker-compose.yml references prowlercloud/prowler-api:latest from the registry,
         # which lags behind PR changes; build locally so E2E exercises the API image
         # produced by this PR.
-        #
-        # The image installs the SDK from git@master (api/uv.lock), so a PR changing BOTH the SDK
-        # and the API would run against the OLD SDK and crash on startup. Overlay the checkout's
-        # SDK source so both run together. New SDK dependencies still need an api/uv.lock bump.
-        run: |
-          docker build -t prowlercloud/prowler-api:pr-base ./api
-          docker build -t prowlercloud/prowler-api:latest -f - prowler <<'DOCKERFILE'
-          FROM prowlercloud/prowler-api:pr-base
-          RUN rm -rf /home/prowler/.venv/lib/python3.12/site-packages/prowler
-          COPY --chown=prowler:prowler . /home/prowler/.venv/lib/python3.12/site-packages/prowler
-          DOCKERFILE
+        run: docker build -t prowlercloud/prowler-api:latest ./api
 
       - name: Start API services
         run: |
@@ -168,7 +147,7 @@ jobs:
           timeout=150
           elapsed=0
           while [ $elapsed -lt $timeout ]; do
-            if curl -s ${UI_API_BASE_URL}/docs >/dev/null 2>&1; then
+            if curl -s ${NEXT_PUBLIC_API_BASE_URL}/docs >/dev/null 2>&1; then
               echo "Prowler API is ready!"
               exit 0
             fi

.github/workflows/ui-security.yml

@@ -15,6 +15,12 @@ on:
     branches:
       - 'master'
       - 'v5.*'
+    paths:
+      - 'ui/package.json'
+      - 'ui/pnpm-lock.yaml'
+      - '.github/workflows/ui-security.yml'
+      - '.github/actions/osv-scanner/**'
+      - '.github/scripts/osv-scan.sh'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -24,6 +30,7 @@ permissions: {}
 
 jobs:
   ui-security-scans:
+    if: github.repository == 'prowler-cloud/prowler'
     runs-on: ubuntu-latest
     timeout-minutes: 15
     permissions:

.github/workflows/ui-tests.yml

@@ -37,12 +37,8 @@ jobs:
           allowed-endpoints: >
             github.com:443
             registry.npmjs.org:443
-            nodejs.org:443
             fonts.googleapis.com:443
             fonts.gstatic.com:443
-            api.iconify.design:443
-            api.simplesvg.com:443
-            api.unisvg.com:443
             api.github.com:443
             release-assets.githubusercontent.com:443
             cdn.playwright.dev:443
@@ -64,7 +60,6 @@ jobs:
             .github/workflows/ui-tests.yml
           files_ignore: |
             ui/CHANGELOG.md
-            ui/changelog.d/**
             ui/README.md
             ui/AGENTS.md
 
@@ -136,10 +131,6 @@ jobs:
         if: steps.check-changes.outputs.any_changed == 'true'
         run: pnpm run healthcheck
 
-      - name: Check product-tour alignment
-        if: steps.check-changes.outputs.any_changed == 'true'
-        run: pnpm run tour:check
-
       - name: Run pnpm audit
         if: steps.check-changes.outputs.any_changed == 'true'
         run: pnpm run audit

.gitignore

@@ -169,7 +169,3 @@ GEMINI.md
 
 # Claude Code
 .claude/*
-
-# Docker
-docker-compose.override.yml
-docker-compose-dev.override.yml

.pre-commit-config.yaml

@@ -7,10 +7,6 @@
 #   P50 — dependency validation
 
 default_install_hook_types: [pre-commit]
-# Hooks run on commit only by default;
-# NOTE: default_stages does NOT override a hook's manifest stages, so fixers shipping pre-push in their
-# manifest need an explicit stages: ["pre-commit"] below to stay off push.
-default_stages: [pre-commit]
 
 repos:
   ## GENERAL (prek built-in — no external repo needed)
@@ -25,16 +21,13 @@ repos:
       - id: check-json
         priority: 10
       - id: end-of-file-fixer
-        stages: ["pre-commit"]
         priority: 0
       - id: trailing-whitespace
-        stages: ["pre-commit"]
         priority: 0
       - id: no-commit-to-branch
         priority: 10
       - id: pretty-format-json
         args: ["--autofix", --no-sort-keys, --no-ensure-ascii]
-        stages: ["pre-commit"]
         priority: 10
 
   ## TOML
@@ -72,13 +65,13 @@ repos:
         exclude: contrib
         priority: 30
 
-  ## PYTHON — SDK (prowler/, tests/, dashboard/, util/, scripts/, docs/scripts/)
+  ## PYTHON — SDK (prowler/, tests/, dashboard/, util/, scripts/)
   - repo: https://github.com/myint/autoflake
     rev: v2.3.3
     hooks:
       - id: autoflake
         name: "SDK - autoflake"
-        files: { glob: ["{prowler,tests,dashboard,util,scripts,docs/scripts}/**/*.py"] }
+        files: { glob: ["{prowler,tests,dashboard,util,scripts}/**/*.py"] }
         args: ["--in-place", "--remove-all-unused-imports", "--remove-unused-variable"]
         priority: 20
 
@@ -87,9 +80,8 @@ repos:
     hooks:
       - id: isort
         name: "SDK - isort"
-        files: { glob: ["{prowler,tests,dashboard,util,scripts,docs/scripts}/**/*.py"] }
+        files: { glob: ["{prowler,tests,dashboard,util,scripts}/**/*.py"] }
         args: ["--profile", "black"]
-        stages: ["pre-commit"]
         priority: 20
 
   - repo: https://github.com/psf/black
@@ -97,7 +89,7 @@ repos:
     hooks:
       - id: black
         name: "SDK - black"
-        files: { glob: ["{prowler,tests,dashboard,util,scripts,docs/scripts}/**/*.py"] }
+        files: { glob: ["{prowler,tests,dashboard,util,scripts}/**/*.py"] }
         priority: 20
 
   - repo: https://github.com/pycqa/flake8
@@ -105,49 +97,22 @@ repos:
     hooks:
       - id: flake8
         name: "SDK - flake8"
-        files: { glob: ["{prowler,tests,dashboard,util,scripts,docs/scripts}/**/*.py"] }
+        files: { glob: ["{prowler,tests,dashboard,util,scripts}/**/*.py"] }
         args: ["--ignore=E266,W503,E203,E501,W605"]
         priority: 30
 
   ## PYTHON — API + MCP Server (ruff)
-  # Run ruff through `uv run` against each project so prek uses the exact ruff
-  # version pinned in that project's uv.lock — the same version GitHub Actions
-  # runs via `uv run ruff`. This removes the drift between the local hooks and
-  # CI. api/ and mcp_server/ are separate uv projects, so they need separate
-  # hooks (each `uv run --project` resolves its own pinned ruff + config).
-  - repo: local
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.15.11
     hooks:
-      - id: ruff-check-api
-        name: "API - ruff check"
-        entry: uv run --project ./api ruff check --fix
-        language: system
-        files: { glob: ["api/**/*.py"] }
+      - id: ruff
+        name: "API + MCP - ruff check"
+        files: { glob: ["{api,mcp_server}/**/*.py"] }
+        args: ["--fix"]
         priority: 30
-      - id: ruff-format-api
-        name: "API - ruff format"
-        entry: uv run --project ./api ruff format
-        language: system
-        files: { glob: ["api/**/*.py"] }
-        priority: 20
-      - id: ruff-check-mcp
-        name: "MCP - ruff check"
-        entry: uv run --project ./mcp_server ruff check --fix
-        language: system
-        files: { glob: ["mcp_server/**/*.py"] }
-        priority: 30
-      - id: ruff-format-mcp
-        name: "MCP - ruff format"
-        entry: uv run --project ./mcp_server ruff format
-        language: system
-        files: { glob: ["mcp_server/**/*.py"] }
-        priority: 20
-
-      - id: generate-provider-cards
-        name: "Docs - regenerate provider cards snippet"
-        entry: python docs/scripts/generate_provider_cards.py
-        language: system
-        files: { glob: ["docs/user-guide/providers/**/getting-started-*.mdx", "docs/scripts/generate_provider_cards.py", "docs/snippets/provider-cards.mdx", "api/src/backend/api/models.py"] }
-        pass_filenames: false
+      - id: ruff-format
+        name: "API + MCP - ruff format"
+        files: { glob: ["{api,mcp_server}/**/*.py"] }
         priority: 20
 
   ## PYTHON — uv (API + SDK)
@@ -191,7 +156,7 @@ repos:
         entry: pylint --disable=W,C,R,E -j 0 -rn -sn
         language: system
         types: [python]
-        files: { glob: ["{prowler,tests,dashboard,util,scripts,docs/scripts}/**/*.py"] }
+        files: { glob: ["{prowler,tests,dashboard,util,scripts}/**/*.py"] }
         priority: 30
 
       - id: trufflehog

.trivyignore

@@ -1,98 +0,0 @@
-# Trivy ignore file for prowlercloud/prowler SDK container image.
-# Each entry below documents (a) the affected package and why it ships in the
-# image, (b) why the CVE is not exploitable in Prowler's runtime, and (c) the
-# upstream fix status. Entries carry an expiry so they auto-force re-review.
-# Entries are scoped per-package so suppressions cannot drift onto unrelated
-# packages that may be assigned the same CVE in the future.
-#
-# Scanned by: .github/actions/trivy-scan via .github/workflows/sdk-container-checks.yml
-
-# CVE-2026-42496 — perl-archive-tar path traversal via crafted symlinks.
-# CVE-2026-8376  — perl heap buffer overflow when compiling regex.
-# Packages: perl, perl-base, perl-modules-5.36, libperl5.36.
-# Why ignored: perl-base is part of Debian's "Essential: yes" set; it cannot be
-# removed without breaking dpkg. The Prowler SDK does not invoke perl at runtime;
-# neither vulnerable code path (Archive::Tar parsing or regex compilation of
-# attacker-controlled input) is reachable from Prowler. No Debian bookworm fix
-# is available yet.
-CVE-2026-42496 pkg:perl exp:2026-07-15
-CVE-2026-42496 pkg:perl-base exp:2026-07-15
-CVE-2026-42496 pkg:perl-modules-5.36 exp:2026-07-15
-CVE-2026-42496 pkg:libperl5.36 exp:2026-07-15
-CVE-2026-8376 pkg:perl exp:2026-07-15
-CVE-2026-8376 pkg:perl-base exp:2026-07-15
-CVE-2026-8376 pkg:perl-modules-5.36 exp:2026-07-15
-CVE-2026-8376 pkg:libperl5.36 exp:2026-07-15
-
-# CVE-2025-7458 — SQLite integer overflow.
-# Package: libsqlite3-0.
-# Why ignored: transitive dependency of CPython's stdlib sqlite3 module. The
-# Prowler SDK does not open user-supplied SQLite databases; SQLite usage is
-# internal and bounded. No Debian bookworm fix is available.
-CVE-2025-7458 pkg:libsqlite3-0 exp:2026-07-15
-
-# CVE-2026-43185 — Linux kernel ksmbd signedness bug.
-# Package: linux-libc-dev.
-# Why ignored: linux-libc-dev ships kernel headers for build-time compilation,
-# not a running kernel. Containers execute against the host kernel, so these
-# headers are inert at runtime. The upstream fix landed in kernel 7.0-rc2 and
-# has not been backported to Debian's 6.1 LTS line.
-CVE-2026-43185 pkg:linux-libc-dev exp:2026-07-15
-
-# CVE-2023-45853 — zlib MiniZip integer overflow / heap overflow in
-# zipOpenNewFileInZip4_64.
-# Packages: zlib1g, zlib1g-dev.
-# Why ignored: Debian Security Tracker status for bookworm is <ignored>, with
-# the published rationale "contrib/minizip not built and src:zlib not producing
-# binary packages" — i.e. the vulnerable symbol is not present in the libz.so
-# shipped by Debian. Real-not-affected, not unpatched. Upstream fix is in
-# zlib 1.3.1, available in Debian trixie (13); migrating the base image would
-# clear it fully.
-# Ref: https://security-tracker.debian.org/tracker/CVE-2023-45853
-CVE-2023-45853 pkg:zlib1g exp:2026-07-15
-CVE-2023-45853 pkg:zlib1g-dev exp:2026-07-15
-
-# CVE-2026-55200 — libssh2 out-of-bounds write in ssh2_transport_read() due to
-# an unchecked packet_length field in transport.c (heap corruption, possible RCE).
-# Package: libssh2-1.
-# Why ignored: libssh2-1 is pulled in only as a transitive dependency of libcurl4
-# (installed in the SDK Dockerfile for the networking/PowerShell stack). The
-# vulnerable path is reached exclusively when libssh2 acts as an SSH/SCP/SFTP
-# client parsing transport packets from a server. Prowler never uses libcurl's
-# SSH/SCP/SFTP transports; it talks to cloud provider HTTPS endpoints only, so the
-# affected code is unreachable at runtime. Fixed upstream in libssh2 commit
-# 97acf3df (PR #2052); no Debian bookworm fix is available yet.
-# Ref: https://security-tracker.debian.org/tracker/CVE-2026-55200
-CVE-2026-55200 pkg:libssh2-1 exp:2026-07-15
-
-# --- API container image (api/Dockerfile) ---
-# The entries below are specific to the Prowler API image, which ships
-# PowerShell and additional build tooling on top of the same bookworm base.
-
-# CVE-2026-7210 — CPython/Expat hash-flooding denial of service in
-# `xml.parsers.expat` and `xml.etree.ElementTree`.
-# Packages: the Debian system Python 3.11 (python3.11*, libpython3.11*).
-# Why ignored: the API runs under the Python 3.12 interpreter shipped in its
-# `.venv`; the system `python3.11` is only present because `python3-dev` is
-# pulled in to compile native extensions (xmlsec, lxml) and is never executed
-# at runtime. The vulnerable path requires parsing attacker-controlled XML with
-# the affected interpreter, which Prowler does not do with the system Python.
-# Full mitigation also needs libexpat >= 2.8.0; no Debian bookworm fix yet.
-CVE-2026-7210 pkg:python3.11 exp:2026-07-15
-CVE-2026-7210 pkg:python3.11-dev exp:2026-07-15
-CVE-2026-7210 pkg:python3.11-minimal exp:2026-07-15
-CVE-2026-7210 pkg:libpython3.11 exp:2026-07-15
-CVE-2026-7210 pkg:libpython3.11-dev exp:2026-07-15
-CVE-2026-7210 pkg:libpython3.11-minimal exp:2026-07-15
-CVE-2026-7210 pkg:libpython3.11-stdlib exp:2026-07-15
-
-# CVE-2026-33278 — Unbound DNSSEC validator use-after-free (DoS, possible RCE).
-# CVE-2026-42960 — Unbound DNS cache poisoning via promiscuous additional records.
-# Package: libunbound8.
-# Why ignored: libunbound8 is a transitive apt dependency of the TLS/networking
-# stack (GnuTLS DANE support); only the shared library ships in the image. Both
-# vulnerabilities require operating a live Unbound recursive DNSSEC validator
-# that processes attacker-influenced DNS responses. Prowler never starts an
-# Unbound resolver, so neither code path is reachable. No Debian bookworm fix yet.
-CVE-2026-33278 pkg:libunbound8 exp:2026-07-15
-CVE-2026-42960 pkg:libunbound8 exp:2026-07-15

AGENTS.md

@@ -51,7 +51,6 @@ Use these skills for detailed patterns on-demand:
 | `django-migration-psql` | Django migration best practices for PostgreSQL | [SKILL.md](skills/django-migration-psql/SKILL.md) |
 | `postgresql-indexing` | PostgreSQL indexing, EXPLAIN, monitoring, maintenance | [SKILL.md](skills/postgresql-indexing/SKILL.md) |
 | `prowler-attack-paths-query` | Create Attack Paths openCypher queries | [SKILL.md](skills/prowler-attack-paths-query/SKILL.md) |
-| `prowler-tour` | Keep product-tour definitions aligned with the UI | [SKILL.md](skills/prowler-tour/SKILL.md) |
 | `gh-aw` | GitHub Agentic Workflows (gh-aw) | [SKILL.md](skills/gh-aw/SKILL.md) |
 | `skill-creator` | Create new AI agent skills | [SKILL.md](skills/skill-creator/SKILL.md) |
 
@@ -68,12 +67,10 @@ When performing these actions, ALWAYS invoke the corresponding skill FIRST:
 | Adding new providers | `prowler-provider` |
 | Adding privilege escalation detection queries | `prowler-attack-paths-query` |
 | Adding services to existing providers | `prowler-provider` |
-| Adding, updating, or removing a tour definition (*.tour.ts) | `prowler-tour` |
 | After creating/modifying a skill | `skill-sync` |
 | App Router / Server Actions | `nextjs-16` |
 | Auditing check-to-requirement mappings as a cloud auditor | `prowler-compliance` |
 | Building AI chat features | `ai-sdk-5` |
-| Changing button labels or section headings on a tour-covered page | `prowler-tour` |
 | Committing changes | `prowler-commit` |
 | Configuring MCP servers in agentic workflows | `gh-aw` |
 | Create PR that requires changelog entry | `prowler-changelog` |
@@ -92,7 +89,6 @@ When performing these actions, ALWAYS invoke the corresponding skill FIRST:
 | Creating/updating compliance frameworks | `prowler-compliance` |
 | Debug why a GitHub Actions job is failing | `prowler-ci` |
 | Debugging gh-aw compilation errors | `gh-aw` |
-| Editing a UI file containing data-tour-id attributes | `prowler-tour` |
 | Fill .github/pull_request_template.md (Context/Description/Steps to review/Checklist) | `prowler-pr` |
 | Fixing bug | `tdd` |
 | Fixing compliance JSON bugs (duplicate IDs, empty Section, stale refs) | `prowler-compliance` |
@@ -109,12 +105,9 @@ When performing these actions, ALWAYS invoke the corresponding skill FIRST:
 | Modifying gh-aw workflow frontmatter or safe-outputs | `gh-aw` |
 | Refactoring code | `tdd` |
 | Regenerate AGENTS.md Auto-invoke tables (sync.sh) | `skill-sync` |
-| Renaming or removing a data-tour-id attribute value | `prowler-tour` |
-| Restructuring routes or layouts covered by a tour | `prowler-tour` |
 | Review PR requirements: template, title conventions, changelog gate | `prowler-pr` |
 | Review changelog format and conventions | `prowler-changelog` |
 | Reviewing JSON:API compliance | `jsonapi` |
-| Reviewing Prowler UI components | `prowler-ui` |
 | Reviewing compliance framework PRs | `prowler-compliance-review` |
 | Running makemigrations or pgmakemigrations | `django-migration-psql` |
 | Syncing compliance framework with upstream catalog | `prowler-compliance` |

Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.12.13-slim-bookworm@sha256:8a7e7cc04fd3e2bd787f7f24e22d5d119aa590d429b50c95dfe12b3abe52f48b AS build
+FROM python:3.12.11-slim-bookworm@sha256:519591d6871b7bc437060736b9f7456b8731f1499a57e22e6c285135ae657bf7 AS build
 
 LABEL maintainer="https://github.com/prowler-cloud/prowler"
 LABEL org.opencontainers.image.source="https://github.com/prowler-cloud/prowler"
@@ -6,7 +6,7 @@ LABEL org.opencontainers.image.source="https://github.com/prowler-cloud/prowler"
 ARG POWERSHELL_VERSION=7.5.0
 ENV POWERSHELL_VERSION=${POWERSHELL_VERSION}
 
-ARG TRIVY_VERSION=0.71.2
+ARG TRIVY_VERSION=0.70.0
 ENV TRIVY_VERSION=${TRIVY_VERSION}
 
 ARG ZIZMOR_VERSION=1.24.1
@@ -95,18 +95,6 @@ RUN uv sync --locked --compile-bytecode && \
 # Install PowerShell modules
 RUN .venv/bin/python prowler/providers/m365/lib/powershell/m365_powershell.py
 
-USER root
-
-# Remove build-only packages from the final image after Python dependencies are installed.
-RUN apt-get purge -y --auto-remove \
-    build-essential \
-    pkg-config \
-    libzstd-dev \
-    zlib1g-dev \
-    && rm -rf /var/lib/apt/lists/*
-
-USER prowler
-
 # Remove deprecated dash dependencies
 RUN pip uninstall dash-html-components -y && \
     pip uninstall dash-core-components -y

Makefile

@@ -1,34 +1,5 @@
 .DEFAULT_GOAL:=help
 
-DEV_LOCAL := ./scripts/development/dev-local.sh
-
-.PHONY: dev dev-setup dev-attach dev-launch dev-stop dev-clean dev-wipe dev-status
-
-##@ Local Development
-dev: ## Start local API, worker, and database logs
-	$(DEV_LOCAL) all
-
-dev-setup: ## Bootstrap local dependencies, migrations, and fixtures
-	$(DEV_LOCAL) setup
-
-dev-attach: ## Attach to the local tmux development session
-	$(DEV_LOCAL) attach
-
-dev-launch: ## Start the local stack on fixed ports and attach
-	$(DEV_LOCAL) launch
-
-dev-stop: ## Stop the local tmux session and containers
-	$(DEV_LOCAL) kill
-
-dev-clean: ## Remove stopped local development containers
-	$(DEV_LOCAL) clean
-
-dev-wipe: ## Stop everything and delete local development data
-	$(DEV_LOCAL) wipe
-
-dev-status: ## Show local development container status
-	$(DEV_LOCAL) status
-
 ##@ Testing
 test:   ## Test with pytest
 	rm -rf .coverage && \
@@ -45,41 +16,18 @@ coverage-html: ## Show Test Coverage
 	coverage html && \
 	open htmlcov/index.html
 
-##@ Code Quality
-# `make` is the single entrypoint and mirrors CI exactly (uv run + same flags):
-#   SDK (prowler/, util/) -> flake8 + black + pylint
-#   API & MCP server      -> ruff (rules live in each project's pyproject.toml)
-# `format` applies fixes (incl. ruff's import/upgrade autofixes); `lint` only
-# verifies and is what CI gates on.
-.PHONY: format format-sdk format-api format-mcp lint lint-sdk lint-api lint-mcp
+##@ Linting
+format: ## Format Code
+	@echo "Running black..."
+	black .
 
-format: format-sdk format-api format-mcp ## Format & autofix all components (SDK, API, MCP)
-
-lint: lint-sdk lint-api lint-mcp ## Lint all components (SDK, API, MCP) — mirrors CI
-
-format-sdk: ## Format SDK code (black)
-	uv run black --exclude "\.venv|api|ui|skills|mcp_server" .
-
-lint-sdk: ## Lint SDK code (flake8, black --check, pylint)
-	uv run flake8 . --ignore=E266,W503,E203,E501,W605,E128 --exclude .venv,contrib,ui,api,skills,mcp_server
-	uv run black --exclude "\.venv|api|ui|skills|mcp_server" --check .
-	uv run pylint --disable=W,C,R,E -j 0 -rn -sn prowler/
-
-format-api: ## Format & autofix API code (ruff)
-	cd api && uv run ruff check . --exclude contrib --fix
-	cd api && uv run ruff format . --exclude contrib
-
-lint-api: ## Lint API code (ruff check + format --check)
-	cd api && uv run ruff check . --exclude contrib
-	cd api && uv run ruff format --check . --exclude contrib
-
-format-mcp: ## Format & autofix MCP server code (ruff)
-	cd mcp_server && uv run ruff check . --fix
-	cd mcp_server && uv run ruff format .
-
-lint-mcp: ## Lint MCP server code (ruff check + format --check)
-	cd mcp_server && uv run ruff check .
-	cd mcp_server && uv run ruff format --check .
+lint: ## Lint Code
+	@echo "Running flake8..."
+	flake8 . --ignore=E266,W503,E203,E501,W605,E128 --exclude .venv,contrib
+	@echo "Running black... "
+	black --check .
+	@echo "Running pylint..."
+	pylint --disable=W,C,R,E -j 0 prowler util
 
 ##@ PyPI
 pypi-clean: ## Delete the distribution files

README.md

@@ -83,35 +83,16 @@ prowler dashboard
 
 ## Attack Paths
 
-Attack Paths automatically extends every completed AWS scan with a graph that combines Cartography's cloud inventory with Prowler findings. The feature runs in the API worker after each scan.
+Attack Paths automatically extends every completed AWS scan with a Neo4j graph that combines Cartography's cloud inventory with Prowler findings. The feature runs in the API worker after each scan and therefore requires:
 
-Two graph backends are supported as the long-lived sink:
+- An accessible Neo4j instance (the Docker Compose files already ships a `neo4j` service).
+- The following environment variables so Django and Celery can connect:
 
-- **Neo4j** (default; the Docker Compose files already ship a `neo4j` service).
-- **Amazon Neptune** (cloud-managed; opt-in).
-
-Select the sink with `ATTACK_PATHS_SINK_DATABASE` (`neo4j` or `neptune`; default `neo4j`).
-
-> Note: Cartography ingestion always uses a temporary Neo4j database, regardless of the configured sink. The `NEO4J_*` variables below must remain set even when `ATTACK_PATHS_SINK_DATABASE=neptune`.
-
-### Neo4j sink
-
-| Variable | Description | Default |
-| --- | --- | --- |
-| `NEO4J_HOST` | Hostname used by the API containers. | `neo4j` |
-| `NEO4J_PORT` | Bolt port exposed by Neo4j. | `7687` |
-| `NEO4J_USER` / `NEO4J_PASSWORD` | Credentials with rights to create per-tenant databases. | `neo4j` / `neo4j_password` |
-
-### Neptune sink
-
-| Variable | Description | Default |
-| --- | --- | --- |
-| `NEPTUNE_WRITER_ENDPOINT` | Bolt host for the Neptune writer instance. Required when sink is `neptune`. | _empty_ |
-| `NEPTUNE_READER_ENDPOINT` | Optional reader endpoint for read-only queries. Falls back to the writer when unset. | _empty_ |
-| `NEPTUNE_PORT` | Bolt port exposed by Neptune. | `8182` |
-| `AWS_REGION` | Region the Neptune cluster lives in. Required when sink is `neptune`. | _empty_ |
-
-Neptune authenticates with SigV4 using the standard boto3 credential chain. The worker's IAM role (or `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY`) supplies the credentials. There is no Neptune password variable.
+  | Variable | Description | Default |
+  | --- | --- | --- |
+  | `NEO4J_HOST` | Hostname used by the API containers. | `neo4j` |
+  | `NEO4J_PORT` | Bolt port exposed by Neo4j. | `7687` |
+  | `NEO4J_USER` / `NEO4J_PASSWORD` | Credentials with rights to create per-tenant databases. | `neo4j` / `neo4j_password` |
 
 Every AWS provider scan will enqueue an Attack Paths ingestion job automatically. Other cloud providers will be added in future iterations.
 
@@ -123,27 +104,26 @@ Every AWS provider scan will enqueue an Attack Paths ingestion job automatically
 
 | Provider | Checks | Services | [Compliance Frameworks](https://docs.prowler.com/projects/prowler-open-source/en/latest/tutorials/compliance/) | [Categories](https://docs.prowler.com/projects/prowler-open-source/en/latest/tutorials/misc/#categories) | Support | Interface |
 |---|---|---|---|---|---|---|
-| AWS | 615 | 86 | 47 | 19 | Official | UI, API, CLI |
-| Azure | 190 | 22 | 21 | 16 | Official | UI, API, CLI |
-| GCP | 109 | 20 | 19 | 12 | Official | UI, API, CLI |
-| Kubernetes | 90 | 7 | 8 | 11 | Official | UI, API, CLI |
-| GitHub | 24 | 3 | 2 | 5 | Official | UI, API, CLI |
-| M365 | 109 | 10 | 6 | 10 | Official | UI, API, CLI |
-| OCI | 52 | 14 | 5 | 10 | Official | UI, API, CLI |
-| Alibaba Cloud | 63 | 9 | 6 | 9 | Official | UI, API, CLI |
-| Cloudflare | 29 | 3 | 2 | 5 | Official | UI, API, CLI |
+| AWS | 600 | 84 | 44 | 18 | Official | UI, API, CLI |
+| Azure | 167 | 22 | 19 | 16 | Official | UI, API, CLI |
+| GCP | 102 | 18 | 17 | 12 | Official | UI, API, CLI |
+| Kubernetes | 83 | 7 | 7 | 11 | Official | UI, API, CLI |
+| GitHub | 24 | 3 | 1 | 5 | Official | UI, API, CLI |
+| M365 | 102 | 10 | 4 | 10 | Official | UI, API, CLI |
+| OCI | 51 | 14 | 4 | 10 | Official | UI, API, CLI |
+| Alibaba Cloud | 63 | 9 | 4 | 9 | Official | UI, API, CLI |
+| Cloudflare | 29 | 3 | 0 | 5 | Official | UI, API, CLI |
 | IaC | [See `trivy` docs.](https://trivy.dev/latest/docs/coverage/iac/) | N/A | N/A | N/A | Official | UI, API, CLI |
-| MongoDB Atlas | 10 | 3 | 1 | 8 | Official | UI, API, CLI |
+| MongoDB Atlas | 10 | 3 | 0 | 8 | Official | UI, API, CLI |
 | LLM | [See `promptfoo` docs.](https://www.promptfoo.dev/docs/red-team/plugins/) | N/A | N/A | N/A | Official | CLI |
 | Image | N/A | N/A | N/A | N/A | Official | CLI, API |
-| Google Workspace | 65 | 11 | 3 | 6 | Official | UI, API, CLI |
-| OpenStack | 34 | 5 | 1 | 9 | Official | UI, API, CLI |
-| Vercel | 26 | 6 | 1 | 8 | Official | UI, API, CLI |
-| Okta | 29 | 8 | 2 | 2 | Official | UI, API, CLI |
-| Linode [Contact us](https://prowler.com/contact) | 10 | 3 | 1 | 4 | Unofficial | CLI |
-| Scaleway [Contact us](https://prowler.com/contact) | 1 | 1 | 1 | 1 | Unofficial | CLI |
-| StackIT [Contact us](https://prowler.com/contact) | 7 | 2 | 1 | 3 | Unofficial | CLI |
-| NHN | 6 | 2 | 2 | 0 | Unofficial | CLI |
+| Google Workspace | 39 | 5 | 2 | 5 | Official | UI, API, CLI |
+| OpenStack | 34 | 5 | 0 | 9 | Official | UI, API, CLI |
+| Vercel | 26 | 6 | 0 | 8 | Official | UI, API, CLI |
+| Okta | 1 | 1 | 0 | 1 | Official | CLI |
+| Scaleway [Contact us](https://prowler.com/contact) | 1 | 1 | 0 | 1 | Unofficial | CLI |
+| StackIT [Contact us](https://prowler.com/contact) | 4 | 1 | 0 | 1 | Unofficial | CLI |
+| NHN | 6 | 2 | 1 | 0 | Unofficial | CLI |
 
 > [!Note]
 > The numbers in the table are updated periodically.
@@ -173,8 +153,6 @@ Prowler App offers flexible installation methods tailored to various environment
 
 #### Commands
 
-_macOS/Linux:_
-
 ``` console
 VERSION=$(curl -s https://api.github.com/repos/prowler-cloud/prowler/releases/latest | jq -r .tag_name)
 curl -sLO "https://raw.githubusercontent.com/prowler-cloud/prowler/refs/tags/${VERSION}/docker-compose.yml"
@@ -183,16 +161,6 @@ curl -sLO "https://raw.githubusercontent.com/prowler-cloud/prowler/refs/tags/${V
 docker compose up -d
 ```
 
-_Windows PowerShell:_
-
-``` powershell
-$VERSION = (Invoke-RestMethod -Uri "https://api.github.com/repos/prowler-cloud/prowler/releases/latest").tag_name
-Invoke-WebRequest -Uri "https://raw.githubusercontent.com/prowler-cloud/prowler/refs/tags/$VERSION/docker-compose.yml" -OutFile "docker-compose.yml"
-# Environment variables can be customized in the .env file. Using default values in production environments is not recommended.
-Invoke-WebRequest -Uri "https://raw.githubusercontent.com/prowler-cloud/prowler/refs/tags/$VERSION/.env" -OutFile ".env"
-docker compose up -d
-```
-
 > [!WARNING]
 > 🔒 For a secure setup, the API auto-generates a unique key pair, `DJANGO_TOKEN_SIGNING_KEY` and `DJANGO_TOKEN_VERIFYING_KEY`, and stores it in `~/.config/prowler-api` (non-container) or the bound Docker volume in `_data/api` (container). Never commit or reuse static/default keys. To rotate keys, delete the stored key files and restart the API.
 

api/.env.example

@@ -24,9 +24,6 @@ DJANGO_THROTTLE_TOKEN_OBTAIN=50/minute
 # Decide whether to allow Django manage database table partitions
 DJANGO_MANAGE_DB_PARTITIONS=[True|False]
 DJANGO_CELERY_DEADLOCK_ATTEMPTS=5
-# Optional: bound Celery's prefork pool size. Unset → Celery uses os.cpu_count().
-# Useful on Kubernetes nodes with many CPUs where unbounded prefork balloons memory.
-# DJANGO_CELERY_WORKER_CONCURRENCY=4
 DJANGO_BROKER_VISIBILITY_TIMEOUT=86400
 DJANGO_SENTRY_DSN=
 

api/CHANGELOG.md

@@ -2,183 +2,6 @@
 
 All notable changes to the **Prowler API** are documented in this file.
 
-<!-- changelog: release notes start -->
-
-## [1.34.2] (Prowler v5.33.2)
-
-### 🐞 Fixed
-
-- Attack Paths graph mutations now retry transient Neptune concurrency and deadline failures, while Neo4j mutations use managed transaction retries [(#11968)](https://github.com/prowler-cloud/prowler/pull/11968)
-- Attack Paths scans now use bounded child node identifiers for normalized list values in Neo4j and Neptune, preventing Neo4j RANGE index key size failures [(#11969)](https://github.com/prowler-cloud/prowler/pull/11969)
-- `scan-summary` aggregation now upserts summaries in deterministic conflict-key order, preventing PostgreSQL deadlocks during concurrent reaggregation [(#11971)](https://github.com/prowler-cloud/prowler/pull/11971)
-
----
-
-## [1.34.1] (Prowler v5.33.1)
-
-### 🐞 Fixed
-
-- Session tokens are rejected after account password updates [(#11914)](https://github.com/prowler-cloud/prowler/pull/11914)
-- Jira dispatch task results now surface user-facing Jira failure messages [(#11925)](https://github.com/prowler-cloud/prowler/pull/11925)
-- AWS Attack Paths privilege escalation queries no longer fail on Neo4j with `Aggregation column contains implicit grouping expressions` [(#11939)](https://github.com/prowler-cloud/prowler/pull/11939)
-
-### 🔐 Security
-
-- OpenAI-compatible Lighthouse provider base URLs are restricted before connection checks [(#11940)](https://github.com/prowler-cloud/prowler/pull/11940)
-- `LIGHTHOUSE_AI_OPENAI_COMPATIBLE_ALLOWED_HOSTS` environment variable to allow internal hosts as OpenAI-compatible Lighthouse AI base URLs [(#11942)](https://github.com/prowler-cloud/prowler/pull/11942)
-
----
-
-## [1.34.0] (Prowler v5.33.0)
-
-### 🚀 Added
-
-- Compliance PDF reports no longer require provider credentials: findings are enriched from the provider metadata stored in the database, so reports generate even after the provider secret is deleted or its credentials become invalid [(#11845)](https://github.com/prowler-cloud/prowler/pull/11845)
-
-### 🐞 Fixed
-
-- Provider scans now queue behind active provider scans instead of dispatching concurrently, and resource failed-finding counters retry database conflicts with stable row locking [(#11848)](https://github.com/prowler-cloud/prowler/pull/11848)
-
----
-
-## [1.33.1] (Prowler v5.32.1)
-
-### 🐞 Fixed
-
-- Attack Paths: Scan rows now have database defaults for `is_migrated` and `sink_backend` so `scan-perform-scheduled` inserts survive deploy skew [(#11826)](https://github.com/prowler-cloud/prowler/pull/11826)
-- Invited users now keep their invitation context when completing authentication with Google, GitHub, or SAML, so the invitation is accepted during login [(#11752)](https://github.com/prowler-cloud/prowler/pull/11752)
-
-### 🔐 Security
-
-- User profile updates now allow users to update their own account while requiring user-management permissions to update other users in the same tenant [(#11792)](https://github.com/prowler-cloud/prowler/pull/11792)
-- Kubernetes provider credentials now reject kubeconfigs using `exec` authentication in Prowler Cloud, preventing user-supplied commands from running on Cloud workers [(#11753)](https://github.com/prowler-cloud/prowler/pull/11753)
-
----
-
-## [1.33.0] (Prowler v5.32.0)
-
-### 🚀 Added
-
-- Timestamp precision support for `/api/v1/findings` `inserted_at` and `updated_at` filters [(#11754)](https://github.com/prowler-cloud/prowler/pull/11754)
-
-### 🔄 Changed
-
-- Attack Paths: AWS Neptune is now supported as a persistent sink database, selectable via `ATTACK_PATHS_SINK_DATABASE=neptune` (default `neo4j`), Cartography's (bumped to 0.138.1) per-scan ingest database stays on Neo4j [(#11524)](https://github.com/prowler-cloud/prowler/pull/11524)
-- Attack Paths: Scan task now checks the ingest Neo4j database and configured graph sink before starting graph ingestion [(#11743)](https://github.com/prowler-cloud/prowler/pull/11743)
-- Disable PowerShell telemetry in the API container image [(#11746)](https://github.com/prowler-cloud/prowler/pull/11746)
-
-### 🐞 Fixed
-
-- Attack Paths: Provider graph cleanup now deletes Neo4j and Neptune relationships in directed batches before deleting nodes [(#11755)](https://github.com/prowler-cloud/prowler/pull/11755)
-- `scan-perform` no longer reports an error when a provider is deleted during a running scan [(#11696)](https://github.com/prowler-cloud/prowler/pull/11696)
-
----
-
-## [1.32.1] (Prowler v5.31.1)
-
-### 🐞 Fixed
-
-- API key auth no longer mutates `TenantAPIKey.objects` during admin DB lookups [(#11686)](https://github.com/prowler-cloud/prowler/pull/11686)
-
----
-
-## [1.32.0] (Prowler v5.31.0)
-
-### 🚀 Added
-
-- Provider group filters for API endpoints that support cloud provider filtering, including exact and `__in` variants [(#11573)](https://github.com/prowler-cloud/prowler/pull/11573)
-- Provider filters for `GET /api/v1/compliance-overviews`, `/metadata`, and `/requirements`, using latest completed scans per matching provider [(#11587)](https://github.com/prowler-cloud/prowler/pull/11587)
-- Server-Sent Events (SSE) infrastructure for the API: a base viewset, a tenant-aware channel manager, and channel-name helpers backed by `django-eventstream` over Valkey Pub/Sub and served through the Gunicorn ASGI worker, so feature endpoints can stream events to clients over a single long-lived connection [(#11556)](https://github.com/prowler-cloud/prowler/pull/11556)
-- `DJANGO_CELERY_WORKER_CONCURRENCY` to configure Celery workers concurrency. Unset for default behaviour [(#11075)](https://github.com/prowler-cloud/prowler/pull/11075)
-
-### 🔄 Changed
-
-- Gunicorn worker timeout raised from the 30s default to 120s, so long-running requests are no longer killed prematurely [(#11631)](https://github.com/prowler-cloud/prowler/pull/11631)
-- Sentry now drops ASGI's `RequestAborted` errors from health-check probe disconnects on `/health/live` [(#11632)](https://github.com/prowler-cloud/prowler/pull/11632)
-- Gunicorn keep-alive timeout now exceeds the load balancer idle timeout, stopping 502s from reused connections [(#11647)](https://github.com/prowler-cloud/prowler/pull/11647)
-- API runs under the Uvicorn worker so keep-alive outlives the load balancer idle timeout, fixing Gunicorn's intermittent 502s [(#11663)](https://github.com/prowler-cloud/prowler/pull/11663)
-- SAML logins no longer wipe a user's roles when the IdP does not send the `userType` attribute; existing roles are kept, and when `userType` names a role that does not exist it is now created with read-only access (visibility over all providers, no management permissions) instead of no permissions at all [(#11520)](https://github.com/prowler-cloud/prowler/pull/11520)
-
-### 🐞 Fixed
-
-- Database connections no longer leak under the ASGI worker, which previously exhausted the read replica's connection slots and caused 500s on read endpoints [(#11640)](https://github.com/prowler-cloud/prowler/pull/11640)
-
-### 🔐 Security
-
-- `aiohttp` to 3.14.0 and `idna` to 3.15, patching known CVEs [(#11596)](https://github.com/prowler-cloud/prowler/pull/11596)
-- Container base image to `python:3.12.13-slim-bookworm` and `trivy` to 0.71.0, patching OS and Go module CVEs [(#11596)](https://github.com/prowler-cloud/prowler/pull/11596)
-- `trivy` binary bumped to 0.71.0 patching embedded `golang.org/x/crypto`, `golang.org/x/net`, and Go `stdlib` CVEs [(#11592)](https://github.com/prowler-cloud/prowler/pull/11592)
-
----
-
-## [1.31.3] (Prowler v5.30.3)
-
-### 🔐 Security
-
-- SAML logins now link to an existing account only when the asserted email domain matches the ACS endpoint and the user is already a member of that domain's tenant, fixing a cross-tenant account takeover [(GHSA-h8m9-jgf8-vwvp)](https://github.com/prowler-cloud/prowler/security/advisories/GHSA-h8m9-jgf8-vwvp)
-
----
-
-## [1.31.2] (Prowler v5.30.2)
-
-### 🔄 Changed
-
-- `scan-compliance-overviews` task now streams the findings aggregation and the requirement-row writes so it runs faster and its peak memory no longer grows with the number of regions and frameworks [(#11591)](https://github.com/prowler-cloud/prowler/pull/11591)
-
----
-
-## [1.31.1] (Prowler v5.30.1)
-
-### 🐞 Fixed
-
-- `compliance-overviews/attributes` now resolves the provider from the scan, so multi-provider universal frameworks (e.g. CSA CCM) return the check IDs of the scan's provider and Azure/GCP requirement details show their findings instead of appearing empty [(#11546)](https://github.com/prowler-cloud/prowler/pull/11546)
-- Attack Paths: `drop_subgraph` now deletes relationships first and then nodes in batches, using less memory on Neo4j when clearing a dense provider graph [(#11557)](https://github.com/prowler-cloud/prowler/pull/11557)
-- OCI scans now use API key credentials with the configured region instead of falling back to `/home/prowler/.oci/config` [(#11558)](https://github.com/prowler-cloud/prowler/pull/11558)
-
----
-
-## [1.31.0] (Prowler v5.30.0)
-
-### 🚀 Added
-
-- Opt-in automatic recovery of allowlisted idempotent background tasks whose worker died during a deploy or crash: when enabled via `DJANGO_TASK_RECOVERY_ENABLED` (off by default), stuck summary and deletion tasks are detected and re-run instead of staying pending forever (scan and Jira tasks are excluded), with a `reconcile_orphan_tasks` management command for on-demand recovery [(#11416)](https://github.com/prowler-cloud/prowler/pull/11416)
-- DORA compliance framework support [(#11131)](https://github.com/prowler-cloud/prowler/pull/11131)
-- Label Postgres connections with `application_name="<component>:<alias>"` (component injected per process via `DJANGO_APP_COMPONENT`) so connections are attributable by component in `pg_stat_activity` [(#11494)](https://github.com/prowler-cloud/prowler/pull/11494)
-- DISA Okta IDaaS STIG V1R2 compliance framework export support for the Okta provider [(#11428)](https://github.com/prowler-cloud/prowler/pull/11428)
-
-### 🔄 Changed
-
-- Allowlisted idempotent background tasks are no longer lost when a worker is stopped or crashes mid-task; tasks with external side effects are marked terminal instead of blindly re-running [(#11416)](https://github.com/prowler-cloud/prowler/pull/11416)
-
-### 🐞 Fixed
-
-- Workers now shut down gracefully on deploy or restart, finishing or re-queueing in-flight tasks instead of being force-killed and leaving them stuck [(#11416)](https://github.com/prowler-cloud/prowler/pull/11416)
-- Resource `name` is now stored and refreshed on every scan, so resources no longer keep an empty name [(#11476)](https://github.com/prowler-cloud/prowler/pull/11476)
-- Compliance catalog now warms in background during startup. `compliance-overviews/attributes` returns `503` while warming, so the first request after a deploy no longer trips the API timeout [(#11530)](https://github.com/prowler-cloud/prowler/pull/11530)
-
-### 🔐 Security
-
-- `dulwich` from 0.23.0 to 1.2.5 and `pyjwt` from 2.12.1 to 2.13.0, patching `GHSA-897w-fcg9-f6xj` (arbitrary file write) and `PYSEC-2026-179` (HMAC/JWK key confusion) [(#11499)](https://github.com/prowler-cloud/prowler/pull/11499)
-
----
-
-## [1.30.3] (Prowler v5.29.3)
-
-### 🐞 Fixed
-
-- API startup no longer crashes when Neo4j is unreachable, as the Neo4j driver now connects lazily on first use rather than during app initialization [(#11491)](https://github.com/prowler-cloud/prowler/pull/11491)
-
----
-
-## [1.30.1] (Prowler v5.29.1)
-
-### 🐞 Fixed
-
-- `GET /api/v1/findings` N+1 query loading `resources__tags` when listing findings [(#11420)](https://github.com/prowler-cloud/prowler/pull/11420)
-- Clean up the scan tmp output directory when `scan-report` fails so partial files do not accumulate and fill the worker disk (`No space left on device`) [(#11421)](https://github.com/prowler-cloud/prowler/pull/11421)
-
----
-
 ## [1.30.0] (Prowler v5.29.0)
 
 ### 🔄 Changed

api/Dockerfile

@@ -1,13 +1,11 @@
-FROM python:3.12.13-slim-bookworm@sha256:8a7e7cc04fd3e2bd787f7f24e22d5d119aa590d429b50c95dfe12b3abe52f48b AS build
+FROM python:3.12.10-slim-bookworm@sha256:fd95fa221297a88e1cf49c55ec1828edd7c5a428187e67b5d1805692d11588db AS build
 
 LABEL maintainer="https://github.com/prowler-cloud/api"
 
 ARG POWERSHELL_VERSION=7.5.0
 ENV POWERSHELL_VERSION=${POWERSHELL_VERSION}
-# Opt out of PowerShell telemetry (Application Insights -> dc.services.visualstudio.com)
-ENV POWERSHELL_TELEMETRY_OPTOUT=1
 
-ARG TRIVY_VERSION=0.71.2
+ARG TRIVY_VERSION=0.70.0
 ENV TRIVY_VERSION=${TRIVY_VERSION}
 
 ARG ZIZMOR_VERSION=1.24.1
@@ -104,23 +102,6 @@ RUN uv sync --locked --no-install-project && \
 
 RUN .venv/bin/python .venv/lib/python3.12/site-packages/prowler/providers/m365/lib/powershell/m365_powershell.py
 
-USER root
-
-# Remove build-only packages from the final image after Python dependencies are installed.
-RUN apt-get purge -y --auto-remove \
-    gcc \
-    g++ \
-    make \
-    libxml2-dev \
-    libxmlsec1-dev \
-    pkg-config \
-    libtool \
-    libxslt1-dev \
-    python3-dev \
-    && rm -rf /var/lib/apt/lists/*
-
-USER prowler
-
 COPY --chown=prowler:prowler src/backend/ ./backend/
 COPY --chown=prowler:prowler docker-entrypoint.sh ./docker-entrypoint.sh
 

api/README.md

@@ -196,42 +196,6 @@ python -m celery -A config.celery worker -l info -E
 
 The Celery worker does not detect and reload changes in the code, so you need to restart it manually when you make changes.
 
-### Makefile-Assisted Local Deployment
-
-This method is an additional local development workflow. It does not replace the manual local deployment or the Docker deployment described in this guide.
-
-PostgreSQL, Valkey, and Neo4j run with Docker Compose, while Django and the Celery worker run natively through `uv`. Additionally, this workflow creates a `tmux` session with panes for the API, worker, and PostgreSQL logs.
-
-Before using this method, ensure `docker compose`, `tmux`, and `uv` are installed.
-
-This workflow is designed for macOS and should also work on Linux when Docker, `tmux`, and `uv` are available. Windows requires script changes before it can be supported.
-
-From the repository root, run:
-
-```console
-make dev
-```
-
-The API will be available at:
-
-```console
-http://localhost:8080/api/v1
-```
-
-Use these commands to manage the local stack:
-
-```console
-make dev-setup   # Bootstrap dependencies, migrations, and fixtures
-make dev-attach  # Attach to the tmux session
-make dev-launch  # Start the stack on fixed ports and attach
-make dev-stop    # Stop the tmux session and containers
-make dev-clean   # Remove stopped development containers
-make dev-wipe    # Stop everything and delete local development data
-make dev-status  # Show development container status
-```
-
-This workflow does not start the UI. Start it separately from the `ui/` directory when needed.
-
 ### Docker deployment
 
 This method requires `docker` and `docker compose`.

api/changelog.d/README.md

@@ -1,10 +0,0 @@
-# Changelog fragments
-
-Each PR adds one small file here instead of editing `CHANGELOG.md` directly, so concurrent PRs never conflict.
-
-- Filename: `<slug>.<type>.md`, e.g. `my-new-check.added.md` (slug is free-form: letters, digits, `.`, `_`, `-`)
-- `<type>` is one of: `added`, `changed`, `deprecated`, `removed`, `fixed`, `security`
-- Content: one line with the changelog entry text, without the PR link and without a trailing period (the PR link is attached automatically at release time)
-- A PR adds as many fragment files as entries it needs, freely mixing types (one file per entry); same-type entries just use different slugs
-
-Fragments are compiled into `CHANGELOG.md` when a release is prepared. Full conventions: `skills/prowler-changelog/SKILL.md`.

api/docker-entrypoint.sh

@@ -21,19 +21,13 @@ apply_fixtures() {
 }
 
 start_dev_server() {
-  echo "Starting the development server (Gunicorn ASGI, debug + reload)..."
-  # Same server/worker as prod (config.asgi via the native `asgi` worker), so
-  # SSE streams run on the event loop exactly as they do in production. DEBUG is
-  # on so guniconf's `reload = DEBUG` hot-reloads edited code (and flips
-  # `preload_app` off so reload actually takes).
-  export DJANGO_DEBUG="${DJANGO_DEBUG:-True}"
-  export DJANGO_BIND_ADDRESS="${DJANGO_BIND_ADDRESS:-0.0.0.0}"
-  exec uv run gunicorn -c config/guniconf.py config.asgi:application
+  echo "Starting the development server..."
+  uv run python manage.py runserver 0.0.0.0:"${DJANGO_PORT:-8080}"
 }
 
 start_prod_server() {
   echo "Starting the Gunicorn server..."
-  exec uv run gunicorn -c config/guniconf.py config.asgi:application
+  uv run gunicorn -c config/guniconf.py config.wsgi:application
 }
 
 resolve_worker_hostname() {
@@ -53,7 +47,7 @@ resolve_worker_hostname() {
 
 start_worker() {
   echo "Starting the worker..."
-  exec uv run python -m celery -A config.celery worker \
+  uv run python -m celery -A config.celery worker \
     -n "$(resolve_worker_hostname)" \
     -l "${DJANGO_LOGGING_LEVEL:-info}" \
     -Q celery,scans,scan-reports,deletion,backfill,overview,integrations,compliance,attack-paths-scans \
@@ -62,7 +56,7 @@ start_worker() {
 
 start_worker_beat() {
   echo "Starting the worker-beat..."
-  exec uv run python -m celery -A config.celery beat -l "${DJANGO_LOGGING_LEVEL:-info}" --scheduler django_celery_beat.schedulers:DatabaseScheduler
+  uv run python -m celery -A config.celery beat -l "${DJANGO_LOGGING_LEVEL:-info}" --scheduler django_celery_beat.schedulers:DatabaseScheduler
 }
 
 manage_db_partitions() {
@@ -74,15 +68,6 @@ manage_db_partitions() {
   fi
 }
 
-# Identify this process to Postgres (application_name=<component>:<alias>) so
-# connections are attributable by component in pg_stat_activity. Web tiers
-# report "api"; everything else uses the launch subcommand.
-case "$1" in
-  prod|dev) DJANGO_APP_COMPONENT="api" ;;
-  *)        DJANGO_APP_COMPONENT="$1" ;;
-esac
-export DJANGO_APP_COMPONENT
-
 case "$1" in
   dev)
     apply_migrations

api/docs/orphan-task-recovery.md

@@ -1,106 +0,0 @@
-# Orphan Celery task recovery
-
-When a worker is terminated mid-task (a deploy, an OOM kill, a node eviction), the
-task it was running can be left non-terminal forever: the `TaskResult` stays
-`STARTED` and nothing re-runs it. This page describes the mechanisms that detect and
-recover allowlisted idempotent orphans so pending-task alerts do not fire. Scan tasks
-are not auto-recovered (re-running a scan is not safe to do automatically); the
-watchdog covers the summary/aggregation and deletion tasks.
-
-## How recovery works
-
-1. **Durable delivery.** The broker is configured so a task message is acknowledged
-   only after the task finishes (`task_acks_late`), one task is reserved at a time
-   (`worker_prefetch_multiplier = 1`), and an abruptly-lost worker re-queues its task
-   (`task_reject_on_worker_lost`). On `SIGTERM` the worker is given a soft-shutdown
-   window (`worker_soft_shutdown_timeout`) to finish or re-queue in-flight work
-   before it is force-killed. `scan-perform`, `scan-perform-scheduled` and
-   `integration-jira` opt out of redelivery with `acks_late=False`, so a crash drops
-   them rather than re-running and duplicating findings or Jira issues. Other
-   non-recovered side-effect tasks keep `acks_late=True`, so the broker can still
-   re-deliver them after a worker loss: the S3 upload rebuilds from worker-local files
-   that did not survive the crash and so no-ops, but Security Hub re-reads findings from
-   the DB and re-sends them to AWS.
-
-2. **Periodic watchdog.** A Beat task, `reconcile-orphan-tasks`, runs every couple of
-   minutes (a `django_celery_beat` periodic task created by migration). For each
-   in-flight task result with an allowlisted idempotent task name, it pings the
-   worker recorded on the task's `TaskResult`:
-   - worker responds -> the task is still running, leave it alone;
-   - worker is gone (and the task started before a short grace window) -> it is a
-     real orphan: the stale task is revoked and marked terminal (clearing the
-     pending/started alert), and the task is re-enqueued from its stored name and
-     kwargs.
-
-   The re-run is safe because only tasks with proven idempotency are allowlisted: the
-   summary/aggregation tasks clear and re-write their own rows, and deletions are
-   idempotent. Scan tasks and external side effects are excluded: re-running a scan is
-   not safe to do automatically, Jira sends would create duplicate issues, the S3
-   upload rebuilds from worker-local files that do not survive a crash, and
-   report/Security Hub recovery is out of scope.
-
-3. **Recovery cap.** A per-task Valkey counter limits how often the same task is
-   re-enqueued. After `--max-attempts` recoveries (default 3) the orphan is marked
-   terminal instead of re-enqueued, so a task that repeatedly kills its worker cannot
-   loop forever.
-
-A Postgres advisory lock ensures that, even with multiple API/worker replicas, only
-one reconciliation runs at a time; the others no-op.
-
-## On-demand command
-
-The same logic is available as a management command, useful right after a deploy or
-for manual intervention:
-
-```bash
-python manage.py reconcile_orphan_tasks            # recover now
-python manage.py reconcile_orphan_tasks --dry-run  # report orphans, change nothing
-python manage.py reconcile_orphan_tasks --grace-minutes 5 --max-attempts 3
-```
-
-## Configuration
-
-All settings have safe defaults; override via environment variables.
-
-| Env var | Default | Purpose |
-| --- | --- | --- |
-| `DJANGO_CELERY_WORKER_PREFETCH_MULTIPLIER` | `1` | Tasks reserved per worker process. |
-| `DJANGO_CELERY_WORKER_CONCURRENCY` | unset | Optional Celery prefork pool size. When unset, Celery uses its CPU-based default. Set this on worker containers to bound idle memory on hosts with many CPUs. |
-| `DJANGO_CELERY_WORKER_SOFT_SHUTDOWN_TIMEOUT` | `60` | Seconds the worker drains/re-queues on `SIGTERM` before force-kill. |
-| `DJANGO_CELERY_TASK_TIME_LIMIT` | `21600` (6h) | Hard limit for most tasks; connection checks are capped at 120s. |
-| `DJANGO_CELERY_TASK_SOFT_TIME_LIMIT` | hard - 600 | Soft limit; raises `SoftTimeLimitExceeded` for cleanup. |
-| `DJANGO_CELERY_LONG_TASK_TIME_LIMIT` | `172800` (48h) | Hard limit for scans and provider/tenant deletions, which can legitimately run for more than a day. |
-| `DJANGO_CELERY_LONG_TASK_SOFT_TIME_LIMIT` | long hard - 600 | Soft limit for the long-running tasks above. |
-| `DJANGO_TASK_RECOVERY_ENABLED` | `false` | Master switch for orphan-task recovery, disabled by default (opt-in); set to `true` to enable. When off, no orphan is detected, marked terminal, or re-enqueued (attack-paths stale cleanup still runs). |
-| `DJANGO_TASK_RECOVERY_SUMMARIES_ENABLED` | `true` | Auto re-enqueue orphaned scan summary/aggregation tasks. |
-| `DJANGO_TASK_RECOVERY_DELETIONS_ENABLED` | `true` | Auto re-enqueue orphaned provider/tenant deletion tasks. |
-
-Recovery is opt-in: with the master flag off (the default) the sweep does nothing.
-Once enabled, the per-group flags default to on, so every group recovers unless you
-turn one off; a task whose group flag is off is marked terminal instead of
-re-enqueued.
-
-Turning recovery off only disables this watchdog sweep; it does not change Celery's
-broker-level redelivery (`task_acks_late`/`task_reject_on_worker_lost`), which still
-re-delivers tasks that keep `acks_late=True` on worker loss, independently of this flag.
-
-`task_acks_late` and `task_reject_on_worker_lost` are enabled in `config/celery.py`.
-
-## Deployment requirement
-
-Two conditions must both hold for the soft shutdown to actually drain work:
-
-1. **The worker must receive `SIGTERM`.** The container entrypoint `exec`s the
-   Celery process so it runs as PID 1; otherwise `SIGTERM` from `docker stop`/ECS
-   hits the entrypoint shell, never reaches Celery, and the worker is hard-killed
-   (SIGKILL) at the grace deadline without draining. Custom entrypoints must
-   preserve the `exec`.
-2. **The orchestrator must give the worker enough time** before force-killing it.
-   Set the stop grace period to exceed `DJANGO_CELERY_WORKER_SOFT_SHUTDOWN_TIMEOUT`
-   plus a margin:
-   - **docker-compose:** `stop_grace_period` on the worker services (set to `120s`).
-   - **AWS ECS:** the worker container `stopTimeout` (configured in the deployment
-     repository).
-
-If either condition is missing, long tasks are still recovered by the watchdog,
-but they are cut mid-run on every deploy instead of draining.

api/pyproject.toml

@@ -14,7 +14,7 @@ dev = [
   "pytest-env==1.1.3",
   "pytest-randomly==3.15.0",
   "pytest-xdist==3.6.1",
-  "ruff==0.15.11",
+  "ruff==0.5.0",
   "tqdm==4.67.1",
   "vulture==2.14",
   "prek==0.3.9"
@@ -41,11 +41,9 @@ dependencies = [
   "drf-spectacular==0.27.2",
   "drf-spectacular-jsonapi==0.5.1",
   "defusedxml==0.7.1",
-  "django-eventstream==5.3.3",
-  "gunicorn==26.0.0",
-  "uvloop==0.22.1",
+  "gunicorn==23.0.0",
   "lxml==6.1.0",
-  "prowler @ git+https://github.com/prowler-cloud/prowler.git@v5.33",
+  "prowler @ git+https://github.com/prowler-cloud/prowler.git@v5.29",
   "psycopg2-binary==2.9.9",
   "pytest-celery[redis] (==1.3.0)",
   "sentry-sdk[django] (==2.56.0)",
@@ -58,12 +56,11 @@ dependencies = [
   "matplotlib (==3.10.8)",
   "reportlab (==4.4.10)",
   "neo4j (==6.1.0)",
-  "cartography (==0.138.1)",
+  "cartography (==0.135.0)",
   "gevent (==25.9.1)",
   "werkzeug (==3.1.7)",
   "sqlparse (==0.5.5)",
-  "fonttools (==4.62.1)",
-  "uvicorn-worker (==0.4.0)",
+  "fonttools (==4.62.1)"
 ]
 description = "Prowler's API (Django/DRF)"
 license = "Apache-2.0"
@@ -71,24 +68,7 @@ name = "prowler-api"
 package-mode = false
 # Needed for the SDK compatibility
 requires-python = ">=3.11,<3.13"
-version = "1.34.2"
-
-# Shared ruff baseline (kept in sync with mcp_server/pyproject.toml).
-# target-version tracks this project's lowest supported Python.
-[tool.ruff]
-src = ["src"]
-target-version = "py311"
-
-[tool.ruff.lint]
-# Defaults (E4/E7/E9, F) plus import sorting, modern-syntax upgrades, and
-# comprehension lints — all mechanically auto-fixable. flake8-bugbear (B) is a
-# good next step but needs manual cleanup (e.g. B904 raise-from), so it is left
-# out of the shared baseline for now.
-extend-select = [
-  "I",  # isort — import ordering (prek's isort hook covers only the SDK)
-  "UP",  # pyupgrade — modern syntax for the min supported Python
-  "C4"  # flake8-comprehensions
-]
+version = "1.30.0"
 
 [tool.uv]
 # Transitive pins matching master to avoid silent drift; bump deliberately.
@@ -99,7 +79,7 @@ constraint-dependencies = [
   "aiobotocore==2.25.1",
   "aiofiles==24.1.0",
   "aiohappyeyeballs==2.6.1",
-  "aiohttp==3.14.0",
+  "aiohttp==3.13.5",
   "aioitertools==0.13.0",
   "aiosignal==1.4.0",
   "alibabacloud-actiontrail20200706==2.4.1",
@@ -144,8 +124,9 @@ constraint-dependencies = [
   "astroid==3.2.4",
   "async-timeout==5.0.1",
   "attrs==25.4.0",
-  "authlib==1.6.12",
+  "authlib==1.6.9",
   "autopep8==2.3.2",
+  "awsipranges==0.3.3",
   "azure-cli-core==2.83.0",
   "azure-cli-telemetry==1.1.0",
   "azure-common==1.1.28",
@@ -193,7 +174,7 @@ constraint-dependencies = [
   "blinker==1.9.0",
   "boto3==1.40.61",
   "botocore==1.40.61",
-  "cartography==0.138.1",
+  "cartography==0.135.0",
   "celery==5.6.2",
   "certifi==2026.1.4",
   "cffi==2.0.0",
@@ -218,6 +199,7 @@ constraint-dependencies = [
   "debugpy==1.8.20",
   "decorator==5.2.1",
   "defusedxml==0.7.1",
+  "detect-secrets==1.5.0",
   "dill==0.4.1",
   "distro==1.9.0",
   "dj-rest-auth==7.0.1",
@@ -227,7 +209,6 @@ constraint-dependencies = [
   "django-celery-results==2.6.0",
   "django-cors-headers==4.4.0",
   "django-environ==0.11.2",
-  "django-eventstream==5.3.3",
   "django-filter==24.3",
   "django-guid==3.5.0",
   "django-postgres-extra==2.0.9",
@@ -245,7 +226,7 @@ constraint-dependencies = [
   "drf-simple-apikey==2.2.1",
   "drf-spectacular==0.27.2",
   "drf-spectacular-jsonapi==0.5.1",
-  "dulwich==1.2.5",
+  "dulwich==0.23.0",
   "duo-client==5.5.0",
   "durationpy==0.10",
   "email-validator==2.2.0",
@@ -272,7 +253,7 @@ constraint-dependencies = [
   "grpc-google-iam-v1==0.14.3",
   "grpcio==1.76.0",
   "grpcio-status==1.76.0",
-  "gunicorn==26.0.0",
+  "gunicorn==23.0.0",
   "h11==0.16.0",
   "h2==4.3.0",
   "hpack==4.1.0",
@@ -281,8 +262,8 @@ constraint-dependencies = [
   "httpx==0.28.1",
   "humanfriendly==10.0",
   "hyperframe==6.1.0",
-  "iamdata==0.1.202605131",
-  "idna==3.15",
+  "iamdata==0.1.202602021",
+  "idna==3.11",
   "importlib-metadata==8.7.1",
   "inflection==0.5.1",
   "iniconfig==2.3.0",
@@ -300,7 +281,6 @@ constraint-dependencies = [
   "jsonschema==4.23.0",
   "jsonschema-specifications==2025.9.1",
   "keystoneauth1==5.13.0",
-  "kingfisher-bin==1.104.0",
   "kiwisolver==1.4.9",
   "knack==0.11.0",
   "kombu==5.6.2",
@@ -335,7 +315,7 @@ constraint-dependencies = [
   "neo4j==6.1.0",
   "nest-asyncio==1.6.0",
   "nltk==3.9.4",
-  "numpy==2.2.6",
+  "numpy==2.0.2",
   "oauthlib==3.3.1",
   "oci==2.169.0",
   "openai==1.109.1",
@@ -364,7 +344,7 @@ constraint-dependencies = [
   "psutil==7.2.2",
   "psycopg2-binary==2.9.9",
   "py-deviceid==0.1.1",
-  "py-iam-expand==0.3.0",
+  "py-iam-expand==0.1.0",
   "py-ocsf-models==0.8.1",
   "pyasn1==0.6.3",
   "pyasn1-modules==0.4.2",
@@ -374,7 +354,7 @@ constraint-dependencies = [
   "pydantic-core==2.41.5",
   "pygithub==2.8.0",
   "pygments==2.20.0",
-  "pyjwt==2.13.0",
+  "pyjwt==2.12.1",
   "pylint==3.2.5",
   "pymsalruntime==0.18.1",
   "pynacl==1.6.2",
@@ -410,7 +390,7 @@ constraint-dependencies = [
   "rpds-py==0.30.0",
   "rsa==4.9.1",
   "ruamel-yaml==0.19.1",
-  "ruff==0.15.11",
+  "ruff==0.5.0",
   "s3transfer==0.14.0",
   "scaleway==2.10.3",
   "scaleway-core==2.10.3",
@@ -440,14 +420,12 @@ constraint-dependencies = [
   "uritemplate==4.2.0",
   "urllib3==2.7.0",
   "uuid6==2024.7.10",
-  "uvicorn==0.49.0",
-  "uvloop==0.22.1",
   "vine==5.1.0",
   "vulture==2.14",
   "wcwidth==0.5.3",
   "websocket-client==1.9.0",
   "werkzeug==3.1.7",
-  "workos==6.0.8",
+  "workos==6.0.4",
   "wrapt==1.17.3",
   "xlsxwriter==3.2.9",
   "xmlsec==1.3.17",
@@ -458,30 +436,14 @@ constraint-dependencies = [
   "zope-interface==8.2",
   "zstd==1.5.7.3"
 ]
-# prowler@master needs okta==3.4.2, but cartography 0.138.1 requires okta<1.0.0.
-# Attack Paths does not ingest Okta today, so override the Cartography
-# dependency to the Prowler pin.
-#
-# prowler@master needs azure-mgmt-containerservice==34.1.0, but cartography
-# 0.138.1 requires azure-mgmt-containerservice>=41.0.0. Attack Paths does not
-# ingest Azure today, so override the Cartography dependency to the Prowler pin.
+# prowler@master needs okta==3.4.2; cartography 0.135.0 declares okta<1.0.0 for an
+# integration prowler does not import.
 #
 # prowler@master hard-pins microsoft-kiota-abstractions==1.9.2 in [project.dependencies].
 # The microsoft-kiota-http security bump to 1.9.9 (GHSA-7j59-v9qr-6fq9) requires
 # microsoft-kiota-abstractions>=1.9.9, which a constraint cannot satisfy against the
 # SDK's hard pin; override it to the patched, kiota-aligned version.
-#
-# prowler@master hard-pins dulwich==0.23.0 and pyjwt==2.12.1 in [project.dependencies].
-# dulwich 1.2.5 patches GHSA-897w-fcg9-f6xj (arbitrary file write) and pyjwt 2.13.0
-# patches PYSEC-2026-179 (HMAC/JWK key-confusion); a constraint cannot satisfy these
-# against the SDK's hard pins, so override them to the patched versions until the SDK
-# bump propagates to the pinned master rev. pyjwt keeps the [crypto] extra because an
-# override replaces the whole requirement; bare pyjwt would drop it from the consumers
-# that request pyjwt[crypto] and leave cryptography (needed for RS256) only transitive.
 override-dependencies = [
   "okta==3.4.2",
-  "azure-mgmt-containerservice==34.1.0",
-  "microsoft-kiota-abstractions==1.9.9",
-  "dulwich==1.2.5",
-  "pyjwt[crypto]==2.13.0"
+  "microsoft-kiota-abstractions==1.9.9"
 ]

api/src/backend/api/adapters.py

@@ -1,16 +1,9 @@
 from allauth.socialaccount.adapter import DefaultSocialAccountAdapter
+from django.db import transaction
+
 from api.db_router import MainRouter
 from api.db_utils import rls_transaction
-from api.models import (
-    Membership,
-    Role,
-    SAMLConfiguration,
-    Tenant,
-    User,
-    UserRoleRelationship,
-)
-from api.utils import accept_invitation_for_user
-from django.db import transaction
+from api.models import Membership, Role, Tenant, User, UserRoleRelationship
 
 
 class ProwlerSocialAccountAdapter(DefaultSocialAccountAdapter):
@@ -21,62 +14,11 @@ class ProwlerSocialAccountAdapter(DefaultSocialAccountAdapter):
         except User.DoesNotExist:
             return None
 
-    @staticmethod
-    def _get_invitation_token(request):
-        for source_name in ("data", "POST"):
-            data = getattr(request, source_name, None) or {}
-            if not hasattr(data, "get"):
-                continue
-            invitation_token = data.get("invitation_token")
-            if invitation_token:
-                return invitation_token
-
-        wrapped_request = getattr(request, "_request", None)
-        if wrapped_request and wrapped_request is not request:
-            return ProwlerSocialAccountAdapter._get_invitation_token(wrapped_request)
-
-        return None
-
     def pre_social_login(self, request, sociallogin):
         # Link existing accounts with the same email address
         email = sociallogin.account.extra_data.get("email")
         if sociallogin.provider.id == "saml":
-            # For SAML, the asserted NameID email cannot be trusted on its own:
-            # any tenant can claim any email domain in its SAML configuration. To
-            # prevent cross-tenant account takeover (GHSA-h8m9-jgf8-vwvp), only link
-            # the incoming SAML session to an existing account when (1) the email
-            # domain matches the tenant whose ACS endpoint is being used and (2) the
-            # existing user is already a member of that tenant.
             email = sociallogin.user.email
-            if not email:
-                return
-
-            domain = email.rsplit("@", 1)[-1].lower()
-            resolver_match = getattr(request, "resolver_match", None)
-            organization_slug = (
-                (resolver_match.kwargs or {}).get("organization_slug", "")
-                if resolver_match
-                else ""
-            ).lower()
-            # The ACS endpoint is scoped per email domain; reject mismatches so an
-            # attacker cannot replay an assertion through another tenant's endpoint.
-            if organization_slug != domain:
-                return
-
-            try:
-                saml_config = SAMLConfiguration.objects.using(MainRouter.admin_db).get(
-                    email_domain=domain
-                )
-            except SAMLConfiguration.DoesNotExist:
-                return
-
-            existing_user = self.get_user_by_email(email)
-            if existing_user and existing_user.is_member_of_tenant(
-                str(saml_config.tenant_id)
-            ):
-                sociallogin.connect(request, existing_user)
-            return
-
         if email:
             existing_user = self.get_user_by_email(email)
             if existing_user:
@@ -100,38 +42,29 @@ class ProwlerSocialAccountAdapter(DefaultSocialAccountAdapter):
                     user.name = social_account_name
                     user.save(using=MainRouter.admin_db)
 
-                invitation_token = self._get_invitation_token(request)
-                if invitation_token:
-                    invitation, _ = accept_invitation_for_user(
+                tenant = Tenant.objects.using(MainRouter.admin_db).create(
+                    name=f"{user.email.split('@')[0]} default tenant"
+                )
+                with rls_transaction(str(tenant.id)):
+                    Membership.objects.using(MainRouter.admin_db).create(
+                        user=user, tenant=tenant, role=Membership.RoleChoices.OWNER
+                    )
+                    role = Role.objects.using(MainRouter.admin_db).create(
+                        name="admin",
+                        tenant_id=tenant.id,
+                        manage_users=True,
+                        manage_account=True,
+                        manage_billing=True,
+                        manage_providers=True,
+                        manage_integrations=True,
+                        manage_scans=True,
+                        unlimited_visibility=True,
+                    )
+                    UserRoleRelationship.objects.using(MainRouter.admin_db).create(
                         user=user,
-                        invitation_token=invitation_token,
+                        role=role,
+                        tenant_id=tenant.id,
                     )
-                    request.prowler_invitation_token = invitation_token
-                    request.prowler_invitation_tenant_id = str(invitation.tenant_id)
-                else:
-                    tenant = Tenant.objects.using(MainRouter.admin_db).create(
-                        name=f"{user.email.split('@')[0]} default tenant"
-                    )
-                    with rls_transaction(str(tenant.id)):
-                        Membership.objects.using(MainRouter.admin_db).create(
-                            user=user, tenant=tenant, role=Membership.RoleChoices.OWNER
-                        )
-                        role = Role.objects.using(MainRouter.admin_db).create(
-                            name="admin",
-                            tenant_id=tenant.id,
-                            manage_users=True,
-                            manage_account=True,
-                            manage_billing=True,
-                            manage_providers=True,
-                            manage_integrations=True,
-                            manage_scans=True,
-                            unlimited_visibility=True,
-                        )
-                        UserRoleRelationship.objects.using(MainRouter.admin_db).create(
-                            user=user,
-                            role=role,
-                            tenant_id=tenant.id,
-                        )
             else:
                 request.session["saml_user_created"] = str(user.id)
 

api/src/backend/api/apps.py

@@ -28,10 +28,9 @@ class ApiConfig(AppConfig):
     name = "api"
 
     def ready(self):
-        from api import (
-            schema_extensions,  # noqa: F401
-            signals,  # noqa: F401
-        )
+        from api import schema_extensions  # noqa: F401
+        from api import signals  # noqa: F401
+        from api.attack_paths import database as graph_database
 
         # Generate required cryptographic keys if not present, but only if:
         #   `"manage.py" not in sys.argv[0]`: If an external server (e.g., Gunicorn) is running the app
@@ -42,6 +41,38 @@ class ApiConfig(AppConfig):
         ):
             self._ensure_crypto_keys()
 
+        # Commands that don't need Neo4j
+        SKIP_NEO4J_DJANGO_COMMANDS = [
+            "makemigrations",
+            "migrate",
+            "pgpartition",
+            "check",
+            "help",
+            "showmigrations",
+            "check_and_fix_socialaccount_sites_migration",
+        ]
+
+        # Skip eager Neo4j init for tests, some Django commands, and Celery (prefork pool: driver must stay lazy, no post_fork hook)
+        if getattr(settings, "TESTING", False) or (
+            len(sys.argv) > 1
+            and (
+                (
+                    "manage.py" in sys.argv[0]
+                    and sys.argv[1] in SKIP_NEO4J_DJANGO_COMMANDS
+                )
+                or "celery" in sys.argv[0]
+            )
+        ):
+            logger.info(
+                "Skipping eager Neo4j init: tests, some Django commands, or Celery prefork pool (driver stays lazy)"
+            )
+
+        else:
+            graph_database.init_driver()
+
+        # Neo4j driver is initialized at API startup (see api.attack_paths.database)
+        # It remains lazy for Celery workers and selected Django commands
+
     def _ensure_crypto_keys(self):
         """
         Orchestrator method that ensures all required cryptographic keys are present.

api/src/backend/api/attack_paths/__init__.py

@@ -5,6 +5,7 @@ from api.attack_paths.queries import (
     get_query_by_id,
 )
 
+
 __all__ = [
     "AttackPathsQueryDefinition",
     "AttackPathsQueryParameterDefinition",

api/src/backend/api/attack_paths/cypher_sanitizer.py

@@ -4,10 +4,10 @@ Cypher sanitizer for custom (user-supplied) Attack Paths queries.
 Two responsibilities:
 
 1. **Validation** - reject queries containing SSRF or dangerous procedure
-   patterns (defense-in-depth; the primary control is `neo4j.READ_ACCESS`).
+   patterns (defense-in-depth; the primary control is ``neo4j.READ_ACCESS``).
 
 2. **Provider-scoped label injection** - inject a dynamic
-   `_Provider_{uuid}` label into every node pattern so the database can
+   ``_Provider_{uuid}`` label into every node pattern so the database can
    use its native label index for provider isolation.
 
 Label-injection pipeline:
@@ -22,16 +22,18 @@ Label-injection pipeline:
 import re
 
 from rest_framework.exceptions import ValidationError
+
 from tasks.jobs.attack_paths.config import get_provider_label
 
+
 # Step 1 - String / comment protection
-# Single combined regex: strings first, then line comments
+# Single combined regex: strings first, then line comments.
 # The regex engine finds the leftmost match, so a string like 'https://prowler.com'
-# is consumed as a string before the // inside it can match as a comment
+# is consumed as a string before the // inside it can match as a comment.
 _PROTECTED_RE = re.compile(r"'(?:[^'\\]|\\.)*'|\"(?:[^\"\\]|\\.)*\"|//[^\n]*")
 
 # Step 2 - Clause splitting
-# `OPTIONAL MATCH` must come before `MATCH` to avoid partial matching
+# OPTIONAL MATCH must come before MATCH to avoid partial matching.
 _CLAUSE_RE = re.compile(
     r"\b(OPTIONAL\s+MATCH|MATCH|WHERE|RETURN|WITH|ORDER\s+BY"
     r"|SKIP|LIMIT|UNION|UNWIND|CALL)\b",
@@ -39,10 +41,10 @@ _CLAUSE_RE = re.compile(
 )
 
 # Pass A - Labeled node patterns (all segments)
-# Matches node patterns that have at least one `:Label`
-# `(?<!\w)\(`  - open paren NOT preceded by a word char, excludes function calls
-# Group 1:  optional variable + one or more `:Label`
-# Group 2:  optional `{`properties`}` + closing paren
+# Matches node patterns that have at least one :Label.
+# (?<!\w)\(  - open paren NOT preceded by a word char (excludes function calls).
+# Group 1:  optional variable + one or more :Label
+# Group 2:  optional {properties} + closing paren
 _LABELED_NODE_RE = re.compile(
     r"(?<!\w)\("
     r"("
@@ -55,9 +57,9 @@ _LABELED_NODE_RE = re.compile(
     r")"
 )
 
-# Pass B - Bare node patterns (`MATCH` segments only)
-# Matches (identifier) or (identifier {properties}) without any `:Label`
-# Only applied in `MATCH` / `OPTIONAL MATCH` segments
+# Pass B - Bare node patterns (MATCH segments only)
+# Matches (identifier) or (identifier {properties}) without any :Label.
+# Only applied in MATCH/OPTIONAL MATCH segments.
 _BARE_NODE_RE = re.compile(
     r"(?<!\w)\(" r"(\s*[a-zA-Z_]\w*)" r"(\s*(?:\{[^}]*\})?)" r"\s*\)"
 )
@@ -96,11 +98,6 @@ def inject_provider_label(cypher: str, provider_id: str) -> str:
         node pattern.
     """
     label = get_provider_label(provider_id)
-    return inject_label(cypher, label)
-
-
-def inject_label(cypher: str, label: str) -> str:
-    """Rewrite a Cypher query to append a label to every node pattern."""
 
     # Step 1: Protect strings and comments (single pass, leftmost-first)
     protected: list[str] = []
@@ -139,7 +136,9 @@ def inject_label(cypher: str, label: str) -> str:
     return work
 
 
+# ---------------------------------------------------------------------------
 # Validation
+# ---------------------------------------------------------------------------
 
 # Patterns that indicate SSRF or dangerous procedure calls
 # Defense-in-depth layer - the primary control is `neo4j.READ_ACCESS`

api/src/backend/api/attack_paths/database.py

@@ -1,32 +1,233 @@
-"""Backwards-compatible facade over the ingest and sink modules.
-
-Historically this module owned a single Neo4j driver used for both the
-cartography temp database and the per-tenant sink database. The port to AWS
-Neptune split those roles: the cartography ingest (temp) database is always
-Neo4j and lives in `api.attack_paths.ingest`; the sink is configurable
-(Neo4j or Neptune) and lives in `api.attack_paths.sink`. This shim preserves
-the public API that `tasks/` and `api/v1/views.py` already depend on, and
-dispatches to the right module by database-name prefix.
-
-A database name starting with `db-tmp-scan-` is a cartography temp DB and
-routes to ingest. Everything else routes to the configured sink.
-"""
-
-from contextlib import AbstractContextManager
-from typing import Any
+import atexit
+import logging
+import threading
+from contextlib import contextmanager
+from typing import Any, Iterator
 from uuid import UUID
 
-import neo4j  # noqa: F401 - kept for tests that patch api.attack_paths.database.neo4j
-from api.attack_paths import ingest
-from api.attack_paths import sink as sink_module
+import neo4j
+import neo4j.exceptions
 from config.env import env
-from django.conf import (
-    settings,  # noqa: F401 - kept for tests that patch ...database.settings
+from django.conf import settings
+from tasks.jobs.attack_paths.config import (
+    BATCH_SIZE,
+    PROVIDER_RESOURCE_LABEL,
+    get_provider_label,
 )
 
-MAX_CUSTOM_QUERY_NODES = env.int("ATTACK_PATHS_MAX_CUSTOM_QUERY_NODES", default=250)
+from api.attack_paths.retryable_session import RetryableSession
 
-TEMP_DB_PREFIX = "db-tmp-scan-"
+# Without this Celery goes crazy with Neo4j logging
+logging.getLogger("neo4j").setLevel(logging.ERROR)
+logging.getLogger("neo4j").propagate = False
+
+SERVICE_UNAVAILABLE_MAX_RETRIES = env.int(
+    "ATTACK_PATHS_SERVICE_UNAVAILABLE_MAX_RETRIES", default=3
+)
+READ_QUERY_TIMEOUT_SECONDS = env.int(
+    "ATTACK_PATHS_READ_QUERY_TIMEOUT_SECONDS", default=30
+)
+MAX_CUSTOM_QUERY_NODES = env.int("ATTACK_PATHS_MAX_CUSTOM_QUERY_NODES", default=250)
+CONN_ACQUISITION_TIMEOUT = env.int("NEO4J_CONN_ACQUISITION_TIMEOUT", default=15)
+READ_EXCEPTION_CODES = [
+    "Neo.ClientError.Statement.AccessMode",
+    "Neo.ClientError.Procedure.ProcedureNotFound",
+]
+CLIENT_STATEMENT_EXCEPTION_PREFIX = "Neo.ClientError.Statement."
+
+# Module-level process-wide driver singleton
+_driver: neo4j.Driver | None = None
+_lock = threading.Lock()
+
+# Base Neo4j functions
+
+
+def get_uri() -> str:
+    host = settings.DATABASES["neo4j"]["HOST"]
+    port = settings.DATABASES["neo4j"]["PORT"]
+    return f"bolt://{host}:{port}"
+
+
+def init_driver() -> neo4j.Driver:
+    global _driver
+    if _driver is not None:
+        return _driver
+
+    with _lock:
+        if _driver is None:
+            uri = get_uri()
+            config = settings.DATABASES["neo4j"]
+
+            _driver = neo4j.GraphDatabase.driver(
+                uri,
+                auth=(config["USER"], config["PASSWORD"]),
+                keep_alive=True,
+                max_connection_lifetime=7200,
+                connection_acquisition_timeout=CONN_ACQUISITION_TIMEOUT,
+                max_connection_pool_size=50,
+            )
+            _driver.verify_connectivity()
+
+            # Register cleanup handler (only runs once since we're inside the _driver is None block)
+            atexit.register(close_driver)
+
+    return _driver
+
+
+def get_driver() -> neo4j.Driver:
+    return init_driver()
+
+
+def close_driver() -> None:  # TODO: Use it
+    global _driver
+    with _lock:
+        if _driver is not None:
+            try:
+                _driver.close()
+
+            finally:
+                _driver = None
+
+
+@contextmanager
+def get_session(
+    database: str | None = None, default_access_mode: str | None = None
+) -> Iterator[RetryableSession]:
+    session_wrapper: RetryableSession | None = None
+
+    try:
+        session_wrapper = RetryableSession(
+            session_factory=lambda: get_driver().session(
+                database=database, default_access_mode=default_access_mode
+            ),
+            max_retries=SERVICE_UNAVAILABLE_MAX_RETRIES,
+        )
+        yield session_wrapper
+
+    except neo4j.exceptions.Neo4jError as exc:
+        if (
+            default_access_mode == neo4j.READ_ACCESS
+            and exc.code
+            and exc.code in READ_EXCEPTION_CODES
+        ):
+            message = "Read query not allowed"
+            code = READ_EXCEPTION_CODES[0]
+            raise WriteQueryNotAllowedException(message=message, code=code)
+
+        message = exc.message if exc.message is not None else str(exc)
+
+        if exc.code and exc.code.startswith(CLIENT_STATEMENT_EXCEPTION_PREFIX):
+            raise ClientStatementException(message=message, code=exc.code)
+
+        raise GraphDatabaseQueryException(message=message, code=exc.code)
+
+    finally:
+        if session_wrapper is not None:
+            session_wrapper.close()
+
+
+def execute_read_query(
+    database: str,
+    cypher: str,
+    parameters: dict[str, Any] | None = None,
+) -> neo4j.graph.Graph:
+    with get_session(database, default_access_mode=neo4j.READ_ACCESS) as session:
+
+        def _run(tx: neo4j.ManagedTransaction) -> neo4j.graph.Graph:
+            result = tx.run(
+                cypher, parameters or {}, timeout=READ_QUERY_TIMEOUT_SECONDS
+            )
+            return result.graph()
+
+        return session.execute_read(_run)
+
+
+def create_database(database: str) -> None:
+    query = "CREATE DATABASE $database IF NOT EXISTS"
+    parameters = {"database": database}
+
+    with get_session() as session:
+        session.run(query, parameters)
+
+
+def drop_database(database: str) -> None:
+    query = f"DROP DATABASE `{database}` IF EXISTS DESTROY DATA"
+
+    with get_session() as session:
+        session.run(query)
+
+
+def drop_subgraph(database: str, provider_id: str) -> int:
+    """
+    Delete all nodes for a provider from the tenant database.
+
+    Uses batched deletion to avoid memory issues with large graphs.
+    Silently returns 0 if the database doesn't exist.
+    """
+    provider_label = get_provider_label(provider_id)
+    deleted_nodes = 0
+
+    try:
+        with get_session(database) as session:
+            deleted_count = 1
+            while deleted_count > 0:
+                result = session.run(
+                    f"""
+                    MATCH (n:{PROVIDER_RESOURCE_LABEL}:`{provider_label}`)
+                    WITH n LIMIT $batch_size
+                    DETACH DELETE n
+                    RETURN COUNT(n) AS deleted_nodes_count
+                    """,
+                    {"batch_size": BATCH_SIZE},
+                )
+                deleted_count = result.single().get("deleted_nodes_count", 0)
+                deleted_nodes += deleted_count
+
+    except GraphDatabaseQueryException as exc:
+        if exc.code == "Neo.ClientError.Database.DatabaseNotFound":
+            return 0
+        raise
+
+    return deleted_nodes
+
+
+def has_provider_data(database: str, provider_id: str) -> bool:
+    """
+    Check if any ProviderResource node exists for this provider.
+
+    Returns `False` if the database doesn't exist.
+    """
+    provider_label = get_provider_label(provider_id)
+    query = f"MATCH (n:{PROVIDER_RESOURCE_LABEL}:`{provider_label}`) RETURN 1 LIMIT 1"
+
+    try:
+        with get_session(database, default_access_mode=neo4j.READ_ACCESS) as session:
+            result = session.run(query)
+            return result.single() is not None
+
+    except GraphDatabaseQueryException as exc:
+        if exc.code == "Neo.ClientError.Database.DatabaseNotFound":
+            return False
+        raise
+
+
+def clear_cache(database: str) -> None:
+    query = "CALL db.clearQueryCaches()"
+
+    try:
+        with get_session(database) as session:
+            session.run(query)
+
+    except GraphDatabaseQueryException as exc:
+        logging.warning(f"Failed to clear query cache for database `{database}`: {exc}")
+
+
+# Neo4j functions related to Prowler + Cartography
+
+
+def get_database_name(entity_id: str | UUID, temporary: bool = False) -> str:
+    prefix = "tmp-scan" if temporary else "tenant"
+    return f"db-{prefix}-{str(entity_id).lower()}"
 
 
 # Exceptions
@@ -41,6 +242,7 @@ class GraphDatabaseQueryException(Exception):
     def __str__(self) -> str:
         if self.code:
             return f"{self.code}: {self.message}"
+
         return self.message
 
 
@@ -50,177 +252,3 @@ class WriteQueryNotAllowedException(GraphDatabaseQueryException):
 
 class ClientStatementException(GraphDatabaseQueryException):
     pass
-
-
-# Routing
-
-
-def _is_ingest_database(database: str | None) -> bool:
-    return bool(database) and database.startswith(TEMP_DB_PREFIX)
-
-
-# Driver lifecycle
-
-
-def init_driver() -> Any:
-    """Initialize the configured sink backend.
-
-    The ingest driver (Neo4j for cartography temp DBs) stays lazy: it is
-    only initialized when a temp-DB operation actually runs, which never
-    happens on API pods.
-    """
-    return sink_module.init()
-
-
-def close_driver() -> None:
-    """Close every driver held by this process."""
-    sink_module.close()
-    ingest.close_driver()
-
-
-def get_driver() -> neo4j.Driver:
-    """Return the sink backend's underlying driver.
-
-    Only meaningful for the Neo4j sink (where the backend has a single Neo4j
-    driver). On Neptune this returns the writer driver. Kept for tests and
-    legacy call-sites; prefer `get_session` for new code.
-    """
-    backend = sink_module.get_backend()
-
-    # Neo4jSink exposes get_driver(); NeptuneSink exposes get_writer()
-    if hasattr(backend, "get_driver"):
-        return backend.get_driver()
-
-    if hasattr(backend, "get_writer"):
-        return backend.get_writer()
-
-    raise RuntimeError("Active sink backend does not expose a driver handle")
-
-
-def verify_connectivity() -> None:
-    """Raise if the configured graph database is unreachable on the API read path.
-
-    Backend-agnostic entry point for the readiness probe: Neo4j verifies its
-    driver, Neptune verifies the reader endpoint.
-    """
-    sink_module.get_backend().verify_connectivity()
-
-
-def verify_scan_databases_available() -> None:
-    """Raise if either graph database needed by an Attack Paths scan is unavailable."""
-    errors: list[str] = []
-    first_error: Exception | None = None
-
-    try:
-        ingest.get_driver().verify_connectivity()
-    except Exception as exc:
-        errors.append(f"ingest Neo4j: {exc}")
-        first_error = exc
-
-    try:
-        get_driver().verify_connectivity()
-    except Exception as exc:
-        errors.append(f"sink {settings.ATTACK_PATHS_SINK_DATABASE}: {exc}")
-        if first_error is None:
-            first_error = exc
-
-    if errors:
-        raise RuntimeError(
-            "Attack Paths graph database unavailable before scan start: "
-            + "; ".join(errors)
-        ) from first_error
-
-
-def get_uri() -> str:
-    """Return the sink URI. Retained for backwards compatibility."""
-    if settings.ATTACK_PATHS_SINK_DATABASE == "neptune":
-        cfg = settings.DATABASES["neptune"]
-        return f"bolt+s://{cfg['WRITER_ENDPOINT']}:{cfg['PORT']}"
-
-    cfg = settings.DATABASES["neo4j"]
-    return f"bolt://{cfg['HOST']}:{cfg['PORT']}"
-
-
-def get_ingest_uri() -> str:
-    """Neo4j URI for the cartography temp (ingest) database, which is always
-    Neo4j regardless of the configured sink."""
-    return ingest.get_uri()
-
-
-# Session API
-
-
-def get_session(
-    database: str | None = None,
-    default_access_mode: str | None = None,
-) -> AbstractContextManager:
-    """Return a session against the right backend.
-
-    - `database` names starting with `db-tmp-scan-` always go to ingest.
-    - No database name → ingest (used for CREATE / DROP DATABASE admin ops).
-    - Any other name → sink.
-    """
-    if _is_ingest_database(database) or database is None:
-        return ingest.get_session(
-            database=database, default_access_mode=default_access_mode
-        )
-
-    return sink_module.get_backend().get_session(
-        database=database, default_access_mode=default_access_mode
-    )
-
-
-def execute_read_query(
-    database: str,
-    cypher: str,
-    parameters: dict[str, Any] | None = None,
-) -> neo4j.graph.Graph:
-    """Read-only query against the sink."""
-    return sink_module.get_backend().execute_read_query(database, cypher, parameters)
-
-
-def create_database(database: str) -> None:
-    """Create a database. Temp DBs always land on ingest (Neo4j).
-
-    On the Neo4j sink, tenant DBs also route to ingest because both drivers
-    connect to the same Neo4j cluster. On the Neptune sink, tenant DB creates
-    are no-ops.
-    """
-    if _is_ingest_database(database):
-        ingest.create_database(database)
-        return
-
-    sink_module.get_backend().create_database(database)
-
-
-def drop_database(database: str) -> None:
-    """Drop a database. Mirrors `create_database` routing."""
-    if _is_ingest_database(database):
-        ingest.drop_database(database)
-        return
-
-    sink_module.get_backend().drop_database(database)
-
-
-def drop_subgraph(database: str, provider_id: str) -> int:
-    return sink_module.get_backend().drop_subgraph(database, provider_id)
-
-
-def has_provider_data(database: str, provider_id: str) -> bool:
-    return sink_module.get_backend().has_provider_data(database, provider_id)
-
-
-def clear_cache(database: str) -> None:
-    if _is_ingest_database(database):
-        ingest.clear_cache(database)
-        return
-
-    sink_module.get_backend().clear_cache(database)
-
-
-# Name helper
-
-
-def get_database_name(entity_id: str | UUID, temporary: bool = False) -> str:
-    prefix = "tmp-scan" if temporary else "tenant"
-    return f"db-{prefix}-{str(entity_id).lower()}"

api/src/backend/api/attack_paths/ingest/__init__.py

@@ -1,29 +0,0 @@
-"""Cartography ingest layer.
-
-Public surface for the per-scan Neo4j temp database driver. Implementation
-lives in `api.attack_paths.ingest.driver`.
-"""
-
-from api.attack_paths.ingest.driver import (
-    clear_cache,
-    close_driver,
-    create_database,
-    drop_database,
-    get_driver,
-    get_session,
-    get_uri,
-    init_driver,
-    run_cypher,
-)
-
-__all__ = [
-    "clear_cache",
-    "close_driver",
-    "create_database",
-    "drop_database",
-    "get_driver",
-    "get_session",
-    "get_uri",
-    "init_driver",
-    "run_cypher",
-]

api/src/backend/api/attack_paths/ingest/driver.py

@@ -1,187 +0,0 @@
-"""Cartography ingest driver: per-scan throw-away Neo4j database.
-
-Cartography writes each scan's graph into a throw-away Neo4j database named
-`db-tmp-scan-{scan_uuid}`. This is always Neo4j, regardless of the configured
-sink: Neptune is single-database and cannot host per-scan throw-away
-databases. This module owns the Neo4j driver used for those temp DBs and the
-admin ops they need (CREATE / DROP DATABASE).
-"""
-
-import atexit
-import logging
-import threading
-from collections.abc import Iterator
-from contextlib import contextmanager
-from typing import Any
-
-import neo4j
-import neo4j.exceptions
-from api.attack_paths.retryable_session import RetryableSession
-from config.env import env
-from django.conf import settings
-
-logging.getLogger("neo4j").setLevel(logging.ERROR)
-logging.getLogger("neo4j").propagate = False
-
-SERVICE_UNAVAILABLE_MAX_RETRIES = env.int(
-    "ATTACK_PATHS_SERVICE_UNAVAILABLE_MAX_RETRIES", default=3
-)
-CONN_ACQUISITION_TIMEOUT = env.int("NEO4J_CONN_ACQUISITION_TIMEOUT", default=15)
-# TCP connect timeout, ordered below the acquisition timeout so an unreachable
-# host can't pin a worker on a temp-DB op longer than this.
-CONNECTION_TIMEOUT = env.int("NEO4J_CONNECTION_TIMEOUT", default=5)
-MAX_CONNECTION_LIFETIME = env.int("NEO4J_MAX_CONNECTION_LIFETIME", default=7200)
-MAX_CONNECTION_POOL_SIZE = env.int("NEO4J_MAX_CONNECTION_POOL_SIZE", default=50)
-
-_driver: neo4j.Driver | None = None
-_lock = threading.Lock()
-
-
-def _neo4j_config() -> dict:
-    return settings.DATABASES["neo4j"]
-
-
-def get_uri() -> str:
-    """Bolt URI for the Neo4j temp (ingest) database. Always Neo4j."""
-    config = _neo4j_config()
-    host = config["HOST"]
-    port = config["PORT"]
-    if not host or not port:
-        raise RuntimeError(
-            "NEO4J_HOST / NEO4J_PORT must be set to use the attack-paths "
-            "temp database. Workers require Neo4j env even when the sink is Neptune."
-        )
-
-    return f"bolt://{host}:{port}"
-
-
-def init_driver() -> neo4j.Driver:
-    """Initialize the temp-database Neo4j driver. Idempotent."""
-    global _driver
-    if _driver is not None:
-        return _driver
-
-    with _lock:
-        if _driver is None:
-            config = _neo4j_config()
-            _driver = neo4j.GraphDatabase.driver(
-                get_uri(),
-                auth=(config["USER"], config["PASSWORD"]),
-                keep_alive=True,
-                max_connection_lifetime=MAX_CONNECTION_LIFETIME,
-                connection_timeout=CONNECTION_TIMEOUT,
-                connection_acquisition_timeout=CONN_ACQUISITION_TIMEOUT,
-                max_connection_pool_size=MAX_CONNECTION_POOL_SIZE,
-            )
-            # Best-effort connectivity check: a Neo4j that is down at boot must
-            # not crash the worker. The driver reconnects lazily on first use.
-            try:
-                _driver.verify_connectivity()
-
-            except Exception:
-                logging.warning(
-                    "Neo4j temp-database unreachable at init; continuing with a "
-                    "lazily-reconnecting driver",
-                    exc_info=True,
-                )
-
-            atexit.register(close_driver)
-
-    return _driver
-
-
-def get_driver() -> neo4j.Driver:
-    return init_driver()
-
-
-def close_driver() -> None:
-    global _driver
-    with _lock:
-        if _driver is not None:
-            try:
-                _driver.close()
-            finally:
-                _driver = None
-
-
-@contextmanager
-def get_session(
-    database: str | None = None,
-    default_access_mode: str | None = None,
-) -> Iterator[RetryableSession]:
-    """Session against the Neo4j temp-database cluster. Used for temp DB sessions
-    and for admin operations (CREATE / DROP DATABASE) when `database` is None."""
-    from api.attack_paths.database import (
-        ClientStatementException,
-        GraphDatabaseQueryException,
-        WriteQueryNotAllowedException,
-    )
-
-    READ_EXCEPTION_CODES = [
-        "Neo.ClientError.Statement.AccessMode",
-        "Neo.ClientError.Procedure.ProcedureNotFound",
-    ]
-    CLIENT_STATEMENT_EXCEPTION_PREFIX = "Neo.ClientError.Statement."
-
-    session_wrapper: RetryableSession | None = None
-    try:
-        session_wrapper = RetryableSession(
-            session_factory=lambda: get_driver().session(
-                database=database, default_access_mode=default_access_mode
-            ),
-            max_retries=SERVICE_UNAVAILABLE_MAX_RETRIES,
-        )
-        yield session_wrapper
-
-    except neo4j.exceptions.Neo4jError as exc:
-        if (
-            default_access_mode == neo4j.READ_ACCESS
-            and exc.code
-            and exc.code in READ_EXCEPTION_CODES
-        ):
-            raise WriteQueryNotAllowedException(
-                message="Read query not allowed", code=READ_EXCEPTION_CODES[0]
-            )
-
-        message = exc.message if exc.message is not None else str(exc)
-        if exc.code and exc.code.startswith(CLIENT_STATEMENT_EXCEPTION_PREFIX):
-            raise ClientStatementException(message=message, code=exc.code)
-        raise GraphDatabaseQueryException(message=message, code=exc.code)
-
-    finally:
-        if session_wrapper is not None:
-            session_wrapper.close()
-
-
-def create_database(database: str) -> None:
-    """Create a database on the Neo4j cluster. Used for temp scan DBs."""
-    with get_session() as session:
-        session.run("CREATE DATABASE $database IF NOT EXISTS", {"database": database})
-
-
-def drop_database(database: str) -> None:
-    """Drop a database on the Neo4j cluster. Used for temp scan DBs."""
-    with get_session() as session:
-        session.run(f"DROP DATABASE `{database}` IF EXISTS DESTROY DATA")
-
-
-def clear_cache(database: str) -> None:
-    """Best-effort cache clear for a Neo4j database."""
-    from api.attack_paths.database import GraphDatabaseQueryException
-
-    try:
-        with get_session(database) as session:
-            session.run("CALL db.clearQueryCaches()")
-
-    except GraphDatabaseQueryException as exc:
-        logging.warning(f"Failed to clear query cache for database `{database}`: {exc}")
-
-
-def run_cypher(
-    database: str | None,
-    cypher: str,
-    parameters: dict[str, Any] | None = None,
-) -> Any:
-    """Execute Cypher directly without the context manager. Thin helper."""
-    with get_session(database) as session:
-        return session.run(cypher, parameters or {})

api/src/backend/api/attack_paths/queries/__init__.py

@@ -1,11 +1,12 @@
-from api.attack_paths.queries.registry import (
-    get_queries_for_provider,
-    get_query_by_id,
-)
 from api.attack_paths.queries.types import (
     AttackPathsQueryDefinition,
     AttackPathsQueryParameterDefinition,
 )
+from api.attack_paths.queries.registry import (
+    get_queries_for_provider,
+    get_query_by_id,
+)
+
 
 __all__ = [
     "AttackPathsQueryDefinition",

api/src/backend/api/attack_paths/queries/registry.py

@@ -1,14 +1,13 @@
+from api.attack_paths.queries.types import AttackPathsQueryDefinition
 from api.attack_paths.queries.aws import AWS_QUERIES
 
-# TODO: drop after Neptune cutover
-from api.attack_paths.queries.aws_deprecated import AWS_DEPRECATED_QUERIES
-from api.attack_paths.queries.types import AttackPathsQueryDefinition
 
-# Query definitions for scans synced with the current schema.
+# Query definitions organized by provider
 _QUERY_DEFINITIONS: dict[str, list[AttackPathsQueryDefinition]] = {
     "aws": AWS_QUERIES,
 }
 
+# Flat lookup by query ID for O(1) access
 _QUERIES_BY_ID: dict[str, AttackPathsQueryDefinition] = {
     definition.id: definition
     for definitions in _QUERY_DEFINITIONS.values()
@@ -16,45 +15,11 @@ _QUERIES_BY_ID: dict[str, AttackPathsQueryDefinition] = {
 }
 
 
-# TODO: drop after Neptune cutover
-#
-# Query definitions for pre-cutover scans (`AttackPathsScan.is_migrated=False`)
-# whose graph data was written under the previous schema. Both maps expose the
-# same query IDs so the API contract is identical regardless of which set is
-# routed to.
-_DEPRECATED_QUERY_DEFINITIONS: dict[str, list[AttackPathsQueryDefinition]] = {
-    "aws": AWS_DEPRECATED_QUERIES,
-}
-
-_DEPRECATED_QUERIES_BY_ID: dict[str, AttackPathsQueryDefinition] = {
-    definition.id: definition
-    for definitions in _DEPRECATED_QUERY_DEFINITIONS.values()
-    for definition in definitions
-}
+def get_queries_for_provider(provider: str) -> list[AttackPathsQueryDefinition]:
+    """Get all attack path queries for a specific provider."""
+    return _QUERY_DEFINITIONS.get(provider, [])
 
 
-def get_queries_for_provider(
-    provider: str,
-    is_migrated: bool = True,
-) -> list[AttackPathsQueryDefinition]:
-    """Get all attack path queries for a provider.
-
-    `is_migrated` selects the catalog: True for scans synced with the current
-    schema, False for pre-cutover scans still using the legacy graph shape.
-    # TODO: drop the `is_migrated` parameter after Neptune cutover
-    """
-    catalog = _QUERY_DEFINITIONS if is_migrated else _DEPRECATED_QUERY_DEFINITIONS
-    return catalog.get(provider, [])
-
-
-def get_query_by_id(
-    query_id: str,
-    is_migrated: bool = True,
-) -> AttackPathsQueryDefinition | None:
-    """Get a specific attack path query by ID.
-
-    `is_migrated` selects the catalog (see `get_queries_for_provider`).
-    # TODO: drop the `is_migrated` parameter after Neptune cutover
-    """
-    by_id = _QUERIES_BY_ID if is_migrated else _DEPRECATED_QUERIES_BY_ID
-    return by_id.get(query_id)
+def get_query_by_id(query_id: str) -> AttackPathsQueryDefinition | None:
+    """Get a specific attack path query by its ID."""
+    return _QUERIES_BY_ID.get(query_id)

api/src/backend/api/attack_paths/retryable_session.py

@@ -1,6 +1,5 @@
 import logging
-import random
-import time
+
 from collections.abc import Callable
 from typing import Any
 
@@ -11,19 +10,17 @@ logger = logging.getLogger(__name__)
 
 
 class RetryableSession:
-    """Wrapper around ``neo4j.Session`` with a refreshable retry policy."""
+    """
+    Wrapper around `neo4j.Session` that retries `neo4j.exceptions.ServiceUnavailable` errors.
+    """
 
     def __init__(
         self,
         session_factory: Callable[[], neo4j.Session],
         max_retries: int,
-        retry_if: Callable[[Exception], bool] | None = None,
-        initial_retry_delay_seconds: float = 0,
     ) -> None:
         self._session_factory = session_factory
         self._max_retries = max(0, max_retries)
-        self._retry_if = retry_if
-        self._initial_retry_delay_seconds = max(0.0, initial_retry_delay_seconds)
         self._session = self._session_factory()
 
     def close(self) -> None:
@@ -60,47 +57,24 @@ class RetryableSession:
                 method = getattr(self._session, method_name)
                 return method(*args, **kwargs)
 
-            except Exception as exc:
-                if not self._should_retry(exc):
-                    raise
-
+            except (
+                BrokenPipeError,
+                ConnectionResetError,
+                neo4j.exceptions.ServiceUnavailable,
+            ) as exc:  # pragma: no cover - depends on infra
                 last_exc = exc
                 attempt += 1
 
                 if attempt > self._max_retries:
                     raise
 
-                delay = self._retry_delay(attempt)
                 logger.warning(
-                    "Graph session %s failed with %s; retry %s/%s in %.3fs",
-                    method_name,
-                    type(exc).__name__,
-                    attempt,
-                    self._max_retries,
-                    delay,
+                    f"Neo4j session {method_name} failed with {type(exc).__name__} ({attempt}/{self._max_retries} attempts). Retrying..."
                 )
                 self._refresh_session()
-                if delay:
-                    time.sleep(delay)
 
         raise last_exc if last_exc else RuntimeError("Unexpected retry loop exit")
 
-    def _should_retry(self, exc: Exception) -> bool:
-        if isinstance(
-            exc,
-            (
-                BrokenPipeError,
-                ConnectionResetError,
-                neo4j.exceptions.ServiceUnavailable,
-            ),
-        ):
-            return True
-        return self._retry_if(exc) if self._retry_if else False
-
-    def _retry_delay(self, attempt: int) -> float:
-        max_delay = self._initial_retry_delay_seconds * (2**attempt)
-        return random.uniform(max_delay / 2, max_delay) if max_delay else 0
-
     def _refresh_session(self) -> None:
         if self._session is not None:
             try:

api/src/backend/api/attack_paths/sink/__init__.py

@@ -1,28 +0,0 @@
-"""Attack-paths sink database layer.
-
-The sink is the persistent store where attack-paths graphs live after a scan
-finishes. Currently selectable between Neo4j (OSS / local dev default) and
-AWS Neptune (hosted dev/staging/prod). Backend is picked by the
-`ATTACK_PATHS_SINK_DATABASE` setting at process init.
-
-This package exposes the public factory API; the implementation lives in
-`api.attack_paths.sink.factory`.
-"""
-
-from api.attack_paths.sink.factory import (
-    SinkBackend,
-    close,
-    get_backend,
-    get_backend_for_name,
-    get_backend_for_scan,
-    init,
-)
-
-__all__ = [
-    "SinkBackend",
-    "close",
-    "get_backend",
-    "get_backend_for_name",
-    "get_backend_for_scan",
-    "init",
-]

api/src/backend/api/attack_paths/sink/base.py

@@ -1,92 +0,0 @@
-"""Protocol every sink backend must implement."""
-
-from contextlib import AbstractContextManager
-from typing import Any, Protocol
-
-import neo4j
-
-
-class SinkDatabase(Protocol):
-    """Contract for the persistent attack-paths graph store.
-
-    The `database` argument is an opaque identifier passed through from the
-    legacy `database.py` API surface. On Neo4j it is the per-tenant database
-    name (e.g. `db-tenant-{uuid}`). On Neptune it is ignored (the cluster
-    has a single graph, and isolation is label-based).
-    """
-
-    def init(self) -> None: ...
-
-    def close(self) -> None: ...
-
-    def verify_connectivity(self) -> None:
-        """Raise if the backend the API read path uses is unreachable.
-
-        Neo4j verifies its single driver. Neptune verifies the reader
-        driver (the endpoint the API serves reads from); on single-endpoint
-        clusters the reader aliases the writer, so that path is covered too.
-        Used by the readiness probe; must not block longer than the caller's
-        probe budget.
-        """
-        ...
-
-    def get_session(
-        self,
-        database: str | None = None,
-        default_access_mode: str | None = None,
-    ) -> AbstractContextManager: ...
-
-    def execute_read_query(
-        self,
-        database: str,
-        cypher: str,
-        parameters: dict[str, Any] | None = None,
-    ) -> neo4j.graph.Graph: ...
-
-    def create_database(self, database: str) -> None: ...
-
-    def drop_database(self, database: str) -> None: ...
-
-    def drop_subgraph(self, database: str, provider_id: str) -> int: ...
-
-    def has_provider_data(self, database: str, provider_id: str) -> bool: ...
-
-    def clear_cache(self, database: str) -> None: ...
-
-    def ensure_sync_indexes(self, database: str) -> None:
-        """Create any index needed for the sync write path.
-
-        Called once at the start of each provider sync; must be idempotent.
-        Neo4j creates a `_provider_element_id` index on `_ProviderResource`;
-        Neptune is a no-op (its `~id` lookup needs no index).
-        """
-        ...
-
-    def write_nodes(
-        self,
-        database: str,
-        labels: str,
-        rows: list[dict[str, Any]],
-    ) -> None:
-        """Upsert a batch of nodes into the sink.
-
-        `labels` is a pre-rendered Cypher label string ready to drop after
-        the node variable (e.g. `` `AWSUser`:`_ProviderResource`:`_Tenant_x` ``).
-        Each row carries `provider_element_id` and `props`.
-        """
-        ...
-
-    def write_relationships(
-        self,
-        database: str,
-        rel_type: str,
-        provider_id: str,
-        rows: list[dict[str, Any]],
-    ) -> None:
-        """Upsert a batch of relationships into the sink.
-
-        Each row carries `start_element_id`, `end_element_id`,
-        `provider_element_id` and `props`. `rel_type` is the relationship
-        type (already a valid Cypher identifier).
-        """
-        ...

api/src/backend/api/attack_paths/sink/drop.py

@@ -1,81 +0,0 @@
-"""Shared batched deletion helpers for sink backends."""
-
-import logging
-import time
-from typing import Any
-
-RELATIONSHIP_DELETE_QUERY_TEMPLATES = {
-    "outgoing relationship": """
-        MATCH (n:`{provider_label}`)-[r]->()
-        WITH r LIMIT $batch_size
-        DELETE r
-        RETURN COUNT(r) AS deleted_rels_count
-        """,
-    "incoming relationship": """
-        MATCH (n:`{provider_label}`)<-[r]-()
-        WITH r LIMIT $batch_size
-        DELETE r
-        RETURN COUNT(r) AS deleted_rels_count
-        """,
-}
-
-NODE_DELETE_QUERY_TEMPLATE = """
-    MATCH (n:{provider_resource_label}:`{provider_label}`)
-    WITH n LIMIT $batch_size
-    DELETE n
-    RETURN COUNT(n) AS deleted_nodes_count
-    """
-
-
-def delete_batches(
-    *,
-    session: Any,
-    logger: logging.Logger,
-    log_target: str,
-    provider_id: str,
-    query: str,
-    phase: str,
-    count_key: str,
-    total_key: str,
-    deleted_key: str,
-    initial_total: int,
-    batch_size: int,
-    drop_t0: float,
-) -> tuple[int, int]:
-    def delete_batch(tx: Any) -> int:
-        record = tx.run(query, {"batch_size": batch_size}).single()
-        return (record[count_key] if record else 0) or 0
-
-    deleted_total = initial_total
-    batches = 0
-    while True:
-        logger.info(
-            "Deleting %s batch from %s "
-            "(provider=%s, batch=%s, total_%s=%s, elapsed=%.3fs)",
-            phase,
-            log_target,
-            provider_id,
-            batches + 1,
-            total_key,
-            deleted_total,
-            time.perf_counter() - drop_t0,
-        )
-        deleted = session.execute_write(delete_batch)
-        if deleted == 0:
-            return deleted_total, batches
-
-        batches += 1
-        deleted_total += deleted
-        logger.info(
-            "Deleted %s batch from %s "
-            "(provider=%s, batch=%s, %s=%s, total_%s=%s, elapsed=%.3fs)",
-            phase,
-            log_target,
-            provider_id,
-            batches,
-            deleted_key,
-            deleted,
-            total_key,
-            deleted_total,
-            time.perf_counter() - drop_t0,
-        )

api/src/backend/api/attack_paths/sink/factory.py

@@ -1,134 +0,0 @@
-"""Sink backend factory and process-wide handle cache.
-
-Picks the active backend from `settings.ATTACK_PATHS_SINK_DATABASE` at first
-use, holds the active backend plus any secondary backends needed to serve
-scans written under the previous configuration, and tears them all down on
-process shutdown. Imported via `from api.attack_paths import sink as
-sink_module`.
-"""
-
-import threading
-from enum import StrEnum, auto
-
-from api.attack_paths.sink.base import SinkDatabase
-from api.models import AttackPathsScan
-from django.conf import settings
-
-# Backend names
-
-
-class SinkBackend(StrEnum):
-    NEO4J = auto()
-    NEPTUNE = auto()
-
-
-# Backend cache
-
-_backend: SinkDatabase | None = None
-_secondary_backends: dict[SinkBackend, SinkDatabase] = {}
-_lock = threading.Lock()
-
-
-def _resolve_setting() -> SinkBackend:
-    raw = settings.ATTACK_PATHS_SINK_DATABASE.lower()
-    try:
-        return SinkBackend(raw)
-
-    except ValueError:
-        valid = sorted(b.value for b in SinkBackend)
-        raise RuntimeError(
-            f"ATTACK_PATHS_SINK_DATABASE must be one of {valid}; got {raw!r}"
-        )
-
-
-def _build_backend(name: SinkBackend) -> SinkDatabase:
-    if name is SinkBackend.NEO4J:
-        from api.attack_paths.sink.neo4j import Neo4jSink
-
-        return Neo4jSink()
-
-    if name is SinkBackend.NEPTUNE:
-        from api.attack_paths.sink.neptune import NeptuneSink
-
-        return NeptuneSink()
-
-    raise RuntimeError(f"Unknown sink backend {name!r}")
-
-
-# Lifecycle
-
-
-def init(name: SinkBackend | str | None = None) -> SinkDatabase:
-    """Initialize the configured sink backend. Idempotent."""
-    global _backend
-    if _backend is not None:
-        return _backend
-
-    with _lock:
-        if _backend is None:
-            resolved = SinkBackend(name) if name else _resolve_setting()
-            backend = _build_backend(resolved)
-            backend.init()
-            _backend = backend
-
-    return _backend
-
-
-def close() -> None:
-    """Close the active backend and every cached secondary backend."""
-    global _backend
-    with _lock:
-        backends = [
-            b for b in (_backend, *_secondary_backends.values()) if b is not None
-        ]
-        _backend = None
-        _secondary_backends.clear()
-
-    for backend in backends:
-        try:
-            backend.close()
-
-        except Exception:  # pragma: no cover - best-effort
-            pass
-
-
-def get_backend() -> SinkDatabase:
-    """Return the active sink. Initializes on first call."""
-    return init()
-
-
-# Per-scan routing
-
-
-def get_backend_for_scan(scan: AttackPathsScan) -> SinkDatabase:
-    """Route reads by the sink that stores this scan's graph."""
-    raw_backend = getattr(scan, "sink_backend", SinkBackend.NEO4J.value)
-    if not isinstance(raw_backend, str):
-        raw_backend = SinkBackend.NEO4J.value
-    return get_backend_for_name(raw_backend)
-
-
-def get_backend_for_name(name: SinkBackend | str) -> SinkDatabase:
-    """Return the backend named by persisted scan metadata."""
-    resolved = SinkBackend(name)
-    if resolved is _resolve_setting():
-        return get_backend()
-
-    return _build_backend_cached(resolved)
-
-
-def _build_backend_cached(name: SinkBackend) -> SinkDatabase:
-    # TODO: drop after Neptune cutover
-    # Needed only during cutover to serve Neo4j-written scans from a Neptune-
-    # configured API pod (and vice versa). Once every scan is on Neptune,
-    # `get_backend_for_scan` becomes a one-liner returning `get_backend()`.
-    if name in _secondary_backends:
-        return _secondary_backends[name]
-
-    with _lock:
-        if name not in _secondary_backends:
-            backend = _build_backend(name)
-            backend.init()
-            _secondary_backends[name] = backend
-
-    return _secondary_backends[name]

api/src/backend/api/attack_paths/sink/neo4j.py

@@ -1,417 +0,0 @@
-"""Neo4j sink implementation.
-
-Owns a Neo4j driver independent from the staging driver. On OSS and local dev
-this is the only sink; on hosted deployments it runs only as a legacy read
-path while phase-1 drains tenant DBs.
-"""
-
-import atexit
-import logging
-import threading
-import time
-from collections.abc import Iterator
-from contextlib import AbstractContextManager, contextmanager
-from typing import Any
-
-import neo4j
-import neo4j.exceptions
-from api.attack_paths.retryable_session import RetryableSession
-from api.attack_paths.sink.base import SinkDatabase
-from api.attack_paths.sink.drop import (
-    NODE_DELETE_QUERY_TEMPLATE,
-    RELATIONSHIP_DELETE_QUERY_TEMPLATES,
-    delete_batches,
-)
-from config.env import env
-from django.conf import settings
-
-logging.getLogger("neo4j").setLevel(logging.ERROR)
-logging.getLogger("neo4j").propagate = False
-
-logger = logging.getLogger(__name__)
-
-SERVICE_UNAVAILABLE_MAX_RETRIES = env.int(
-    "ATTACK_PATHS_SERVICE_UNAVAILABLE_MAX_RETRIES", default=3
-)
-READ_QUERY_TIMEOUT_SECONDS = env.int(
-    "ATTACK_PATHS_READ_QUERY_TIMEOUT_SECONDS", default=30
-)
-CONN_ACQUISITION_TIMEOUT = env.int("NEO4J_CONN_ACQUISITION_TIMEOUT", default=15)
-# TCP connect timeout, ordered below the acquisition timeout so an unreachable
-# host can't pin a request or the readiness probe longer than this.
-CONNECTION_TIMEOUT = env.int("NEO4J_CONNECTION_TIMEOUT", default=5)
-MAX_CONNECTION_LIFETIME = env.int("NEO4J_MAX_CONNECTION_LIFETIME", default=7200)
-MAX_CONNECTION_POOL_SIZE = env.int("NEO4J_MAX_CONNECTION_POOL_SIZE", default=50)
-
-READ_EXCEPTION_CODES = [
-    "Neo.ClientError.Statement.AccessMode",
-    "Neo.ClientError.Procedure.ProcedureNotFound",
-]
-CLIENT_STATEMENT_EXCEPTION_PREFIX = "Neo.ClientError.Statement."
-DATABASE_NOT_FOUND_CODE = "Neo.ClientError.Database.DatabaseNotFound"
-
-
-class Neo4jSink(SinkDatabase):
-    """Neo4j-backed sink. Multi-database cluster; tenant isolation is physical."""
-
-    def __init__(self) -> None:
-        self._driver: neo4j.Driver | None = None
-        self._lock = threading.Lock()
-        self._atexit_registered = False
-
-    # Driver
-
-    def _config(self) -> dict:
-        return settings.DATABASES["neo4j"]
-
-    def _uri(self) -> str:
-        cfg = self._config()
-        host = cfg["HOST"]
-        port = cfg["PORT"]
-        if not host or not port:
-            raise RuntimeError(
-                "NEO4J_HOST / NEO4J_PORT must be set when ATTACK_PATHS_SINK_DATABASE=neo4j"
-            )
-        return f"bolt://{host}:{port}"
-
-    def init(self) -> neo4j.Driver:
-        if self._driver is not None:
-            return self._driver
-        with self._lock:
-            if self._driver is None:
-                cfg = self._config()
-                self._driver = neo4j.GraphDatabase.driver(
-                    self._uri(),
-                    auth=(cfg["USER"], cfg["PASSWORD"]),
-                    keep_alive=True,
-                    max_connection_lifetime=MAX_CONNECTION_LIFETIME,
-                    connection_timeout=CONNECTION_TIMEOUT,
-                    connection_acquisition_timeout=CONN_ACQUISITION_TIMEOUT,
-                    max_connection_pool_size=MAX_CONNECTION_POOL_SIZE,
-                )
-                # Eager connectivity check is best-effort:
-                # A Neo4j that is down at boot must not crash the process, same degradation model as Postgres
-                # The driver reconnects lazily on first use
-                # /health/ready surfaces the outage until it recovers
-                try:
-                    self._driver.verify_connectivity()
-
-                except Exception:
-                    logger.warning(
-                        "Neo4j sink unreachable at init; continuing with a lazily-reconnecting driver",
-                        exc_info=True,
-                    )
-
-                if not self._atexit_registered:
-                    atexit.register(self.close)
-                    self._atexit_registered = True
-        return self._driver
-
-    def _get_driver(self) -> neo4j.Driver:
-        return self.init()
-
-    def verify_connectivity(self) -> None:
-        self._get_driver().verify_connectivity()
-
-    def close(self) -> None:
-        with self._lock:
-            if self._driver is not None:
-                try:
-                    self._driver.close()
-                finally:
-                    self._driver = None
-
-    # Sessions
-
-    @contextmanager
-    def get_session(
-        self,
-        database: str | None = None,
-        default_access_mode: str | None = None,
-    ) -> Iterator[RetryableSession]:
-        from api.attack_paths.database import (
-            ClientStatementException,
-            GraphDatabaseQueryException,
-            WriteQueryNotAllowedException,
-        )
-
-        session_wrapper: RetryableSession | None = None
-        try:
-            session_wrapper = RetryableSession(
-                session_factory=lambda: self._get_driver().session(
-                    database=database, default_access_mode=default_access_mode
-                ),
-                max_retries=SERVICE_UNAVAILABLE_MAX_RETRIES,
-            )
-            yield session_wrapper
-
-        except neo4j.exceptions.Neo4jError as exc:
-            if (
-                default_access_mode == neo4j.READ_ACCESS
-                and exc.code
-                and exc.code in READ_EXCEPTION_CODES
-            ):
-                raise WriteQueryNotAllowedException(
-                    message="Read query not allowed", code=READ_EXCEPTION_CODES[0]
-                )
-
-            message = exc.message if exc.message is not None else str(exc)
-            if exc.code and exc.code.startswith(CLIENT_STATEMENT_EXCEPTION_PREFIX):
-                raise ClientStatementException(message=message, code=exc.code)
-            raise GraphDatabaseQueryException(message=message, code=exc.code)
-
-        finally:
-            if session_wrapper is not None:
-                session_wrapper.close()
-
-    # Operations
-
-    def execute_read_query(
-        self,
-        database: str,
-        cypher: str,
-        parameters: dict[str, Any] | None = None,
-    ) -> neo4j.graph.Graph:
-        with self.get_session(
-            database, default_access_mode=neo4j.READ_ACCESS
-        ) as session:
-
-            def _run(tx: neo4j.ManagedTransaction) -> neo4j.graph.Graph:
-                result = tx.run(
-                    cypher, parameters or {}, timeout=READ_QUERY_TIMEOUT_SECONDS
-                )
-                return result.graph()
-
-            return session.execute_read(_run)
-
-    def create_database(self, database: str) -> None:
-        with self.get_session() as session:
-            session.run(
-                "CREATE DATABASE $database IF NOT EXISTS", {"database": database}
-            )
-
-    def drop_database(self, database: str) -> None:
-        with self.get_session() as session:
-            session.run(f"DROP DATABASE `{database}` IF EXISTS DESTROY DATA")
-
-    def drop_subgraph(self, database: str, provider_id: str) -> int:
-        """Delete all nodes for a provider from a tenant database, batched.
-
-        Deletes relationships then nodes in batches (not `DETACH DELETE`) so a
-        dense provider's graph cannot exceed Neo4j's transaction memory limit.
-        Silently returns 0 if the database doesn't exist.
-        """
-        from api.attack_paths.database import GraphDatabaseQueryException
-        from tasks.jobs.attack_paths.config import (
-            BATCH_SIZE,
-            PROVIDER_RESOURCE_LABEL,
-            get_provider_label,
-        )
-
-        provider_label = get_provider_label(provider_id)
-        deleted_nodes = deleted_relationships = 0
-        relationship_batches = node_batches = 0
-        drop_t0 = time.perf_counter()
-
-        logger.info(
-            "Dropping provider graph from Neo4j sink database %s "
-            "(provider=%s, provider_label=%s)",
-            database,
-            provider_id,
-            provider_label,
-        )
-
-        try:
-            logger.info(
-                "Opening Neo4j sink session for provider graph drop "
-                "(database=%s, provider=%s)",
-                database,
-                provider_id,
-            )
-            with self.get_session(database) as session:
-                logger.info(
-                    "Opened Neo4j sink session for provider graph drop "
-                    "(database=%s, provider=%s)",
-                    database,
-                    provider_id,
-                )
-                log_target = f"Neo4j sink database {database}"
-                for (
-                    phase,
-                    query_template,
-                ) in RELATIONSHIP_DELETE_QUERY_TEMPLATES.items():
-                    deleted_relationships, phase_batches = delete_batches(
-                        session=session,
-                        logger=logger,
-                        log_target=log_target,
-                        provider_id=provider_id,
-                        query=query_template.format(provider_label=provider_label),
-                        phase=phase,
-                        count_key="deleted_rels_count",
-                        total_key="rels",
-                        deleted_key="deleted_rels",
-                        initial_total=deleted_relationships,
-                        batch_size=BATCH_SIZE,
-                        drop_t0=drop_t0,
-                    )
-                    relationship_batches += phase_batches
-
-                deleted_nodes, node_batches = delete_batches(
-                    session=session,
-                    logger=logger,
-                    log_target=log_target,
-                    provider_id=provider_id,
-                    query=NODE_DELETE_QUERY_TEMPLATE.format(
-                        provider_label=provider_label,
-                        provider_resource_label=PROVIDER_RESOURCE_LABEL,
-                    ),
-                    phase="node",
-                    count_key="deleted_nodes_count",
-                    total_key="nodes",
-                    deleted_key="deleted_nodes",
-                    initial_total=0,
-                    batch_size=BATCH_SIZE,
-                    drop_t0=drop_t0,
-                )
-
-        except GraphDatabaseQueryException as exc:
-            if exc.code == DATABASE_NOT_FOUND_CODE:
-                logger.info(
-                    "Skipped provider graph drop from Neo4j sink database %s "
-                    "(provider=%s, reason=database_not_found, elapsed=%.3fs)",
-                    database,
-                    provider_id,
-                    time.perf_counter() - drop_t0,
-                )
-                return 0
-            raise
-
-        logger.info(
-            "Finished dropping provider graph from Neo4j sink database %s "
-            "(provider=%s, relationship_batches=%s, deleted_rels=%s, "
-            "node_batches=%s, deleted_nodes=%s, elapsed=%.3fs)",
-            database,
-            provider_id,
-            relationship_batches,
-            deleted_relationships,
-            node_batches,
-            deleted_nodes,
-            time.perf_counter() - drop_t0,
-        )
-        return deleted_nodes
-
-    def has_provider_data(self, database: str, provider_id: str) -> bool:
-        from api.attack_paths.database import GraphDatabaseQueryException
-        from tasks.jobs.attack_paths.config import (
-            PROVIDER_RESOURCE_LABEL,
-            get_provider_label,
-        )
-
-        provider_label = get_provider_label(provider_id)
-        query = (
-            f"MATCH (n:{PROVIDER_RESOURCE_LABEL}:`{provider_label}`) RETURN 1 LIMIT 1"
-        )
-        try:
-            with self.get_session(
-                database, default_access_mode=neo4j.READ_ACCESS
-            ) as session:
-                result = session.run(query)
-                return result.single() is not None
-
-        except GraphDatabaseQueryException as exc:
-            if exc.code == DATABASE_NOT_FOUND_CODE:
-                return False
-            raise
-
-    def clear_cache(self, database: str) -> None:
-        from api.attack_paths.database import GraphDatabaseQueryException
-
-        try:
-            with self.get_session(database) as session:
-                session.run("CALL db.clearQueryCaches()")
-        except GraphDatabaseQueryException as exc:
-            logger.warning(
-                f"Failed to clear query cache for database `{database}`: {exc}"
-            )
-
-    # Sync write path
-
-    def ensure_sync_indexes(self, database: str) -> None:
-        """Create the `_provider_element_id` lookup index on `_ProviderResource`.
-
-        Every synced node carries the `_ProviderResource` label, so a single
-        index covers both node-upserts and relationship endpoint MATCHes.
-        Without this index the rel sync degrades to a label scan per row and
-        large provider syncs become unworkable.
-        """
-        from tasks.jobs.attack_paths.config import (
-            PROVIDER_ELEMENT_ID_PROPERTY,
-            PROVIDER_RESOURCE_LABEL,
-        )
-
-        query = (
-            f"CREATE INDEX provider_element_id_idx IF NOT EXISTS "
-            f"FOR (n:`{PROVIDER_RESOURCE_LABEL}`) "
-            f"ON (n.`{PROVIDER_ELEMENT_ID_PROPERTY}`)"
-        )
-        with self.get_session(database) as session:
-            session.execute_write(lambda tx: tx.run(query).consume())
-
-    def write_nodes(
-        self,
-        database: str,
-        labels: str,
-        rows: list[dict[str, Any]],
-    ) -> None:
-        if not rows:
-            return
-        from tasks.jobs.attack_paths.config import (
-            PROVIDER_ELEMENT_ID_PROPERTY,
-            PROVIDER_RESOURCE_LABEL,
-        )
-
-        query = f"""
-            UNWIND $rows AS row
-            MERGE (n:`{PROVIDER_RESOURCE_LABEL}` {{`{PROVIDER_ELEMENT_ID_PROPERTY}`: row.provider_element_id}})
-            SET n:{labels}
-            SET n += row.props
-        """
-        with self.get_session(database) as session:
-            session.execute_write(lambda tx: tx.run(query, {"rows": rows}).consume())
-
-    def write_relationships(
-        self,
-        database: str,
-        rel_type: str,
-        provider_id: str,
-        rows: list[dict[str, Any]],
-    ) -> None:
-        if not rows:
-            return
-        from tasks.jobs.attack_paths.config import (
-            PROVIDER_ELEMENT_ID_PROPERTY,
-            PROVIDER_RESOURCE_LABEL,
-            get_provider_label,
-        )
-
-        provider_label = get_provider_label(provider_id)
-        query = f"""
-            UNWIND $rows AS row
-            MATCH (s:`{PROVIDER_RESOURCE_LABEL}`:`{provider_label}` {{`{PROVIDER_ELEMENT_ID_PROPERTY}`: row.start_element_id}})
-            MATCH (t:`{PROVIDER_RESOURCE_LABEL}`:`{provider_label}` {{`{PROVIDER_ELEMENT_ID_PROPERTY}`: row.end_element_id}})
-            MERGE (s)-[r:`{rel_type}` {{`{PROVIDER_ELEMENT_ID_PROPERTY}`: row.provider_element_id}}]->(t)
-            SET r += row.props
-        """
-        with self.get_session(database) as session:
-            session.execute_write(lambda tx: tx.run(query, {"rows": rows}).consume())
-
-    # For compatibility with test harnesses that patch the concrete driver
-    def get_driver(self) -> neo4j.Driver:
-        return self._get_driver()
-
-
-# Helper for tests / external callers that want a writer session specifically
-def get_read_session(
-    sink: Neo4jSink, database: str
-) -> AbstractContextManager[RetryableSession]:
-    return sink.get_session(database, default_access_mode=neo4j.READ_ACCESS)

api/src/backend/api/attack_paths/sink/neptune.py

@@ -1,507 +0,0 @@
-"""AWS Neptune sink implementation.
-
-Dual Bolt drivers: one against the writer endpoint for workers, one against
-the reader endpoint for the API read path. If `NEPTUNE_READER_ENDPOINT` is
-unset the reader falls back to the writer driver so single-node clusters work.
-
-Neptune is single-database. The `database` argument on the SinkDatabase
-protocol is ignored; tenant / provider isolation is enforced by labels that
-the sync step already writes on every node (see tasks/jobs/attack_paths/sync.py).
-
-SigV4 auth lives at the bottom of this file as `neptune_auth_provider`. The
-neo4j driver invokes the returned callable on each token refresh.
-"""
-
-import atexit
-import datetime
-import json
-import logging
-import threading
-import time
-from collections.abc import Callable, Iterator
-from contextlib import contextmanager
-from typing import Any
-from urllib.parse import urlsplit
-
-import neo4j
-import neo4j.exceptions
-from api.attack_paths.retryable_session import RetryableSession
-from api.attack_paths.sink.base import SinkDatabase
-from api.attack_paths.sink.drop import (
-    NODE_DELETE_QUERY_TEMPLATE,
-    RELATIONSHIP_DELETE_QUERY_TEMPLATES,
-    delete_batches,
-)
-from botocore.auth import SigV4Auth
-from botocore.awsrequest import AWSRequest
-from botocore.session import Session as BotoSession
-from config.env import env
-from django.conf import settings
-from neo4j.auth_management import AuthManagers, ExpiringAuth
-
-logging.getLogger("neo4j").setLevel(logging.ERROR)
-logging.getLogger("neo4j").propagate = False
-
-logger = logging.getLogger(__name__)
-
-SERVICE_UNAVAILABLE_MAX_RETRIES = env.int(
-    "ATTACK_PATHS_SERVICE_UNAVAILABLE_MAX_RETRIES", default=3
-)
-READ_QUERY_TIMEOUT_SECONDS = env.int(
-    "ATTACK_PATHS_READ_QUERY_TIMEOUT_SECONDS", default=30
-)
-# Neptune serverless cold-start can be >30s; give the driver room
-CONN_ACQUISITION_TIMEOUT = env.int("NEPTUNE_CONN_ACQUISITION_TIMEOUT", default=60)
-# TCP connect timeout, ordered below the acquisition timeout so an unreachable
-# endpoint can't pin a request or the readiness probe longer than this. Kept
-# generous: cold-start delays query execution, not the socket connect.
-CONNECTION_TIMEOUT = env.int("NEPTUNE_CONNECTION_TIMEOUT", default=10)
-# Roll connections hourly so SigV4 rotations and cert refreshes don't strand long-lived pool entries
-MAX_CONNECTION_LIFETIME = env.int("NEPTUNE_MAX_CONNECTION_LIFETIME", default=3600)
-MAX_CONNECTION_POOL_SIZE = env.int("NEPTUNE_MAX_CONNECTION_POOL_SIZE", default=50)
-NEPTUNE_WRITE_RETRY_DELAY_SECONDS = 2
-
-READ_EXCEPTION_CODES = [
-    "Neo.ClientError.Statement.AccessMode",
-    "Neo.ClientError.Procedure.ProcedureNotFound",
-]
-CLIENT_STATEMENT_EXCEPTION_PREFIX = "Neo.ClientError.Statement."
-RETRYABLE_WRITE_ERROR_PREFIXES = (
-    "Operation failed due to conflicting concurrent operations",
-    "Operation terminated (deadline exceeded)",
-)
-
-# Refresh 60s before the 5-minute SigV4 window closes
-SIGV4_TOKEN_LIFETIME_MINUTES = 4
-
-
-def _is_retryable_write_error(exc: Exception) -> bool:
-    if not isinstance(exc, neo4j.exceptions.Neo4jError):
-        return False
-    return bool(exc.message and exc.message.startswith(RETRYABLE_WRITE_ERROR_PREFIXES))
-
-
-class NeptuneSink(SinkDatabase):
-    """Neptune-backed sink. Single database; isolation is label-based."""
-
-    def __init__(self) -> None:
-        self._writer: neo4j.Driver | None = None
-        self._reader: neo4j.Driver | None = None
-        self._lock = threading.Lock()
-        self._atexit_registered = False
-
-    # Config
-
-    def _config(self) -> dict:
-        return settings.DATABASES["neptune"]
-
-    def _bolt_uri(self, endpoint: str, port: str) -> str:
-        return f"bolt+s://{endpoint}:{port}"
-
-    def _https_url(self, endpoint: str, port: str) -> str:
-        return f"https://{endpoint}:{port}"
-
-    def _build_driver(self, endpoint: str) -> neo4j.Driver:
-        cfg = self._config()
-        port = cfg["PORT"]
-        region = cfg["REGION"]
-        if not endpoint or not region:
-            raise RuntimeError(
-                "NEPTUNE_WRITER_ENDPOINT and AWS_REGION must be set when "
-                "ATTACK_PATHS_SINK_DATABASE=neptune"
-            )
-        return neo4j.GraphDatabase.driver(
-            self._bolt_uri(endpoint, port),
-            auth=AuthManagers.bearer(
-                neptune_auth_provider(region, self._https_url(endpoint, port))
-            ),
-            keep_alive=True,
-            max_connection_lifetime=MAX_CONNECTION_LIFETIME,
-            connection_timeout=CONNECTION_TIMEOUT,
-            connection_acquisition_timeout=CONN_ACQUISITION_TIMEOUT,
-            max_connection_pool_size=MAX_CONNECTION_POOL_SIZE,
-            max_transaction_retry_time=0,
-        )
-
-    # Lifecycle
-
-    def init(self) -> None:
-        if self._writer is not None:
-            return
-        with self._lock:
-            if self._writer is None:
-                cfg = self._config()
-                writer_endpoint = cfg["WRITER_ENDPOINT"]
-                reader_endpoint = cfg["READER_ENDPOINT"] or writer_endpoint
-
-                # Eager connectivity checks are best-effort
-                # A Neptune that is down at boot must not crash the process, same degradation model as Postgres
-                # Drivers reconnect lazily on first use
-                # /health/ready surfaces the outage until it recovers
-                self._writer = self._build_driver(writer_endpoint)
-                self._verify_best_effort(self._writer, "writer")
-
-                if reader_endpoint == writer_endpoint:
-                    self._reader = self._writer
-
-                else:
-                    self._reader = self._build_driver(reader_endpoint)
-                    self._verify_best_effort(self._reader, "reader")
-
-                if not self._atexit_registered:
-                    atexit.register(self.close)
-                    self._atexit_registered = True
-
-    def close(self) -> None:
-        with self._lock:
-            # `Driver.close()` is idempotent, so closing the same driver twice
-            # (when reader aliases writer on single-endpoint configs) is safe
-            for driver in (self._reader, self._writer):
-                if driver is None:
-                    continue
-                try:
-                    driver.close()
-                except Exception:  # pragma: no cover - best-effort
-                    pass
-            self._writer = None
-            self._reader = None
-
-    # Sessions
-
-    def _get_writer(self) -> neo4j.Driver:
-        self.init()
-        assert self._writer is not None
-        return self._writer
-
-    def _get_reader(self) -> neo4j.Driver:
-        self.init()
-        assert self._reader is not None
-        return self._reader
-
-    @staticmethod
-    def _verify_best_effort(driver: neo4j.Driver, role: str) -> None:
-        try:
-            driver.verify_connectivity()
-
-        except Exception:
-            logger.warning(
-                "Neptune %s endpoint unreachable at init; continuing with a lazily-reconnecting driver",
-                role,
-                exc_info=True,
-            )
-
-    def verify_connectivity(self) -> None:
-        # The API read path uses the reader driver
-        # On single-endpoint clusters it aliases the writer, so this also covers the writer
-        # A writer-only outage is a workers' concern (no HTTP probe there) and deliberately does not fail API readiness
-        self._get_reader().verify_connectivity()
-
-    @contextmanager
-    def get_session(
-        self,
-        database: str | None = None,  # noqa: ARG002 - ignored on Neptune
-        default_access_mode: str | None = None,
-    ) -> Iterator[RetryableSession]:
-        from api.attack_paths.database import (
-            ClientStatementException,
-            GraphDatabaseQueryException,
-            WriteQueryNotAllowedException,
-        )
-
-        driver = (
-            self._get_reader()
-            if default_access_mode == neo4j.READ_ACCESS
-            else self._get_writer()
-        )
-
-        session_wrapper: RetryableSession | None = None
-        try:
-            is_write_session = default_access_mode != neo4j.READ_ACCESS
-            session_wrapper = RetryableSession(
-                session_factory=lambda: driver.session(
-                    default_access_mode=default_access_mode
-                ),
-                max_retries=SERVICE_UNAVAILABLE_MAX_RETRIES,
-                retry_if=_is_retryable_write_error if is_write_session else None,
-                initial_retry_delay_seconds=(
-                    NEPTUNE_WRITE_RETRY_DELAY_SECONDS if is_write_session else 0
-                ),
-            )
-            yield session_wrapper
-
-        except neo4j.exceptions.Neo4jError as exc:
-            if (
-                default_access_mode == neo4j.READ_ACCESS
-                and exc.code
-                and exc.code in READ_EXCEPTION_CODES
-            ):
-                raise WriteQueryNotAllowedException(
-                    message="Read query not allowed", code=READ_EXCEPTION_CODES[0]
-                )
-
-            message = exc.message if exc.message is not None else str(exc)
-            if exc.code and exc.code.startswith(CLIENT_STATEMENT_EXCEPTION_PREFIX):
-                raise ClientStatementException(message=message, code=exc.code)
-            raise GraphDatabaseQueryException(message=message, code=exc.code)
-
-        finally:
-            if session_wrapper is not None:
-                session_wrapper.close()
-
-    # Operations
-
-    def execute_read_query(
-        self,
-        database: str,  # noqa: ARG002 - ignored on Neptune
-        cypher: str,
-        parameters: dict[str, Any] | None = None,
-    ) -> neo4j.graph.Graph:
-        with self.get_session(default_access_mode=neo4j.READ_ACCESS) as session:
-
-            def _run(tx: neo4j.ManagedTransaction) -> neo4j.graph.Graph:
-                result = tx.run(
-                    cypher, parameters or {}, timeout=READ_QUERY_TIMEOUT_SECONDS
-                )
-                return result.graph()
-
-            return session.execute_read(_run)
-
-    def create_database(self, database: str) -> None:  # noqa: ARG002
-        # Neptune clusters are single-database; there is nothing to create.
-        return None
-
-    def drop_database(self, database: str) -> None:  # noqa: ARG002
-        # Neptune clusters are single-database; there is nothing to drop.
-        return None
-
-    def drop_subgraph(self, database: str, provider_id: str) -> int:  # noqa: ARG002
-        """Delete a provider's subgraph in two bounded phases.
-
-        Neptune write transactions are capped at ~2 minutes. A naive
-        `DETACH DELETE` on a label-scanned batch grows unbounded with graph
-        density (one node can drag thousands of relationships into the same
-        transaction). Instead:
-
-        1. Delete relationships incident to provider nodes, one fixed-size
-           batch per transaction.
-        2. Delete the now-orphaned nodes, one fixed-size batch per transaction.
-
-        Each transaction does work proportional to `batch_size`, never to the
-        graph's branching factor.
-        """
-        from tasks.jobs.attack_paths.config import (
-            BATCH_SIZE,
-            PROVIDER_RESOURCE_LABEL,
-            get_provider_label,
-        )
-
-        provider_label = get_provider_label(provider_id)
-        deleted_relationships = 0
-        relationship_batches = 0
-        node_batches = 0
-        drop_t0 = time.perf_counter()
-
-        logger.info(
-            "Dropping provider graph from Neptune sink "
-            "(provider=%s, provider_label=%s)",
-            provider_id,
-            provider_label,
-        )
-
-        logger.info(
-            "Opening Neptune writer session for provider graph drop (provider=%s)",
-            provider_id,
-        )
-        with self.get_session() as session:
-            logger.info(
-                "Opened Neptune writer session for provider graph drop (provider=%s)",
-                provider_id,
-            )
-            for phase, query_template in RELATIONSHIP_DELETE_QUERY_TEMPLATES.items():
-                deleted_relationships, phase_batches = delete_batches(
-                    session=session,
-                    logger=logger,
-                    log_target="Neptune sink",
-                    provider_id=provider_id,
-                    query=query_template.format(provider_label=provider_label),
-                    phase=phase,
-                    count_key="deleted_rels_count",
-                    total_key="rels",
-                    deleted_key="deleted_rels",
-                    initial_total=deleted_relationships,
-                    batch_size=BATCH_SIZE,
-                    drop_t0=drop_t0,
-                )
-                relationship_batches += phase_batches
-
-            deleted_nodes, node_batches = delete_batches(
-                session=session,
-                logger=logger,
-                log_target="Neptune sink",
-                provider_id=provider_id,
-                query=NODE_DELETE_QUERY_TEMPLATE.format(
-                    provider_label=provider_label,
-                    provider_resource_label=PROVIDER_RESOURCE_LABEL,
-                ),
-                phase="node",
-                count_key="deleted_nodes_count",
-                total_key="nodes",
-                deleted_key="deleted_nodes",
-                initial_total=0,
-                batch_size=BATCH_SIZE,
-                drop_t0=drop_t0,
-            )
-
-        logger.info(
-            "Finished dropping provider graph from Neptune sink "
-            "(provider=%s, relationship_batches=%s, deleted_rels=%s, "
-            "node_batches=%s, deleted_nodes=%s, elapsed=%.3fs)",
-            provider_id,
-            relationship_batches,
-            deleted_relationships,
-            node_batches,
-            deleted_nodes,
-            time.perf_counter() - drop_t0,
-        )
-        return deleted_nodes
-
-    def has_provider_data(self, database: str, provider_id: str) -> bool:  # noqa: ARG002
-        from tasks.jobs.attack_paths.config import (
-            PROVIDER_RESOURCE_LABEL,
-            get_provider_label,
-        )
-
-        provider_label = get_provider_label(provider_id)
-        query = (
-            f"MATCH (n:{PROVIDER_RESOURCE_LABEL}:`{provider_label}`) RETURN 1 LIMIT 1"
-        )
-        with self.get_session(default_access_mode=neo4j.READ_ACCESS) as session:
-            result = session.run(query)
-            return result.single() is not None
-
-    def clear_cache(self, database: str) -> None:  # noqa: ARG002
-        # Neptune has no user-facing cache-clear procedure; no-op.
-        return None
-
-    # Sync write path
-
-    def ensure_sync_indexes(self, database: str) -> None:  # noqa: ARG002
-        # Neptune routes node and relationship lookups through `~id`, which is the cluster's primary key
-        # No additional index is needed or supported
-        return None
-
-    def write_nodes(
-        self,
-        database: str,  # noqa: ARG002
-        labels: str,
-        rows: list[dict[str, Any]],
-    ) -> None:
-        if not rows:
-            return
-        from tasks.jobs.attack_paths.config import (
-            PROVIDER_ELEMENT_ID_PROPERTY,
-            PROVIDER_RESOURCE_LABEL,
-        )
-
-        # MERGE on `~id` is the documented and engine-optimized idempotent
-        # upsert pattern for Neptune openCypher. The label inside the MERGE
-        # matters: Neptune assigns a default `vertex` label to any node
-        # created without an explicit one, so we pin `_ProviderResource`
-        # (which every synced node carries anyway) at MERGE-time. Additional
-        # labels are added after
-        #
-        # We also write `_provider_element_id` as a regular property so
-        # non-sync code (drop_subgraph, query helpers) keeps a stable contract
-        # that doesn't know about `~id`
-        query = f"""
-            UNWIND $rows AS row
-            MERGE (n:`{PROVIDER_RESOURCE_LABEL}` {{`~id`: row.provider_element_id}})
-            SET n:{labels}
-            SET n += row.props
-            SET n.`{PROVIDER_ELEMENT_ID_PROPERTY}` = row.provider_element_id
-        """
-        with self.get_session() as session:
-            session.execute_write(lambda tx: tx.run(query, {"rows": rows}).consume())
-
-    def write_relationships(
-        self,
-        database: str,  # noqa: ARG002
-        rel_type: str,
-        provider_id: str,  # noqa: ARG002 - encoded in start/end `~id` already
-        rows: list[dict[str, Any]],
-    ) -> None:
-        if not rows:
-            return
-        from tasks.jobs.attack_paths.config import PROVIDER_ELEMENT_ID_PROPERTY
-
-        # `id(n) = $value` is Neptune's parameterized fast path; both endpoint
-        # MATCHes resolve in O(1) via the system `~id`, so per-row work stays
-        # bounded regardless of batch size
-        query = f"""
-            UNWIND $rows AS row
-            MATCH (s) WHERE id(s) = row.start_element_id
-            MATCH (e) WHERE id(e) = row.end_element_id
-            MERGE (s)-[r:`{rel_type}` {{`{PROVIDER_ELEMENT_ID_PROPERTY}`: row.provider_element_id}}]->(e)
-            SET r += row.props
-        """
-        with self.get_session() as session:
-            session.execute_write(lambda tx: tx.run(query, {"rows": rows}).consume())
-
-    # Test helpers
-
-    def get_writer(self) -> neo4j.Driver:
-        return self._get_writer()
-
-    def get_reader(self) -> neo4j.Driver:
-        return self._get_reader()
-
-
-# SigV4 auth provider
-
-
-class _NeptuneAuthToken(neo4j.Auth):
-    """Neo4j Auth backed by a SigV4-signed GET to `/opencypher`."""
-
-    def __init__(self, region: str, url: str) -> None:
-        session = BotoSession()
-        credentials = session.get_credentials()
-        if credentials is None:
-            raise RuntimeError(
-                "No AWS credentials available for Neptune SigV4 signing. "
-                "Ensure the boto3 credential chain can resolve."
-            )
-        credentials = credentials.get_frozen_credentials()
-
-        request = AWSRequest(method="GET", url=url + "/opencypher")
-        # SigV4 canonical Host must carry the real `host:port`
-        # Neptune runs on a non-default port (8182), so `.hostname` would drop it and break signing
-        request.headers.add_header("Host", urlsplit(url).netloc)
-        SigV4Auth(credentials, "neptune-db", region).add_auth(request)
-
-        auth_obj = {
-            header: request.headers[header]
-            for header in (
-                "Authorization",
-                "X-Amz-Date",
-                "X-Amz-Security-Token",
-                "Host",
-            )
-            if header in request.headers
-        }
-        auth_obj["HttpMethod"] = "GET"
-
-        super().__init__("basic", "username", json.dumps(auth_obj))
-
-
-def neptune_auth_provider(region: str, https_url: str) -> Callable[[], ExpiringAuth]:
-    """Return a callable the neo4j driver can invoke to refresh credentials."""
-
-    def _provider() -> ExpiringAuth:
-        token = _NeptuneAuthToken(region, https_url)
-        expires_at = (
-            datetime.datetime.now(datetime.UTC)
-            + datetime.timedelta(minutes=SIGV4_TOKEN_LIFETIME_MINUTES)
-        ).timestamp()
-        return ExpiringAuth(auth=token, expires_at=expires_at)
-
-    return _provider

api/src/backend/api/attack_paths/views_helpers.py

@@ -1,11 +1,12 @@
 import logging
-from collections.abc import Iterable
-from typing import Any
+
+from typing import Any, Iterable
 
 import neo4j
-from api.attack_paths import AttackPathsQueryDefinition
-from api.attack_paths import database as graph_database
-from api.attack_paths import sink as sink_module
+
+from rest_framework.exceptions import APIException, PermissionDenied, ValidationError
+
+from api.attack_paths import database as graph_database, AttackPathsQueryDefinition
 from api.attack_paths.cypher_sanitizer import (
     inject_provider_label,
     validate_custom_query,
@@ -15,10 +16,7 @@ from api.attack_paths.queries.schema import (
     RAW_SCHEMA_URL,
     get_cartography_schema_query,
 )
-from api.models import AttackPathsScan
 from config.custom_logging import BackendLogger
-from config.env import env
-from rest_framework.exceptions import APIException, PermissionDenied, ValidationError
 from tasks.jobs.attack_paths.config import (
     INTERNAL_LABELS,
     INTERNAL_PROPERTIES,
@@ -29,10 +27,6 @@ from tasks.jobs.attack_paths.config import (
 logger = logging.getLogger(BackendLogger.API)
 
 
-def _custom_query_timeout_ms() -> int:
-    return env.int("ATTACK_PATHS_READ_QUERY_TIMEOUT_SECONDS", default=30) * 1000
-
-
 # Predefined query helpers
 
 
@@ -109,13 +103,13 @@ def execute_query(
     definition: AttackPathsQueryDefinition,
     parameters: dict[str, Any],
     provider_id: str,
-    scan: AttackPathsScan,
 ) -> dict[str, Any]:
     try:
-        # TODO: drop after Neptune cutover
-        # Route reads by the scan row's recorded sink, not by current settings.
-        backend = sink_module.get_backend_for_scan(scan)
-        graph = backend.execute_read_query(database_name, definition.cypher, parameters)
+        graph = graph_database.execute_read_query(
+            database=database_name,
+            cypher=definition.cypher,
+            parameters=parameters,
+        )
         return _serialize_graph(graph, provider_id)
 
     except graph_database.WriteQueryNotAllowedException:
@@ -149,31 +143,22 @@ def execute_custom_query(
     database_name: str,
     cypher: str,
     provider_id: str,
-    scan: AttackPathsScan,
 ) -> dict[str, Any]:
     # Defense-in-depth for custom queries:
-    # 1. `neo4j.READ_ACCESS` — prevents mutations at the driver level
-    # 2. `inject_provider_label()` — regex-based label injection scopes node patterns
-    # 3. `_serialize_graph()` — post-query filter drops nodes without the provider label
-    # 4. `USING QUERY:TIMEOUTMILLISECONDS` on Neptune — server-side runaway cutoff
+    # 1. neo4j.READ_ACCESS — prevents mutations at the driver level
+    # 2. inject_provider_label() — regex-based label injection scopes node patterns
+    # 3. _serialize_graph() — post-query filter drops nodes without the provider label
     #
     # Layer 2 is best-effort (regex can't fully parse Cypher);
     # layer 3 is the safety net that guarantees provider isolation.
     validate_custom_query(cypher)
     cypher = inject_provider_label(cypher, provider_id)
 
-    # TODO: drop after Neptune cutover
-    backend = sink_module.get_backend_for_scan(scan)
-
-    # Neptune enforces a cluster-level query timeout; prepending the hint
-    # makes the limit explicit and matches the client-side read timeout.
-    # Applies only when the scan's graph lives in Neptune.
-    if getattr(scan, "sink_backend", None) == "neptune":
-        timeout_ms = _custom_query_timeout_ms()
-        cypher = f"USING QUERY:TIMEOUTMILLISECONDS {timeout_ms}\n{cypher}"
-
     try:
-        graph = backend.execute_read_query(database_name, cypher, None)
+        graph = graph_database.execute_read_query(
+            database=database_name,
+            cypher=cypher,
+        )
         serialized = _serialize_graph(graph, provider_id)
         return _truncate_graph(serialized)
 
@@ -196,11 +181,10 @@ def execute_custom_query(
 
 
 def get_cartography_schema(
-    database_name: str, provider_id: str, scan: AttackPathsScan
+    database_name: str, provider_id: str
 ) -> dict[str, str] | None:
     try:
-        backend = sink_module.get_backend_for_scan(scan)
-        with backend.get_session(
+        with graph_database.get_session(
             database_name, default_access_mode=neo4j.READ_ACCESS
         ) as session:
             result = session.run(get_cartography_schema_query(provider_id))

api/src/backend/api/authentication.py

@@ -1,19 +1,18 @@
-from math import isfinite
+from typing import Optional, Tuple
 from uuid import UUID
 
-from api.db_router import MainRouter
-from api.models import TenantAPIKey, TenantAPIKeyManager
 from cryptography.fernet import InvalidToken
-from django.core.exceptions import ObjectDoesNotExist
 from django.utils import timezone
 from drf_simple_apikey.backends import APIKeyAuthentication as BaseAPIKeyAuth
 from drf_simple_apikey.crypto import get_crypto
-from drf_simple_apikey.settings import package_settings
 from rest_framework.authentication import BaseAuthentication
 from rest_framework.exceptions import AuthenticationFailed
 from rest_framework.request import Request
 from rest_framework_simplejwt.authentication import JWTAuthentication
 
+from api.db_router import MainRouter
+from api.models import TenantAPIKey, TenantAPIKeyManager
+
 
 class TenantAPIKeyAuthentication(BaseAPIKeyAuth):
     model = TenantAPIKey
@@ -24,49 +23,18 @@ class TenantAPIKeyAuthentication(BaseAPIKeyAuth):
     def _authenticate_credentials(self, request, key):
         """
         Override to use admin connection, bypassing RLS during authentication.
+        Delegates to parent after temporarily routing model queries to admin DB.
         """
-        try:
-            payload = self.key_crypto.decrypt(key)
-        except ValueError:
-            raise AuthenticationFailed("Invalid API Key.")
-
-        if not isinstance(payload, dict):
-            raise AuthenticationFailed("Invalid API Key.")
-
-        payload_pk = payload.get("_pk")
-        payload_exp = payload.get("_exp")
-        if (
-            not isinstance(payload_pk, str)
-            or isinstance(payload_exp, bool)
-            or not isinstance(payload_exp, (int, float))
-            or not isfinite(payload_exp)
-        ):
-            raise AuthenticationFailed("Invalid API Key.")
+        # Temporarily point the model's manager to admin database
+        original_objects = self.model.objects
+        self.model.objects = self.model.objects.using(MainRouter.admin_db)
 
         try:
-            api_key_pk = UUID(payload_pk)
-        except ValueError:
-            raise AuthenticationFailed("Invalid API Key.")
-
-        if payload_exp < timezone.now().timestamp():
-            raise AuthenticationFailed("API Key has already expired.")
-
-        try:
-            api_key = self.model.objects.using(MainRouter.admin_db).get(id=api_key_pk)
-        except ObjectDoesNotExist:
-            raise AuthenticationFailed("No entity matching this api key.")
-
-        if api_key.revoked:
-            raise AuthenticationFailed("This API Key has been revoked.")
-
-        client_ip = request.META.get(package_settings.IP_ADDRESS_HEADER)
-        if api_key.blacklisted_ips and client_ip in api_key.blacklisted_ips:
-            raise AuthenticationFailed("Access denied from blacklisted IP.")
-
-        if api_key.whitelisted_ips and client_ip not in api_key.whitelisted_ips:
-            raise AuthenticationFailed("Access restricted to specific IP addresses.")
-
-        return api_key.entity, key
+            # Call parent method which will now use admin database
+            return super()._authenticate_credentials(request, key)
+        finally:
+            # Restore original manager
+            self.model.objects = original_objects
 
     def authenticate(self, request: Request):
         prefixed_key = self.get_key(request)
@@ -113,7 +81,7 @@ class CombinedJWTOrAPIKeyAuthentication(BaseAuthentication):
     jwt_auth = JWTAuthentication()
     api_key_auth = TenantAPIKeyAuthentication()
 
-    def authenticate(self, request: Request) -> tuple[object, dict] | None:
+    def authenticate(self, request: Request) -> Optional[Tuple[object, dict]]:
         auth_header = request.headers.get("Authorization", "")
 
         # Prioritize JWT authentication if both are present
@@ -125,30 +93,3 @@ class CombinedJWTOrAPIKeyAuthentication(BaseAuthentication):
 
         # Default fallback
         return self.jwt_auth.authenticate(request)
-
-
-class SSEAuthentication(CombinedJWTOrAPIKeyAuthentication):
-    """JWT/API-Key auth that also accepts `?access_token=<jwt>`.
-
-    Browser `EventSource` is the only widely available SSE client API
-    and it cannot set the `Authorization` header (its constructor takes
-    only a URL and `withCredentials`). To keep browser SSE clients on
-    the same auth stack as the rest of the API, SSE endpoints additionally
-    accept a JWT via the `?access_token=<jwt>` query parameter — the
-    standard parameter name defined in RFC 6750 Section 2.3 for bearer tokens.
-    """
-
-    def authenticate(self, request: Request):
-        auth_header = request.headers.get("Authorization", "")
-        if auth_header:
-            return super().authenticate(request)
-
-        raw_token = request.query_params.get("access_token")
-        if not raw_token:
-            # No header and no query token — let the default path raise
-            # the canonical AuthenticationFailed via the parent class.
-            return super().authenticate(request)
-
-        validated_token = self.jwt_auth.get_validated_token(raw_token)
-        user = self.jwt_auth.get_user(validated_token)
-        return user, validated_token

api/src/backend/api/base_views.py

@@ -1,9 +1,3 @@
-from api.authentication import CombinedJWTOrAPIKeyAuthentication
-from api.db_router import MainRouter, reset_read_db_alias, set_read_db_alias
-from api.db_utils import POSTGRES_USER_VAR, rls_transaction
-from api.filters import CustomDjangoFilterBackend
-from api.models import Role, UserRoleRelationship
-from api.rbac.permissions import HasPermissions
 from django.conf import settings
 from django.db import transaction
 from rest_framework import permissions
@@ -14,6 +8,13 @@ from rest_framework.response import Response
 from rest_framework_json_api import filters
 from rest_framework_json_api.views import ModelViewSet
 
+from api.authentication import CombinedJWTOrAPIKeyAuthentication
+from api.db_router import MainRouter, reset_read_db_alias, set_read_db_alias
+from api.db_utils import POSTGRES_USER_VAR, rls_transaction
+from api.filters import CustomDjangoFilterBackend
+from api.models import Role, UserRoleRelationship
+from api.rbac.permissions import HasPermissions
+
 
 class BaseViewSet(ModelViewSet):
     authentication_classes = [CombinedJWTOrAPIKeyAuthentication]

api/src/backend/api/compliance.py

@@ -1,26 +1,11 @@
-import logging
-import threading
 from collections.abc import Iterable, Mapping
 
 from api.models import Provider
-from prowler.lib.check.compliance_models import (
-    get_bulk_compliance_frameworks_universal,
-)
+from prowler.lib.check.compliance_models import Compliance
 from prowler.lib.check.models import CheckMetadata
 
-logger = logging.getLogger(__name__)
-
 AVAILABLE_COMPLIANCE_FRAMEWORKS = {}
 
-# Per-process readiness flags for the background compliance warm-up.
-# `STARTED` is set as soon as warming begins (only happens under Gunicorn via
-# the post_fork hook); `WARMED` is set when it finishes. The attributes
-# endpoint checks both: it returns 503 only while warming is in progress.
-# Under `runserver` warming never runs, so `STARTED` stays clear and the
-# endpoint keeps lazy-loading as before.
-COMPLIANCE_WARMING_STARTED = threading.Event()
-COMPLIANCE_WARMED = threading.Event()
-
 
 class LazyComplianceTemplate(Mapping):
     """Lazy-load compliance templates per provider on first access."""
@@ -109,22 +94,25 @@ PROWLER_CHECKS = LazyChecksMapping()
 
 
 def get_compliance_frameworks(provider_type: Provider.ProviderChoices) -> list[str]:
-    """List compliance framework identifiers available for `provider_type`.
+    """List compliance frameworks the API can load for `provider_type`.
 
-    Includes both per-provider frameworks and universal top-level frameworks
-    (e.g. ``dora_2022_2554``, ``csa_ccm_4.0``).
+    The list is sourced from `Compliance.get_bulk` so that the names
+    returned here are guaranteed to be loadable by the bulk loader. This
+    prevents downstream key mismatches (e.g. CSV report generation iterating
+    framework names and looking them up in the bulk dict).
 
     Args:
-        provider_type (Provider.ProviderChoices): The cloud provider type
-            (e.g., "aws", "azure", "gcp", "m365").
+        provider_type (Provider.ProviderChoices): The cloud provider type for which to retrieve
+            available compliance frameworks (e.g., "aws", "azure", "gcp", "m365").
 
     Returns:
-        list[str]: Framework identifiers (e.g., "cis_1.4_aws", "dora_2022_2554").
+        list[str]: A list of framework identifiers (e.g., "cis_1.4_aws", "mitre_attack_azure") available
+        for the given provider.
     """
     global AVAILABLE_COMPLIANCE_FRAMEWORKS
     if provider_type not in AVAILABLE_COMPLIANCE_FRAMEWORKS:
         AVAILABLE_COMPLIANCE_FRAMEWORKS[provider_type] = list(
-            get_bulk_compliance_frameworks_universal(provider_type).keys()
+            Compliance.get_bulk(provider_type).keys()
         )
 
     return AVAILABLE_COMPLIANCE_FRAMEWORKS[provider_type]
@@ -151,14 +139,18 @@ def get_prowler_provider_compliance(provider_type: Provider.ProviderChoices) ->
     """
     Retrieve the Prowler compliance data for a specified provider type.
 
+    This function fetches the compliance frameworks and their associated
+    requirements for the given cloud provider.
+
     Args:
         provider_type (Provider.ProviderChoices): The provider type
             (e.g., 'aws', 'azure') for which to retrieve compliance data.
 
     Returns:
-        dict: Mapping of framework name to `ComplianceFramework` for the provider.
+        dict: A dictionary mapping compliance framework names to their respective
+            Compliance objects for the specified provider.
     """
-    return get_bulk_compliance_frameworks_universal(provider_type)
+    return Compliance.get_bulk(provider_type)
 
 
 def _load_provider_assets(provider_type: Provider.ProviderChoices) -> tuple[dict, dict]:
@@ -187,56 +179,6 @@ def _ensure_provider_loaded(provider_type: Provider.ProviderChoices) -> None:
         PROWLER_CHECKS._cache[provider_type] = checks
 
 
-def warm_compliance_caches(
-    provider_types: Iterable[str] | None = None,
-) -> list[str]:
-    """
-    Eagerly populate the per-process compliance caches at server startup.
-
-    Moves the cold-cache catalog load off the request thread so the first
-    request does not trip the Gunicorn worker timeout. Reads only on-disk
-    metadata (no database access). Each provider is warmed in isolation;
-    failures are logged and fall back to lazy loading.
-
-    Args:
-        provider_types (Iterable[str] | None): Subset to warm. Defaults to all.
-
-    Returns:
-        list[str]: Provider types that could not be warmed.
-    """
-    if provider_types is None:
-        provider_types = Provider.ProviderChoices.values
-    provider_types = list(provider_types)
-
-    COMPLIANCE_WARMING_STARTED.set()
-    logger.info("Compliance cache warm-up started for providers: %s", provider_types)
-
-    failed = []
-    for provider_type in provider_types:
-        try:
-            get_compliance_frameworks(provider_type)
-            _ensure_provider_loaded(provider_type)
-        # Prowler check loading may sys.exit (SystemExit, not Exception).
-        except (Exception, SystemExit):
-            logger.warning(
-                "Failed to warm compliance caches for provider '%s'; "
-                "loading lazily on first request",
-                provider_type,
-                exc_info=True,
-            )
-            failed.append(provider_type)
-
-    # Mark as warmed even when some providers failed: a failed provider falls
-    # back to a single-provider lazy load, which stays under the worker timeout.
-    COMPLIANCE_WARMED.set()
-    logger.info(
-        "Compliance cache warm-up finished (providers warmed: %d, failed: %s)",
-        len(provider_types) - len(failed),
-        failed,
-    )
-    return failed
-
-
 def load_prowler_checks(
     prowler_compliance, provider_types: Iterable[str] | None = None
 ):
@@ -267,8 +209,8 @@ def load_prowler_checks(
         for compliance_name, compliance_data in prowler_compliance.get(
             provider_type, {}
         ).items():
-            for requirement in compliance_data.requirements:
-                for check in requirement.checks.get(provider_type, []):
+            for requirement in compliance_data.Requirements:
+                for check in requirement.Checks:
                     try:
                         checks[provider_type][check].add(compliance_name)
                     except KeyError:
@@ -348,40 +290,24 @@ def generate_compliance_overview_template(
             requirements_status = {"passed": 0, "failed": 0, "manual": 0}
             total_requirements = 0
 
-            for requirement in compliance_data.requirements:
+            for requirement in compliance_data.Requirements:
                 total_requirements += 1
-                provider_check_list = list(requirement.checks.get(provider_type, []))
-                total_checks = len(provider_check_list)
-                checks_dict = dict.fromkeys(provider_check_list)
+                total_checks = len(requirement.Checks)
+                checks_dict = {check: None for check in requirement.Checks}
 
                 req_status_val = "MANUAL" if total_checks == 0 else "PASS"
 
-                # MITRE attrs are wrapped under `_raw_attributes` by the
-                # universal adapter — unwrap so consumers see the flat list.
-                requirement_attributes = requirement.attributes
-                if (
-                    isinstance(requirement_attributes, dict)
-                    and "_raw_attributes" in requirement_attributes
-                ):
-                    attributes_payload = list(requirement_attributes["_raw_attributes"])
-                elif isinstance(requirement_attributes, dict):
-                    attributes_payload = (
-                        [dict(requirement_attributes)] if requirement_attributes else []
-                    )
-                else:
-                    attributes_payload = [
-                        dict(attribute) for attribute in requirement_attributes
-                    ]
-
                 # Build requirement dictionary
                 requirement_dict = {
-                    "name": requirement.name or requirement.id,
-                    "description": requirement.description,
-                    "tactics": requirement.tactics or [],
-                    "subtechniques": requirement.sub_techniques or [],
-                    "platforms": requirement.platforms or [],
-                    "technique_url": requirement.technique_url or "",
-                    "attributes": attributes_payload,
+                    "name": requirement.Name or requirement.Id,
+                    "description": requirement.Description,
+                    "tactics": getattr(requirement, "Tactics", []),
+                    "subtechniques": getattr(requirement, "SubTechniques", []),
+                    "platforms": getattr(requirement, "Platforms", []),
+                    "technique_url": getattr(requirement, "TechniqueURL", ""),
+                    "attributes": [
+                        dict(attribute) for attribute in requirement.Attributes
+                    ],
                     "checks": checks_dict,
                     "checks_status": {
                         "pass": 0,
@@ -399,15 +325,15 @@ def generate_compliance_overview_template(
                     requirements_status["passed"] += 1
 
                 # Add requirement to compliance requirements
-                compliance_requirements[requirement.id] = requirement_dict
+                compliance_requirements[requirement.Id] = requirement_dict
 
             # Build compliance dictionary
             compliance_dict = {
-                "framework": compliance_data.framework,
-                "name": compliance_data.name,
-                "version": compliance_data.version,
+                "framework": compliance_data.Framework,
+                "name": compliance_data.Name,
+                "version": compliance_data.Version,
                 "provider": provider_type,
-                "description": compliance_data.description,
+                "description": compliance_data.Description,
                 "requirements": compliance_requirements,
                 "requirements_status": requirements_status,
                 "total_requirements": total_requirements,

api/src/backend/api/db_utils.py

@@ -3,14 +3,8 @@ import secrets
 import time
 import uuid
 from contextlib import contextmanager
-from datetime import UTC, datetime, timedelta
+from datetime import datetime, timedelta, timezone
 
-from api.db_router import (
-    READ_REPLICA_ALIAS,
-    get_read_db_alias,
-    reset_read_db_alias,
-    set_read_db_alias,
-)
 from celery.utils.log import get_task_logger
 from config.env import env
 from django.conf import settings
@@ -28,6 +22,13 @@ from psycopg2 import sql as psycopg2_sql
 from psycopg2.extensions import AsIs, new_type, register_adapter, register_type
 from rest_framework_json_api.serializers import ValidationError
 
+from api.db_router import (
+    READ_REPLICA_ALIAS,
+    get_read_db_alias,
+    reset_read_db_alias,
+    set_read_db_alias,
+)
+
 logger = get_task_logger(__name__)
 
 DB_USER = settings.DATABASES["default"]["USER"] if not settings.TESTING else "test"
@@ -169,7 +170,7 @@ def one_week_from_now():
     """
     Return a datetime object with a date one week from now.
     """
-    return datetime.now(UTC) + timedelta(days=7)
+    return datetime.now(timezone.utc) + timedelta(days=7)
 
 
 def generate_random_token(length: int = 14, symbols: str | None = None) -> str:
@@ -404,10 +405,10 @@ def _should_create_index_on_partition(
             # Unknown month abbreviation, include it to be safe
             return True
 
-        partition_date = datetime(year, month, 1, tzinfo=UTC)
+        partition_date = datetime(year, month, 1, tzinfo=timezone.utc)
 
         # Get current month start
-        now = datetime.now(UTC)
+        now = datetime.now(timezone.utc)
         current_month_start = now.replace(
             day=1, hour=0, minute=0, second=0, microsecond=0
         )

api/src/backend/api/decorators.py

@@ -1,13 +1,14 @@
 import uuid
 from functools import wraps
 
+from django.core.exceptions import ObjectDoesNotExist
+from django.db import DatabaseError, connection, transaction
+from rest_framework_json_api.serializers import ValidationError
+
 from api.db_router import READ_REPLICA_ALIAS
 from api.db_utils import POSTGRES_TENANT_VAR, SET_CONFIG_QUERY, rls_transaction
 from api.exceptions import ProviderDeletedException
 from api.models import Provider, Scan
-from django.core.exceptions import ObjectDoesNotExist
-from django.db import DatabaseError, connection, transaction
-from rest_framework_json_api.serializers import ValidationError
 
 
 def set_tenant(func=None, *, keep_tenant=False):

api/src/backend/api/exceptions.py

@@ -187,32 +187,6 @@ class UpstreamServiceUnavailableError(APIException):
         )
 
 
-class ComplianceWarmingError(APIException):
-    """Compliance catalog is still warming (503 Service Unavailable).
-
-    Returned by the compliance attributes endpoint while the per-process
-    catalog warm-up is in progress, so the request thread never triggers the
-    slow cold load that would trip the Gunicorn worker timeout.
-    """
-
-    status_code = status.HTTP_503_SERVICE_UNAVAILABLE
-    default_detail = (
-        "Compliance data is still loading. Please try again in a few seconds."
-    )
-    default_code = "compliance_warming"
-
-    def __init__(self, detail=None):
-        super().__init__(
-            detail=[
-                {
-                    "detail": detail or self.default_detail,
-                    "status": str(self.status_code),
-                    "code": self.default_code,
-                }
-            ]
-        )
-
-
 class UpstreamInternalError(APIException):
     """Unexpected error communicating with provider (500 Internal Server Error).
 

api/src/backend/api/filters.py

@@ -1,4 +1,19 @@
-from datetime import UTC, date, datetime, timedelta
+from datetime import date, datetime, timedelta, timezone
+
+from dateutil.parser import parse
+from django.conf import settings
+from django.db.models import F, Q
+from django_filters.rest_framework import (
+    BaseInFilter,
+    BooleanFilter,
+    CharFilter,
+    ChoiceFilter,
+    DateFilter,
+    FilterSet,
+    UUIDFilter,
+)
+from rest_framework_json_api.django_filters.backends import DjangoFilterBackend
+from rest_framework_json_api.serializers import ValidationError
 
 from api.constants import SEVERITY_ORDER
 from api.db_utils import (
@@ -53,21 +68,6 @@ from api.uuid_utils import (
     uuid7_start,
 )
 from api.v1.serializers import TaskBase
-from dateutil.parser import parse
-from django.conf import settings
-from django.db.models import F, Q
-from django_filters.rest_framework import (
-    BaseInFilter,
-    BooleanFilter,
-    CharFilter,
-    ChoiceFilter,
-    DateFilter,
-    FilterSet,
-    UUIDFilter,
-)
-from rest_framework_json_api.django_filters.backends import DjangoFilterBackend
-from rest_framework_json_api.serializers import ValidationError
-from uuid6 import UUID
 
 
 class CustomDjangoFilterBackend(DjangoFilterBackend):
@@ -102,7 +102,7 @@ class BaseProviderFilter(FilterSet):
     """
     Abstract base filter for models with direct FK to Provider.
 
-    Provides standard provider_id, provider_type, and provider_groups filters.
+    Provides standard provider_id and provider_type filters.
     Subclasses must define Meta.model.
     """
 
@@ -116,16 +116,6 @@ class BaseProviderFilter(FilterSet):
         choices=Provider.ProviderChoices.choices,
         lookup_expr="in",
     )
-    provider_groups = UUIDFilter(
-        field_name="provider__provider_groups__id",
-        lookup_expr="exact",
-        distinct=True,
-    )
-    provider_groups__in = UUIDInFilter(
-        field_name="provider__provider_groups__id",
-        lookup_expr="in",
-        distinct=True,
-    )
 
     class Meta:
         abstract = True
@@ -136,7 +126,7 @@ class BaseScanProviderFilter(FilterSet):
     """
     Abstract base filter for models with FK to Scan (and Scan has FK to Provider).
 
-    Provides standard provider_id, provider_type, and provider_groups filters via scan relationship.
+    Provides standard provider_id and provider_type filters via scan relationship.
     Subclasses must define Meta.model.
     """
 
@@ -150,16 +140,6 @@ class BaseScanProviderFilter(FilterSet):
         choices=Provider.ProviderChoices.choices,
         lookup_expr="in",
     )
-    provider_groups = UUIDFilter(
-        field_name="scan__provider__provider_groups__id",
-        lookup_expr="exact",
-        distinct=True,
-    )
-    provider_groups__in = UUIDInFilter(
-        field_name="scan__provider__provider_groups__id",
-        lookup_expr="in",
-        distinct=True,
-    )
 
     class Meta:
         abstract = True
@@ -180,16 +160,6 @@ class CommonFindingFilters(FilterSet):
     provider_type__in = ChoiceInFilter(
         choices=Provider.ProviderChoices.choices, field_name="scan__provider__provider"
     )
-    provider_groups = UUIDFilter(
-        field_name="scan__provider__provider_groups__id",
-        lookup_expr="exact",
-        distinct=True,
-    )
-    provider_groups__in = UUIDInFilter(
-        field_name="scan__provider__provider_groups__id",
-        lookup_expr="in",
-        distinct=True,
-    )
     provider_uid = CharFilter(field_name="scan__provider__uid", lookup_expr="exact")
     provider_uid__in = CharInFilter(field_name="scan__provider__uid", lookup_expr="in")
     provider_uid__icontains = CharFilter(
@@ -400,12 +370,6 @@ class ProviderFilter(FilterSet):
         choices=Provider.ProviderChoices.choices,
         lookup_expr="in",
     )
-    provider_groups = UUIDFilter(
-        field_name="provider_groups__id", lookup_expr="exact", distinct=True
-    )
-    provider_groups__in = UUIDInFilter(
-        field_name="provider_groups__id", lookup_expr="in", distinct=True
-    )
 
     class Meta:
         model = Provider
@@ -431,16 +395,6 @@ class ProviderRelationshipFilterSet(FilterSet):
     provider_type__in = ChoiceInFilter(
         choices=Provider.ProviderChoices.choices, field_name="provider__provider"
     )
-    provider_groups = UUIDFilter(
-        field_name="provider__provider_groups__id",
-        lookup_expr="exact",
-        distinct=True,
-    )
-    provider_groups__in = UUIDInFilter(
-        field_name="provider__provider_groups__id",
-        lookup_expr="in",
-        distinct=True,
-    )
     provider_uid = CharFilter(field_name="provider__uid", lookup_expr="exact")
     provider_uid__in = CharInFilter(field_name="provider__uid", lookup_expr="in")
     provider_uid__icontains = CharFilter(
@@ -598,12 +552,12 @@ class ResourceFilter(ProviderRelationshipFilterSet):
         gte_date = (
             parse(self.data.get("updated_at__gte")).date()
             if self.data.get("updated_at__gte")
-            else datetime.now(UTC).date()
+            else datetime.now(timezone.utc).date()
         )
         lte_date = (
             parse(self.data.get("updated_at__lte")).date()
             if self.data.get("updated_at__lte")
-            else datetime.now(UTC).date()
+            else datetime.now(timezone.utc).date()
         )
 
         if abs(lte_date - gte_date) > timedelta(
@@ -673,32 +627,35 @@ class LatestResourceFilter(ProviderRelationshipFilterSet):
         return queryset.filter(tags__text_search=value)
 
 
-FINDING_BASE_FILTER_FIELDS = {
-    "id": ["exact", "in"],
-    "uid": ["exact", "in"],
-    "scan": ["exact", "in"],
-    "delta": ["exact", "in"],
-    "status": ["exact", "in"],
-    "severity": ["exact", "in"],
-    "impact": ["exact", "in"],
-    "check_id": ["exact", "in", "icontains"],
-}
-
-
-class BaseFindingFilter(CommonFindingFilters):
-    DATE_FILTER_FIELDS = ()
-    DATE_FILTER_NAMES = ()
-    DATE_RANGE_HELP_TEXT = (
-        f"Maximum date range is {settings.FINDINGS_MAX_DAYS_IN_RANGE} days."
-    )
-    DATE_FILTER_REQUIRED_DETAIL = "At least one date filter is required."
-
+class FindingFilter(CommonFindingFilters):
     scan = UUIDFilter(method="filter_scan_id")
     scan__in = UUIDInFilter(method="filter_scan_id_in")
 
+    inserted_at = DateFilter(method="filter_inserted_at", lookup_expr="date")
+    inserted_at__date = DateFilter(method="filter_inserted_at", lookup_expr="date")
+    inserted_at__gte = DateFilter(
+        method="filter_inserted_at_gte",
+        help_text=f"Maximum date range is {settings.FINDINGS_MAX_DAYS_IN_RANGE} days.",
+    )
+    inserted_at__lte = DateFilter(
+        method="filter_inserted_at_lte",
+        help_text=f"Maximum date range is {settings.FINDINGS_MAX_DAYS_IN_RANGE} days.",
+    )
+
     class Meta:
         model = Finding
-        fields = FINDING_BASE_FILTER_FIELDS
+        fields = {
+            "id": ["exact", "in"],
+            "uid": ["exact", "in"],
+            "scan": ["exact", "in"],
+            "delta": ["exact", "in"],
+            "status": ["exact", "in"],
+            "severity": ["exact", "in"],
+            "impact": ["exact", "in"],
+            "check_id": ["exact", "in", "icontains"],
+            "inserted_at": ["date", "gte", "lte"],
+            "updated_at": ["gte", "lte"],
+        }
         filter_overrides = {
             FindingDeltaEnumField: {
                 "filter_class": CharFilter,
@@ -721,13 +678,17 @@ class BaseFindingFilter(CommonFindingFilters):
         return queryset.filter(resource_services__contains=[value])
 
     def filter_queryset(self, queryset):
-        if not (self.data.get("scan") or self.data.get("scan__in")) and not any(
-            self.data.get(filter_name) for filter_name in self.DATE_FILTER_NAMES
+        if not (self.data.get("scan") or self.data.get("scan__in")) and not (
+            self.data.get("inserted_at")
+            or self.data.get("inserted_at__date")
+            or self.data.get("inserted_at__gte")
+            or self.data.get("inserted_at__lte")
         ):
             raise ValidationError(
                 [
                     {
-                        "detail": self.DATE_FILTER_REQUIRED_DETAIL,
+                        "detail": "At least one date filter is required: filter[inserted_at], filter[inserted_at.gte], "
+                        "or filter[inserted_at.lte].",
                         "status": 400,
                         "source": {"pointer": "/data/attributes/inserted_at"},
                         "code": "required",
@@ -736,41 +697,30 @@ class BaseFindingFilter(CommonFindingFilters):
             )
 
         cleaned = self.form.cleaned_data
-        for field_name in self.DATE_FILTER_FIELDS:
-            self.validate_datetime_filter_range(cleaned, field_name)
+        exact_date = cleaned.get("inserted_at") or cleaned.get("inserted_at__date")
+        gte_date = cleaned.get("inserted_at__gte") or exact_date
+        lte_date = cleaned.get("inserted_at__lte") or exact_date
 
-        return super().filter_queryset(queryset)
+        if gte_date is None:
+            gte_date = datetime.now(timezone.utc).date()
+        if lte_date is None:
+            lte_date = datetime.now(timezone.utc).date()
 
-    def validate_datetime_filter_range(self, cleaned, field_name):
-        exact_value = cleaned.get(field_name) or cleaned.get(f"{field_name}__date")
-        gte_value = cleaned.get(f"{field_name}__gte") or exact_value
-        lte_value = cleaned.get(f"{field_name}__lte") or exact_value
-
-        if not (exact_value or gte_value or lte_value):
-            return
-
-        default_value = datetime.now(UTC).date()
-        gte_value = gte_value or default_value
-        lte_value = lte_value or default_value
-
-        gte_datetime = self.filter_value_to_datetime(gte_value, field_name)
-        lte_datetime = self.filter_value_to_datetime(lte_value, field_name)
-
-        if abs(lte_datetime - gte_datetime) <= timedelta(
+        if abs(lte_date - gte_date) > timedelta(
             days=settings.FINDINGS_MAX_DAYS_IN_RANGE
         ):
-            return
+            raise ValidationError(
+                [
+                    {
+                        "detail": f"The date range cannot exceed {settings.FINDINGS_MAX_DAYS_IN_RANGE} days.",
+                        "status": 400,
+                        "source": {"pointer": "/data/attributes/inserted_at"},
+                        "code": "invalid",
+                    }
+                ]
+            )
 
-        raise ValidationError(
-            [
-                {
-                    "detail": f"The date range cannot exceed {settings.FINDINGS_MAX_DAYS_IN_RANGE} days.",
-                    "status": 400,
-                    "source": {"pointer": f"/data/attributes/{field_name}"},
-                    "code": "invalid",
-                }
-            ]
-        )
+        return super().filter_queryset(queryset)
 
     #  Convert filter values to UUIDv7 values for use with partitioning
     def filter_scan_id(self, queryset, name, value):
@@ -829,169 +779,27 @@ class BaseFindingFilter(CommonFindingFilters):
         datetime_value = self.maybe_date_to_datetime(value)
         start = uuid7_start(datetime_to_uuid7(datetime_value))
         end = uuid7_start(datetime_to_uuid7(datetime_value + timedelta(days=1)))
+
         return queryset.filter(id__gte=start, id__lt=end)
 
     def filter_inserted_at_gte(self, queryset, name, value):
         datetime_value = self.maybe_date_to_datetime(value)
         start = uuid7_start(datetime_to_uuid7(datetime_value))
+
         return queryset.filter(id__gte=start)
 
     def filter_inserted_at_lte(self, queryset, name, value):
         datetime_value = self.maybe_date_to_datetime(value)
         end = uuid7_start(datetime_to_uuid7(datetime_value + timedelta(days=1)))
+
         return queryset.filter(id__lt=end)
 
     @staticmethod
     def maybe_date_to_datetime(value):
-        if isinstance(value, datetime):
-            return value
+        dt = value
         if isinstance(value, date):
-            return datetime.combine(value, datetime.min.time(), tzinfo=UTC)
-        if isinstance(value, str):
-            return parse(value)
-        return value
-
-    @classmethod
-    def filter_value_to_datetime(cls, value, field_name):
-        try:
-            datetime_value = cls.maybe_date_to_datetime(value)
-        except (TypeError, ValueError, OverflowError):
-            raise ValidationError(
-                [
-                    {
-                        "detail": "Enter a valid date or datetime.",
-                        "status": 400,
-                        "source": {"pointer": f"/data/attributes/{field_name}"},
-                        "code": "invalid",
-                    }
-                ]
-            )
-
-        if datetime_value.tzinfo is None:
-            return datetime_value.replace(tzinfo=UTC)
-        return datetime_value.astimezone(UTC)
-
-
-class FindingFilter(BaseFindingFilter):
-    DATE_FILTER_FIELDS = ("inserted_at", "updated_at")
-    DATE_FILTER_NAMES = (
-        "inserted_at",
-        "inserted_at__date",
-        "inserted_at__gte",
-        "inserted_at__lte",
-        "updated_at",
-        "updated_at__date",
-        "updated_at__gte",
-        "updated_at__lte",
-    )
-    DATE_FILTER_REQUIRED_DETAIL = (
-        "At least one date filter is required: filter[inserted_at], filter[updated_at], "
-        "filter[inserted_at.gte], filter[updated_at.gte], filter[inserted_at.lte], "
-        "or filter[updated_at.lte]."
-    )
-
-    inserted_at = CharFilter(method="filter_inserted_at")
-    inserted_at__date = DateFilter(method="filter_inserted_at", lookup_expr="date")
-    inserted_at__gte = CharFilter(
-        method="filter_inserted_at",
-        help_text=BaseFindingFilter.DATE_RANGE_HELP_TEXT,
-    )
-    inserted_at__lte = CharFilter(
-        method="filter_inserted_at",
-        help_text=BaseFindingFilter.DATE_RANGE_HELP_TEXT,
-    )
-    updated_at = CharFilter(method="filter_updated_at")
-    updated_at__date = DateFilter(method="filter_updated_at", lookup_expr="date")
-    updated_at__gte = CharFilter(
-        method="filter_updated_at",
-        help_text=BaseFindingFilter.DATE_RANGE_HELP_TEXT,
-    )
-    updated_at__lte = CharFilter(
-        method="filter_updated_at",
-        help_text=BaseFindingFilter.DATE_RANGE_HELP_TEXT,
-    )
-
-    class Meta(BaseFindingFilter.Meta):
-        fields = FINDING_BASE_FILTER_FIELDS | {
-            "inserted_at": ["date", "gte", "lte"],
-            "updated_at": ["date", "gte", "lte"],
-        }
-
-    def filter_inserted_at(self, queryset, name, value):
-        start, end = self.filter_value_to_datetime_bounds(value, "inserted_at")
-
-        if name.endswith("__gte"):
-            return queryset.filter(id__gte=self.datetime_to_uuid7_boundary(start))
-        if name.endswith("__lte"):
-            return queryset.filter(id__lt=self.datetime_to_uuid7_boundary(end))
-
-        return queryset.filter(
-            id__gte=self.datetime_to_uuid7_boundary(start),
-            id__lt=self.datetime_to_uuid7_boundary(end),
-        )
-
-    def filter_updated_at(self, queryset, name, value):
-        start, end = self.filter_value_to_datetime_bounds(value, "updated_at")
-
-        if name.endswith("__gte"):
-            return queryset.filter(updated_at__gte=start)
-        if name.endswith("__lte"):
-            return queryset.filter(updated_at__lt=end)
-
-        return queryset.filter(updated_at__gte=start, updated_at__lt=end)
-
-    @classmethod
-    def filter_value_to_datetime_bounds(cls, value, field_name):
-        start = cls.filter_value_to_datetime(value, field_name)
-        if cls.is_date_filter_value(value):
-            return start, start + timedelta(days=1)
-        return start, start + timedelta(milliseconds=1)
-
-    @staticmethod
-    def datetime_to_uuid7_boundary(datetime_value):
-        timestamp_ms = int(datetime_value.timestamp() * 1000) & 0xFFFFFFFFFFFF
-        uuid_int = timestamp_ms << 80
-        uuid_int |= 0x7 << 76
-        uuid_int |= 0x2 << 62
-        return UUID(int=uuid_int)
-
-    @staticmethod
-    def is_date_filter_value(value):
-        if isinstance(value, datetime):
-            return False
-        if isinstance(value, date):
-            return True
-        return isinstance(value, str) and len(value.strip()) == 10
-
-
-class FindingMetadataFilter(BaseFindingFilter):
-    DATE_FILTER_FIELDS = ("inserted_at",)
-    DATE_FILTER_NAMES = (
-        "inserted_at",
-        "inserted_at__date",
-        "inserted_at__gte",
-        "inserted_at__lte",
-    )
-    DATE_FILTER_REQUIRED_DETAIL = (
-        "At least one date filter is required: filter[inserted_at], filter[inserted_at.gte], "
-        "or filter[inserted_at.lte]."
-    )
-
-    inserted_at = DateFilter(method="filter_inserted_at", lookup_expr="date")
-    inserted_at__date = DateFilter(method="filter_inserted_at", lookup_expr="date")
-    inserted_at__gte = DateFilter(
-        method="filter_inserted_at_gte",
-        help_text=BaseFindingFilter.DATE_RANGE_HELP_TEXT,
-    )
-    inserted_at__lte = DateFilter(
-        method="filter_inserted_at_lte",
-        help_text=BaseFindingFilter.DATE_RANGE_HELP_TEXT,
-    )
-
-    class Meta(BaseFindingFilter.Meta):
-        fields = FINDING_BASE_FILTER_FIELDS | {
-            "inserted_at": ["date", "gte", "lte"],
-        }
+            dt = datetime.combine(value, datetime.min.time(), tzinfo=timezone.utc)
+        return dt
 
 
 class LatestFindingFilter(CommonFindingFilters):
@@ -1079,9 +887,9 @@ class FindingGroupFilter(CommonFindingFilters):
         lte_date = cleaned.get("inserted_at__lte") or exact_date
 
         if gte_date is None:
-            gte_date = datetime.now(UTC).date()
+            gte_date = datetime.now(timezone.utc).date()
         if lte_date is None:
-            lte_date = datetime.now(UTC).date()
+            lte_date = datetime.now(timezone.utc).date()
 
         if abs(lte_date - gte_date) > timedelta(
             days=settings.FINDINGS_MAX_DAYS_IN_RANGE
@@ -1123,7 +931,7 @@ class FindingGroupFilter(CommonFindingFilters):
         """Convert date to datetime if needed."""
         dt = value
         if isinstance(value, date):
-            dt = datetime.combine(value, datetime.min.time(), tzinfo=UTC)
+            dt = datetime.combine(value, datetime.min.time(), tzinfo=timezone.utc)
         return dt
 
 
@@ -1193,16 +1001,6 @@ class FindingGroupSummaryFilter(_CheckTitleToCheckIdMixin, FilterSet):
         field_name="provider__provider", choices=Provider.ProviderChoices.choices
     )
     provider_type__in = CharInFilter(field_name="provider__provider", lookup_expr="in")
-    provider_groups = UUIDFilter(
-        field_name="provider__provider_groups__id",
-        lookup_expr="exact",
-        distinct=True,
-    )
-    provider_groups__in = UUIDInFilter(
-        field_name="provider__provider_groups__id",
-        lookup_expr="in",
-        distinct=True,
-    )
 
     class Meta:
         model = FindingGroupDailySummary
@@ -1237,9 +1035,9 @@ class FindingGroupSummaryFilter(_CheckTitleToCheckIdMixin, FilterSet):
         lte_date = cleaned.get("inserted_at__lte") or exact_date
 
         if gte_date is None:
-            gte_date = datetime.now(UTC).date()
+            gte_date = datetime.now(timezone.utc).date()
         if lte_date is None:
-            lte_date = datetime.now(UTC).date()
+            lte_date = datetime.now(timezone.utc).date()
 
         if abs(lte_date - gte_date) > timedelta(
             days=settings.FINDINGS_MAX_DAYS_IN_RANGE
@@ -1278,7 +1076,7 @@ class FindingGroupSummaryFilter(_CheckTitleToCheckIdMixin, FilterSet):
     def _maybe_date_to_datetime(value):
         dt = value
         if isinstance(value, date):
-            dt = datetime.combine(value, datetime.min.time(), tzinfo=UTC)
+            dt = datetime.combine(value, datetime.min.time(), tzinfo=timezone.utc)
         return dt
 
 
@@ -1303,16 +1101,6 @@ class LatestFindingGroupSummaryFilter(_CheckTitleToCheckIdMixin, FilterSet):
         field_name="provider__provider", choices=Provider.ProviderChoices.choices
     )
     provider_type__in = CharInFilter(field_name="provider__provider", lookup_expr="in")
-    provider_groups = UUIDFilter(
-        field_name="provider__provider_groups__id",
-        lookup_expr="exact",
-        distinct=True,
-    )
-    provider_groups__in = UUIDInFilter(
-        field_name="provider__provider_groups__id",
-        lookup_expr="in",
-        distinct=True,
-    )
 
     class Meta:
         model = FindingGroupDailySummary
@@ -1492,19 +1280,12 @@ class RoleFilter(FilterSet):
         }
 
 
-class ComplianceOverviewFilter(BaseScanProviderFilter):
-    """
-    Keep provider filters in the schema while runtime filtering resolves scans first.
-
-    Compliance overview provider filters are applied to the latest completed scans
-    in the viewset, then this filterset handles the remaining compliance fields.
-    """
-
+class ComplianceOverviewFilter(FilterSet):
     inserted_at = DateFilter(field_name="inserted_at", lookup_expr="date")
-    scan_id = UUIDFilter(field_name="scan_id")
+    scan_id = UUIDFilter(field_name="scan_id", required=True)
     region = CharFilter(field_name="region")
 
-    class Meta(BaseScanProviderFilter.Meta):
+    class Meta:
         model = ComplianceRequirementOverview
         fields = {
             "inserted_at": ["date", "gte", "lte"],
@@ -1525,16 +1306,6 @@ class ScanSummaryFilter(FilterSet):
     provider_type__in = ChoiceInFilter(
         field_name="scan__provider__provider", choices=Provider.ProviderChoices.choices
     )
-    provider_groups = UUIDFilter(
-        field_name="scan__provider__provider_groups__id",
-        lookup_expr="exact",
-        distinct=True,
-    )
-    provider_groups__in = UUIDInFilter(
-        field_name="scan__provider__provider_groups__id",
-        lookup_expr="in",
-        distinct=True,
-    )
     region = CharFilter(field_name="region")
 
     class Meta:
@@ -1558,16 +1329,6 @@ class DailySeveritySummaryFilter(FilterSet):
     provider_type__in = ChoiceInFilter(
         field_name="provider__provider", choices=Provider.ProviderChoices.choices
     )
-    provider_groups = UUIDFilter(
-        field_name="provider__provider_groups__id",
-        lookup_expr="exact",
-        distinct=True,
-    )
-    provider_groups__in = UUIDInFilter(
-        field_name="provider__provider_groups__id",
-        lookup_expr="in",
-        distinct=True,
-    )
     date_from = DateFilter(method="filter_noop")
     date_to = DateFilter(method="filter_noop")
 
@@ -1824,16 +1585,6 @@ class ThreatScoreSnapshotFilter(FilterSet):
         choices=Provider.ProviderChoices.choices,
         lookup_expr="in",
     )
-    provider_groups = UUIDFilter(
-        field_name="provider__provider_groups__id",
-        lookup_expr="exact",
-        distinct=True,
-    )
-    provider_groups__in = UUIDInFilter(
-        field_name="provider__provider_groups__id",
-        lookup_expr="in",
-        distinct=True,
-    )
     compliance_id = CharFilter(field_name="compliance_id", lookup_expr="exact")
     compliance_id__in = CharInFilter(field_name="compliance_id", lookup_expr="in")
 
@@ -1877,16 +1628,6 @@ class ResourceGroupOverviewFilter(FilterSet):
         choices=Provider.ProviderChoices.choices,
         lookup_expr="in",
     )
-    provider_groups = UUIDFilter(
-        field_name="scan__provider__provider_groups__id",
-        lookup_expr="exact",
-        distinct=True,
-    )
-    provider_groups__in = UUIDInFilter(
-        field_name="scan__provider__provider_groups__id",
-        lookup_expr="in",
-        distinct=True,
-    )
     resource_group = CharFilter(field_name="resource_group", lookup_expr="exact")
     resource_group__in = CharInFilter(field_name="resource_group", lookup_expr="in")
 

api/src/backend/api/health.py

@@ -2,9 +2,8 @@
 Format (draft-inadarei-api-health-check-06).
 
 Liveness reports only process status. Readiness verifies that PostgreSQL,
-Valkey and the attack-paths graph store (Neo4j or Neptune, per
-``ATTACK_PATHS_SINK_DATABASE``) are reachable and returns per-dependency
-detail when any of them is unreachable.
+Valkey and Neo4j are reachable and returns per-dependency detail when any
+of them is unreachable.
 """
 
 from __future__ import annotations
@@ -12,10 +11,8 @@ from __future__ import annotations
 import logging
 import threading
 import time
-from concurrent.futures import ThreadPoolExecutor
-from concurrent.futures import TimeoutError as FuturesTimeoutError
 from contextlib import suppress
-from datetime import UTC, datetime
+from datetime import datetime, timezone
 from typing import Any
 
 import redis
@@ -40,28 +37,9 @@ STATUS_FAIL = "fail"
 STATUS_WARN = "warn"
 
 # Short socket timeout so a stuck Valkey cannot stall the probe.
+# Neo4j inherits its driver-level ``connection_acquisition_timeout``.
 VALKEY_PROBE_TIMEOUT_SECONDS = 2
 
-# Probe-scoped budget for the graph database.
-# ``Driver.verify_connectivity()`` takes no timeout; its only bound is the
-# driver-level ``connection_acquisition_timeout`` (60s on Neptune). The
-# probe needs its own budget, independent of the workload driver, so a
-# graph-database outage cannot pin a worker thread (and the readiness lock)
-# for a minute.
-GRAPH_DB_PROBE_TIMEOUT_SECONDS = 5
-
-# Bounded pool that enforces ``GRAPH_DB_PROBE_TIMEOUT_SECONDS``. If the
-# graph database is unreachable the probe call blocks until the driver's
-# own acquisition timeout fires; we abandon the future after the budget and
-# report ``fail``. Orphaned tasks are capped by ``max_workers`` plus the 3s
-# readiness cache plus the per-IP throttle, so they cannot pile up: worst
-# case during a graph-database outage is every readiness call failing fast
-# in ``GRAPH_DB_PROBE_TIMEOUT_SECONDS`` with at most 2 background threads
-# stuck for <= the driver acquisition timeout.
-_graph_db_probe_executor = ThreadPoolExecutor(
-    max_workers=2, thread_name_prefix="health-graph-db-probe"
-)
-
 # Brief cache window so high-frequency probes (ALB target groups, scrapers)
 # do not stampede the actual dependency checks.
 CACHE_CONTROL_HEADER = "max-age=3, must-revalidate"
@@ -84,7 +62,11 @@ class HealthJSONRenderer(JSONRenderer):
 
 
 def _now_iso() -> str:
-    return datetime.now(UTC).isoformat(timespec="milliseconds").replace("+00:00", "Z")
+    return (
+        datetime.now(timezone.utc)
+        .isoformat(timespec="milliseconds")
+        .replace("+00:00", "Z")
+    )
 
 
 def _measure(name: str, check_fn) -> tuple[dict[str, Any], float]:
@@ -131,24 +113,11 @@ def _probe_valkey() -> None:
             client.close()
 
 
-def _graph_db_component_id() -> str:
-    """Return the active graph database name for the ``componentId`` field."""
-    return settings.ATTACK_PATHS_SINK_DATABASE.strip().lower()
+def _probe_neo4j() -> None:
+    # Lazy import: avoids pulling attack_paths into the boot import graph.
+    from api.attack_paths.database import get_driver
 
-
-def _probe_graph_db() -> None:
-    # Lazy import: avoids pulling attack_paths into the boot import graph
-    from api.attack_paths.database import verify_connectivity
-
-    future = _graph_db_probe_executor.submit(verify_connectivity)
-    try:
-        future.result(timeout=GRAPH_DB_PROBE_TIMEOUT_SECONDS)
-    except FuturesTimeoutError as exc:
-        # Do not wait for the abandoned task; it ends when the driver's own acquisition timeout fires
-        future.cancel()
-        raise TimeoutError(
-            f"graph-db probe exceeded {GRAPH_DB_PROBE_TIMEOUT_SECONDS}s"
-        ) from exc
+    get_driver().verify_connectivity()
 
 
 def _build_check_entry(
@@ -211,18 +180,14 @@ def _readiness_payload() -> tuple[dict[str, Any], int]:
         ):
             return snapshot[1], snapshot[2]
 
-        graph_db_component_id = _graph_db_component_id()
-
         postgres_result, postgres_ms = _measure("postgres", _probe_postgres)
         valkey_result, valkey_ms = _measure("valkey", _probe_valkey)
-        graph_db_result, graph_db_ms = _measure(graph_db_component_id, _probe_graph_db)
+        neo4j_result, neo4j_ms = _measure("neo4j", _probe_neo4j)
 
         entries = [
             _build_check_entry("postgres", "datastore", postgres_result, postgres_ms),
             _build_check_entry("valkey", "datastore", valkey_result, valkey_ms),
-            _build_check_entry(
-                graph_db_component_id, "datastore", graph_db_result, graph_db_ms
-            ),
+            _build_check_entry("neo4j", "datastore", neo4j_result, neo4j_ms),
         ]
         overall = _aggregate_status(entries)
 
@@ -230,7 +195,7 @@ def _readiness_payload() -> tuple[dict[str, Any], int]:
         payload["checks"] = {
             "postgres:responseTime": [entries[0]],
             "valkey:responseTime": [entries[1]],
-            "graphdb:responseTime": [entries[2]],
+            "neo4j:responseTime": [entries[2]],
         }
 
         http_status = (
@@ -272,10 +237,10 @@ class LivenessView(APIView):
 class ReadinessView(APIView):
     """Readiness probe.
 
-    Returns 200 when PostgreSQL, Valkey and the attack-paths graph store
-    all respond, or 503 with per-dependency detail when any of them is
-    unreachable. Per-IP throttle plus the short in-process result cache cap
-    the real dependency hits regardless of inbound traffic shape.
+    Returns 200 when PostgreSQL, Valkey and Neo4j all respond, or 503 with
+    per-dependency detail when any of them is unreachable. Per-IP throttle
+    plus the short in-process result cache cap the real dependency hits
+    regardless of inbound traffic shape.
     """
 
     authentication_classes: list = []

api/src/backend/api/management/commands/findings.py

@@ -1,8 +1,11 @@
 import random
-from datetime import UTC, datetime
+from datetime import datetime, timezone
 from math import ceil
 from uuid import uuid4
 
+from django.core.management.base import BaseCommand
+from tqdm import tqdm
+
 from api.db_utils import rls_transaction
 from api.models import (
     Finding,
@@ -13,9 +16,7 @@ from api.models import (
     Scan,
     StatusChoices,
 )
-from django.core.management.base import BaseCommand
 from prowler.lib.check.models import CheckMetadata
-from tqdm import tqdm
 
 
 class Command(BaseCommand):
@@ -115,7 +116,7 @@ class Command(BaseCommand):
                 trigger="manual",
                 state="executing",
                 progress=0,
-                started_at=datetime.now(UTC),
+                started_at=datetime.now(timezone.utc),
             )
         scan_state = "completed"
 
@@ -271,8 +272,10 @@ class Command(BaseCommand):
             self.stdout.write(self.style.ERROR(f"Failed to populate test data: {e}"))
             scan_state = "failed"
         finally:
-            scan.completed_at = datetime.now(UTC)
-            scan.duration = int((datetime.now(UTC) - scan.started_at).total_seconds())
+            scan.completed_at = datetime.now(timezone.utc)
+            scan.duration = int(
+                (datetime.now(timezone.utc) - scan.started_at).total_seconds()
+            )
             scan.progress = 100
             scan.state = scan_state
             scan.unique_resource_count = num_resources

api/src/backend/api/management/commands/reconcile_orphan_tasks.py

@@ -1,58 +0,0 @@
-from django.core.management.base import BaseCommand
-from tasks.jobs.orphan_recovery import reconcile_orphans
-
-
-class Command(BaseCommand):
-    help = (
-        "Recover orphaned allowlisted Celery tasks whose worker is gone and mark "
-        "other stale task results terminal. Single-flight via a Postgres advisory lock."
-    )
-
-    def add_arguments(self, parser):
-        parser.add_argument(
-            "--grace-minutes",
-            type=int,
-            default=2,
-            help="Skip tasks started within this window (worker may still register).",
-        )
-        parser.add_argument(
-            "--max-attempts",
-            type=int,
-            default=3,
-            help="Give up re-running a task after this many recovery attempts; it is then left terminal instead of re-enqueued.",
-        )
-        parser.add_argument(
-            "--dry-run",
-            action="store_true",
-            help="Detect and report orphans without revoking or re-enqueuing.",
-        )
-
-    def handle(self, *args, **options):
-        result = reconcile_orphans(
-            grace_minutes=options["grace_minutes"],
-            max_attempts=options["max_attempts"],
-            dry_run=options["dry_run"],
-        )
-
-        if not result.get("acquired"):
-            self.stdout.write("Reconcile skipped: another run holds the lock.")
-            return
-
-        if result.get("enabled") is False:
-            message = (
-                "Task recovery is disabled (DJANGO_TASK_RECOVERY_ENABLED is off); "
-                "no orphans were recovered."
-            )
-            if result.get("attack_paths") is not None:
-                message += " Attack-paths stale cleanup still ran."
-            self.stdout.write(message)
-            return
-
-        self.stdout.write(
-            self.style.SUCCESS(
-                "Orphan reconcile complete: "
-                f"recovered={len(result.get('recovered', []))} "
-                f"failed={len(result.get('failed', []))} "
-                f"skipped(in-flight)={len(result.get('skipped', []))}"
-            )
-        )

api/src/backend/api/middleware.py

@@ -2,31 +2,6 @@ import logging
 import time
 
 from config.custom_logging import BackendLogger
-from django.core.handlers.asgi import ASGIRequest
-from django.db import connections
-
-
-class CloseDBConnectionsMiddleware:
-    """
-    Close request-scoped DB connections at the end of each ASGI request.
-
-    Under the ASGI worker, connections opened by sync views are not released
-    by Django's normal request-boundary cleanup, so they accumulate idle until
-    Postgres runs out of slots. Only ASGI requests are handled; the sync WSGI
-    test client manages its own connections and must be left alone.
-    """
-
-    def __init__(self, get_response):
-        self.get_response = get_response
-
-    def __call__(self, request):
-        try:
-            return self.get_response(request)
-        finally:
-            if isinstance(request, ASGIRequest):
-                for conn in connections.all(initialized_only=True):
-                    if not conn.in_atomic_block:
-                        conn.close_if_unusable_or_obsolete()
 
 
 def extract_auth_info(request) -> dict:

api/src/backend/api/migrations/0001_initial.py

@@ -1,13 +1,26 @@
 import uuid
 from functools import partial
 
-import api.rls
 import django.contrib.auth.models
 import django.contrib.postgres.indexes
 import django.contrib.postgres.search
 import django.core.validators
 import django.db.models.deletion
 import django.utils.timezone
+from django.conf import settings
+from django.db import migrations, models
+from psqlextra.backend.migrations.operations.add_default_partition import (
+    PostgresAddDefaultPartition,
+)
+from psqlextra.backend.migrations.operations.create_partitioned_model import (
+    PostgresCreatePartitionedModel,
+)
+from psqlextra.manager.manager import PostgresManager
+from psqlextra.models.partitioned import PostgresPartitionedModel
+from psqlextra.types import PostgresPartitioningMethod
+from uuid6 import uuid7
+
+import api.rls
 from api.db_utils import (
     DB_PROWLER_PASSWORD,
     DB_PROWLER_USER,
@@ -40,18 +53,6 @@ from api.models import (
     StateChoices,
     StatusChoices,
 )
-from django.conf import settings
-from django.db import migrations, models
-from psqlextra.backend.migrations.operations.add_default_partition import (
-    PostgresAddDefaultPartition,
-)
-from psqlextra.backend.migrations.operations.create_partitioned_model import (
-    PostgresCreatePartitionedModel,
-)
-from psqlextra.manager.manager import PostgresManager
-from psqlextra.models.partitioned import PostgresPartitionedModel
-from psqlextra.types import PostgresPartitioningMethod
-from uuid6 import uuid7
 
 DB_NAME = settings.DATABASES["default"]["NAME"]
 

api/src/backend/api/migrations/0002_token_migrations.py

@@ -1,7 +1,8 @@
-from api.db_utils import DB_PROWLER_USER
 from django.conf import settings
 from django.db import migrations
 
+from api.db_utils import DB_PROWLER_USER
+
 DB_NAME = settings.DATABASES["default"]["NAME"]
 
 

api/src/backend/api/migrations/0004_rbac.py

@@ -2,11 +2,12 @@
 
 import uuid
 
-import api.rls
 import django.db.models.deletion
 from django.conf import settings
 from django.db import migrations, models
 
+import api.rls
+
 
 class Migration(migrations.Migration):
     dependencies = [

api/src/backend/api/migrations/0005_rbac_missing_admin_roles.py

@@ -1,6 +1,7 @@
-from api.db_router import MainRouter
 from django.db import migrations
 
+from api.db_router import MainRouter
+
 
 def create_admin_role(apps, schema_editor):
     Tenant = apps.get_model("api", "Tenant")

api/src/backend/api/migrations/0008_daily_scheduled_tasks_update.py

@@ -1,12 +1,13 @@
 import json
-from datetime import UTC, datetime, timedelta
+from datetime import datetime, timedelta, timezone
 
 import django.db.models.deletion
-from api.db_utils import rls_transaction
-from api.models import Scan, StateChoices
 from django.db import migrations, models
 from django_celery_beat.models import PeriodicTask
 
+from api.db_utils import rls_transaction
+from api.models import Scan, StateChoices
+
 
 def migrate_daily_scheduled_scan_tasks(apps, schema_editor):
     for daily_scheduled_scan_task in PeriodicTask.objects.filter(
@@ -16,11 +17,11 @@ def migrate_daily_scheduled_scan_tasks(apps, schema_editor):
         tenant_id = task_kwargs["tenant_id"]
         provider_id = task_kwargs["provider_id"]
 
-        current_time = datetime.now(UTC)
+        current_time = datetime.now(timezone.utc)
         scheduled_time_today = datetime.combine(
             current_time.date(),
             daily_scheduled_scan_task.start_time.time(),
-            tzinfo=UTC,
+            tzinfo=timezone.utc,
         )
 
         if current_time < scheduled_time_today:

api/src/backend/api/migrations/0013_integrations_enum.py

@@ -2,9 +2,10 @@
 
 from functools import partial
 
+from django.db import migrations
+
 from api.db_utils import IntegrationTypeEnum, PostgresEnumMigration, register_enum
 from api.models import Integration
-from django.db import migrations
 
 IntegrationTypeEnumMigration = PostgresEnumMigration(
     enum_name="integration_type",

api/src/backend/api/migrations/0014_integrations.py

@@ -2,11 +2,12 @@
 
 import uuid
 
+import django.db.models.deletion
+from django.db import migrations, models
+
 import api.db_utils
 import api.rls
-import django.db.models.deletion
 from api.rls import RowLevelSecurityConstraint
-from django.db import migrations, models
 
 
 class Migration(migrations.Migration):

api/src/backend/api/migrations/0015_finding_muted.py

@@ -1,8 +1,9 @@
 # Generated by Django 5.1.5 on 2025-03-25 11:29
 
-import api.db_utils
 from django.db import migrations, models
 
+import api.db_utils
+
 
 class Migration(migrations.Migration):
     dependencies = [

api/src/backend/api/migrations/0017_m365_provider.py

@@ -1,8 +1,9 @@
 # Generated by Django 5.1.7 on 2025-04-16 08:47
 
-import api.db_utils
 from django.db import migrations
 
+import api.db_utils
+
 
 class Migration(migrations.Migration):
     dependencies = [

api/src/backend/api/migrations/0018_resource_scan_summaries.py

@@ -2,11 +2,12 @@
 
 import uuid
 
-import api.rls
 import django.db.models.deletion
 import uuid6
 from django.db import migrations, models
 
+import api.rls
+
 
 class Migration(migrations.Migration):
     dependencies = [

api/src/backend/api/migrations/0020_findings_new_performance_indexes_partitions.py

@@ -1,8 +1,9 @@
 from functools import partial
 
-from api.db_utils import create_index_on_partitions, drop_index_on_partitions
 from django.db import migrations
 
+from api.db_utils import create_index_on_partitions, drop_index_on_partitions
+
 
 class Migration(migrations.Migration):
     atomic = False

api/src/backend/api/migrations/0024_findings_uid_index_partitions.py

@@ -1,8 +1,9 @@
 from functools import partial
 
-from api.db_utils import create_index_on_partitions, drop_index_on_partitions
 from django.db import migrations
 
+from api.db_utils import create_index_on_partitions, drop_index_on_partitions
+
 
 class Migration(migrations.Migration):
     atomic = False

api/src/backend/api/migrations/0027_compliance_requirement_overviews.py

@@ -2,11 +2,12 @@
 
 import uuid
 
+import django.db.models.deletion
+from django.db import migrations, models
+
 import api.db_utils
 import api.rls
-import django.db.models.deletion
 from api.rls import RowLevelSecurityConstraint
-from django.db import migrations, models
 
 
 class Migration(migrations.Migration):

api/src/backend/api/migrations/0028_findings_check_index_partitions.py

@@ -1,8 +1,9 @@
 from functools import partial
 
-from api.db_utils import create_index_on_partitions, drop_index_on_partitions
 from django.db import migrations
 
+from api.db_utils import create_index_on_partitions, drop_index_on_partitions
+
 
 class Migration(migrations.Migration):
     atomic = False

api/src/backend/api/migrations/0030_lighthouseconfiguration.py

@@ -2,11 +2,12 @@
 
 import uuid
 
-import api.rls
 import django.core.validators
 import django.db.models.deletion
 from django.db import migrations, models
 
+import api.rls
+
 
 class Migration(migrations.Migration):
     dependencies = [