fix(huaweicloud): preserve FunctionGraph region attribution

- Carry regional client keys through function discovery - Cover regionless SDK clients with a regression test - Document FunctionGraph initialization behavior
fix(huaweicloud): clarify FunctionGraph VPC guidance
2026-08-22 05:41:51 +00:00 · 2026-08-20 13:13:55 +01:00 · 2026-08-20 12:49:36 +01:00 · 2026-08-20 12:48:44 +01:00 · 2026-08-12 04:41:20 +08:00 · 2026-07-29 04:11:52 +08:00
520 changed files with 5371 additions and 36945 deletions
@@ -158,7 +158,7 @@ SENTRY_RELEASE=local
 # REO_DEV_CLIENT_ID=

 #### Prowler release version ####
-NEXT_PUBLIC_PROWLER_RELEASE_VERSION=v5.37.1
+NEXT_PUBLIC_PROWLER_RELEASE_VERSION=v5.37.0

 # Social login credentials
 SOCIAL_GOOGLE_OAUTH_CALLBACK_URL="${AUTH_URL}/api/auth/callback/google"
@@ -54,7 +54,7 @@ runs:
          trivy-db-${{ runner.os }}-

    - name: Run Trivy vulnerability scan (JSON)
-      uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+      uses: aquasecurity/trivy-action@e368e328979b113139d6f9068e03accaed98a518 # 0.34.1
      with:
        image-ref: ${{ inputs.image-name }}:${{ inputs.image-tag }}
        format: 'json'
@@ -67,7 +67,7 @@ runs:

    - name: Run Trivy vulnerability scan (SARIF)
      if: inputs.upload-sarif == 'true' && github.event_name == 'push'
-      uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+      uses: aquasecurity/trivy-action@e368e328979b113139d6f9068e03accaed98a518 # 0.34.1
      with:
        image-ref: ${{ inputs.image-name }}:${{ inputs.image-tag }}
        format: 'sarif'
@@ -51,8 +51,7 @@ STDERR="$(mktemp)"
 trap 'rm -f "${STDERR}"' EXIT

 set +e
-# ${a[@]+...} guard: an empty array trips `set -u` on bash before 4.4.
-OUTPUT="$(osv-scanner scan source ${SCAN_ARGS[@]+"${SCAN_ARGS[@]}"} --format=json "$@" 2>"${STDERR}")"
+OUTPUT="$(osv-scanner scan source "${SCAN_ARGS[@]}" --format=json "$@" 2>"${STDERR}")"
 RC=$?
 set -e

@@ -101,8 +100,6 @@ FINDINGS="$(printf '%s' "${OUTPUT}" | jq --argjson sevs "${SEVERITY_JSON}" '
  ]
 ')"

-# jq exits 0 with no output on empty stdin, but non-zero on malformed JSON.
-# Let the failure abort under set -e rather than reporting zero findings.
 COUNT="$(printf '%s' "${FINDINGS}" | jq 'length')"

 # Write the findings JSON to OSV_REPORT_FILE so callers (e.g. the composite
@@ -111,7 +108,7 @@ if [ -n "${OSV_REPORT_FILE:-}" ]; then
  printf '%s' "${FINDINGS}" > "${OSV_REPORT_FILE}"
 fi

-if [ "${COUNT:-0}" -gt 0 ]; then
+if [ "${COUNT}" -gt 0 ]; then
  echo "osv-scanner: ${COUNT} finding(s) at severity ${SEVERITY_LEVELS}"
  printf '%s' "${FINDINGS}" | jq -r '
    .[] | "  [\(.severity)\(if .score then " \(.score)" else "" end)] \(.id) \(.ecosystem)/\(.package)@\(.version) — \(.summary // "(no summary)")"
@@ -249,7 +249,6 @@ modules:
      - ui/tests/profile/**
      - ui/tests/lighthouse/**
      - ui/tests/home/**
-      - ui/tests/navigation/**
      - ui/tests/attack-paths/**

  - name: api-serializers
@@ -276,7 +275,6 @@ modules:
      - ui/tests/profile/**
      - ui/tests/lighthouse/**
      - ui/tests/home/**
-      - ui/tests/navigation/**
      - ui/tests/attack-paths/**

  - name: api-filters
@@ -434,14 +432,6 @@ modules:
    e2e:
      - ui/tests/lighthouse/**

-  - name: ui-navigation
-    match:
-      - ui/components/layout/**
-      - ui/tests/navigation/**
-    tests: []
-    e2e:
-      - ui/tests/navigation/**
-
  - name: ui-overview
    match:
      - ui/components/overview/**
@@ -474,7 +464,6 @@ modules:
      - ui/tests/profile/**
      - ui/tests/lighthouse/**
      - ui/tests/home/**
-      - ui/tests/navigation/**
      - ui/tests/attack-paths/**

  - name: ui-attack-paths
@@ -105,9 +105,7 @@ jobs:
        id: check-changes
        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
        with:
-          files: |
-            api/**
-            .github/actions/trivy-scan/**
+          files: api/**
          files_ignore: |
            api/docs/**
            api/README.md
@@ -107,7 +107,6 @@ jobs:
          files: |
            api/**
            .github/workflows/api-tests.yml
-            codecov.yml
          files_ignore: |
            api/docs/**
            api/README.md
@@ -98,9 +98,7 @@ jobs:
        id: check-changes
        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
        with:
-          files: |
-            mcp_server/**
-            .github/actions/trivy-scan/**
+          files: mcp_server/**
          files_ignore: |
            mcp_server/README.md
            mcp_server/CHANGELOG.md
@@ -25,7 +25,6 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
-      actions: write
      contents: write
      pull-requests: write
    steps:
@@ -34,12 +33,6 @@ jobs:
      with:
        egress-policy: audit

-    - name: Enable release freeze
-      env:
-        GH_TOKEN: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }}
-      run: |
-        gh variable set RELEASE_FREEZE --body true --repo "${GITHUB_REPOSITORY}"
-
    - name: Checkout repository
      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      with:
@@ -389,4 +382,3 @@ jobs:
      if: always()
      run: |
        rm -f prowler_changelog.md api_changelog.md ui_changelog.md mcp_changelog.md combined_changelog.md
-
@@ -1,45 +0,0 @@
-name: 'Tools: Release Freeze Gate'
-
-on:
-  pull_request:
-    branches:
-      - 'master'
-    types:
-      - opened
-      - synchronize
-      - reopened
-      - ready_for_review
-  merge_group:
-    branches:
-      - 'master'
-    types:
-      - checks_requested
-  workflow_dispatch:
-
-permissions: {}
-
-jobs:
-  release-freeze-gate:
-    name: release-freeze-gate
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-
-      - name: Check release freeze status
-        env:
-          RELEASE_FREEZE: ${{ vars.RELEASE_FREEZE }}
-        run: |
-          case "${RELEASE_FREEZE}" in
-            true|TRUE|True)
-              echo "::error::Release freeze is active. Merges to master are temporarily blocked."
-              echo "Set the RELEASE_FREEZE repository variable to false when the release is complete."
-              exit 1
-              ;;
-            *)
-              echo "Release freeze is not active."
-              ;;
-          esac
@@ -113,7 +113,6 @@ jobs:
            pyproject.toml
            uv.lock
            .github/workflows/sdk-container-checks.yml
-            .github/actions/trivy-scan/**
          files_ignore: |
            prowler/CHANGELOG.md
            prowler/changelog.d/**
@@ -99,9 +99,7 @@ jobs:
        id: check-changes
        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
        with:
-          files: |
-            ui/**
-            .github/actions/trivy-scan/**
+          files: ui/**
          files_ignore: |
            ui/CHANGELOG.md
            ui/changelog.d/**
@@ -36,7 +36,6 @@ jobs:
    needs: impact-analysis
    if: |
      github.repository == 'prowler-cloud/prowler' &&
-      (github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false) &&
      (needs.impact-analysis.outputs.has-ui-e2e == 'true' || needs.impact-analysis.outputs.run-all == 'true')
    runs-on: ubuntu-latest
    env:
@@ -119,104 +118,6 @@ jobs:
        env:
          NEEDS_IMPACT_ANALYSIS_OUTPUTS_MODULES: ${{ needs.impact-analysis.outputs.modules }}

-      - name: Validate E2E prerequisites
-        shell: bash
-        run: |
-          declare -A required=()
-
-          suite_selected() {
-            [[ "${RUN_ALL_TESTS}" == "true" ]] ||
-              [[ " ${E2E_TEST_PATHS} " == *"ui/tests/$1/"* ]]
-          }
-
-          require_vars() {
-            local variable
-            for variable in "$@"; do
-              required["${variable}"]=1
-            done
-          }
-
-          if suite_selected auth || suite_selected providers ||
-            suite_selected invitations || suite_selected scans ||
-            suite_selected navigation; then
-            require_vars E2E_ADMIN_USER E2E_ADMIN_PASSWORD
-          fi
-
-          if suite_selected sign-up; then
-            require_vars E2E_NEW_USER_PASSWORD
-          fi
-
-          if suite_selected invitations; then
-            require_vars E2E_NEW_USER_PASSWORD E2E_ORGANIZATION_ID
-          fi
-
-          if suite_selected scans; then
-            require_vars \
-              E2E_AWS_PROVIDER_ACCOUNT_ID \
-              E2E_AWS_PROVIDER_ACCESS_KEY \
-              E2E_AWS_PROVIDER_SECRET_KEY
-          fi
-
-          if suite_selected providers; then
-            require_vars \
-              E2E_AWS_PROVIDER_ACCOUNT_ID \
-              E2E_AWS_PROVIDER_ACCESS_KEY \
-              E2E_AWS_PROVIDER_SECRET_KEY \
-              E2E_AWS_PROVIDER_ROLE_ARN \
-              E2E_AZURE_SUBSCRIPTION_ID \
-              E2E_AZURE_CLIENT_ID \
-              E2E_AZURE_SECRET_ID \
-              E2E_AZURE_TENANT_ID \
-              E2E_M365_DOMAIN_ID \
-              E2E_M365_CLIENT_ID \
-              E2E_M365_SECRET_ID \
-              E2E_M365_TENANT_ID \
-              E2E_M365_CERTIFICATE_CONTENT \
-              E2E_GCP_BASE64_SERVICE_ACCOUNT_KEY \
-              E2E_GCP_PROJECT_ID \
-              E2E_GITHUB_APP_ID \
-              E2E_GITHUB_BASE64_APP_PRIVATE_KEY \
-              E2E_GITHUB_USERNAME \
-              E2E_GITHUB_PERSONAL_ACCESS_TOKEN \
-              E2E_GITHUB_ORGANIZATION \
-              E2E_GITHUB_ORGANIZATION_ACCESS_TOKEN \
-              E2E_OCI_TENANCY_ID \
-              E2E_OCI_USER_ID \
-              E2E_OCI_FINGERPRINT \
-              E2E_OCI_KEY_CONTENT \
-              E2E_ALIBABACLOUD_ACCOUNT_ID \
-              E2E_ALIBABACLOUD_ACCESS_KEY_ID \
-              E2E_ALIBABACLOUD_ACCESS_KEY_SECRET \
-              E2E_ALIBABACLOUD_ROLE_ARN \
-              E2E_OKTA_DOMAIN \
-              E2E_OKTA_CLIENT_ID \
-              E2E_OKTA_BASE64_PRIVATE_KEY \
-              E2E_GOOGLEWORKSPACE_CUSTOMER_ID \
-              E2E_GOOGLEWORKSPACE_SERVICE_ACCOUNT_JSON \
-              E2E_GOOGLEWORKSPACE_DELEGATED_USER \
-              E2E_VERCEL_TEAM_ID \
-              E2E_VERCEL_API_TOKEN
-          fi
-
-          missing=()
-          if (( ${#required[@]} > 0 )); then
-            while IFS= read -r variable; do
-              [[ -z "${!variable:-}" ]] && missing+=("${variable}")
-            done < <(printf '%s\n' "${!required[@]}" | sort)
-          fi
-
-          if (( ${#missing[@]} > 0 )); then
-            echo "Missing required E2E variables:"
-            printf ' - %s\n' "${missing[@]}"
-            {
-              echo "## Missing E2E prerequisites"
-              printf -- "- \`%s\`\n" "${missing[@]}"
-            } >> "${GITHUB_STEP_SUMMARY}"
-            exit 1
-          fi
-
-          echo "E2E prerequisite preflight passed."
-
      - name: Create k8s Kind Cluster
        uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1
        with:
@@ -403,29 +304,6 @@ jobs:
        run: |
          docker compose down -v || true

-  # Fork pull requests cannot access the secrets required by the E2E suites.
-  fork-e2e-unavailable:
-    needs: impact-analysis
-    if: |
-      github.repository == 'prowler-cloud/prowler' &&
-      github.event_name == 'pull_request' &&
-      github.event.pull_request.head.repo.fork == true &&
-      (needs.impact-analysis.outputs.has-ui-e2e == 'true' || needs.impact-analysis.outputs.run-all == 'true')
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-
-      - name: Report unavailable E2E tests
-        run: |
-          echo "## E2E Tests Skipped" >> "$GITHUB_STEP_SUMMARY"
-          echo "" >> "$GITHUB_STEP_SUMMARY"
-          echo "UI E2E tests require repository secrets and cannot run for fork pull requests." >> "$GITHUB_STEP_SUMMARY"
-
  # Skip job - provides clear feedback when no E2E tests needed
  skip-e2e:
    needs: impact-analysis
@@ -181,9 +181,9 @@ jobs:
        if: steps.check-changes.outputs.any_changed == 'true' && steps.playwright-cache.outputs.cache-hit != 'true'
        run: pnpm exec playwright install chromium

-      - name: Run integration tests
+      - name: Run browser tests
        if: steps.check-changes.outputs.any_changed == 'true'
-        run: pnpm run test:integration
+        run: pnpm run test:browser

      - name: Build application
        if: steps.check-changes.outputs.any_changed == 'true'
@@ -173,5 +173,3 @@ GEMINI.md
 # Docker
 docker-compose.override.yml
 docker-compose-dev.override.yml
-# Local Pi runtime state
-.atl/
@@ -1,58 +1,123 @@
-# Trivy ignore file for the prowlercloud/prowler SDK and API container images.
+# Trivy ignore file for prowlercloud/prowler SDK container image.
 # Each entry below documents (a) the affected package and why it ships in the
 # image, (b) why the CVE is not exploitable in Prowler's runtime, and (c) the
 # upstream fix status. Entries carry an expiry so they auto-force re-review.
-# The `pkg:` selector on each line is documentation only. Trivy's classic
-# .trivyignore format parses the CVE ID and ignores the rest, so each entry
-# suppresses its CVE across every package in the image, not just the one named.
-# Verified against Trivy 0.65.0: an entry written `pkg:zlib1g` still suppressed
-# the finding on perl-base. Real per-package scoping needs .trivyignore.yaml
-# with purls — tracked in PROWLER-2327.
-# `exp:` IS honoured: an entry dated in the past correctly lapses.
-#
-# Keep expiries staggered, and only suppress packages the images actually install.
+# Entries are scoped per-package so suppressions cannot drift onto unrelated
+# packages that may be assigned the same CVE in the future.
 #
 # Scanned by: .github/actions/trivy-scan via .github/workflows/sdk-container-checks.yml
-# and .github/workflows/api-container-checks.yml

-# perl-base is Debian "Essential: yes". Trivy spreads src:perl CVEs across every
-# binary package, so perl-base gets flagged for modules only perl-modules-5.40 ships.
-# Neither image installs perl-modules-5.40, and nothing in either invokes perl.
-#
-# Why these four cannot be fixed rather than accepted (reviewed 2026-07-31):
-#
-#   1. No fix exists. All four report no fixed version on perl-base 5.40.1-6.
-#      Debian's tracker marks CVE-2026-42496 "fix_deferred" and the other three
-#      "affected". Updating the base image, apt upgrade, or moving to a newer
-#      Debian release changes nothing, because Debian has not shipped a fix.
-#   2. The package cannot be removed. "Essential: yes" means removal needs
-#      dpkg --force-remove-essential, which also breaks apt for anything built
-#      downstream from these images.
-#   3. Changing base distribution was evaluated and rejected. Alpine removes
-#      perl entirely, but PowerShell publishes no linux-musl-arm64 build in any
-#      release, so M365 scanning would break on arm64 — which is what we run in
-#      production. Wolfi keeps glibc and drops perl, but pinnable versioned tags
-#      are a paid tier, so builds would not be reproducibly pinnable.
-#
-# Not-invoked claim verified by sweeping both images for: files with a perl
-# shebang, shell/python callers of perl, ELF binaries containing "perl", and
-# .pl/.pm files or perl subprocess calls anywhere in site-packages. The only
-# consumers found are dpkg/debconf/adduser/pam tooling, none of which runs at
-# runtime, plus one build-time script inside the ExchangeOnlineManagement
-# PowerShell module that is never invoked (it generates that module's manifest,
-# and lives in its netFramework/ path, while Linux loads netCore/).
+# CVE-2026-42496 — perl-archive-tar path traversal via crafted symlinks.
+# CVE-2026-8376  — perl heap buffer overflow when compiling regex.
+# Packages: perl, perl-base, perl-modules-5.36, libperl5.36.
+# Why ignored: perl-base is part of Debian's "Essential: yes" set; it cannot be
+# removed without breaking dpkg. The Prowler SDK does not invoke perl at runtime;
+# neither vulnerable code path (Archive::Tar parsing or regex compilation of
+# attacker-controlled input) is reachable from Prowler. No Debian bookworm fix
+# is available yet.
+CVE-2026-42496 pkg:perl exp:2026-08-15
+CVE-2026-42496 pkg:perl-base exp:2026-08-15
+CVE-2026-42496 pkg:perl-modules-5.36 exp:2026-08-15
+CVE-2026-42496 pkg:libperl5.36 exp:2026-08-15
+CVE-2026-8376 pkg:perl exp:2026-08-15
+CVE-2026-8376 pkg:perl-base exp:2026-08-15
+CVE-2026-8376 pkg:perl-modules-5.36 exp:2026-08-15
+CVE-2026-8376 pkg:libperl5.36 exp:2026-08-15

-# Archive::Tar path traversal. Not installed: `perl -MArchive::Tar -e1` cannot locate it.
-CVE-2026-42496 pkg:perl-base exp:2027-01-31
-
-# Storable integer overflow. Not installed: `perl -MStorable -e1` cannot locate it.
-CVE-2026-57433 pkg:perl-base exp:2027-01-31
-
-# Regex heap overflow on 32-bit builds only; both published arches are 64-bit.
-CVE-2026-8376 pkg:perl-base exp:2027-01-31
-
-# Regex trie bug giving silently wrong matches above 65535 alternation branches. Now on
-# perl 5.40.1, which is in range (the 5.36-predates-it argument no longer applies), so this
-# rests on nothing invoking perl. Short expiry to force a re-look.
+# CVE-2026-13221 - Perl regex trie overflow.
+# Packages: perl, perl-base, perl-modules-5.36, libperl5.36.
+# Why ignored: upstream confirms Perl 5.36.0 is not affected; the regression
+# was introduced after this version. Debian currently marks bookworm as
+# vulnerable, which causes Trivy to report a false positive.
 # Ref: https://github.com/Perl/perl5/issues/23388
-CVE-2026-13221 pkg:perl-base exp:2026-11-30
+CVE-2026-13221 pkg:perl exp:2026-08-15
+CVE-2026-13221 pkg:perl-base exp:2026-08-15
+CVE-2026-13221 pkg:perl-modules-5.36 exp:2026-08-15
+CVE-2026-13221 pkg:libperl5.36 exp:2026-08-15
+
+# CVE-2026-57433 — Perl Storable signed integer overflow when deserializing a
+# crafted SX_HOOK record (retrieve_hook_common passes a wrapped negative count
+# to av_extend).
+# Packages: perl, perl-base, perl-modules-5.36, libperl5.36.
+# Why ignored: perl-base is part of Debian's "Essential: yes" set; it cannot be
+# removed without breaking dpkg. Prowler does not invoke perl at runtime and
+# never calls Storable's thaw/retrieve on attacker-controlled blobs, so the
+# vulnerable deserialization path is unreachable. Fixed upstream in
+# Storable 3.41; no Debian bookworm fix is available yet.
+CVE-2026-57433 pkg:perl exp:2026-08-15
+CVE-2026-57433 pkg:perl-base exp:2026-08-15
+CVE-2026-57433 pkg:perl-modules-5.36 exp:2026-08-15
+CVE-2026-57433 pkg:libperl5.36 exp:2026-08-15
+
+# CVE-2025-7458 — SQLite integer overflow.
+# Package: libsqlite3-0.
+# Why ignored: transitive dependency of CPython's stdlib sqlite3 module. The
+# Prowler SDK does not open user-supplied SQLite databases; SQLite usage is
+# internal and bounded. No Debian bookworm fix is available.
+CVE-2025-7458 pkg:libsqlite3-0 exp:2026-08-15
+
+# CVE-2026-43185 — Linux kernel ksmbd signedness bug.
+# Package: linux-libc-dev.
+# Why ignored: linux-libc-dev ships kernel headers for build-time compilation,
+# not a running kernel. Containers execute against the host kernel, so these
+# headers are inert at runtime. The upstream fix landed in kernel 7.0-rc2 and
+# has not been backported to Debian's 6.1 LTS line.
+CVE-2026-43185 pkg:linux-libc-dev exp:2026-08-15
+
+# CVE-2023-45853 — zlib MiniZip integer overflow / heap overflow in
+# zipOpenNewFileInZip4_64.
+# Packages: zlib1g, zlib1g-dev.
+# Why ignored: Debian Security Tracker status for bookworm is <ignored>, with
+# the published rationale "contrib/minizip not built and src:zlib not producing
+# binary packages" — i.e. the vulnerable symbol is not present in the libz.so
+# shipped by Debian. Real-not-affected, not unpatched. Upstream fix is in
+# zlib 1.3.1, available in Debian trixie (13); migrating the base image would
+# clear it fully.
+# Ref: https://security-tracker.debian.org/tracker/CVE-2023-45853
+CVE-2023-45853 pkg:zlib1g exp:2026-08-15
+CVE-2023-45853 pkg:zlib1g-dev exp:2026-08-15
+
+# CVE-2026-55200 — libssh2 out-of-bounds write in ssh2_transport_read() due to
+# an unchecked packet_length field in transport.c (heap corruption, possible RCE).
+# Package: libssh2-1.
+# Why ignored: libssh2-1 is pulled in only as a transitive dependency of libcurl4
+# (installed in the SDK Dockerfile for the networking/PowerShell stack). The
+# vulnerable path is reached exclusively when libssh2 acts as an SSH/SCP/SFTP
+# client parsing transport packets from a server. Prowler never uses libcurl's
+# SSH/SCP/SFTP transports; it talks to cloud provider HTTPS endpoints only, so the
+# affected code is unreachable at runtime. Fixed upstream in libssh2 commit
+# 97acf3df (PR #2052); no Debian bookworm fix is available yet.
+# Ref: https://security-tracker.debian.org/tracker/CVE-2026-55200
+CVE-2026-55200 pkg:libssh2-1 exp:2026-08-15
+
+# --- API container image (api/Dockerfile) ---
+# The entries below are specific to the Prowler API image, which ships
+# PowerShell and additional build tooling on top of the same bookworm base.
+
+# CVE-2026-7210 — CPython/Expat hash-flooding denial of service in
+# `xml.parsers.expat` and `xml.etree.ElementTree`.
+# Packages: the Debian system Python 3.11 (python3.11*, libpython3.11*).
+# Why ignored: the API runs under the Python 3.12 interpreter shipped in its
+# `.venv`; the system `python3.11` is only present because `python3-dev` is
+# pulled in to compile native extensions (xmlsec, lxml) and is never executed
+# at runtime. The vulnerable path requires parsing attacker-controlled XML with
+# the affected interpreter, which Prowler does not do with the system Python.
+# Full mitigation also needs libexpat >= 2.8.0; no Debian bookworm fix yet.
+CVE-2026-7210 pkg:python3.11 exp:2026-08-15
+CVE-2026-7210 pkg:python3.11-dev exp:2026-08-15
+CVE-2026-7210 pkg:python3.11-minimal exp:2026-08-15
+CVE-2026-7210 pkg:libpython3.11 exp:2026-08-15
+CVE-2026-7210 pkg:libpython3.11-dev exp:2026-08-15
+CVE-2026-7210 pkg:libpython3.11-minimal exp:2026-08-15
+CVE-2026-7210 pkg:libpython3.11-stdlib exp:2026-08-15
+
+# CVE-2026-33278 — Unbound DNSSEC validator use-after-free (DoS, possible RCE).
+# CVE-2026-42960 — Unbound DNS cache poisoning via promiscuous additional records.
+# Package: libunbound8.
+# Why ignored: libunbound8 is a transitive apt dependency of the TLS/networking
+# stack (GnuTLS DANE support); only the shared library ships in the image. Both
+# vulnerabilities require operating a live Unbound recursive DNSSEC validator
+# that processes attacker-influenced DNS responses. Prowler never starts an
+# Unbound resolver, so neither code path is reachable. No Debian bookworm fix yet.
+CVE-2026-33278 pkg:libunbound8 exp:2026-08-15
+CVE-2026-42960 pkg:libunbound8 exp:2026-08-15
@@ -1,14 +1,14 @@
-FROM python:3.12.13-slim-trixie@sha256:57cd7c3a7a273101a6485ba99423ee568157882804b1124b4dd04266317710de AS build
+FROM python:3.12.13-slim-bookworm@sha256:8a7e7cc04fd3e2bd787f7f24e22d5d119aa590d429b50c95dfe12b3abe52f48b AS build

 LABEL maintainer="https://github.com/prowler-cloud/prowler"
 LABEL org.opencontainers.image.source="https://github.com/prowler-cloud/prowler"

-ARG POWERSHELL_VERSION=7.5.9
+ARG POWERSHELL_VERSION=7.5.0
 ENV POWERSHELL_VERSION=${POWERSHELL_VERSION}
 # Opt out of PowerShell telemetry (Application Insights -> dc.services.visualstudio.com)
 ENV POWERSHELL_TELEMETRY_OPTOUT=1

-ARG TRIVY_VERSION=0.72.0
+ARG TRIVY_VERSION=0.71.2
 ENV TRIVY_VERSION=${TRIVY_VERSION}

 ARG ZIZMOR_VERSION=1.24.1
@@ -16,7 +16,7 @@ ENV ZIZMOR_VERSION=${ZIZMOR_VERSION}

 # hadolint ignore=DL3008
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    wget libicu76 libunwind8 libssl3 libcurl4 ca-certificates apt-transport-https gnupg \
+    wget libicu72 libunwind8 libssl3 libcurl4 ca-certificates apt-transport-https gnupg \
    build-essential pkg-config libzstd-dev zlib1g-dev \
    && rm -rf /var/lib/apt/lists/*

@@ -89,7 +89,7 @@ ENV HOME='/home/prowler'
 ENV PATH="${HOME}/.local/bin:${PATH}"
 #hadolint ignore=DL3013
 RUN pip install --no-cache-dir --upgrade pip && \
-    pip install --no-cache-dir uv==0.12.0
+    pip install --no-cache-dir uv==0.11.14

 RUN uv sync --locked --compile-bytecode && \
    rm -rf ~/.cache/uv
@@ -105,9 +105,6 @@ RUN apt-get purge -y --auto-remove \
    pkg-config \
    libzstd-dev \
    zlib1g-dev \
-    wget \
-    gnupg \
-    apt-transport-https \
    && rm -rf /var/lib/apt/lists/*

 USER prowler
@@ -116,15 +113,5 @@ USER prowler
 RUN pip uninstall dash-html-components -y && \
    pip uninstall dash-core-components -y

-USER root
-
-# pip is build-only; the entrypoint runs the venv directly.
-RUN rm -rf /usr/local/lib/python3.12/site-packages/pip \
-    /usr/local/lib/python3.12/site-packages/pip-*.dist-info \
-    /home/prowler/.local/lib/python3.12/site-packages/pip \
-    /home/prowler/.local/lib/python3.12/site-packages/pip-*.dist-info \
-    /usr/local/bin/pip /usr/local/bin/pip3 /usr/local/bin/pip3.12 \
-    /home/prowler/.local/bin/pip /home/prowler/.local/bin/pip3 /home/prowler/.local/bin/pip3.12
-
 USER prowler
 ENTRYPOINT ["/home/prowler/.venv/bin/prowler"]
@@ -4,47 +4,6 @@ All notable changes to the **Prowler API** are documented in this file.

 <!-- changelog: release notes start -->

-## [1.38.1] (Prowler v5.37.1)
-
-### 🐞 Fixed
-
- Entra Conditional Access guest-user checks no longer report false FAILs in M365 scans: microsoft-kiota packages overridden to 1.9.10 so `guestOrExternalUserTypes` (a flags enum Graph serializes as a comma-separated string) deserializes correctly instead of returning an empty list [(#12315)](https://github.com/prowler-cloud/prowler/pull/12315)
-
-### 🔐 Security
-
- The API container image now builds on Debian 13 (trixie), taking its critical CVE count from 18 to 4 [(#12311)](https://github.com/prowler-cloud/prowler/pull/12311)
- Bumped PowerShell, Trivy and uv in the API container image, clearing 14 high-severity CVEs [(#12311)](https://github.com/prowler-cloud/prowler/pull/12311)
- Bumped `workos` and `pyopenssl` so the API can move to `cryptography` 48.0.1 [(#12311)](https://github.com/prowler-cloud/prowler/pull/12311)
- Removed `gnupg` and `apt-transport-https` from the API container image [(#12311)](https://github.com/prowler-cloud/prowler/pull/12311)
- The API container image no longer ships `git`; removing it also dropped `perl`, `perl-modules`, `libperl` and `liberror-perl`, clearing 12 critical CVEs. Only `perl-base` remains, which Debian marks Essential and cannot be removed [(#12311)](https://github.com/prowler-cloud/prowler/pull/12311)
- Removed `pip` from the API container image, clearing two high-severity CVEs in the vendored copies of `setuptools` and `msgpack` [(#12311)](https://github.com/prowler-cloud/prowler/pull/12311)
- Bumped `pillow` to 12.3.0, `httplib2` to 0.32.0 and `pyasn1` to 0.6.4 to resolve known CVEs [(#12311)](https://github.com/prowler-cloud/prowler/pull/12311)
-
---
-
-## [1.38.0] (Prowler v5.37.0)
-
-### 🚀 Added
-
- Attack Paths: four AWS privilege-escalation detection queries from pathfinding.cloud: cross-account role trust (STS-002), wildcard role trust (STS-003), user permissions-boundary removal (IAM-022), and IAM Identity Center permission-set escalation (SSO-001) [(#11460)](https://github.com/prowler-cloud/prowler/pull/11460)
-
-### 🐞 Fixed
-
- Attack Paths IAM privilege-escalation queries no longer build an all-nodes × all-resource-items cartesian product, fixing runtime errors and timeouts on accounts with many IAM roles, users, or groups [(#12136)](https://github.com/prowler-cloud/prowler/pull/12136)
- `task_args` serialization no longer returns HTTP 500 errors when Celery truncates stored task keyword arguments [(#12165)](https://github.com/prowler-cloud/prowler/pull/12165)
- Attack Paths predefined queries on migrated graphs are now scoped with the provider label, letting the graph database seed from its label index instead of a global label scan and preventing query timeouts on Neptune [(#12167)](https://github.com/prowler-cloud/prowler/pull/12167)
- Authentication with an API key whose owning user was deleted now returns `401` instead of an unhandled `AttributeError`, and user deletion now revokes the user's API keys across all their tenants [(#12210)](https://github.com/prowler-cloud/prowler/pull/12210)
- AWS Security Hub integrations now persist successful connection checks during finding delivery so their connection status and last checked timestamp stay current [(#12212)](https://github.com/prowler-cloud/prowler/pull/12212)
- SAML users without a `userType` attribute and without an existing role in the SAML tenant now receive a least-privilege `read_only` fallback role; a numeric suffix is used when that name belongs to a role with different permissions [(#12223)](https://github.com/prowler-cloud/prowler/pull/12223)
- Social signups create users and authentication records in one database transaction, preventing incomplete accounts when provisioning fails [(#12245)](https://github.com/prowler-cloud/prowler/pull/12245)
- Requesting integrations with a sparse fieldset that leaves out `configuration` no longer returns HTTP 500 errors when the tenant has a Jira integration [(#12261)](https://github.com/prowler-cloud/prowler/pull/12261)
-
-### 🔐 Security
-
- Provider deletion and connection checks, scan creation, provider secrets, provider groups, and daily schedules now respect role provider-group visibility [(#12216)](https://github.com/prowler-cloud/prowler/pull/12216)
-
---
-
 ## [1.37.0] (Prowler v5.36.0)

 ### 🔄 Changed
@@ -1,13 +1,13 @@
-FROM python:3.12.13-slim-trixie@sha256:57cd7c3a7a273101a6485ba99423ee568157882804b1124b4dd04266317710de AS build
+FROM python:3.12.13-slim-bookworm@sha256:8a7e7cc04fd3e2bd787f7f24e22d5d119aa590d429b50c95dfe12b3abe52f48b AS build

 LABEL maintainer="https://github.com/prowler-cloud/api"

-ARG POWERSHELL_VERSION=7.5.9
+ARG POWERSHELL_VERSION=7.5.0
 ENV POWERSHELL_VERSION=${POWERSHELL_VERSION}
 # Opt out of PowerShell telemetry (Application Insights -> dc.services.visualstudio.com)
 ENV POWERSHELL_TELEMETRY_OPTOUT=1

-ARG TRIVY_VERSION=0.72.0
+ARG TRIVY_VERSION=0.71.2
 ENV TRIVY_VERSION=${TRIVY_VERSION}

 ARG ZIZMOR_VERSION=1.24.1
@@ -17,7 +17,7 @@ ENV ZIZMOR_VERSION=${ZIZMOR_VERSION}
 RUN apt-get update && apt-get install -y --no-install-recommends \
    wget \
    git \
-    libicu76 \
+    libicu72 \
    gcc \
    g++ \
    make \
@@ -28,6 +28,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
    libtool \
    libxslt1-dev \
    python3-dev \
+    git \
    && rm -rf /var/lib/apt/lists/*

 # Install PowerShell
@@ -93,7 +94,7 @@ RUN mkdir -p /tmp/prowler_api_output
 COPY --chown=prowler:prowler pyproject.toml uv.lock ./

 RUN pip install --no-cache-dir --upgrade pip && \
-    pip install --no-cache-dir uv==0.12.0
+    pip install --no-cache-dir uv==0.11.14

 ENV PATH="/home/prowler/.local/bin:$PATH"

@@ -108,34 +109,19 @@ RUN .venv/bin/python -m prowler.providers.m365.lib.powershell.m365_powershell
 USER root

 # Remove build-only packages from the final image after Python dependencies are installed.
-# git is only needed by uv sync for the `prowler @ git+...` dependency; purging it drops perl too.
-# wget stays: the compose healthcheck shells out to it.
 RUN apt-get purge -y --auto-remove \
    gcc \
    g++ \
-    git \
    make \
    libxml2-dev \
    libxmlsec1-dev \
    libxmlsec1-openssl \
-    libxmlsec1t64 \
-    libxmlsec1t64-openssl \
    pkg-config \
    libtool \
    libxslt1-dev \
    python3-dev \
-    gnupg \
-    apt-transport-https \
    && rm -rf /var/lib/apt/lists/*

-# pip is build-only; the entrypoint runs uv against the prepared venv. uv stays.
-RUN rm -rf /usr/local/lib/python3.12/site-packages/pip \
-    /usr/local/lib/python3.12/site-packages/pip-*.dist-info \
-    /home/prowler/.local/lib/python3.12/site-packages/pip \
-    /home/prowler/.local/lib/python3.12/site-packages/pip-*.dist-info \
-    /usr/local/bin/pip /usr/local/bin/pip3 /usr/local/bin/pip3.12 \
-    /home/prowler/.local/bin/pip /home/prowler/.local/bin/pip3 /home/prowler/.local/bin/pip3.12
-
 USER prowler

 COPY --chown=prowler:prowler src/backend/ ./backend/
@@ -0,0 +1 @@
+Attack Paths IAM privilege-escalation queries no longer build an all-nodes × all-resource-items cartesian product, fixing runtime errors and timeouts on accounts with many IAM roles, users, or groups
@@ -45,7 +45,7 @@ dependencies = [
  "gunicorn==26.0.0",
  "uvloop==0.22.1",
  "lxml==6.1.0",
-  "prowler @ git+https://github.com/prowler-cloud/prowler.git@v5.37",
+  "prowler @ git+https://github.com/prowler-cloud/prowler.git@master",
  "psycopg2-binary==2.9.9",
  "pytest-celery[redis] (==1.3.0)",
  "sentry-sdk[django] (==2.56.0)",
@@ -63,7 +63,7 @@ dependencies = [
  "werkzeug (==3.1.7)",
  "sqlparse (==0.5.5)",
  "fonttools (==4.62.1)",
-  "uvicorn-worker (==0.4.0)"
+  "uvicorn-worker (==0.4.0)",
 ]
 description = "Prowler's API (Django/DRF)"
 license = "Apache-2.0"
@@ -71,7 +71,7 @@ name = "prowler-api"
 package-mode = false
 # Needed for the SDK compatibility
 requires-python = ">=3.11,<3.13"
-version = "1.38.1"
+version = "1.38.0"

 # Shared ruff baseline (kept in sync with mcp_server/pyproject.toml).
 # target-version tracks this project's lowest supported Python.
@@ -92,8 +92,6 @@ extend-select = [

 [tool.uv]
 # Transitive pins matching master to avoid silent drift; bump deliberately.
-# workos and pyopenssl run ahead of master: the versions master pins cap cryptography
-# below 48, so both were bumped to versions that allow it (PROWLER-2310).
 constraint-dependencies = [
  "about-time==4.2.1",
  "adal==1.2.7",
@@ -130,7 +128,7 @@ constraint-dependencies = [
  "alibabacloud-sls20201230==5.9.0",
  "alibabacloud-sts20150401==1.1.6",
  "alibabacloud-tea==0.4.3",
-  "alibabacloud-tea-openapi==0.4.5",
+  "alibabacloud-tea-openapi==0.4.4",
  "alibabacloud-tea-util==0.3.14",
  "alibabacloud-tea-xml==0.0.3",
  "alibabacloud-vpc20160428==6.13.0",
@@ -212,9 +210,9 @@ constraint-dependencies = [
  "coverage==7.5.4",
  "cron-descriptor==1.4.5",
  "crowdstrike-falconpy==1.6.0",
-  "cryptography==48.0.1",
+  "cryptography==46.0.7",
  "cycler==0.12.1",
-  "darabonba-core==1.0.8",
+  "darabonba-core==1.0.5",
  "dash==3.1.1",
  "dash-bootstrap-components==2.0.3",
  "debugpy==1.8.20",
@@ -279,7 +277,7 @@ constraint-dependencies = [
  "h2==4.3.0",
  "hpack==4.1.0",
  "httpcore==1.0.9",
-  "httplib2==0.32.0",
+  "httplib2==0.31.2",
  "httpx==0.28.1",
  "humanfriendly==10.0",
  "hyperframe==6.1.0",
@@ -316,13 +314,13 @@ constraint-dependencies = [
  "matplotlib==3.10.8",
  "mccabe==0.7.0",
  "mdurl==0.1.2",
-  "microsoft-kiota-abstractions==1.9.10",
-  "microsoft-kiota-authentication-azure==1.9.10",
-  "microsoft-kiota-http==1.9.10",
-  "microsoft-kiota-serialization-form==1.9.10",
-  "microsoft-kiota-serialization-json==1.9.10",
-  "microsoft-kiota-serialization-multipart==1.9.10",
-  "microsoft-kiota-serialization-text==1.9.10",
+  "microsoft-kiota-abstractions==1.9.9",
+  "microsoft-kiota-authentication-azure==1.9.9",
+  "microsoft-kiota-http==1.9.9",
+  "microsoft-kiota-serialization-form==1.9.9",
+  "microsoft-kiota-serialization-json==1.9.9",
+  "microsoft-kiota-serialization-multipart==1.9.9",
+  "microsoft-kiota-serialization-text==1.9.9",
  "microsoft-security-utilities-secret-masker==1.0.0b4",
  "msal==1.35.0b1",
  "msal-extensions==1.2.0",
@@ -339,7 +337,7 @@ constraint-dependencies = [
  "nltk==3.9.4",
  "numpy==2.2.6",
  "oauthlib==3.3.1",
-  "oci==2.183.0",
+  "oci==2.169.0",
  "openai==1.109.1",
  "openstacksdk==4.2.0",
  "opentelemetry-api==1.39.1",
@@ -351,7 +349,7 @@ constraint-dependencies = [
  "pagerduty==6.1.0",
  "pandas==2.2.3",
  "pbr==7.0.3",
-  "pillow==12.3.0",
+  "pillow==12.2.0",
  "pkginfo==1.12.1.2",
  "platformdirs==4.5.1",
  "plotly==6.5.2",
@@ -367,8 +365,8 @@ constraint-dependencies = [
  "psycopg2-binary==2.9.9",
  "py-deviceid==0.1.1",
  "py-iam-expand==0.3.0",
-  "py-ocsf-models==0.10.0",
-  "pyasn1==0.6.4",
+  "py-ocsf-models==0.8.1",
+  "pyasn1==0.6.3",
  "pyasn1-modules==0.4.2",
  "pycodestyle==2.14.0",
  "pycparser==3.0",
@@ -380,7 +378,7 @@ constraint-dependencies = [
  "pylint==3.2.5",
  "pymsalruntime==0.18.1",
  "pynacl==1.6.2",
-  "pyopenssl==26.2.0",
+  "pyopenssl==26.0.0",
  "pyparsing==3.3.2",
  "pyreadline3==3.5.4",
  "pysocks==1.7.1",
@@ -449,7 +447,7 @@ constraint-dependencies = [
  "wcwidth==0.5.3",
  "websocket-client==1.9.0",
  "werkzeug==3.1.7",
-  "workos==8.3.0",
+  "workos==6.0.8",
  "wrapt==1.17.3",
  "xlsxwriter==3.2.9",
  "xmlsec==1.3.17",
@@ -468,13 +466,10 @@ constraint-dependencies = [
 # 0.138.1 requires azure-mgmt-containerservice>=41.0.0. Attack Paths does not
 # ingest Azure today, so override the Cartography dependency to the Prowler pin.
 #
-# prowler@master hard-pins the microsoft-kiota packages in [project.dependencies].
-# microsoft-kiota-serialization-json 1.9.10 fixes get_collection_of_enum_values
-# returning [] for flags enums serialized as CSV strings (microsoft/kiota-python#515),
-# which broke the Entra Conditional Access guest-user checks; the kiota packages
-# release in lockstep and 1.9.10 requires microsoft-kiota-abstractions>=1.9.10, which
-# a constraint cannot satisfy against the SDK's hard pins, so override the whole set
-# to 1.9.10 until the SDK bump propagates to the pinned master rev.
+# prowler@master hard-pins microsoft-kiota-abstractions==1.9.2 in [project.dependencies].
+# The microsoft-kiota-http security bump to 1.9.9 (GHSA-7j59-v9qr-6fq9) requires
+# microsoft-kiota-abstractions>=1.9.9, which a constraint cannot satisfy against the
+# SDK's hard pin; override it to the patched, kiota-aligned version.
 #
 # prowler@master hard-pins dulwich==0.23.0 and pyjwt==2.12.1 in [project.dependencies].
 # dulwich 1.2.5 patches GHSA-897w-fcg9-f6xj (arbitrary file write) and pyjwt 2.13.0
@@ -486,13 +481,7 @@ constraint-dependencies = [
 override-dependencies = [
  "okta==3.4.2",
  "azure-mgmt-containerservice==34.1.0",
-  "microsoft-kiota-abstractions==1.9.10",
-  "microsoft-kiota-authentication-azure==1.9.10",
-  "microsoft-kiota-http==1.9.10",
-  "microsoft-kiota-serialization-form==1.9.10",
-  "microsoft-kiota-serialization-json==1.9.10",
-  "microsoft-kiota-serialization-multipart==1.9.10",
-  "microsoft-kiota-serialization-text==1.9.10",
+  "microsoft-kiota-abstractions==1.9.9",
  "dulwich==1.2.5",
  "pyjwt[crypto]==2.13.0"
 ]
@@ -1,7 +1,7 @@
 from allauth.account.models import EmailAddress
 from allauth.core.exceptions import ImmediateHttpResponse
 from allauth.socialaccount.adapter import DefaultSocialAccountAdapter
-from api.db_router import MainRouter, write_db_alias
+from api.db_router import MainRouter
 from api.db_utils import rls_transaction
 from api.models import (
    Membership,
@@ -107,10 +107,7 @@ class ProwlerSocialAccountAdapter(DefaultSocialAccountAdapter):
        and is about to be saved to the DB for the first time.
        """
        with transaction.atomic(using=MainRouter.admin_db):
-            # Allauth saves the user without an explicit alias. Route that save
-            # through admin so every signup record shares this transaction.
-            with write_db_alias(MainRouter.admin_db):
-                user = super().save_user(request, sociallogin, form)
+            user = super().save_user(request, sociallogin, form)
            provider = sociallogin.provider.id
            extra = sociallogin.account.extra_data

@@ -3536,160 +3536,6 @@ AWS_STS_PRIVESC_ASSUME_ROLE = AttackPathsQueryDefinition(
    parameters=[],
 )

-# STS-002
-AWS_STS_PRIVESC_CROSS_ACCOUNT_TRUST = AttackPathsQueryDefinition(
-    id="aws-sts-privesc-cross-account-trust",
-    name="Cross-Account Role Trust for Privilege Escalation (STS-002)",
-    short_description="Roles that trust an external account's root principal can be assumed by any principal in that account, enabling confused-deputy escalation.",
-    description="Detect IAM roles whose trust policy allows an external AWS account root principal (arn:aws:iam::<account-id>:root) to assume them. Any principal in the trusted external account that holds sts:AssumeRole can assume the role and gain its permissions, which is the confused-deputy escalation surface. The ingested graph does not record trust-policy conditions, so roles protected by an sts:ExternalId condition cannot be filtered out automatically and are surfaced here for manual review.",
-    attribution=AttackPathsQueryAttribution(
-        text="pathfinding.cloud - STS-002 - sts:AssumeRole",
-        link="https://pathfinding.cloud/paths/sts-002",
-    ),
-    provider="aws",
-    cypher=f"""
-        // Find roles that trust an external account's root principal (cross-account trust)
-        MATCH path_target = (aws:AWSAccount {{id: $provider_uid}})--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(trusted:AWSRootPrincipal)
-        WHERE trusted.arn CONTAINS ':root'
-            AND NOT trusted.arn CONTAINS aws.id
-
-        WITH DISTINCT path_target
-        WITH collect(path_target) AS paths
-        UNWIND paths AS p
-        UNWIND nodes(p) AS n
-
-        WITH paths, collect(DISTINCT n) AS unique_nodes
-        UNWIND unique_nodes AS n
-
-        OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
-
-        RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
-    """,
-    parameters=[],
-)
-
-# STS-003
-AWS_STS_PRIVESC_WILDCARD_TRUST = AttackPathsQueryDefinition(
-    id="aws-sts-privesc-wildcard-trust",
-    name="Potential Wildcard Role Trust (STS-003)",
-    short_description="Potential wildcard role trusts that need manual review before they are treated as assumable.",
-    description='Find IAM roles linked to a wildcard principal ("AWS": "*"). The ingested graph does not preserve trust-policy Effect or Condition fields, so a match can come from a Deny statement or a restricted Allow statement. Treat each result as a candidate for manual review, not as a confirmed assumable role.',
-    attribution=AttackPathsQueryAttribution(
-        text="pathfinding.cloud - STS-003 - sts:AssumeRole",
-        link="https://pathfinding.cloud/paths/sts-003",
-    ),
-    provider="aws",
-    cypher=f"""
-        // Find roles linked to a wildcard principal for manual review
-        MATCH path_target = (aws:AWSAccount {{id: $provider_uid}})--(target_role:AWSRole)-[:TRUSTS_AWS_PRINCIPAL]->(trusted:AWSPrincipal)
-        WHERE trusted.arn = '*'
-
-        WITH DISTINCT path_target
-        WITH collect(path_target) AS paths
-        UNWIND paths AS p
-        UNWIND nodes(p) AS n
-
-        WITH paths, collect(DISTINCT n) AS unique_nodes
-        UNWIND unique_nodes AS n
-
-        OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
-
-        RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
-    """,
-    parameters=[],
-)
-
-# IAM-022
-AWS_IAM_PRIVESC_DELETE_USER_PERMISSIONS_BOUNDARY = AttackPathsQueryDefinition(
-    id="aws-iam-privesc-delete-user-permissions-boundary",
-    name="Permissions Boundary Removal for Self-Escalation (IAM-022)",
-    short_description="IAM users that can remove their own permissions boundary, if one is attached.",
-    description="Find IAM users whose policies allow iam:DeleteUserPermissionsBoundary on their own user ARN. The graph does not record whether a boundary is attached or whether removing it grants more access, so each result needs manual review.",
-    attribution=AttackPathsQueryAttribution(
-        text="pathfinding.cloud - IAM-022 - iam:DeleteUserPermissionsBoundary",
-        link="https://pathfinding.cloud/paths/iam-022",
-    ),
-    provider="aws",
-    cypher=f"""
-        // Find IAM users with iam:DeleteUserPermissionsBoundary permission
-        MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSUser)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement {{effect: 'Allow'}})
-        MATCH (stmt)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
-        WHERE toLower(act.value) IN ['iam:*', 'iam:deleteuserpermissionsboundary']
-            OR act.value = '*'
-        WITH DISTINCT principal, stmt, path_principal
-
-        // Keep only users that can remove the boundary from their own user ARN
-        MATCH (stmt)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
-        WHERE res.value = '*'
-            OR res.value = principal.arn
-            OR (res.value ENDS WITH '*' AND principal.arn STARTS WITH replace(res.value, '*', ''))
-
-        WITH DISTINCT path_principal
-        WITH collect(path_principal) AS paths
-        UNWIND paths AS p
-        UNWIND nodes(p) AS n
-
-        WITH paths, collect(DISTINCT n) AS unique_nodes
-        UNWIND unique_nodes AS n
-
-        OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
-
-        RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
-    """,
-    parameters=[],
-)
-
-# SSO-001
-AWS_SSO_PRIVESC_PERMISSION_SET_ESCALATION = AttackPathsQueryDefinition(
-    id="aws-sso-privesc-permission-set-escalation",
-    name="Identity Center Permission Set Escalation (SSO-001)",
-    short_description="Create an administrative Identity Center permission set and assign it to gain organization-wide admin access.",
-    description="Detect principals that hold sso:CreatePermissionSet, sso:AttachManagedPolicyToPermissionSet, and sso:CreateAccountAssignment together. With all three, a principal can create a new IAM Identity Center permission set, attach the AdministratorAccess managed policy to it, and assign it to their own user or group for any account in the organization, gaining administrative access across the organization through the Identity Center portal.",
-    attribution=AttackPathsQueryAttribution(
-        text="pathfinding.cloud - SSO-001 - sso:CreatePermissionSet + sso:AttachManagedPolicyToPermissionSet + sso:CreateAccountAssignment",
-        link="https://pathfinding.cloud/paths/sso-001",
-    ),
-    provider="aws",
-    cypher=f"""
-        // Find principals with sso:CreatePermissionSet permission
-        MATCH path_principal = (aws:AWSAccount {{id: $provider_uid}})--(principal:AWSPrincipal)-[:POLICY]->(policy:AWSPolicy)-[:STATEMENT]->(stmt:AWSPolicyStatement {{effect: 'Allow'}})
-        MATCH (stmt)-[:HAS_ACTION]->(act:AWSPolicyStatementActionItem)
-        WHERE toLower(act.value) IN ['sso:*', 'sso:createpermissionset']
-            OR act.value = '*'
-        MATCH (stmt)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)
-        WHERE res.value = '*'
-        WITH DISTINCT aws, principal, path_principal
-
-        // Find sso:AttachManagedPolicyToPermissionSet permission on the same principal
-        MATCH (principal)-[:POLICY]->(:AWSPolicy)-[:STATEMENT]->(stmt2:AWSPolicyStatement {{effect: 'Allow'}})-[:HAS_ACTION]->(act2:AWSPolicyStatementActionItem)
-        WHERE toLower(act2.value) IN ['sso:*', 'sso:attachmanagedpolicytopermissionset']
-            OR act2.value = '*'
-        MATCH (stmt2)-[:HAS_RESOURCE]->(res2:AWSPolicyStatementResourceItem)
-        WHERE res2.value = '*'
-        WITH DISTINCT principal, path_principal
-
-        // Find sso:CreateAccountAssignment permission on the same principal
-        MATCH (principal)-[:POLICY]->(:AWSPolicy)-[:STATEMENT]->(stmt3:AWSPolicyStatement {{effect: 'Allow'}})-[:HAS_ACTION]->(act3:AWSPolicyStatementActionItem)
-        WHERE toLower(act3.value) IN ['sso:*', 'sso:createaccountassignment']
-            OR act3.value = '*'
-        MATCH (stmt3)-[:HAS_RESOURCE]->(res3:AWSPolicyStatementResourceItem)
-        WHERE res3.value = '*'
-
-        WITH DISTINCT path_principal
-        WITH collect(path_principal) AS paths
-        UNWIND paths AS p
-        UNWIND nodes(p) AS n
-
-        WITH paths, collect(DISTINCT n) AS unique_nodes
-        UNWIND unique_nodes AS n
-
-        OPTIONAL MATCH (n)-[pfr:HAS_FINDING]-(pf:{PROWLER_FINDING_LABEL} {{status: 'FAIL'}})
-
-        RETURN paths, collect(DISTINCT pf) as dpf, collect(DISTINCT pfr) as dpfr
-    """,
-    parameters=[],
-)
-
 # AWS Queries List

 AWS_QUERIES: list[AttackPathsQueryDefinition] = [
@@ -3771,8 +3617,4 @@ AWS_QUERIES: list[AttackPathsQueryDefinition] = [
    AWS_SSM_PRIVESC_START_SESSION,
    AWS_SSM_PRIVESC_SEND_COMMAND,
    AWS_STS_PRIVESC_ASSUME_ROLE,
-    AWS_STS_PRIVESC_CROSS_ACCOUNT_TRUST,
-    AWS_STS_PRIVESC_WILDCARD_TRUST,
-    AWS_IAM_PRIVESC_DELETE_USER_PERMISSIONS_BOUNDARY,
-    AWS_SSO_PRIVESC_PERMISSION_SET_ESCALATION,
 ]
@@ -115,26 +115,7 @@ def execute_query(
        # TODO: drop after Neptune cutover
        # Route reads by the scan row's recorded sink, not by current settings.
        backend = sink_module.get_backend_for_scan(scan)
-
-        cypher = definition.cypher
-        # Every synced node carries a `_Provider_{uuid}` isolation label (the
-        # sync labels the whole provider subgraph). Injecting it into the
-        # predefined query's node patterns gives the planner a selective label
-        # index to seed from instead of a global label scan (`:AWSRole` across
-        # every tenant), which on Neptune is the difference between a sub-second
-        # plan and a query that times out. The custom-query path relies on this
-        # same injection.
-        #
-        # Restrict it to migrated scans: that catalog runs on the Neptune sink
-        # where the plan blowup happens, while the pre-cutover legacy catalog
-        # runs on the old sink and is dropped after the cutover, so leave it
-        # byte-for-byte unchanged. This only affects the query plan, not
-        # isolation - `_serialize_graph` already label-filters both catalogs.
-        # TODO: drop the is_migrated guard after Neptune cutover
-        if scan.is_migrated:
-            cypher = inject_provider_label(cypher, provider_id)
-
-        graph = backend.execute_read_query(database_name, cypher, parameters)
+        graph = backend.execute_read_query(database_name, definition.cypher, parameters)
        return _serialize_graph(graph, provider_id)

    except graph_database.WriteQueryNotAllowedException:
@@ -1,4 +1,3 @@
-import logging
 from math import isfinite
 from uuid import UUID

@@ -6,7 +5,6 @@ from api.db_router import MainRouter
 from api.models import TenantAPIKey, TenantAPIKeyManager
 from cryptography.fernet import InvalidToken
 from django.core.exceptions import ObjectDoesNotExist
-from django.db import transaction
 from django.utils import timezone
 from drf_simple_apikey.backends import APIKeyAuthentication as BaseAPIKeyAuth
 from drf_simple_apikey.crypto import get_crypto
@@ -16,16 +14,6 @@ from rest_framework.exceptions import AuthenticationFailed
 from rest_framework.request import Request
 from rest_framework_simplejwt.authentication import JWTAuthentication

-logger = logging.getLogger(__name__)
-
-
-class OrphanedAPIKeyError(Exception):
-    """Raised when an API key outlived the user that owns it.
-
-    Handled by `authenticate`, which commits the revocation written while detecting it
-    and then rejects the request with `AuthenticationFailed`.
-    """
-

 class TenantAPIKeyAuthentication(BaseAPIKeyAuth):
    model = TenantAPIKey
@@ -36,13 +24,10 @@ class TenantAPIKeyAuthentication(BaseAPIKeyAuth):
    def _authenticate_credentials(self, request, key):
        """
        Override to use admin connection, bypassing RLS during authentication.
-
-        Returns the validated API key row, locked with `select_for_update`, so callers
-        must run inside `transaction.atomic(using=MainRouter.admin_db)`.
        """
        try:
            payload = self.key_crypto.decrypt(key)
-        except (ValueError, InvalidToken):
+        except ValueError:
            raise AuthenticationFailed("Invalid API Key.")

        if not isinstance(payload, dict):
@@ -67,33 +52,13 @@ class TenantAPIKeyAuthentication(BaseAPIKeyAuth):
            raise AuthenticationFailed("API Key has already expired.")

        try:
-            api_key = (
-                self.model.objects.using(MainRouter.admin_db)
-                .select_for_update()
-                .get(id=api_key_pk)
-            )
+            api_key = self.model.objects.using(MainRouter.admin_db).get(id=api_key_pk)
        except ObjectDoesNotExist:
            raise AuthenticationFailed("No entity matching this api key.")

        if api_key.revoked:
            raise AuthenticationFailed("This API Key has been revoked.")

-        # `entity` is nullable and `on_delete=SET_NULL` leaves the key behind when its
-        # owner is deleted, so a key can outlive its user. Reject it here: further down
-        # the authentication would return `None` as the authenticated user, which blows
-        # up while building the auth dict and surfaces as a 500 instead of a 401.
-        # Revoke it as well, so it stops showing up as active and later attempts fail
-        # the `revoked` check above like any other revoked key.
-        if api_key.entity_id is None:
-            api_key.revoked = True
-            api_key.save(update_fields=["revoked"], using=MainRouter.admin_db)
-            logger.warning(
-                "Revoked orphaned API key: prefix=%s tenant=%s",
-                api_key.prefix,
-                api_key.tenant_id,
-            )
-            raise OrphanedAPIKeyError
-
        client_ip = request.META.get(package_settings.IP_ADDRESS_HEADER)
        if api_key.blacklisted_ips and client_ip in api_key.blacklisted_ips:
            raise AuthenticationFailed("Access denied from blacklisted IP.")
@@ -101,7 +66,7 @@ class TenantAPIKeyAuthentication(BaseAPIKeyAuth):
        if api_key.whitelisted_ips and client_ip not in api_key.whitelisted_ips:
            raise AuthenticationFailed("Access restricted to specific IP addresses.")

-        return api_key
+        return api_key.entity, key

    def authenticate(self, request: Request):
        prefixed_key = self.get_key(request)
@@ -112,34 +77,36 @@ class TenantAPIKeyAuthentication(BaseAPIKeyAuth):
        except ValueError:
            raise AuthenticationFailed("Invalid API Key.")

-        # Validation, the `last_used_at` update and the auth claims all read the same
-        # row, locked until the transaction ends. Looking the key up a second time to
-        # build the claims used to leave a window where a key revoked or orphaned right
-        # after passing validation still authenticated.
-        with transaction.atomic(using=MainRouter.admin_db):
-            try:
-                api_key = self._authenticate_credentials(request, key)
-            except OrphanedAPIKeyError:
-                # Rejected below instead of here: leaving the block normally commits
-                # the revocation `_authenticate_credentials` wrote, while raising from
-                # inside would roll it back.
-                pass
-            else:
-                # The prefix used to be checked by the second lookup
-                if api_key.prefix != prefix:
-                    raise AuthenticationFailed("Invalid API Key.")
+        try:
+            entity, _ = self._authenticate_credentials(request, key)
+        except InvalidToken:
+            raise AuthenticationFailed("Invalid API Key.")

-                api_key.last_used_at = timezone.now()
-                api_key.save(update_fields=["last_used_at"], using=MainRouter.admin_db)
+        # Get the API key instance to update last_used_at and retrieve tenant info
+        # We need to decrypt again to get the pk (already validated by _authenticate_credentials)
+        payload = self.key_crypto.decrypt(key)
+        api_key_pk = payload["_pk"]

-                entity = api_key.entity
-                return entity, {
-                    "tenant_id": str(api_key.tenant_id),
-                    "sub": str(entity.id),
-                    "api_key_prefix": api_key.prefix,
-                }
+        # Convert string UUID back to UUID object for lookup
+        if isinstance(api_key_pk, str):
+            api_key_pk = UUID(api_key_pk)

-        raise AuthenticationFailed("No entity matching this api key.")
+        try:
+            api_key_instance = TenantAPIKey.objects.using(MainRouter.admin_db).get(
+                id=api_key_pk, prefix=prefix
+            )
+        except TenantAPIKey.DoesNotExist:
+            raise AuthenticationFailed("Invalid API Key.")
+
+        # Update last_used_at
+        api_key_instance.last_used_at = timezone.now()
+        api_key_instance.save(update_fields=["last_used_at"], using=MainRouter.admin_db)
+
+        return entity, {
+            "tenant_id": str(api_key_instance.tenant_id),
+            "sub": str(api_key_instance.entity.id),
+            "api_key_prefix": prefix,
+        }


 class CombinedJWTOrAPIKeyAuthentication(BaseAuthentication):
@@ -1,40 +0,0 @@
-import ast
-import json
-from typing import Any
-
-_UNPARSED = object()
-
-
-def decode_celery_field(value: Any, default: Any) -> Any:
-    """Decode a Celery result field and require JSON-serializable output."""
-    decoded = value
-    for _ in range(2):
-        if not isinstance(decoded, str):
-            break
-
-        text = decoded.strip()
-        if not text:
-            decoded = default
-            break
-
-        parsed = _UNPARSED
-        for parser in (json.loads, ast.literal_eval):
-            try:
-                parsed = parser(text)
-                break
-            except (TypeError, ValueError, SyntaxError):
-                continue
-
-        if parsed is _UNPARSED:
-            raise ValueError("Unable to decode Celery result field")
-        decoded = parsed
-
-    decoded = default if decoded is None else decoded
-    try:
-        json.dumps(decoded, allow_nan=False)
-    except (TypeError, ValueError) as error:
-        raise ValueError(
-            "Decoded Celery result field is not JSON serializable"
-        ) from error
-
-    return decoded
@@ -1,4 +1,3 @@
-from contextlib import contextmanager
 from contextvars import ContextVar

 from django.conf import settings
@@ -6,7 +5,6 @@ from django.conf import settings
 ALLOWED_APPS = ("django", "socialaccount", "account", "authtoken", "silk")

 _read_db_alias = ContextVar("read_db_alias", default=None)
-_write_db_alias = ContextVar("write_db_alias", default=None)


 def set_read_db_alias(alias: str | None):
@@ -24,30 +22,6 @@ def reset_read_db_alias(token) -> None:
        _read_db_alias.reset(token)


-def set_write_db_alias(alias: str | None):
-    if not alias:
-        return None
-    return _write_db_alias.set(alias)
-
-
-def get_write_db_alias() -> str | None:
-    return _write_db_alias.get()
-
-
-def reset_write_db_alias(token) -> None:
-    if token is not None:
-        _write_db_alias.reset(token)
-
-
-@contextmanager
-def write_db_alias(alias: str | None):
-    token = set_write_db_alias(alias)
-    try:
-        yield
-    finally:
-        reset_write_db_alias(token)
-
-
 class MainRouter:
    default_db = "default"
    admin_db = "admin"
@@ -69,9 +43,6 @@ class MainRouter:
        model_table_name = model._meta.db_table
        if any(model_table_name.startswith(f"{app}_") for app in ALLOWED_APPS):
            return self.admin_db
-        write_alias = get_write_db_alias()
-        if write_alias:
-            return write_alias
        return None

    def allow_migrate(self, db, app_label, model_name=None, **hints):  # noqa: F841
@@ -1,4 +1,3 @@
-from api.db_router import MainRouter
 from api.db_utils import delete_related_daily_task
 from api.models import (
    LighthouseProviderConfiguration,
@@ -48,15 +47,8 @@ def revoke_user_api_keys(sender, instance, **kwargs):  # noqa: F841

    The entity field will be set to NULL by on_delete=SET_NULL,
    but we explicitly revoke the keys to prevent further use.
-
-    The update runs on the admin connection because `api_keys` is RLS protected and its
-    policy denies every row when `api.tenant_id` is unset. Users are deleted through the
-    admin connection and may belong to several tenants, so going through the default
-    connection would silently revoke nothing, or only the keys of the active tenant.
    """
-    TenantAPIKey.objects.using(MainRouter.admin_db).filter(entity=instance).update(
-        revoked=True
-    )
+    TenantAPIKey.objects.filter(entity=instance).update(revoked=True)


@receiver(post_delete, sender=Membership)
@@ -66,12 +58,8 @@ def revoke_membership_api_keys(sender, instance, **kwargs):  # noqa: F841

    When a membership is deleted, all API keys created by that user
    in that tenant should be revoked to prevent further access.
-
-    Uses the admin connection for the same reason as `revoke_user_api_keys`: the RLS
-    policy on `api_keys` denies every row when `api.tenant_id` is unset, which is the
-    case when the membership is removed as a cascade of a user deletion.
    """
-    TenantAPIKey.objects.using(MainRouter.admin_db).filter(
+    TenantAPIKey.objects.filter(
        entity_id=instance.user_id, tenant_id=instance.tenant_id
    ).update(revoked=True)

@@ -1,7 +1,7 @@
 openapi: 3.0.3
 info:
  title: Prowler API
-  version: 1.38.1
+  version: 1.38.0
  description: |-
    Prowler API specification.

@@ -4,11 +4,8 @@ from datetime import UTC, datetime, timedelta
 from uuid import uuid4

 import pytest
-from api.db_router import MainRouter
 from api.models import Membership, Role, TenantAPIKey, User, UserRoleRelationship
-from api.signals import revoke_membership_api_keys, revoke_user_api_keys
 from conftest import TEST_PASSWORD, get_api_tokens, get_authorization_header
-from django.db.utils import ConnectionDoesNotExist
 from django.urls import reverse
 from drf_simple_apikey.crypto import get_crypto
 from rest_framework.test import APIClient
@@ -628,34 +625,6 @@ class TestAPIKeyErrors:
        assert response.status_code == 401
        assert "API Key has been revoked." in response.json()["errors"][0]["detail"]

-    def test_orphaned_api_key_rejected(
-        self, create_test_user, tenants_fixture, api_keys_fixture
-    ):
-        """Key whose owning user was deleted returns 401 instead of 500."""
-        client = APIClient()
-
-        api_key = api_keys_fixture[0]
-        # `on_delete=SET_NULL` leaves the key behind with no entity when the owner goes
-        TenantAPIKey.objects.filter(id=api_key.id).update(entity=None)
-
-        api_key_headers = get_api_key_header(api_key._raw_key)
-        response = client.get(reverse("provider-list"), headers=api_key_headers)
-
-        assert response.status_code == 401
-        assert (
-            "No entity matching this api key." in response.json()["errors"][0]["detail"]
-        )
-
-        # The orphaned key is revoked on use; retries fail the regular revoked check
-        api_key.refresh_from_db()
-        assert api_key.revoked is True
-
-        retry_response = client.get(reverse("provider-list"), headers=api_key_headers)
-        assert retry_response.status_code == 401
-        assert (
-            "API Key has been revoked." in retry_response.json()["errors"][0]["detail"]
-        )
-
    def test_non_existent_api_key(self, create_test_user, tenants_fixture):
        """Key UUID doesn't exist in database."""
        client = APIClient()
@@ -848,93 +817,6 @@ class TestAPIKeyTenantIsolation:
        error_detail = response_json["errors"][0]["detail"]
        assert "revoked" in error_detail.lower()

-    def test_deleting_user_revokes_api_keys_in_every_tenant(self, tenants_fixture):
-        """Deleting a user revokes their keys in all their tenants, not just one."""
-        first_tenant, second_tenant = tenants_fixture[0], tenants_fixture[1]
-
-        test_user = User.objects.create_user(
-            name="multi_tenant_user",
-            email="multi_tenant_user@prowler.com",
-            password=TEST_PASSWORD,
-        )
-        for tenant in (first_tenant, second_tenant):
-            Membership.objects.create(
-                user=test_user, tenant=tenant, role=Membership.RoleChoices.OWNER
-            )
-
-        first_key, _ = TenantAPIKey.objects.create_api_key(
-            name="Key in first tenant", tenant_id=first_tenant.id, entity=test_user
-        )
-        second_key, _ = TenantAPIKey.objects.create_api_key(
-            name="Key in second tenant", tenant_id=second_tenant.id, entity=test_user
-        )
-
-        test_user.delete()
-
-        first_key.refresh_from_db()
-        second_key.refresh_from_db()
-        assert first_key.revoked is True
-        assert second_key.revoked is True
-        # `on_delete=SET_NULL` orphans the keys, so revoking them is what keeps them
-        # from authenticating
-        assert first_key.entity_id is None
-        assert second_key.entity_id is None
-
-    def test_revoke_user_api_keys_uses_the_admin_connection(
-        self, monkeypatch, tenants_fixture
-    ):
-        """The revocation must not go through the default connection.
-
-        `api_keys` is RLS protected and its policy denies every row when `api.tenant_id`
-        is unset, which is the case while a user is deleted through the admin
-        connection: the update would silently revoke nothing and leave usable orphaned
-        keys behind.
-
-        Pointing `admin_db` at a missing alias is the only way to assert the connection
-        here, because the test suite runs on a single superuser database with
-        `MainRouter.admin_db` patched to "default" (see `conftest.py`), so RLS never
-        applies and both connections are otherwise indistinguishable.
-        """
-        test_user = User.objects.create_user(
-            name="admin_connection_user",
-            email="admin_connection_user@prowler.com",
-            password=TEST_PASSWORD,
-        )
-        Membership.objects.create(user=test_user, tenant=tenants_fixture[0])
-        TenantAPIKey.objects.create_api_key(
-            name="Key for admin connection check",
-            tenant_id=tenants_fixture[0].id,
-            entity=test_user,
-        )
-
-        monkeypatch.setattr(MainRouter, "admin_db", "missing_admin_alias")
-
-        with pytest.raises(ConnectionDoesNotExist):
-            revoke_user_api_keys(sender=User, instance=test_user)
-
-    def test_revoke_membership_api_keys_uses_the_admin_connection(
-        self, monkeypatch, tenants_fixture
-    ):
-        """Same as the user deletion case: this receiver also runs as its cascade."""
-        test_user = User.objects.create_user(
-            name="admin_connection_membership_user",
-            email="admin_connection_membership_user@prowler.com",
-            password=TEST_PASSWORD,
-        )
-        membership = Membership.objects.create(
-            user=test_user, tenant=tenants_fixture[0]
-        )
-        TenantAPIKey.objects.create_api_key(
-            name="Key for membership admin connection check",
-            tenant_id=tenants_fixture[0].id,
-            entity=test_user,
-        )
-
-        monkeypatch.setattr(MainRouter, "admin_db", "missing_admin_alias")
-
-        with pytest.raises(ConnectionDoesNotExist):
-            revoke_membership_api_keys(sender=Membership, instance=membership)
-

@pytest.mark.django_db
 class TestAPIKeyLifecycle:
@@ -10,12 +10,10 @@ from allauth.socialaccount import app_settings as socialaccount_app_settings
 from allauth.socialaccount.internal.flows.login import complete_login
 from allauth.socialaccount.models import SocialAccount, SocialLogin
 from api.adapters import ProwlerSocialAccountAdapter
-from api.db_router import MainRouter, get_write_db_alias
+from api.db_router import MainRouter
 from api.models import Invitation, Membership, SAMLConfiguration, Tenant
 from django.contrib.auth import get_user_model
 from django.core import mail
-from django.db import connections
-from django.db import router as django_router

 User = get_user_model()

@@ -384,65 +382,6 @@ class TestProwlerSocialAccountAdapter:
            role=Membership.RoleChoices.MEMBER,
        ).exists()

-    def test_save_user_routes_initial_allauth_write_to_admin_and_resets_on_error(
-        self, rf
-    ):
-        adapter = ProwlerSocialAccountAdapter()
-        request = rf.get("/")
-        request.session = {}
-        sociallogin = _oauth_sociallogin(
-            User(name="Frank", email="frank-routing@example.com")
-        )
-
-        def fail_after_checking_write_route(*_args, **_kwargs):
-            assert (
-                MainRouter().db_for_write(User, instance=sociallogin.user)
-                == MainRouter.admin_db
-            )
-            raise RuntimeError("Stop after checking the write route.")
-
-        with (
-            patch("api.adapters.super") as mock_super,
-            patch("api.adapters.transaction.atomic"),
-            patch.object(MainRouter, "admin_db", "admin"),
-            pytest.raises(RuntimeError, match="Stop after checking the write route"),
-        ):
-            mock_super.return_value.save_user.side_effect = (
-                fail_after_checking_write_route
-            )
-            adapter.save_user(request, sociallogin)
-
-        assert get_write_db_alias() is None
-
-    def test_save_user_rolls_back_all_signup_records_on_downstream_error(self, rf):
-        adapter = ProwlerSocialAccountAdapter()
-        request = rf.post("/")
-        request.session = {}
-        email = "frank-rollback@example.com"
-        sociallogin = _real_oauth_sociallogin(
-            User(name="Frank", email=email),
-            uid="frank-rollback-google-account",
-        )
-        tenants_before = Tenant.objects.count()
-
-        with (
-            patch(
-                "api.adapters.rls_transaction",
-                side_effect=RuntimeError("Simulated downstream failure."),
-            ),
-            pytest.raises(RuntimeError, match="Simulated downstream failure"),
-        ):
-            adapter.save_user(request, sociallogin)
-
-        assert not User.objects.filter(email=email).exists()
-        assert not SocialAccount.objects.filter(
-            provider="google",
-            uid="frank-rollback-google-account",
-        ).exists()
-        assert not EmailAddress.objects.filter(email=email).exists()
-        assert Tenant.objects.count() == tenants_before
-        assert get_write_db_alias() is None
-
    def test_save_user_saml_sets_session_flag(self, rf):
        adapter = ProwlerSocialAccountAdapter()
        request = rf.get("/")
@@ -463,104 +402,3 @@ class TestProwlerSocialAccountAdapter:
                    mock_super.return_value.save_user.return_value = mock_user
                    adapter.save_user(request, sociallogin)
                    assert request.session["saml_user_created"] == "123"
-
-
-@pytest.mark.requires_test_admin_alias
-@pytest.mark.django_db(transaction=True, databases=["default", "admin"])
-class TestProwlerSocialAccountAdapterMultiDatabase:
-    @staticmethod
-    def _production_router():
-        return patch.object(django_router, "routers", [MainRouter()])
-
-    def test_save_user_rolls_back_across_production_database_aliases(self, rf):
-        adapter = ProwlerSocialAccountAdapter()
-        request = rf.post("/")
-        request.session = {}
-        email = "frank-multidb-rollback@example.com"
-        sociallogin = _real_oauth_sociallogin(
-            User(name="Frank", email=email),
-            uid="frank-multidb-rollback-google-account",
-        )
-        tenants_before = Tenant.objects.using("admin").count()
-
-        assert connections["default"] is not connections["admin"]
-        assert (
-            connections["default"].settings_dict["NAME"]
-            == connections["admin"].settings_dict["NAME"]
-        )
-
-        def fail_after_allauth_save(*_args, **_kwargs):
-            assert sociallogin.user._state.db == MainRouter.admin_db
-            assert connections["default"].get_autocommit()
-            assert not connections["admin"].get_autocommit()
-            raise RuntimeError("Simulated downstream failure.")
-
-        with (
-            patch.object(MainRouter, "admin_db", "admin"),
-            self._production_router(),
-            patch("api.adapters.rls_transaction", side_effect=fail_after_allauth_save),
-            pytest.raises(RuntimeError, match="Simulated downstream failure"),
-        ):
-            adapter.save_user(request, sociallogin)
-
-        assert connections["default"].get_autocommit()
-        assert connections["admin"].get_autocommit()
-        assert not User.objects.using("default").filter(email=email).exists()
-        assert not User.objects.using("admin").filter(email=email).exists()
-        assert (
-            not SocialAccount.objects.using("admin")
-            .filter(
-                provider="google",
-                uid="frank-multidb-rollback-google-account",
-            )
-            .exists()
-        )
-        assert not EmailAddress.objects.using("admin").filter(email=email).exists()
-        assert Tenant.objects.using("admin").count() == tenants_before
-        assert get_write_db_alias() is None
-
-    def test_save_user_commits_complete_signup_across_production_aliases(self, rf):
-        adapter = ProwlerSocialAccountAdapter()
-        request = rf.post("/")
-        request.session = {}
-        email = "frank-multidb-success@example.com"
-        sociallogin = _real_oauth_sociallogin(
-            User(name="Frank", email=email),
-            uid="frank-multidb-success-google-account",
-        )
-
-        with (
-            patch.object(MainRouter, "admin_db", "admin"),
-            self._production_router(),
-        ):
-            user = adapter.save_user(request, sociallogin)
-
-        user = User.objects.using("admin").get(id=user.id)
-        assert user.email == email
-        assert (
-            SocialAccount.objects.using("admin")
-            .filter(
-                user_id=user.id,
-                provider="google",
-                uid="frank-multidb-success-google-account",
-            )
-            .exists()
-        )
-        assert (
-            EmailAddress.objects.using("admin")
-            .filter(
-                user_id=user.id,
-                email=email,
-                verified=True,
-            )
-            .exists()
-        )
-        assert (
-            Membership.objects.using("admin")
-            .filter(
-                user_id=user.id,
-                role=Membership.RoleChoices.OWNER,
-            )
-            .exists()
-        )
-        assert get_write_db_alias() is None
@@ -154,88 +154,6 @@ def test_execute_query_serializes_graph(
    assert result["relationships"][0]["label"] == "OWNS"


-def test_execute_query_injects_provider_label_when_migrated(
-    attack_paths_query_definition_factory,
-    sink_backend_stub,
-):
-    # On migrated graphs the predefined cypher must be scoped with the
-    # provider label so the planner seeds from the label index instead of a
-    # global label scan (the Neptune cartesian/timeout fix).
-    definition = attack_paths_query_definition_factory(
-        id="aws-iam",
-        name="IAM",
-        short_description="Short desc",
-        description="",
-        cypher="MATCH (aws:AWSAccount)--(target_role:AWSRole) RETURN target_role",
-        parameters=[],
-    )
-    provider_id = "test-provider-123"
-    plabel = get_provider_label(provider_id)
-    parameters = {"provider_uid": "123"}
-
-    graph_result = MagicMock()
-    graph_result.nodes = []
-    graph_result.relationships = []
-    sink_backend_stub.execute_read_query.return_value = graph_result
-
-    # Injection is gated on `is_migrated`, not the sink (it is a pure string
-    # transform), so `neo4j` exercises the same code path as Neptune here.
-    views_helpers.execute_query(
-        "db-tenant-test",
-        definition,
-        parameters,
-        provider_id=provider_id,
-        scan=MagicMock(is_migrated=True, sink_backend="neo4j"),
-    )
-
-    executed_cypher = sink_backend_stub.execute_read_query.call_args[0][1]
-    assert executed_cypher != definition.cypher
-    # Both node patterns are scoped - not just one. Asserting the exact rewrite
-    # (rather than `f":{plabel}" in executed_cypher`, which a partial injection
-    # would still satisfy) proves every node got the label and that injection
-    # inserted labels and nothing else.
-    assert executed_cypher == (
-        f"MATCH (aws:AWSAccount:{plabel})--(target_role:AWSRole:{plabel}) "
-        "RETURN target_role"
-    )
-    # Parameters are passed through untouched.
-    assert sink_backend_stub.execute_read_query.call_args[0][2] == parameters
-
-
-def test_execute_query_does_not_inject_label_when_deprecated(
-    attack_paths_query_definition_factory,
-    sink_backend_stub,
-):
-    # The pre-cutover legacy catalog runs on the old sink and is removed after
-    # the Neptune cutover, so it must run verbatim (no injection).
-    definition = attack_paths_query_definition_factory(
-        id="aws-iam",
-        name="IAM",
-        short_description="Short desc",
-        description="",
-        cypher="MATCH (aws:AWSAccount)--(target_role:AWSRole) RETURN target_role",
-        parameters=[],
-    )
-    parameters = {"provider_uid": "123"}
-
-    graph_result = MagicMock()
-    graph_result.nodes = []
-    graph_result.relationships = []
-    sink_backend_stub.execute_read_query.return_value = graph_result
-
-    views_helpers.execute_query(
-        "db-tenant-test",
-        definition,
-        parameters,
-        provider_id="test-provider-123",
-        scan=MagicMock(is_migrated=False, sink_backend="neo4j"),
-    )
-
-    sink_backend_stub.execute_read_query.assert_called_once_with(
-        "db-tenant-test", definition.cypher, parameters
-    )
-
-
 def test_execute_query_wraps_graph_errors(
    attack_paths_query_definition_factory,
    sink_backend_stub,
@@ -1,245 +0,0 @@
-"""
-Structural validation tests for Attack Paths query definitions.
-
-These tests verify that each query in the AWS_QUERIES registry meets the
-schema and convention requirements documented in
-`docs/developer-guide/attack-paths-queries.mdx` without requiring a live
-graph connection. They deliberately assert the conventions that keep queries
-functional and Neptune-compatible: list-typed policy properties are reached
-through `HAS_*` child-item traversals (never read as node fields), predicate
-functions unsupported on Neptune (`any`/`all`/`none`, regex `=~`) are absent,
-the finding probe is typed and filters only on `status`, and the `RETURN`
-shape preserves the `paths, dpf, dpfr` contract.
-"""
-
-import re
-
-import pytest
-from api.attack_paths.queries.aws import (
-    AWS_IAM_PRIVESC_DELETE_USER_PERMISSIONS_BOUNDARY,
-    AWS_QUERIES,
-    AWS_SSO_PRIVESC_PERMISSION_SET_ESCALATION,
-    AWS_STS_PRIVESC_CROSS_ACCOUNT_TRUST,
-    AWS_STS_PRIVESC_WILDCARD_TRUST,
-)
-from api.attack_paths.queries.types import AttackPathsQueryDefinition
-
-# The pathfinding.cloud privilege-escalation queries added for PROWLER-2278.
-NEW_PATHFINDING_QUERIES = [
-    AWS_STS_PRIVESC_CROSS_ACCOUNT_TRUST,
-    AWS_STS_PRIVESC_WILDCARD_TRUST,
-    AWS_IAM_PRIVESC_DELETE_USER_PERMISSIONS_BOUNDARY,
-    AWS_SSO_PRIVESC_PERMISSION_SET_ESCALATION,
-]
-
-# Cypher keywords that indicate a mutating query (not allowed; queries are read-only).
-MUTATING_KEYWORDS = re.compile(
-    r"\b(CREATE|MERGE|SET|DELETE|REMOVE|DETACH)\b", re.IGNORECASE
-)
-
-# CALL subquery: unsupported by Neptune openCypher.
-CALL_SUBQUERY_PATTERN = re.compile(r"\bCALL\s*\{", re.IGNORECASE)
-
-# Predicate functions that are not part of the openCypher spec and fail on Neptune.
-NEPTUNE_UNSUPPORTED_PREDICATES = re.compile(r"\b(any|all|none)\s*\(", re.IGNORECASE)
-
-# The list-typed policy properties that are exploded into child item nodes at sync
-# time and popped off the parent, so reading them as a field always yields null.
-NORMALIZED_STATEMENT_FIELDS = ("action", "resource", "notaction", "notresource")
-
-
-class TestNewPathfindingQueriesRegistered:
-    """Every new query is present in the AWS_QUERIES registry."""
-
-    @pytest.mark.parametrize("query", NEW_PATHFINDING_QUERIES, ids=lambda q: q.id)
-    def test_query_in_registry(self, query):
-        assert query in AWS_QUERIES
-
-
-class TestNewPathfindingQueriesSchema:
-    """Required fields and naming conventions for each new query."""
-
-    @pytest.mark.parametrize("query", NEW_PATHFINDING_QUERIES, ids=lambda q: q.id)
-    def test_is_query_definition_instance(self, query):
-        assert isinstance(query, AttackPathsQueryDefinition)
-
-    @pytest.mark.parametrize("query", NEW_PATHFINDING_QUERIES, ids=lambda q: q.id)
-    def test_id_is_kebab_case(self, query):
-        assert re.match(r"^[a-z0-9]+(-[a-z0-9]+)*$", query.id), (
-            f"Query id '{query.id}' is not kebab-case"
-        )
-
-    @pytest.mark.parametrize("query", NEW_PATHFINDING_QUERIES, ids=lambda q: q.id)
-    def test_id_starts_with_aws(self, query):
-        assert query.id.startswith("aws-")
-
-    @pytest.mark.parametrize("query", NEW_PATHFINDING_QUERIES, ids=lambda q: q.id)
-    def test_provider_is_aws(self, query):
-        assert query.provider == "aws"
-
-    @pytest.mark.parametrize("query", NEW_PATHFINDING_QUERIES, ids=lambda q: q.id)
-    def test_has_name(self, query):
-        assert query.name and len(query.name) > 5
-
-    @pytest.mark.parametrize("query", NEW_PATHFINDING_QUERIES, ids=lambda q: q.id)
-    def test_has_short_description(self, query):
-        assert query.short_description and len(query.short_description) > 10
-
-    @pytest.mark.parametrize("query", NEW_PATHFINDING_QUERIES, ids=lambda q: q.id)
-    def test_has_description(self, query):
-        assert query.description and len(query.description) > 20
-
-    @pytest.mark.parametrize("query", NEW_PATHFINDING_QUERIES, ids=lambda q: q.id)
-    def test_has_attribution(self, query):
-        assert query.attribution is not None
-        assert "pathfinding.cloud" in query.attribution.text
-        assert query.attribution.link.startswith("https://pathfinding.cloud/paths/")
-
-    @pytest.mark.parametrize("query", NEW_PATHFINDING_QUERIES, ids=lambda q: q.id)
-    def test_parameters_is_list(self, query):
-        assert isinstance(query.parameters, list)
-
-
-class TestNewPathfindingQueriesCypher:
-    """Cypher content, conventions, and Neptune compatibility."""
-
-    @pytest.mark.parametrize("query", NEW_PATHFINDING_QUERIES, ids=lambda q: q.id)
-    def test_cypher_not_empty(self, query):
-        assert query.cypher and len(query.cypher.strip()) > 0
-
-    @pytest.mark.parametrize("query", NEW_PATHFINDING_QUERIES, ids=lambda q: q.id)
-    def test_cypher_under_10000_chars(self, query):
-        assert len(query.cypher) < 10000, (
-            f"Query {query.id} exceeds 10,000 character limit "
-            f"({len(query.cypher)} chars)"
-        )
-
-    @pytest.mark.parametrize("query", NEW_PATHFINDING_QUERIES, ids=lambda q: q.id)
-    def test_cypher_uses_provider_uid_parameter(self, query):
-        assert "$provider_uid" in query.cypher, (
-            f"Query {query.id} missing $provider_uid parameter"
-        )
-
-    @pytest.mark.parametrize("query", NEW_PATHFINDING_QUERIES, ids=lambda q: q.id)
-    def test_finding_label_interpolated(self, query):
-        # The f-string should have interpolated PROWLER_FINDING_LABEL already.
-        assert "PROWLER_FINDING_LABEL" not in query.cypher, (
-            f"Query {query.id} has unresolved PROWLER_FINDING_LABEL "
-            "(f-string not applied)"
-        )
-
-    @pytest.mark.parametrize("query", NEW_PATHFINDING_QUERIES, ids=lambda q: q.id)
-    def test_finding_probe_is_typed_and_status_scoped(self, query):
-        # The finding probe must be typed HAS_FINDING (so Neptune applies an inline
-        # edge filter) and gate on FAIL status only. ProwlerFinding nodes carry no
-        # provider_uid property, so a probe that filters on it never matches.
-        assert re.search(
-            r"-\[pfr:HAS_FINDING\]-\(pf:ProwlerFinding \{status: 'FAIL'\}\)",
-            query.cypher,
-        ), f"Query {query.id} does not use the typed, status-scoped finding probe"
-        assert "provider_uid:$provider_uid}" not in query.cypher.replace(" ", ""), (
-            f"Query {query.id} filters the finding node on a non-existent "
-            "provider_uid property"
-        )
-
-    @pytest.mark.parametrize("query", NEW_PATHFINDING_QUERIES, ids=lambda q: q.id)
-    def test_cypher_is_read_only(self, query):
-        cypher_no_comments = _strip_comment_lines(query.cypher)
-        match = MUTATING_KEYWORDS.search(cypher_no_comments)
-        assert match is None, (
-            f"Query {query.id} contains mutating keyword: '{match.group()}'"
-        )
-
-    @pytest.mark.parametrize("query", NEW_PATHFINDING_QUERIES, ids=lambda q: q.id)
-    def test_cypher_no_call_subquery(self, query):
-        assert not CALL_SUBQUERY_PATTERN.search(query.cypher), (
-            f"Query {query.id} uses a CALL subquery (not Neptune-compatible)"
-        )
-
-    @pytest.mark.parametrize("query", NEW_PATHFINDING_QUERIES, ids=lambda q: q.id)
-    def test_cypher_no_neptune_unsupported_predicates(self, query):
-        match = NEPTUNE_UNSUPPORTED_PREDICATES.search(query.cypher)
-        assert match is None, (
-            f"Query {query.id} uses '{match.group().strip()}' predicate function; "
-            "use size([x IN list WHERE pred]) > 0 for Neptune compatibility"
-        )
-
-    @pytest.mark.parametrize("query", NEW_PATHFINDING_QUERIES, ids=lambda q: q.id)
-    def test_cypher_no_regex_operator(self, query):
-        assert "=~" not in query.cypher, (
-            f"Query {query.id} uses the regex operator '=~'; "
-            "use CONTAINS / STARTS WITH for Neptune compatibility"
-        )
-
-    @pytest.mark.parametrize("query", NEW_PATHFINDING_QUERIES, ids=lambda q: q.id)
-    def test_cypher_does_not_read_normalized_list_fields(self, query):
-        # action/resource/notaction/notresource are materialized as child item nodes
-        # and popped off AWSPolicyStatement, so `stmt.action` etc. are always null.
-        for field in NORMALIZED_STATEMENT_FIELDS:
-            assert not re.search(rf"\.{field}\b", query.cypher), (
-                f"Query {query.id} reads the normalized list field "
-                f"'.{field}' as a node property; traverse the HAS_"
-                f"{field.upper()} edge to the child item node instead"
-            )
-
-    @pytest.mark.parametrize("query", NEW_PATHFINDING_QUERIES, ids=lambda q: q.id)
-    def test_cypher_preserves_return_contract(self, query):
-        assert re.search(
-            r"RETURN paths, collect\(DISTINCT pf\) as dpf, "
-            r"collect\(DISTINCT pfr\) as dpfr",
-            query.cypher,
-        ), f"Query {query.id} does not preserve the 'paths, dpf, dpfr' RETURN contract"
-
-    @pytest.mark.parametrize("query", NEW_PATHFINDING_QUERIES, ids=lambda q: q.id)
-    def test_cypher_anchored_on_account(self, query):
-        assert "(aws:AWSAccount {id: $provider_uid})" in query.cypher, (
-            f"Query {query.id} is not anchored on the AWSAccount node"
-        )
-
-
-class TestNewPathfindingQueriesAccuracy:
-    """Query-specific contracts that prevent known false positives."""
-
-    def test_wildcard_trust_is_presented_as_a_manual_review_candidate(self):
-        query = AWS_STS_PRIVESC_WILDCARD_TRUST
-        text = f"{query.name} {query.short_description} {query.description}".lower()
-        assert all(
-            word in text
-            for word in ("potential", "effect", "condition", "manual review")
-        )
-
-    def test_permissions_boundary_removal_is_scoped_to_the_same_user(self):
-        query = AWS_IAM_PRIVESC_DELETE_USER_PERMISSIONS_BOUNDARY
-        assert "(principal:AWSUser)" in query.cypher
-        assert (
-            "(stmt)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)"
-            in query.cypher
-        )
-        assert "principal.arn" in query.cypher
-        assert "manual review" in query.description.lower()
-
-    def test_permission_set_escalation_requires_global_resources(self):
-        query = AWS_SSO_PRIVESC_PERMISSION_SET_ESCALATION
-        for suffix in ("", "2", "3"):
-            resource_match = (
-                f"(stmt{suffix})-[:HAS_RESOURCE]->"
-                f"(res{suffix}:AWSPolicyStatementResourceItem)"
-            )
-            assert resource_match in query.cypher
-            assert f"WHERE res{suffix}.value = '*'" in query.cypher
-
-
-class TestAllQueriesUniqueIds:
-    """No duplicate IDs in the full registry."""
-
-    def test_no_duplicate_ids_in_aws_queries(self):
-        ids = [q.id for q in AWS_QUERIES]
-        duplicates = sorted({qid for qid in ids if ids.count(qid) > 1})
-        assert not duplicates, f"Duplicate query IDs found: {duplicates}"
-
-
-def _strip_comment_lines(cypher: str) -> str:
-    """Drop `//` comment lines so keyword scans ignore prose in comments."""
-    return "\n".join(
-        line for line in cypher.split("\n") if not line.strip().startswith("//")
-    )
@@ -4,17 +4,11 @@ from unittest.mock import MagicMock, patch
 from uuid import uuid4

 import pytest
-from api.authentication import (
-    OrphanedAPIKeyError,
-    SSEAuthentication,
-    TenantAPIKeyAuthentication,
-)
+from api.authentication import SSEAuthentication, TenantAPIKeyAuthentication
 from api.db_router import MainRouter
 from api.models import TenantAPIKey
-from django.db import connections
 from django.db.models.query import QuerySet
 from django.test import RequestFactory
-from django.test.utils import CaptureQueriesContext
 from rest_framework.exceptions import AuthenticationFailed


@@ -44,12 +38,13 @@ class TestTenantAPIKeyAuthentication:
        request = request_factory.get("/")

        # Call the method
-        validated_key = auth_backend._authenticate_credentials(request, encrypted_key)
+        entity, auth_dict = auth_backend._authenticate_credentials(
+            request, encrypted_key
+        )

        # Verify that the entity is the user associated with the API key
-        assert validated_key.id == api_key.id
-        assert validated_key.entity == api_key.entity
-        assert validated_key.entity.id == api_key.entity.id
+        assert entity == api_key.entity
+        assert entity.id == api_key.entity.id

    def test_authenticate_credentials_restores_manager_on_success(
        self, auth_backend, api_keys_fixture, request_factory
@@ -236,120 +231,6 @@ class TestTenantAPIKeyAuthentication:

        assert str(exc_info.value.detail) == "This API Key has been revoked."

-    def test_authenticate_credentials_orphaned_api_key(
-        self, auth_backend, api_keys_fixture, request_factory
-    ):
-        """Test credential validation fails when the owning user no longer exists."""
-        api_key = api_keys_fixture[0]
-        _, encrypted_key = api_key._raw_key.split(TenantAPIKey.objects.separator, 1)
-
-        # `entity` is what `on_delete=SET_NULL` leaves behind when the owner is deleted
-        TenantAPIKey.objects.filter(id=api_key.id).update(entity=None)
-
-        request = request_factory.get("/")
-
-        with pytest.raises(OrphanedAPIKeyError):
-            auth_backend._authenticate_credentials(request, encrypted_key)
-
-        # The orphaned key is revoked on use, so it stops showing up as active
-        api_key.refresh_from_db()
-        assert api_key.revoked is True
-
-    def test_authenticate_orphaned_api_key(
-        self, auth_backend, api_keys_fixture, request_factory
-    ):
-        """Test authentication fails with a key whose owning user was deleted.
-
-        Regression test: this used to raise `AttributeError: 'NoneType' object has no
-        attribute 'id'` while building the auth dict, which DRF re-raises as
-        `WrappedAttributeError` and turns into a 500 instead of a 401.
-        """
-        api_key = api_keys_fixture[0]
-        raw_key = api_key._raw_key
-
-        TenantAPIKey.objects.filter(id=api_key.id).update(entity=None)
-
-        request = request_factory.get("/")
-        request.META["HTTP_AUTHORIZATION"] = f"Api-Key {raw_key}"
-
-        with pytest.raises(AuthenticationFailed) as exc_info:
-            auth_backend.authenticate(request)
-
-        assert str(exc_info.value.detail) == "No entity matching this api key."
-
-        # The orphaned key is revoked on use; retries fail the regular revoked check
-        api_key.refresh_from_db()
-        assert api_key.revoked is True
-
-        with pytest.raises(AuthenticationFailed) as exc_info:
-            auth_backend.authenticate(request)
-
-        assert str(exc_info.value.detail) == "This API Key has been revoked."
-
-    def test_authenticate_reads_the_api_key_once_under_a_row_lock(
-        self, auth_backend, api_keys_fixture, request_factory
-    ):
-        """Test the API key is read a single time and the row is locked.
-
-        Validation, the `last_used_at` update and the claims must all come from the
-        same authoritative row: a second, unlocked lookup would reopen the window
-        where a key revoked in between still authenticates.
-        """
-        api_key = api_keys_fixture[0]
-
-        request = request_factory.get("/")
-        request.META["HTTP_AUTHORIZATION"] = f"Api-Key {api_key._raw_key}"
-
-        with CaptureQueriesContext(connections[MainRouter.admin_db]) as captured:
-            auth_backend.authenticate(request)
-
-        api_key_selects = [
-            query["sql"]
-            for query in captured.captured_queries
-            if query["sql"].startswith("SELECT") and '"api_keys"' in query["sql"]
-        ]
-
-        assert len(api_key_selects) == 1
-        assert "FOR UPDATE" in api_key_selects[0]
-
-    def test_authenticate_ignores_revocation_after_the_locked_read(
-        self, auth_backend, api_keys_fixture, request_factory
-    ):
-        """Test the claims describe the row that was validated, not a later state.
-
-        Regression test: the key used to be looked up again to build the auth dict,
-        without rechecking `revoked` or `entity`. A key revoked or orphaned between
-        both reads still authenticated, and the claims came from that stale row. With
-        a single locked read the write below cannot land mid-authentication, and the
-        revocation only takes effect on the next request.
-        """
-        api_key = api_keys_fixture[0]
-        entity_at_validation = api_key.entity
-        original_save = TenantAPIKey.save
-
-        def revoke_and_orphan_before_saving(instance, *args, **kwargs):
-            # Runs after validation, right before the claims are built: the exact
-            # window a concurrent revocation or user deletion used to slip into
-            TenantAPIKey.objects.filter(id=api_key.id).update(revoked=True, entity=None)
-            return original_save(instance, *args, **kwargs)
-
-        request = request_factory.get("/")
-        request.META["HTTP_AUTHORIZATION"] = f"Api-Key {api_key._raw_key}"
-
-        with patch.object(TenantAPIKey, "save", revoke_and_orphan_before_saving):
-            entity, auth_dict = auth_backend.authenticate(request)
-
-        assert entity == entity_at_validation
-        assert auth_dict["sub"] == str(entity_at_validation.id)
-        assert auth_dict["tenant_id"] == str(api_key.tenant_id)
-        assert auth_dict["api_key_prefix"] == api_key.prefix
-
-        # The revoked key is rejected from the next request on
-        with pytest.raises(AuthenticationFailed) as exc_info:
-            auth_backend.authenticate(request)
-
-        assert str(exc_info.value.detail) == "This API Key has been revoked."
-
    def test_authenticate_expired_api_key(
        self, auth_backend, create_test_user, tenants_fixture, request_factory
    ):
@@ -1,6 +1,5 @@
 """Unit tests for the Cypher sanitizer (validation + provider-label injection)."""

-import re
 from unittest.mock import patch

 import pytest
@@ -23,38 +22,6 @@ def _inject(cypher: str) -> str:
        return inject_provider_label(cypher, PROVIDER_ID)


-# String literals and line comments can contain parentheses that look like node
-# patterns; strip them first. Implemented here independently of the sanitizer so
-# the node count is an oracle for the injector rather than a copy of its regexes.
-_STRING_OR_COMMENT_RE = re.compile(r"'(?:[^'\\]|\\.)*'|\"(?:[^\"\\]|\\.)*\"|//[^\n]*")
-
-# A node pattern is `(`, not preceded by a word char (which would make it a
-# function call), wrapping an optional variable, zero or more `:Label`s and an
-# optional `{property map}` - and nothing else, which excludes parenthesized
-# expressions such as `(a OR b)` in a WHERE clause.
-_NODE_PATTERN_RE = re.compile(
-    r"(?<![\w`])\("
-    r"\s*(?:[a-zA-Z_]\w*)?"
-    r"(?:\s*:\s*(?:`[^`]*`|[a-zA-Z_]\w*))*"
-    r"(?:\s*\{[^{}]*\})?"
-    r"\s*\)"
-)
-
-
-def _count_node_patterns(cypher: str) -> int:
-    """Count node patterns in a query, independently of the injector.
-
-    Injection appends exactly one provider label per node pattern, so the
-    number of injected labels must equal this count - proving *every* node is
-    scoped, not just one."""
-    stripped = _STRING_OR_COMMENT_RE.sub("", cypher)
-    return sum(
-        1
-        for match in _NODE_PATTERN_RE.finditer(stripped)
-        if match.group(0)[1:-1].strip()
-    )
-
-
 def test_generic_inject_label_reuses_provider_injection_pipeline():
    result = inject_label("MATCH (n:AWSRole)--(m) RETURN n, m", "_Tenant_test")

@@ -460,66 +427,3 @@ class TestValidation:
    )
    def test_allows_clean_queries(self, cypher):
        validate_custom_query(cypher)
-
-
-# ---------------------------------------------------------------------------
-# Predefined-catalog injection (Option 1: label-scoped predefined queries)
-# ---------------------------------------------------------------------------
-
-
-def _all_predefined_queries():
-    """Every predefined query in the migrated catalog, as (id, cypher)."""
-    from api.attack_paths.queries.registry import _QUERY_DEFINITIONS
-
-    return [
-        (definition.id, definition.cypher)
-        for definitions in _QUERY_DEFINITIONS.values()
-        for definition in definitions
-    ]
-
-
-_PREDEFINED_QUERIES = _all_predefined_queries()
-
-
-class TestPredefinedCatalogInjection:
-    """`execute_query` injects the provider label into predefined queries on
-    migrated graphs. The injection must be *lossless* for every catalog query:
-    it may only insert `:_Provider_{uuid}` tokens and must not otherwise alter
-    the cypher (which would corrupt a hand-authored query). This runs over the
-    whole catalog so a regex regression is caught for all queries at once.
-
-    Injection is a pure string transform, so it is sink-independent (the same
-    result is sent to Neo4j and Neptune)."""
-
-    def test_catalog_is_not_empty(self):
-        # Guard against the parametrized tests silently covering nothing.
-        assert len(_PREDEFINED_QUERIES) > 0
-
-    @pytest.mark.parametrize(
-        "cypher",
-        [cypher for _, cypher in _PREDEFINED_QUERIES],
-        ids=[query_id for query_id, _ in _PREDEFINED_QUERIES],
-    )
-    def test_injection_is_lossless(self, cypher):
-        injected = _inject(cypher)
-
-        # Every node pattern is scoped - not just one. A partial-injection
-        # regression that missed some nodes would still satisfy a bare
-        # `f":{LABEL}" in injected` check, so assert the label count matches the
-        # number of node patterns.
-        assert injected.count(f":{LABEL}") == _count_node_patterns(cypher)
-        # Stripping the injected tokens restores the query verbatim, proving
-        # injection changed nothing but the labels.
-        assert injected.replace(f":{LABEL}", "") == cypher
-
-    @pytest.mark.parametrize(
-        "cypher",
-        [cypher for _, cypher in _PREDEFINED_QUERIES],
-        ids=[query_id for query_id, _ in _PREDEFINED_QUERIES],
-    )
-    def test_injection_preserves_parameter_placeholders(self, cypher):
-        # Label injection must never touch `$param` bindings.
-        original_params = sorted(set(re.findall(r"\$\w+", cypher)))
-        injected_params = sorted(set(re.findall(r"\$\w+", _inject(cypher))))
-
-        assert injected_params == original_params
@@ -1,13 +1,7 @@
-from unittest.mock import Mock, patch
+from unittest.mock import patch

 import pytest
-from api.db_router import (
-    MainRouter,
-    get_write_db_alias,
-    reset_write_db_alias,
-    set_write_db_alias,
-    write_db_alias,
-)
+from api.db_router import MainRouter
 from api.rls import Tenant
 from config.django.base import DATABASE_ROUTERS as PROD_DATABASE_ROUTERS
 from django.conf import settings
@@ -32,66 +26,6 @@ class TestMainDatabaseRouter:
        assert router.allow_migrate_model(MainRouter.admin_db, api_model)
        assert not router.allow_migrate_model("default", api_model)

-    def test_scoped_write_alias_routes_api_models(self, router):
-        token = set_write_db_alias(MainRouter.admin_db)
-        try:
-            assert get_write_db_alias() == MainRouter.admin_db
-            assert router.db_for_write(Tenant) == MainRouter.admin_db
-        finally:
-            reset_write_db_alias(token)
-
-        assert get_write_db_alias() is None
-        assert router.db_for_write(Tenant) == "default"
-
-    def test_scoped_write_alias_restores_nested_context(self, router):
-        outer_token = set_write_db_alias("outer")
-        try:
-            assert router.db_for_write(Tenant) == "outer"
-
-            inner_token = set_write_db_alias(MainRouter.admin_db)
-            try:
-                assert router.db_for_write(Tenant) == MainRouter.admin_db
-            finally:
-                reset_write_db_alias(inner_token)
-
-            assert router.db_for_write(Tenant) == "outer"
-        finally:
-            reset_write_db_alias(outer_token)
-
-        assert get_write_db_alias() is None
-        assert router.db_for_write(Tenant) == "default"
-
-    def test_scoped_write_alias_does_not_override_admin_models(self, router):
-        token = set_write_db_alias("other")
-        try:
-            assert (
-                router.db_for_write(MigrationRecorder.Migration) == MainRouter.admin_db
-            )
-        finally:
-            reset_write_db_alias(token)
-
-        assert get_write_db_alias() is None
-
-    def test_write_db_alias_context_manager_resets_after_error(self, router):
-        fail = Mock(side_effect=RuntimeError("Simulated failure"))
-
-        with pytest.raises(RuntimeError, match="Simulated failure"):
-            with write_db_alias(MainRouter.admin_db):
-                assert get_write_db_alias() == MainRouter.admin_db
-                assert router.db_for_write(Tenant) == MainRouter.admin_db
-                fail()
-
-        fail.assert_called_once_with()
-        assert get_write_db_alias() is None
-        assert router.db_for_write(Tenant) == "default"
-
-    def test_write_db_alias_context_manager_ignores_empty_alias(self, router):
-        with write_db_alias(None):
-            assert get_write_db_alias() is None
-            assert router.db_for_write(Tenant) == "default"
-
-        assert get_write_db_alias() is None
-
    def test_router_django_models(self, router):
        assert router.db_for_read(MigrationRecorder.Migration) == MainRouter.admin_db
        assert not router.db_for_read(MigrationRecorder.Migration) == "default"
@@ -2,17 +2,14 @@ import json
 from unittest.mock import ANY, Mock, patch

 import pytest
-from api.db_utils import rls_transaction
 from api.models import (
    Integration,
    IntegrationProviderRelationship,
    Membership,
    ProviderGroup,
    ProviderGroupMembership,
-    ProviderSecret,
    Role,
    RoleProviderGroupRelationship,
-    Scan,
    User,
    UserRoleRelationship,
 )
@@ -669,612 +666,6 @@ class TestLimitedVisibility:
            limited_admin_user, tenants_fixture[0]
        )

-    @pytest.fixture
-    def hidden_provider_secret(self, aws_provider_pair):
-        hidden_provider = aws_provider_pair[1]
-        return ProviderSecret.objects.create(
-            tenant_id=hidden_provider.tenant_id,
-            provider=hidden_provider,
-            secret_type=ProviderSecret.TypeChoices.STATIC,
-            secret={
-                "aws_access_key_id": "hidden-key",
-                "aws_secret_access_key": "hidden-secret",
-            },
-            name="Hidden provider secret",
-        )
-
-    @pytest.fixture
-    def limited_provider_group(self, limited_admin_user):
-        return ProviderGroup.objects.get(name="limited_visibility_group")
-
-    @patch("api.v1.views.enqueue_scan_execution_on_commit")
-    def test_scan_create_out_of_scope_provider_is_rejected(
-        self,
-        mock_enqueue_scan,
-        authenticated_client_rbac_limited,
-        aws_provider_pair,
-    ):
-        hidden_provider = aws_provider_pair[1]
-
-        response = authenticated_client_rbac_limited.post(
-            reverse("scan-list"),
-            data=json.dumps(
-                {
-                    "data": {
-                        "type": "scans",
-                        "attributes": {"name": "Out of scope scan"},
-                        "relationships": {
-                            "provider": {
-                                "data": {
-                                    "type": "providers",
-                                    "id": str(hidden_provider.id),
-                                }
-                            }
-                        },
-                    }
-                }
-            ),
-            content_type="application/vnd.api+json",
-        )
-
-        assert response.status_code == status.HTTP_400_BAD_REQUEST
-        assert not Scan.objects.filter(
-            provider=hidden_provider, name="Out of scope scan"
-        ).exists()
-        mock_enqueue_scan.assert_not_called()
-
-    @patch("api.v1.views.enqueue_scan_execution_on_commit")
-    def test_scan_create_in_scope_provider_is_accepted(
-        self,
-        mock_enqueue_scan,
-        authenticated_client_rbac_limited,
-        aws_provider,
-    ):
-        response = authenticated_client_rbac_limited.post(
-            reverse("scan-list"),
-            data=json.dumps(
-                {
-                    "data": {
-                        "type": "scans",
-                        "attributes": {"name": "In scope scan"},
-                        "relationships": {
-                            "provider": {
-                                "data": {
-                                    "type": "providers",
-                                    "id": str(aws_provider.id),
-                                }
-                            }
-                        },
-                    }
-                }
-            ),
-            content_type="application/vnd.api+json",
-        )
-
-        assert response.status_code == status.HTTP_202_ACCEPTED
-        assert Scan.objects.filter(provider=aws_provider, name="In scope scan").exists()
-        mock_enqueue_scan.assert_called_once()
-
-    def test_provider_secret_retrieve_out_of_scope_returns_404(
-        self,
-        authenticated_client_rbac_limited,
-        hidden_provider_secret,
-    ):
-        response = authenticated_client_rbac_limited.get(
-            reverse(
-                "providersecret-detail",
-                kwargs={"pk": hidden_provider_secret.id},
-            )
-        )
-
-        assert response.status_code == status.HTTP_404_NOT_FOUND
-
-    def test_provider_secret_list_excludes_out_of_scope_provider(
-        self,
-        authenticated_client_rbac_limited,
-        hidden_provider_secret,
-    ):
-        response = authenticated_client_rbac_limited.get(reverse("providersecret-list"))
-
-        assert response.status_code == status.HTTP_200_OK
-        assert str(hidden_provider_secret.id) not in {
-            item["id"] for item in response.json()["data"]
-        }
-
-    def test_provider_secret_create_out_of_scope_provider_is_rejected(
-        self,
-        authenticated_client_rbac_limited,
-        aws_provider_pair,
-    ):
-        hidden_provider = aws_provider_pair[1]
-        response = authenticated_client_rbac_limited.post(
-            reverse("providersecret-list"),
-            data=json.dumps(
-                {
-                    "data": {
-                        "type": "provider-secrets",
-                        "attributes": {
-                            "name": "Out of scope secret",
-                            "secret_type": ProviderSecret.TypeChoices.STATIC,
-                            "secret": {
-                                "aws_access_key_id": "hidden-key",
-                                "aws_secret_access_key": "hidden-secret",
-                            },
-                        },
-                        "relationships": {
-                            "provider": {
-                                "data": {
-                                    "type": "providers",
-                                    "id": str(hidden_provider.id),
-                                }
-                            }
-                        },
-                    }
-                }
-            ),
-            content_type="application/vnd.api+json",
-        )
-
-        assert response.status_code == status.HTTP_400_BAD_REQUEST
-        assert not ProviderSecret.objects.filter(provider=hidden_provider).exists()
-
-    def test_provider_secret_create_in_scope_provider_is_accepted(
-        self,
-        authenticated_client_rbac_limited,
-        aws_provider,
-    ):
-        response = authenticated_client_rbac_limited.post(
-            reverse("providersecret-list"),
-            data=json.dumps(
-                {
-                    "data": {
-                        "type": "provider-secrets",
-                        "attributes": {
-                            "name": "In scope secret",
-                            "secret_type": ProviderSecret.TypeChoices.STATIC,
-                            "secret": {
-                                "aws_access_key_id": "visible-key",
-                                "aws_secret_access_key": "visible-secret",
-                            },
-                        },
-                        "relationships": {
-                            "provider": {
-                                "data": {
-                                    "type": "providers",
-                                    "id": str(aws_provider.id),
-                                }
-                            }
-                        },
-                    }
-                }
-            ),
-            content_type="application/vnd.api+json",
-        )
-
-        assert response.status_code == status.HTTP_201_CREATED
-        assert ProviderSecret.objects.filter(provider=aws_provider).exists()
-
-    def test_provider_secret_update_out_of_scope_returns_404(
-        self,
-        authenticated_client_rbac_limited,
-        hidden_provider_secret,
-    ):
-        response = authenticated_client_rbac_limited.patch(
-            reverse(
-                "providersecret-detail",
-                kwargs={"pk": hidden_provider_secret.id},
-            ),
-            data=json.dumps(
-                {
-                    "data": {
-                        "type": "provider-secrets",
-                        "id": str(hidden_provider_secret.id),
-                        "attributes": {"name": "Updated hidden secret"},
-                    }
-                }
-            ),
-            content_type="application/vnd.api+json",
-        )
-
-        assert response.status_code == status.HTTP_404_NOT_FOUND
-        hidden_provider_secret.refresh_from_db()
-        assert hidden_provider_secret.name == "Hidden provider secret"
-
-    def test_provider_secret_delete_out_of_scope_returns_404(
-        self,
-        authenticated_client_rbac_limited,
-        hidden_provider_secret,
-    ):
-        response = authenticated_client_rbac_limited.delete(
-            reverse(
-                "providersecret-detail",
-                kwargs={"pk": hidden_provider_secret.id},
-            )
-        )
-
-        assert response.status_code == status.HTTP_404_NOT_FOUND
-        assert ProviderSecret.objects.filter(id=hidden_provider_secret.id).exists()
-
-    def test_provider_group_create_out_of_scope_provider_is_rejected(
-        self,
-        authenticated_client_rbac_limited,
-        aws_provider_pair,
-    ):
-        hidden_provider = aws_provider_pair[1]
-        response = authenticated_client_rbac_limited.post(
-            reverse("providergroup-list"),
-            data=json.dumps(
-                {
-                    "data": {
-                        "type": "provider-groups",
-                        "attributes": {"name": "Out of scope group"},
-                        "relationships": {
-                            "providers": {
-                                "data": [
-                                    {
-                                        "type": "providers",
-                                        "id": str(hidden_provider.id),
-                                    }
-                                ]
-                            }
-                        },
-                    }
-                }
-            ),
-            content_type="application/vnd.api+json",
-        )
-
-        assert response.status_code == status.HTTP_400_BAD_REQUEST
-        assert not ProviderGroup.objects.filter(name="Out of scope group").exists()
-
-    def test_provider_group_create_in_scope_provider_is_accepted(
-        self,
-        authenticated_client_rbac_limited,
-        aws_provider,
-    ):
-        response = authenticated_client_rbac_limited.post(
-            reverse("providergroup-list"),
-            data=json.dumps(
-                {
-                    "data": {
-                        "type": "provider-groups",
-                        "attributes": {"name": "In scope group"},
-                        "relationships": {
-                            "providers": {
-                                "data": [
-                                    {
-                                        "type": "providers",
-                                        "id": str(aws_provider.id),
-                                    }
-                                ]
-                            }
-                        },
-                    }
-                }
-            ),
-            content_type="application/vnd.api+json",
-        )
-
-        assert response.status_code == status.HTTP_201_CREATED
-        provider_group = ProviderGroup.objects.get(name="In scope group")
-        assert set(provider_group.providers.all()) == {aws_provider}
-
-    def test_provider_group_update_out_of_scope_provider_is_rejected(
-        self,
-        authenticated_client_rbac_limited,
-        limited_provider_group,
-        aws_provider_pair,
-    ):
-        visible_provider, hidden_provider = aws_provider_pair
-        response = authenticated_client_rbac_limited.patch(
-            reverse(
-                "providergroup-detail",
-                kwargs={"pk": limited_provider_group.id},
-            ),
-            data=json.dumps(
-                {
-                    "data": {
-                        "type": "provider-groups",
-                        "id": str(limited_provider_group.id),
-                        "relationships": {
-                            "providers": {
-                                "data": [
-                                    {
-                                        "type": "providers",
-                                        "id": str(hidden_provider.id),
-                                    }
-                                ]
-                            }
-                        },
-                    }
-                }
-            ),
-            content_type="application/vnd.api+json",
-        )
-
-        assert response.status_code == status.HTTP_400_BAD_REQUEST
-        assert set(limited_provider_group.providers.all()) == {visible_provider}
-
-    def test_provider_group_relationship_create_out_of_scope_provider_is_rejected(
-        self,
-        authenticated_client_rbac_limited,
-        limited_provider_group,
-        aws_provider_pair,
-    ):
-        hidden_provider = aws_provider_pair[1]
-        response = authenticated_client_rbac_limited.post(
-            reverse(
-                "provider_group-providers-relationship",
-                kwargs={"pk": limited_provider_group.id},
-            ),
-            data={
-                "data": [
-                    {"type": "providers", "id": str(hidden_provider.id)},
-                ]
-            },
-            content_type="application/vnd.api+json",
-        )
-
-        assert response.status_code == status.HTTP_400_BAD_REQUEST
-        assert not ProviderGroupMembership.objects.filter(
-            provider_group=limited_provider_group,
-            provider=hidden_provider,
-        ).exists()
-
-    def test_provider_group_relationship_update_out_of_scope_provider_is_rejected(
-        self,
-        authenticated_client_rbac_limited,
-        limited_provider_group,
-        aws_provider_pair,
-    ):
-        visible_provider, hidden_provider = aws_provider_pair
-        response = authenticated_client_rbac_limited.patch(
-            reverse(
-                "provider_group-providers-relationship",
-                kwargs={"pk": limited_provider_group.id},
-            ),
-            data={
-                "data": [
-                    {"type": "providers", "id": str(hidden_provider.id)},
-                ]
-            },
-            content_type="application/vnd.api+json",
-        )
-
-        assert response.status_code == status.HTTP_400_BAD_REQUEST
-        assert set(limited_provider_group.providers.all()) == {visible_provider}
-
-    def test_provider_group_relationship_create_in_scope_provider_is_accepted(
-        self,
-        authenticated_client_rbac_limited,
-        limited_provider_group,
-        aws_provider_pair,
-    ):
-        additional_provider = aws_provider_pair[1]
-        additional_group = ProviderGroup.objects.create(
-            tenant_id=additional_provider.tenant_id,
-            name="Additional visible group",
-        )
-        ProviderGroupMembership.objects.create(
-            tenant_id=additional_provider.tenant_id,
-            provider_group=additional_group,
-            provider=additional_provider,
-        )
-        RoleProviderGroupRelationship.objects.create(
-            tenant_id=additional_provider.tenant_id,
-            role=limited_provider_group.roles.get(),
-            provider_group=additional_group,
-        )
-
-        response = authenticated_client_rbac_limited.post(
-            reverse(
-                "provider_group-providers-relationship",
-                kwargs={"pk": limited_provider_group.id},
-            ),
-            data={
-                "data": [
-                    {"type": "providers", "id": str(additional_provider.id)},
-                ]
-            },
-            content_type="application/vnd.api+json",
-        )
-
-        assert response.status_code == status.HTTP_204_NO_CONTENT
-        assert ProviderGroupMembership.objects.filter(
-            provider_group=limited_provider_group,
-            provider=additional_provider,
-        ).exists()
-
-    def test_provider_group_relationship_delete_out_of_scope_group_returns_404(
-        self,
-        authenticated_client_rbac_limited,
-        aws_provider_pair,
-    ):
-        hidden_provider = aws_provider_pair[1]
-        hidden_group = ProviderGroup.objects.create(
-            tenant_id=hidden_provider.tenant_id,
-            name="Unassigned provider group",
-        )
-        ProviderGroupMembership.objects.create(
-            tenant_id=hidden_provider.tenant_id,
-            provider_group=hidden_group,
-            provider=hidden_provider,
-        )
-
-        response = authenticated_client_rbac_limited.delete(
-            reverse(
-                "provider_group-providers-relationship",
-                kwargs={"pk": hidden_group.id},
-            )
-        )
-
-        assert response.status_code == status.HTTP_404_NOT_FOUND
-        assert ProviderGroupMembership.objects.filter(
-            provider_group=hidden_group,
-            provider=hidden_provider,
-        ).exists()
-
-    @patch("api.v1.views.Task.objects.get")
-    @patch("api.v1.views.delete_provider_task.delay")
-    def test_provider_delete_out_of_scope_returns_404(
-        self,
-        mock_delete_task,
-        mock_task_get,
-        authenticated_client_rbac_limited,
-        aws_provider_pair,
-        tasks_fixture,
-    ):
-        hidden_provider = aws_provider_pair[1]
-        prowler_task = tasks_fixture[0]
-        mock_delete_task.return_value.id = prowler_task.id
-        mock_task_get.return_value = prowler_task
-
-        response = authenticated_client_rbac_limited.delete(
-            reverse("provider-detail", kwargs={"pk": hidden_provider.id})
-        )
-
-        assert response.status_code == status.HTTP_404_NOT_FOUND
-        hidden_provider.refresh_from_db()
-        assert hidden_provider.is_deleted is False
-        mock_delete_task.assert_not_called()
-        mock_task_get.assert_not_called()
-
-    @patch("api.v1.views.Task.objects.get")
-    @patch("api.v1.views.delete_provider_task.delay")
-    def test_provider_delete_in_scope_returns_202(
-        self,
-        mock_delete_task,
-        mock_task_get,
-        authenticated_client_rbac_limited,
-        aws_provider,
-        tasks_fixture,
-    ):
-        prowler_task = tasks_fixture[0]
-        mock_delete_task.return_value.id = prowler_task.id
-        mock_task_get.return_value = prowler_task
-
-        response = authenticated_client_rbac_limited.delete(
-            reverse("provider-detail", kwargs={"pk": aws_provider.id})
-        )
-
-        assert response.status_code == status.HTTP_202_ACCEPTED
-        mock_delete_task.assert_called_once_with(
-            provider_id=str(aws_provider.id), tenant_id=ANY
-        )
-        mock_task_get.assert_called_once_with(id=prowler_task.id)
-
-    @patch("api.v1.views.Task.objects.get")
-    @patch("api.v1.views.check_provider_connection_task.delay")
-    def test_provider_connection_out_of_scope_returns_404(
-        self,
-        mock_provider_connection,
-        mock_task_get,
-        authenticated_client_rbac_limited,
-        aws_provider_pair,
-        tasks_fixture,
-    ):
-        hidden_provider = aws_provider_pair[1]
-        prowler_task = tasks_fixture[0]
-        mock_provider_connection.return_value.id = prowler_task.id
-        mock_task_get.return_value = prowler_task
-
-        response = authenticated_client_rbac_limited.post(
-            reverse("provider-connection", kwargs={"pk": hidden_provider.id})
-        )
-
-        assert response.status_code == status.HTTP_404_NOT_FOUND
-        mock_provider_connection.assert_not_called()
-        mock_task_get.assert_not_called()
-
-    @patch("api.v1.views.Task.objects.get")
-    @patch("api.v1.views.check_provider_connection_task.delay")
-    def test_provider_connection_in_scope_returns_202(
-        self,
-        mock_provider_connection,
-        mock_task_get,
-        authenticated_client_rbac_limited,
-        aws_provider,
-        tasks_fixture,
-    ):
-        prowler_task = tasks_fixture[0]
-        mock_provider_connection.return_value.id = prowler_task.id
-        mock_task_get.return_value = prowler_task
-
-        response = authenticated_client_rbac_limited.post(
-            reverse("provider-connection", kwargs={"pk": aws_provider.id})
-        )
-
-        assert response.status_code == status.HTTP_202_ACCEPTED
-        mock_provider_connection.assert_called_once_with(
-            provider_id=str(aws_provider.id), tenant_id=ANY
-        )
-        mock_task_get.assert_called_once_with(id=prowler_task.id)
-
-    @patch("api.v1.views.Task.objects.get")
-    @patch("api.v1.views.schedule_provider_scan")
-    def test_schedule_daily_out_of_scope_returns_404(
-        self,
-        mock_schedule_scan,
-        mock_task_get,
-        authenticated_client_rbac_limited,
-        aws_provider_pair,
-        tasks_fixture,
-    ):
-        hidden_provider = aws_provider_pair[1]
-        prowler_task = tasks_fixture[0]
-        mock_schedule_scan.return_value.id = prowler_task.id
-        mock_task_get.return_value = prowler_task
-
-        response = authenticated_client_rbac_limited.post(
-            reverse("schedule-daily"),
-            data=json.dumps(
-                {
-                    "data": {
-                        "type": "daily-schedules",
-                        "attributes": {"provider_id": str(hidden_provider.id)},
-                    }
-                }
-            ),
-            content_type="application/vnd.api+json",
-        )
-
-        assert response.wsgi_request.content_type == "application/vnd.api+json"
-        assert response.status_code == status.HTTP_404_NOT_FOUND
-        mock_schedule_scan.assert_not_called()
-        mock_task_get.assert_not_called()
-
-    @patch("api.v1.views.Task.objects.get")
-    @patch("api.v1.views.schedule_provider_scan")
-    def test_schedule_daily_in_scope_returns_202(
-        self,
-        mock_schedule_scan,
-        mock_task_get,
-        authenticated_client_rbac_limited,
-        aws_provider,
-        tasks_fixture,
-    ):
-        prowler_task = tasks_fixture[0]
-        mock_schedule_scan.return_value.id = prowler_task.id
-        mock_task_get.return_value = prowler_task
-
-        response = authenticated_client_rbac_limited.post(
-            reverse("schedule-daily"),
-            data=json.dumps(
-                {
-                    "data": {
-                        "type": "daily-schedules",
-                        "attributes": {"provider_id": str(aws_provider.id)},
-                    }
-                }
-            ),
-            content_type="application/vnd.api+json",
-        )
-
-        assert response.wsgi_request.content_type == "application/vnd.api+json"
-        assert response.status_code == status.HTTP_202_ACCEPTED
-        mock_schedule_scan.assert_called_once_with(aws_provider)
-        mock_task_get.assert_called_once_with(id=prowler_task.id)
-
    def test_integrations(
        self, authenticated_client_rbac_limited, integrations_fixture
    ):
@@ -1292,6 +683,22 @@ class TestLimitedVisibility:
            response.json()["data"]["relationships"]["providers"]["meta"]["count"] == 1
        )

+    @pytest.fixture
+    def jira_integration(self, tenants_fixture):
+        # Jira is a tenant-wide integration: it is not attached to any provider
+        return Integration.objects.create(
+            tenant_id=tenants_fixture[0].id,
+            enabled=True,
+            connected=True,
+            integration_type=Integration.IntegrationChoices.JIRA,
+            configuration={"projects": {"TEST": "Test project"}},
+            credentials={
+                "domain": "test",
+                "user_mail": "a@b.com",
+                "api_token": "token",
+            },
+        )
+
    @pytest.fixture
    def out_of_scope_integration(self, tenants_fixture, provider_factory):
        tenant_id = tenants_fixture[0].id
@@ -1317,7 +724,7 @@ class TestLimitedVisibility:
        self,
        authenticated_client_rbac_limited,
        integrations_fixture,
-        jira_integration_fixture,
+        jira_integration,
        aws_provider_pair,
    ):
        # Integration 2 is attached to both providers, so make both visible to the role
@@ -1333,16 +740,13 @@ class TestLimitedVisibility:
        assert response.status_code == status.HTTP_200_OK
        integration_ids = [item["id"] for item in response.json()["data"]]
        # The tenant-wide Jira integration is visible without unlimited visibility
-        assert str(jira_integration_fixture.id) in integration_ids
+        assert str(jira_integration.id) in integration_ids
        # Integrations attached to more than one visible provider are not duplicated
        assert integration_ids.count(str(integrations_fixture[1].id)) == 1
        assert response.json()["meta"]["pagination"]["count"] == len(integration_ids)

    def test_integrations_list_without_provider_groups_keeps_tenant_wide_integration(
-        self,
-        authenticated_client_rbac_limited,
-        integrations_fixture,
-        jira_integration_fixture,
+        self, authenticated_client_rbac_limited, integrations_fixture, jira_integration
    ):
        # A role with no provider group at all sees no provider, but still needs Jira
        RoleProviderGroupRelationship.objects.all().delete()
@@ -1351,7 +755,7 @@ class TestLimitedVisibility:

        assert response.status_code == status.HTTP_200_OK
        integration_ids = [item["id"] for item in response.json()["data"]]
-        assert integration_ids == [str(jira_integration_fixture.id)]
+        assert integration_ids == [str(jira_integration.id)]

    def test_integrations_include_providers_hides_out_of_scope_providers(
        self, authenticated_client_rbac_limited, integrations_fixture, aws_provider_pair
@@ -1370,19 +774,13 @@ class TestLimitedVisibility:
        assert str(hidden_provider.id) not in included_ids

    def test_integrations_list_with_sparse_fields(
-        self,
-        authenticated_client_rbac_limited,
-        integrations_fixture,
-        jira_integration_fixture,
+        self, authenticated_client_rbac_limited, integrations_fixture
    ):
        response = authenticated_client_rbac_limited.get(
            reverse("integration-list"), {"fields[integrations]": "enabled"}
        )

        assert response.status_code == status.HTTP_200_OK
-        assert str(jira_integration_fixture.id) in [
-            item["id"] for item in response.json()["data"]
-        ]
        assert all(
            list(item["attributes"].keys()) == ["enabled"]
            for item in response.json()["data"]
@@ -1418,10 +816,7 @@ class TestLimitedVisibility:
        assert response.status_code == status.HTTP_404_NOT_FOUND

    def test_integration_update_allowed_when_fully_visible(
-        self,
-        authenticated_client_rbac_limited,
-        integrations_fixture,
-        jira_integration_fixture,
+        self, authenticated_client_rbac_limited, integrations_fixture, jira_integration
    ):
        # Integration 1 is only related to provider1, which the role can access
        integration = integrations_fixture[0]
@@ -1455,21 +850,20 @@ class TestLimitedVisibility:
        payload = {
            "data": {
                "type": "integrations",
-                "id": str(jira_integration_fixture.id),
+                "id": str(jira_integration.id),
                "attributes": {"enabled": False},
            }
        }

        response = authenticated_client_rbac_limited.patch(
-            reverse("integration-detail", kwargs={"pk": jira_integration_fixture.id}),
+            reverse("integration-detail", kwargs={"pk": jira_integration.id}),
            data=json.dumps(payload),
            content_type="application/vnd.api+json",
        )

        assert response.status_code == status.HTTP_200_OK
-        with rls_transaction(str(jira_integration_fixture.tenant_id)):
-            jira_integration_fixture.refresh_from_db()
-        assert jira_integration_fixture.enabled is False
+        jira_integration.refresh_from_db()
+        assert jira_integration.enabled is False

    def test_integration_create_rejects_out_of_scope_provider(
        self, authenticated_client_rbac_limited, aws_provider_pair
@@ -1569,10 +963,7 @@ class TestLimitedVisibility:
        assert Integration.objects.filter(id=integration.id).exists()

    def test_integration_delete_allowed_when_fully_visible(
-        self,
-        authenticated_client_rbac_limited,
-        integrations_fixture,
-        jira_integration_fixture,
+        self, authenticated_client_rbac_limited, integrations_fixture, jira_integration
    ):
        # Integration 1 is only related to provider1, which the role can access
        integration = integrations_fixture[0]
@@ -1586,20 +977,20 @@ class TestLimitedVisibility:

        # Tenant-wide integrations have no provider restricting the role
        response = authenticated_client_rbac_limited.delete(
-            reverse("integration-detail", kwargs={"pk": jira_integration_fixture.id})
+            reverse("integration-detail", kwargs={"pk": jira_integration.id})
        )

        assert response.status_code == status.HTTP_204_NO_CONTENT

    def test_jira_issue_types_allowed_without_unlimited_visibility(
-        self, authenticated_client_rbac_limited, jira_integration_fixture
+        self, authenticated_client_rbac_limited, jira_integration
    ):
        with patch("api.v1.views.initialize_prowler_integration") as mock_jira:
            mock_jira.return_value.get_available_issue_types.return_value = ["Task"]
            response = authenticated_client_rbac_limited.get(
                reverse(
                    "integration-jira-issue-types",
-                    kwargs={"integration_pk": jira_integration_fixture.id},
+                    kwargs={"integration_pk": jira_integration.id},
                ),
                {"project_key": "TEST"},
            )
@@ -1635,12 +1026,12 @@ class TestLimitedVisibility:
        assert response.status_code == status.HTTP_404_NOT_FOUND

    def test_jira_dispatches_allowed_without_unlimited_visibility(
-        self, authenticated_client_rbac_limited, jira_integration_fixture
+        self, authenticated_client_rbac_limited, jira_integration
    ):
        response = authenticated_client_rbac_limited.post(
            reverse(
                "integration-jira-dispatches",
-                kwargs={"integration_pk": jira_integration_fixture.id},
+                kwargs={"integration_pk": jira_integration.id},
            ),
            data=json.dumps({}),
            content_type="application/vnd.api+json",
@@ -6,13 +6,10 @@ from api.v1.serializer_utils.integrations import (
 from api.v1.serializer_utils.providers import ProviderSecretField
 from api.v1.serializers import (
    ImageProviderSecret,
-    IntegrationSerializer,
-    IntegrationUpdateSerializer,
    KubernetesProviderSecret,
    OracleCloudProviderSecret,
 )
 from rest_framework.exceptions import ValidationError
-from rest_framework.test import APIRequestFactory


 class TestS3ConfigSerializer:
@@ -355,25 +352,3 @@ current-context: test-context

        assert not serializer.is_valid()
        assert "kubeconfig_content" in serializer.errors
-
-
-@pytest.mark.django_db
-class TestIntegrationSerializerJiraDomain:
-    """The serialized Jira `domain` must not reach the model instance."""
-
-    @pytest.mark.parametrize(
-        "serializer_class", [IntegrationSerializer, IntegrationUpdateSerializer]
-    )
-    def test_to_representation_does_not_mutate_configuration(
-        self, serializer_class, jira_integration_fixture
-    ):
-        # `IntegrationUpdateSerializer` exposes a `HyperlinkedIdentityField`
-        context = {"request": APIRequestFactory().get("/")}
-        representation = serializer_class(
-            jira_integration_fixture, context=context
-        ).data
-
-        assert representation["configuration"]["domain"] == "test"
-        assert jira_integration_fixture.configuration == {
-            "projects": {"TEST": "Test project"}
-        }
@@ -3,11 +3,9 @@ import io
 import json
 import os
 import tempfile
-from concurrent.futures import ThreadPoolExecutor
 from datetime import UTC, date, datetime, timedelta
 from decimal import Decimal
 from pathlib import Path
-from threading import Event, Lock
 from types import SimpleNamespace
 from unittest.mock import ANY, MagicMock, Mock, patch
 from urllib.parse import parse_qs, urlparse
@@ -23,7 +21,6 @@ from api.attack_paths import (
 )
 from api.compliance import get_compliance_frameworks
 from api.db_router import MainRouter
-from api.db_utils import rls_transaction
 from api.models import (
    AttackSurfaceOverview,
    ComplianceOverviewSummary,
@@ -68,7 +65,6 @@ from api.v1.views import (
 )
 from botocore.exceptions import ClientError, NoCredentialsError
 from celery import states
-from celery.utils.saferepr import saferepr
 from conftest import (
    API_JSON_CONTENT_TYPE,
    TEST_PASSWORD,
@@ -77,7 +73,7 @@ from conftest import (
    today_after_n_days,
 )
 from django.conf import settings
-from django.db import close_old_connections, connection
+from django.db import connection
 from django.db.models import Count
 from django.http import JsonResponse
 from django.test import RequestFactory
@@ -5047,60 +5043,11 @@ class TestTaskViewSet:
            reverse("task-detail", kwargs={"pk": task1.id}),
        )
        assert response.status_code == status.HTTP_200_OK
-        assert response.json()["data"]["attributes"]["task_args"] == {
-            "kwarg1": "value1"
-        }
        assert (
            response.json()["data"]["attributes"]["name"]
            == task1.task_runner_task.task_name
        )

-    def test_tasks_retrieve_hides_tenant_id(
-        self, authenticated_client, tasks_fixture, tenants_fixture
-    ):
-        task, *_ = tasks_fixture
-        task.task_runner_task.task_kwargs = json.dumps(
-            repr(
-                {
-                    "tenant_id": str(tenants_fixture[0].id),
-                    "enabled": True,
-                    "scan_id": None,
-                    "label": "True North",
-                }
-            )
-        )
-        task.task_runner_task.save(update_fields=["task_kwargs"])
-
-        response = authenticated_client.get(
-            reverse("task-detail", kwargs={"pk": task.id}),
-        )
-
-        assert response.status_code == status.HTTP_200_OK
-        assert response.json()["data"]["attributes"]["task_args"] == {
-            "enabled": True,
-            "scan_id": None,
-            "label": "True North",
-        }
-
-    def test_tasks_retrieve_with_truncated_kwargs_returns_empty_task_args(
-        self, authenticated_client, tasks_fixture
-    ):
-        task, *_ = tasks_fixture
-        kwargs_repr = saferepr(
-            {"finding_ids": [str(uuid4()) for _ in range(30)]}, maxlen=1024
-        )
-        assert "..." in kwargs_repr
-        task.task_runner_task.task_kwargs = json.dumps(kwargs_repr)
-        task.task_runner_task.save(update_fields=["task_kwargs"])
-
-        response = authenticated_client.get(
-            reverse("task-detail", kwargs={"pk": task.id}),
-        )
-
-        assert response.status_code == status.HTTP_200_OK
-        assert response.headers["Content-Type"] == API_JSON_CONTENT_TYPE
-        assert response.json()["data"]["attributes"]["task_args"] == {}
-
    def test_tasks_invalid_retrieve(self, authenticated_client):
        response = authenticated_client.get(
            reverse("task-detail", kwargs={"pk": "invalid_id"})
@@ -13499,73 +13446,6 @@ class TestIntegrationViewSet:
                f"Expected type '{expected_type}' not found in included data"
            )

-    # Serializing a Jira integration reads `configuration` to add the domain from the
-    # credentials, and a sparse fieldset can leave that field out of the representation
-
-    def test_integrations_list_sparse_fields_without_configuration(
-        self, authenticated_client, jira_integration_fixture
-    ):
-        response = authenticated_client.get(
-            reverse("integration-list"),
-            {"fields[integrations]": "enabled,integration_type"},
-        )
-
-        assert response.status_code == status.HTTP_200_OK
-        attributes = response.json()["data"][0]["attributes"]
-        assert sorted(attributes.keys()) == ["enabled", "integration_type"]
-
-    def test_integrations_retrieve_sparse_fields_without_configuration(
-        self, authenticated_client, jira_integration_fixture
-    ):
-        response = authenticated_client.get(
-            reverse("integration-detail", kwargs={"pk": jira_integration_fixture.id}),
-            {"fields[integrations]": "enabled,integration_type"},
-        )
-
-        assert response.status_code == status.HTTP_200_OK
-        assert "configuration" not in response.json()["data"]["attributes"]
-
-    def test_integrations_partial_update_sparse_fields_without_configuration(
-        self, authenticated_client, jira_integration_fixture
-    ):
-        data = {
-            "data": {
-                "type": "integrations",
-                "id": str(jira_integration_fixture.id),
-                "attributes": {"enabled": False},
-            }
-        }
-
-        url = reverse("integration-detail", kwargs={"pk": jira_integration_fixture.id})
-        response = authenticated_client.patch(
-            f"{url}?fields[integrations]=enabled,integration_type",
-            data=json.dumps(data),
-            content_type="application/vnd.api+json",
-        )
-
-        assert response.status_code == status.HTTP_200_OK
-        assert "configuration" not in response.json()["data"]["attributes"]
-        with rls_transaction(str(jira_integration_fixture.tenant_id)):
-            jira_integration_fixture.refresh_from_db()
-        assert jira_integration_fixture.enabled is False
-        # Omitting `configuration` from the fieldset must not rewrite it, and the
-        # serialized `domain` must not leak into the stored value
-        assert jira_integration_fixture.configuration == {
-            "projects": {"TEST": "Test project"}
-        }
-
-    def test_integrations_retrieve_jira_keeps_domain_in_configuration(
-        self, authenticated_client, jira_integration_fixture
-    ):
-        response = authenticated_client.get(
-            reverse("integration-detail", kwargs={"pk": jira_integration_fixture.id})
-        )
-
-        assert response.status_code == status.HTTP_200_OK
-        configuration = response.json()["data"]["attributes"]["configuration"]
-        assert configuration["domain"] == "test"
-        assert configuration["projects"] == {"TEST": "Test project"}
-
    @pytest.mark.parametrize(
        "integration_type, configuration, credentials",
        [
@@ -14913,94 +14793,19 @@ class TestTenantFinishACSView:
        # Verify no new role was created
        assert Role.objects.using(MainRouter.admin_db).count() == roles_before

-    @pytest.mark.parametrize(
-        (
-            "existing_role_attributes",
-            "existing_suffixes",
-            "expected_role_name",
-            "expected_role_created",
-        ),
-        [
-            (None, (), "read_only", True),
-            ({"unlimited_visibility": True}, (), "read_only", False),
-            (
-                {"manage_users": True, "unlimited_visibility": True},
-                (
-                    ("read_only_0", {"unlimited_visibility": True}),
-                    ("read_only_1", {"unlimited_visibility": True}),
-                ),
-                "read_only_0",
-                False,
-            ),
-            (
-                {"manage_users": True, "unlimited_visibility": True},
-                (
-                    (
-                        "read_only_0",
-                        {"manage_users": True, "unlimited_visibility": True},
-                    ),
-                    ("read_only_1", {"unlimited_visibility": True}),
-                ),
-                "read_only_1",
-                False,
-            ),
-            ({"unlimited_visibility": False}, (), "read_only_0", True),
-        ],
-        ids=[
-            "creates-role",
-            "reuses-safe-role",
-            "reuses-first-safe-suffixed-role",
-            "skips-unsafe-suffixed-role",
-            "avoids-restricted-visibility",
-        ],
-    )
-    def test_dispatch_assigns_read_only_role_when_usertype_missing(
+    def test_dispatch_assigns_no_role_to_new_user_when_usertype_missing(
        self,
        create_test_user,
        tenants_fixture,
        saml_setup,
        settings,
        monkeypatch,
-        existing_role_attributes,
-        existing_suffixes,
-        expected_role_name,
-        expected_role_created,
    ):
-        """Test safe fallback role assignment when userType is missing"""
+        """Test that a user without roles gets none assigned when userType is missing"""
        monkeypatch.setenv("SAML_SSO_CALLBACK_URL", "http://localhost/sso-complete")
        user = create_test_user
        tenant = tenants_fixture[0]
-        other_tenant = tenants_fixture[1]
-
-        other_tenant_role = Role.objects.using(MainRouter.admin_db).create(
-            name="read_only",
-            tenant=other_tenant,
-            unlimited_visibility=True,
-        )
-        other_tenant_relationship = UserRoleRelationship.objects.using(
-            MainRouter.admin_db
-        ).create(
-            user=user,
-            role=other_tenant_role,
-            tenant=other_tenant,
-        )
-
-        existing_role = None
-        if existing_role_attributes is not None:
-            existing_role = Role.objects.using(MainRouter.admin_db).create(
-                name="read_only",
-                tenant=tenant,
-                **existing_role_attributes,
-            )
-        for role_name, role_attributes in existing_suffixes:
-            Role.objects.using(MainRouter.admin_db).create(
-                name=role_name,
-                tenant=tenant,
-                **role_attributes,
-            )
-        roles_before = (
-            Role.objects.using(MainRouter.admin_db).filter(tenant=tenant).count()
-        )
+        roles_before = Role.objects.using(MainRouter.admin_db).count()

        social_account = SocialAccount(
            user=user,
@@ -15053,44 +14858,12 @@ class TestTenantFinishACSView:

        assert response.status_code == 302

-        # Verify the fallback role was created or reused with read-only access
-        expected_role_count = roles_before + expected_role_created
-        assert (
-            Role.objects.using(MainRouter.admin_db).filter(tenant=tenant).count()
-            == expected_role_count
-        )
-        role = Role.objects.using(MainRouter.admin_db).get(
-            name=expected_role_name, tenant=tenant
-        )
-        if existing_role is not None and expected_role_name == "read_only":
-            assert role == existing_role
-        assert not role.manage_users
-        assert not role.manage_account
-        assert not role.manage_billing
-        assert not role.manage_providers
-        assert not role.manage_integrations
-        assert not role.manage_scans
-        assert role.unlimited_visibility
-        assert (
-            UserRoleRelationship.objects.using(MainRouter.admin_db)
-            .filter(user=user, role=role, tenant_id=tenant.id)
-            .exists()
-        )
-        assert (
-            UserRoleRelationship.objects.using(MainRouter.admin_db)
-            .filter(
-                id=other_tenant_relationship.id,
-                user=user,
-                role=other_tenant_role,
-                tenant_id=other_tenant.id,
-            )
-            .exists()
-        )
-        assert (
+        # Verify no role was created or assigned
+        assert Role.objects.using(MainRouter.admin_db).count() == roles_before
+        assert not (
            UserRoleRelationship.objects.using(MainRouter.admin_db)
            .filter(user=user, tenant_id=tenant.id)
-            .count()
-            == 1
+            .exists()
        )

        # Membership is still created so the user belongs to the tenant
@@ -15100,131 +14873,6 @@ class TestTenantFinishACSView:
            .exists()
        )

-    @pytest.mark.django_db(transaction=True)
-    def test_dispatch_serializes_concurrent_fallback_role_assignment(
-        self,
-        create_test_user,
-        tenants_fixture,
-        saml_setup,
-        monkeypatch,
-    ):
-        """Test concurrent callbacks assign only one fallback role"""
-        monkeypatch.setenv("SAML_SSO_CALLBACK_URL", "http://localhost/sso-complete")
-        user = create_test_user
-        tenant = tenants_fixture[0]
-
-        Role.objects.using(MainRouter.admin_db).create(
-            name="read_only",
-            tenant=tenant,
-            manage_users=True,
-            unlimited_visibility=True,
-        )
-
-        social_account = SocialAccount(
-            user=user,
-            provider="saml",
-            extra_data={
-                "firstName": ["John"],
-                "lastName": ["Doe"],
-                "organization": ["testing_company"],
-            },
-        )
-        # Without the user lock, both callbacks reach this query before either
-        # creates a fallback. With the lock, the first callback times out here
-        # while the second waits for the transaction to finish.
-        second_role_check_reached = Event()
-        concurrent_role_checks_detected = Event()
-        role_check_count_lock = Lock()
-        role_check_count = 0
-        original_role_check = TenantFinishACSView._user_has_tenant_role
-
-        def synchronize_role_checks(user_id, tenant_id):
-            nonlocal role_check_count
-            with role_check_count_lock:
-                role_check_count += 1
-                is_first_role_check = role_check_count == 1
-                if role_check_count == 2:
-                    second_role_check_reached.set()
-            if is_first_role_check and second_role_check_reached.wait(timeout=1):
-                concurrent_role_checks_detected.set()
-            return original_role_check(user_id, tenant_id)
-
-        def dispatch_callback():
-            close_old_connections()
-            try:
-                thread_user = User.objects.using(MainRouter.admin_db).get(pk=user.pk)
-                request = RequestFactory().get(
-                    reverse(
-                        "saml_finish_acs",
-                        kwargs={"organization_slug": saml_setup["domain"]},
-                    )
-                )
-                request.user = thread_user
-                request.session = {}
-                response = TenantFinishACSView.as_view()(
-                    request, organization_slug=saml_setup["domain"]
-                )
-                return response
-            finally:
-                close_old_connections()
-
-        with (
-            patch(
-                "allauth.socialaccount.providers.saml.views.get_app_or_404"
-            ) as mock_get_app_or_404,
-            patch(
-                "allauth.socialaccount.models.SocialApp.objects.get"
-            ) as mock_socialapp_get,
-            patch(
-                "allauth.socialaccount.models.SocialAccount.objects.get"
-            ) as mock_sa_get,
-            patch("api.models.SAMLDomainIndex.objects.get") as mock_saml_domain_get,
-            patch("api.models.SAMLConfiguration.objects.get") as mock_saml_config_get,
-            patch("api.models.User.objects.get") as mock_user_get,
-            patch.object(
-                TenantFinishACSView,
-                "_user_has_tenant_role",
-                side_effect=synchronize_role_checks,
-            ),
-        ):
-            mock_get_app_or_404.return_value = MagicMock(
-                provider="saml",
-                client_id=saml_setup["domain"],
-                name="Test App",
-                settings={},
-            )
-            mock_sa_get.return_value = social_account
-            mock_socialapp_get.return_value = MagicMock(provider_id="saml")
-            mock_saml_domain_get.return_value = SimpleNamespace(tenant_id=tenant.id)
-            mock_saml_config_get.return_value = SimpleNamespace(
-                email_domain=saml_setup["domain"], tenant=tenant
-            )
-            mock_user_get.side_effect = lambda *_args, **_kwargs: User.objects.using(
-                MainRouter.admin_db
-            ).get(pk=user.pk)
-
-            with ThreadPoolExecutor(max_workers=2) as executor:
-                responses = list(executor.map(lambda _: dispatch_callback(), range(2)))
-
-        assert role_check_count == 2
-        assert not concurrent_role_checks_detected.is_set()
-        for response in responses:
-            assert response.status_code == status.HTTP_302_FOUND
-            parsed_redirect = urlparse(response.url)
-            assert parsed_redirect.path == "/sso-complete"
-            assert set(parse_qs(parsed_redirect.query)) == {"id"}
-        relationships = UserRoleRelationship.objects.using(MainRouter.admin_db).filter(
-            user=user, tenant_id=tenant.id
-        )
-        assert relationships.count() == 1
-        assert relationships.get().role.name == "read_only_0"
-        assert (
-            Role.objects.using(MainRouter.admin_db)
-            .filter(tenant=tenant, name__startswith="read_only_")
-            .count()
-            == 1
-        )
-
    def test_dispatch_skips_role_mapping_when_last_manage_account_user_maps_to_new_role(
        self,
        create_test_user,
@@ -16100,23 +15748,6 @@ class TestTenantApiKeyViewSet:
        data = response.json()["data"]
        assert len(data) == len(api_keys_fixture)

-    def test_api_keys_list_with_orphaned_key(
-        self, authenticated_client, api_keys_fixture
-    ):
-        """Test listing keys whose owner was deleted: `entity` is serialized as null."""
-        orphaned_key = api_keys_fixture[0]
-        TenantAPIKey.objects.filter(id=orphaned_key.id).update(entity=None)
-
-        response = authenticated_client.get(reverse("api-key-list"))
-
-        assert response.status_code == status.HTTP_200_OK
-        data = response.json()["data"]
-        assert len(data) == len(api_keys_fixture)
-        serialized_key = next(
-            item for item in data if item["id"] == str(orphaned_key.id)
-        )
-        assert serialized_key["relationships"]["entity"]["data"] is None
-
    def test_api_keys_list_empty(self, authenticated_client, tenants_fixture):
        """Test listing API keys when none exist returns empty list."""
        response = authenticated_client.get(reverse("api-key-list"))
@@ -6,11 +6,9 @@ from api.exceptions import (
    TaskNotFoundException,
 )
 from api.models import Provider, StateChoices, Task
-from api.rbac.permissions import get_providers
 from api.v1.serializers import TaskSerializer
 from django.http import QueryDict
 from django.urls import reverse
-from django.utils.functional import cached_property
 from django_celery_results.models import TaskResult
 from rest_framework import status
 from rest_framework.exceptions import ValidationError
@@ -35,22 +33,6 @@ class DisablePaginationMixin:
        return super().paginate_queryset(queryset)


-class ProviderVisibilityMixin:
-    @cached_property
-    def provider_queryset(self):
-        if self.user_role.unlimited_visibility:
-            return Provider.objects.filter(tenant_id=self.request.tenant_id)
-        return get_providers(self.user_role)
-
-    def get_provider_queryset(self):
-        return self.provider_queryset
-
-    def get_serializer_context(self):
-        context = super().get_serializer_context()
-        context["provider_queryset"] = self.get_provider_queryset()
-        return context
-
-
 class PaginateByPkMixin:
    """
    Mixin to paginate on a list of PKs (cheaper than heavy JOINs),
@@ -1,10 +1,8 @@
 import base64
 import json
-import logging
 from datetime import UTC, datetime, timedelta

 import yaml
-from api.celery_utils import decode_celery_field
 from api.db_router import MainRouter
 from api.exceptions import ConflictException
 from api.models import (
@@ -61,7 +59,6 @@ from api.v1.serializer_utils.lighthouse import (
 from api.v1.serializer_utils.processors import ProcessorConfigField
 from api.v1.serializer_utils.providers import ProviderSecretField
 from api.validators import validate_lighthouse_openai_compatible_base_url
-from config.custom_logging import BackendLogger
 from django.conf import settings
 from django.contrib.auth import authenticate
 from django.contrib.auth.models import update_last_login
@@ -82,8 +79,6 @@ from rest_framework_simplejwt.settings import api_settings
 from rest_framework_simplejwt.tokens import RefreshToken
 from rest_framework_simplejwt.utils import get_md5_hash_password

-logger = logging.getLogger(BackendLogger.API)
-
 # Base


@@ -129,20 +124,6 @@ class RLSSerializer(BaseModelSerializerV1):
        return super().create(validated_data)


-class ScopedProviderFieldMixin:
-    provider_field_name = "provider"
-
-    def __init__(self, *args, **kwargs):
-        super().__init__(*args, **kwargs)
-        provider_queryset = self.context.get("provider_queryset")
-        provider_field = self.fields.get(self.provider_field_name)
-        if provider_queryset is None or provider_field is None:
-            return
-
-        related_field = getattr(provider_field, "child_relation", provider_field)
-        related_field.queryset = provider_queryset
-
-
 class StateEnumSerializerField(serializers.ChoiceField):
    def __init__(self, **kwargs):
        kwargs["choices"] = StateChoices.choices
@@ -626,24 +607,13 @@ class TaskSerializer(RLSSerializer, TaskBase):

    @extend_schema_field(serializers.JSONField())
    def get_task_args(self, obj):
-        task_kwargs = (
-            getattr(obj.task_runner_task, "task_kwargs", None)
-            if obj.task_runner_task
-            else None
-        )
-        try:
-            task_args = decode_celery_field(task_kwargs, {})
-            if not isinstance(task_args, dict):
-                raise ValueError("Decoded task kwargs must be a dictionary")
-        except ValueError:
-            logger.warning(
-                "Unable to decode task kwargs for task %s; returning empty task_args.",
-                obj.id,
-            )
-            return {}
-
-        task_args = task_args.copy()
+        task_args = self.get_json_field(obj, "task_kwargs")
+        # Celery task_kwargs are stored as a double string JSON in the database when not empty
+        if isinstance(task_args, str):
+            task_args = json.loads(task_args.replace("'", '"').replace("None", "null"))
+        # Remove tenant_id from task_kwargs if present
        task_args.pop("tenant_id", None)
+
        return task_args

    @staticmethod
@@ -723,10 +693,7 @@ class MembershipIncludeSerializer(serializers.ModelSerializer):


 # Provider Groups
-class ProviderGroupSerializer(
-    ScopedProviderFieldMixin, RLSSerializer, BaseWriteSerializer
-):
-    provider_field_name = "providers"
+class ProviderGroupSerializer(RLSSerializer, BaseWriteSerializer):
    providers = serializers.ResourceRelatedField(
        queryset=Provider.objects.all(), many=True, required=False
    )
@@ -884,27 +851,9 @@ class ProviderGroupMembershipSerializer(RLSSerializer, BaseWriteSerializer):
        help_text="List of resource identifier objects representing providers.",
    )

-    def get_providers(self, validated_data):
-        provider_ids = {item["id"] for item in validated_data["providers"]}
-        provider_queryset = self.context.get("provider_queryset")
-        if provider_queryset is None:
-            provider_queryset = Provider.objects.filter(
-                tenant_id=self.context.get("tenant_id")
-            )
-
-        providers = list(provider_queryset.filter(id__in=provider_ids))
-        if {provider.id for provider in providers} != provider_ids:
-            raise serializers.ValidationError(
-                {
-                    "providers": (
-                        "One or more providers do not exist or are not accessible."
-                    )
-                }
-            )
-        return providers
-
    def create(self, validated_data):
-        providers = self.get_providers(validated_data)
+        provider_ids = [item["id"] for item in validated_data["providers"]]
+        providers = Provider.objects.filter(id__in=provider_ids)
        tenant_id = self.context.get("tenant_id")

        new_relationships = [
@@ -920,7 +869,8 @@ class ProviderGroupMembershipSerializer(RLSSerializer, BaseWriteSerializer):
        return self.context.get("provider_group")

    def update(self, instance, validated_data):
-        providers = self.get_providers(validated_data)
+        provider_ids = [item["id"] for item in validated_data["providers"]]
+        providers = Provider.objects.filter(id__in=provider_ids)
        tenant_id = self.context.get("tenant_id")

        instance.providers.clear()
@@ -1159,9 +1109,7 @@ class ScanIncludeSerializer(RLSSerializer):
    }


-class ScanCreateSerializer(
-    ScopedProviderFieldMixin, RLSSerializer, BaseWriteSerializer
-):
+class ScanCreateSerializer(RLSSerializer, BaseWriteSerializer):
    class Meta:
        model = Scan
        # TODO: add mutelist when implemented
@@ -2026,9 +1974,7 @@ class ProviderSecretSerializer(RLSSerializer):
        ]


-class ProviderSecretCreateSerializer(
-    ScopedProviderFieldMixin, RLSSerializer, BaseWriteProviderSecretSerializer
-):
+class ProviderSecretCreateSerializer(RLSSerializer, BaseWriteProviderSecretSerializer):
    secret = ProviderSecretField(write_only=True)

    class Meta:
@@ -3006,15 +2952,10 @@ class IntegrationSerializer(IntegrationProviderVisibilityMixin, RLSSerializer):
        representation = self.hide_restricted_providers(
            super().to_representation(instance)
        )
-        # `configuration` is missing when the request asks for a subset of the fields
-        if (
-            instance.integration_type == Integration.IntegrationChoices.JIRA
-            and "configuration" in representation
-        ):
-            representation["configuration"] = {
-                **representation["configuration"],
-                "domain": instance.credentials.get("domain"),
-            }
+        if instance.integration_type == Integration.IntegrationChoices.JIRA:
+            representation["configuration"].update(
+                {"domain": instance.credentials.get("domain")}
+            )
        return representation


@@ -3148,16 +3089,11 @@ class IntegrationUpdateSerializer(
        representation = self.hide_restricted_providers(
            super().to_representation(instance)
        )
-        # Ensure JIRA integrations show updated domain in configuration from credentials.
-        # `configuration` is missing when the request asks for a subset of the fields
-        if (
-            instance.integration_type == Integration.IntegrationChoices.JIRA
-            and "configuration" in representation
-        ):
-            representation["configuration"] = {
-                **representation["configuration"],
-                "domain": instance.credentials.get("domain"),
-            }
+        # Ensure JIRA integrations show updated domain in configuration from credentials
+        if instance.integration_type == Integration.IntegrationChoices.JIRA:
+            representation["configuration"].update(
+                {"domain": instance.credentials.get("domain")}
+            )
        return representation


@@ -146,7 +146,6 @@ from api.v1.mixins import (
    JsonApiFilterMixin,
    PaginateByPkMixin,
    ProviderFilterParamsMixin,
-    ProviderVisibilityMixin,
    TaskManagementMixin,
 )
 from api.v1.serializers import (
@@ -814,21 +813,6 @@ class TenantFinishACSView(FinishACSView):
            User.objects.using(MainRouter.admin_db).filter(id=saml_user_id).delete()
            request.session.pop("saml_user_created", None)

-    @staticmethod
-    def _user_has_tenant_role(user_id, tenant_id):
-        return (
-            UserRoleRelationship.objects.using(MainRouter.admin_db)
-            .filter(user_id=user_id, tenant_id=tenant_id)
-            .exists()
-        )
-
-    @staticmethod
-    def _is_read_only_fallback_role(role):
-        return (
-            not any(getattr(role, permission) for permission in Role.PERMISSION_FIELDS)
-            and role.unlimited_visibility
-        )
-
    def dispatch(self, request, organization_slug):
        try:
            super().dispatch(request, organization_slug)
@@ -894,56 +878,11 @@ class TenantFinishACSView(FinishACSView):
            user.name = "N/A"
        user.save()

-        # Only remap existing roles when the IdP provides a userType attribute.
-        # Without it, preserve current roles or assign a read-only fallback.
+        # Only remap roles when the IdP provides a userType attribute.
+        # Without it, the user's current roles are left untouched.
        role_name = (
            extra.get("userType", [""])[0].strip() if extra.get("userType") else ""
        )
-        if not role_name:
-            with rls_transaction(str(tenant.id), using=MainRouter.admin_db):
-                with transaction.atomic(using=MainRouter.admin_db):
-                    # Serialize concurrent ACS callbacks for the same user.
-                    (
-                        User.objects.using(MainRouter.admin_db)
-                        .select_for_update()
-                        .only("id")
-                        .get(pk=user_id)
-                    )
-                    user_has_roles = self._user_has_tenant_role(user_id, tenant.id)
-                    if not user_has_roles:
-                        read_only_defaults = dict.fromkeys(
-                            Role.PERMISSION_FIELDS, False
-                        )
-                        read_only_defaults["unlimited_visibility"] = True
-                        role, role_created = Role.objects.using(
-                            MainRouter.admin_db
-                        ).get_or_create(
-                            name="read_only",
-                            tenant=tenant,
-                            defaults=read_only_defaults,
-                        )
-                        role_is_read_only = self._is_read_only_fallback_role(role)
-                        if not role_created and not role_is_read_only:
-                            suffix = 0
-                            while not role_created and not role_is_read_only:
-                                role, role_created = Role.objects.using(
-                                    MainRouter.admin_db
-                                ).get_or_create(
-                                    name=f"read_only_{suffix}",
-                                    tenant=tenant,
-                                    defaults=read_only_defaults,
-                                )
-                                role_is_read_only = self._is_read_only_fallback_role(
-                                    role
-                                )
-                                suffix += 1
-                        UserRoleRelationship.objects.using(
-                            MainRouter.admin_db
-                        ).get_or_create(
-                            user=user,
-                            role=role,
-                            defaults={"tenant": tenant},
-                        )
        if role_name:
            with transaction.atomic(using=MainRouter.admin_db):
                role = (
@@ -1693,7 +1632,7 @@ class TenantMembersViewSet(BaseTenantViewset):
    ),
    update=extend_schema(exclude=True),
 )
-class ProviderGroupViewSet(ProviderVisibilityMixin, BaseRLSViewSet):
+class ProviderGroupViewSet(BaseRLSViewSet):
    queryset = ProviderGroup.objects.all()
    serializer_class = ProviderGroupSerializer
    filterset_class = ProviderGroupFilter
@@ -1714,13 +1653,14 @@ class ProviderGroupViewSet(ProviderVisibilityMixin, BaseRLSViewSet):
            self.required_permissions = [Permissions.MANAGE_PROVIDERS]

    def get_queryset(self):
-        if self.user_role.unlimited_visibility:
-            queryset = ProviderGroup.objects.filter(tenant_id=self.request.tenant_id)
-        else:
-            queryset = self.user_role.provider_groups.filter(
-                tenant_id=self.request.tenant_id
-            )
-        return queryset.prefetch_related("providers", "roles")
+        user_roles = get_role(self.request.user, self.request.tenant_id)
+        # Check if any of the user's roles have UNLIMITED_VISIBILITY
+        if user_roles.unlimited_visibility:
+            # User has unlimited visibility, return all provider groups
+            return ProviderGroup.objects.prefetch_related("providers", "roles")
+
+        # Collect provider groups associated with the user's roles
+        return user_roles.provider_groups.all().prefetch_related("providers", "roles")

    def get_serializer_class(self):
        if self.action == "create":
@@ -1761,9 +1701,7 @@ class ProviderGroupViewSet(ProviderVisibilityMixin, BaseRLSViewSet):
        },
    ),
 )
-class ProviderGroupProvidersRelationshipView(
-    ProviderVisibilityMixin, RelationshipView, BaseRLSViewSet
-):
+class ProviderGroupProvidersRelationshipView(RelationshipView, BaseRLSViewSet):
    queryset = ProviderGroup.objects.all()
    serializer_class = ProviderGroupMembershipSerializer
    resource_name = "providers"
@@ -1773,9 +1711,7 @@ class ProviderGroupProvidersRelationshipView(
    required_permissions = [Permissions.MANAGE_PROVIDERS]

    def get_queryset(self):
-        if self.user_role.unlimited_visibility:
-            return ProviderGroup.objects.filter(tenant_id=self.request.tenant_id)
-        return self.user_role.provider_groups.filter(tenant_id=self.request.tenant_id)
+        return ProviderGroup.objects.filter(tenant_id=self.request.tenant_id)

    def create(self, request, *args, **kwargs):
        provider_group = self.get_object()
@@ -1797,7 +1733,6 @@ class ProviderGroupProvidersRelationshipView(
            data={"providers": request.data},
            context={
                "provider_group": provider_group,
-                "provider_queryset": self.get_provider_queryset(),
                "tenant_id": self.request.tenant_id,
                "request": request,
            },
@@ -1812,11 +1747,7 @@ class ProviderGroupProvidersRelationshipView(
        serializer = self.get_serializer(
            instance=provider_group,
            data={"providers": request.data},
-            context={
-                "provider_queryset": self.get_provider_queryset(),
-                "tenant_id": self.request.tenant_id,
-                "request": request,
-            },
+            context={"tenant_id": self.request.tenant_id, "request": request},
        )
        serializer.is_valid(raise_exception=True)
        serializer.save()
@@ -1933,7 +1864,7 @@ class ProviderViewSet(DisablePaginationMixin, BaseRLSViewSet):
    )
    @action(detail=True, methods=["post"], url_name="connection")
    def connection(self, request, pk=None):
-        self.get_object()
+        get_object_or_404(Provider, pk=pk)
        with transaction.atomic():
            task = check_provider_connection_task.delay(
                provider_id=pk, tenant_id=self.request.tenant_id
@@ -1951,7 +1882,7 @@ class ProviderViewSet(DisablePaginationMixin, BaseRLSViewSet):
        )

    def destroy(self, request, *args, pk=None, **kwargs):
-        provider = self.get_object()
+        provider = get_object_or_404(Provider, pk=pk)
        provider.is_deleted = True
        provider.save()
        task_name = f"scan-perform-scheduled-{pk}"
@@ -2173,7 +2104,7 @@ class ProviderViewSet(DisablePaginationMixin, BaseRLSViewSet):
 )
@method_decorator(CACHE_DECORATOR, name="list")
@method_decorator(CACHE_DECORATOR, name="retrieve")
-class ScanViewSet(ProviderVisibilityMixin, BaseRLSViewSet):
+class ScanViewSet(BaseRLSViewSet):
    queryset = Scan.objects.all()
    serializer_class = ScanSerializer
    http_method_names = ["get", "post", "patch"]
@@ -2202,7 +2133,13 @@ class ScanViewSet(ProviderVisibilityMixin, BaseRLSViewSet):
            self.required_permissions = [Permissions.MANAGE_SCANS]

    def get_queryset(self):
-        queryset = Scan.objects.filter(provider__in=self.get_provider_queryset())
+        user_roles = get_role(self.request.user, self.request.tenant_id)
+        if user_roles.unlimited_visibility:
+            # User has unlimited visibility, return all scans
+            queryset = Scan.objects.filter(tenant_id=self.request.tenant_id)
+        else:
+            # User lacks permission, filter providers based on provider groups associated with the role
+            queryset = Scan.objects.filter(provider__in=get_providers(user_roles))
        return queryset.select_related("provider", "task")

    def get_serializer_class(self):
@@ -2800,7 +2737,6 @@ class ScanViewSet(ProviderVisibilityMixin, BaseRLSViewSet):
                provider = Provider.objects.select_for_update().get(
                    id=provider.id,
                    tenant_id=self.request.tenant_id,
-                    id__in=self.get_provider_queryset().values("id"),
                )
                active_scan = get_active_provider_scan(
                    self.request.tenant_id, provider.id
@@ -4375,7 +4311,7 @@ class FindingViewSet(PaginateByPkMixin, BaseRLSViewSet):
 )
@method_decorator(CACHE_DECORATOR, name="list")
@method_decorator(CACHE_DECORATOR, name="retrieve")
-class ProviderSecretViewSet(ProviderVisibilityMixin, BaseRLSViewSet):
+class ProviderSecretViewSet(BaseRLSViewSet):
    queryset = ProviderSecret.objects.all()
    serializer_class = ProviderSecretSerializer
    filterset_class = ProviderSecretFilter
@@ -4391,7 +4327,7 @@ class ProviderSecretViewSet(ProviderVisibilityMixin, BaseRLSViewSet):
    required_permissions = [Permissions.MANAGE_PROVIDERS]

    def get_queryset(self):
-        return ProviderSecret.objects.filter(provider__in=self.get_provider_queryset())
+        return ProviderSecret.objects.filter(tenant_id=self.request.tenant_id)

    def get_serializer_class(self):
        if self.action == "create":
@@ -6672,7 +6608,7 @@ class OverviewViewSet(ProviderFilterParamsMixin, BaseRLSViewSet):
        responses={202: OpenApiResponse(response=TaskSerializer)},
    )
 )
-class ScheduleViewSet(ProviderVisibilityMixin, BaseRLSViewSet):
+class ScheduleViewSet(BaseRLSViewSet):
    # TODO: change to Schedule when implemented
    queryset = Task.objects.none()
    http_method_names = ["post"]
@@ -6699,9 +6635,7 @@ class ScheduleViewSet(ProviderVisibilityMixin, BaseRLSViewSet):
        serializer.is_valid(raise_exception=True)
        provider_id = serializer.validated_data["provider_id"]

-        provider_instance = get_object_or_404(
-            self.get_provider_queryset(), pk=provider_id
-        )
+        provider_instance = get_object_or_404(Provider, pk=provider_id)
        with transaction.atomic():
            task = schedule_provider_scan(provider_instance)

@@ -70,7 +70,6 @@ API_JSON_CONTENT_TYPE = "application/vnd.api+json"
 NO_TENANT_HTTP_STATUS = status.HTTP_401_UNAUTHORIZED
 TEST_USER = "dev@prowler.com"
 TEST_PASSWORD = "testing_psswd"
-TEST_ADMIN_ALIAS = "admin"
 TEST_REPLICA_ALIAS = "test_replica"


@@ -1450,26 +1449,6 @@ def integrations_fixture(aws_provider_pair):
    return integration1, integration2


-@pytest.fixture
-def jira_integration_fixture(tenants_fixture):
-    # Jira is a tenant-wide integration: it is not attached to any provider, and its
-    # `domain` is read from the credentials when the integration is serialized
-    tenant_id = tenants_fixture[0].id
-    with rls_transaction(str(tenant_id)):
-        return Integration.objects.create(
-            tenant_id=tenant_id,
-            enabled=True,
-            connected=True,
-            integration_type=Integration.IntegrationChoices.JIRA,
-            configuration={"projects": {"TEST": "Test project"}},
-            credentials={
-                "domain": "test",
-                "user_mail": "a@b.com",
-                "api_token": "token",
-            },
-        )
-
-
@pytest.fixture
 def backfill_scan_metadata_fixture(scans_fixture, findings_fixture):
    for scan_instance in scans_fixture:
@@ -2560,36 +2539,26 @@ def finding_groups_title_variants_fixture(
    return findings


-def _ensure_mirrored_test_alias(alias: str) -> None:
-    default_database = settings.DATABASES["default"]
-    if alias not in settings.DATABASES:
-        settings.DATABASES[alias] = {
-            **default_database,
-            "TEST": {
-                **default_database.get("TEST", {}),
-                "MIRROR": "default",
-            },
-        }
-    django_connections.databases[alias] = settings.DATABASES[alias]
-
-
 def pytest_collection_modifyitems(items):
    """Ensure test_rbac.py is executed first."""
    items.sort(key=lambda item: 0 if "test_rbac.py" in item.nodeid else 1)

-    if any(item.get_closest_marker("requires_test_admin_alias") for item in items):
-        _ensure_mirrored_test_alias(TEST_ADMIN_ALIAS)
-
    if any(item.get_closest_marker("requires_test_replica_alias") for item in items):
-        _ensure_mirrored_test_alias(TEST_REPLICA_ALIAS)
+        default_database = settings.DATABASES["default"]
+        if TEST_REPLICA_ALIAS not in settings.DATABASES:
+            settings.DATABASES[TEST_REPLICA_ALIAS] = {
+                **default_database,
+                "TEST": {
+                    **default_database.get("TEST", {}),
+                    "MIRROR": "default",
+                },
+            }
+        django_connections.databases[TEST_REPLICA_ALIAS] = settings.DATABASES[
+            TEST_REPLICA_ALIAS
+        ]


 def pytest_configure(config):
-    config.addinivalue_line(
-        "markers",
-        "requires_test_admin_alias: creates a test-only admin alias mirrored "
-        "to default",
-    )
    config.addinivalue_line(
        "markers",
        "requires_test_replica_alias: creates a test-only replica alias mirrored "
@@ -1,6 +1,5 @@
 import os
 import time
-from datetime import UTC, datetime
 from glob import glob

 from api.db_router import READ_REPLICA_ALIAS, MainRouter
@@ -215,10 +214,8 @@ def get_security_hub_client_from_integration(
        for region in set(all_security_hub_regions):
            regions_status[region] = region in connection.enabled_regions

-        # Persist the successful connection check and regions information
+        # Save regions information in the integration configuration
        with rls_transaction(tenant_id, using=MainRouter.default_db):
-            integration.connected = True
-            integration.connection_last_checked_at = datetime.now(tz=UTC)
            integration.configuration["regions"] = regions_status
            integration.save()

@@ -18,11 +18,12 @@ This is the shared engine behind both the periodic Beat watchdog and the
 `reconcile_orphan_tasks` management command.
 """

+import ast
+import json
 from contextlib import contextmanager
 from datetime import UTC, datetime, timedelta
 from uuid import uuid4

-from api.celery_utils import decode_celery_field
 from celery import current_app, states
 from celery.utils.log import get_task_logger
 from django.db import connections
@@ -137,6 +138,34 @@ def revoke_task(task_result, terminate: bool = True) -> None:
        logger.exception(f"Failed to revoke task {task_result.task_id}")


+def _decode_celery_field(value, default):
+    """Decode django-celery-results' stored task_args/task_kwargs to a Python object.
+
+    The backend stores them as a (sometimes double-encoded) repr/JSON string. An
+    empty or missing field returns ``default``; a non-empty value that cannot be
+    decoded raises ``ValueError`` so the caller can avoid re-enqueuing a task with
+    the wrong arguments.
+    """
+    obj = value
+    for _ in range(2):  # values can be double-encoded (a string holding a repr)
+        if not isinstance(obj, str):
+            break
+        text = obj.strip()
+        if not text:
+            return default
+        parsed = None
+        for parser in (ast.literal_eval, json.loads):
+            try:
+                parsed = parser(text)
+                break
+            except (ValueError, SyntaxError, TypeError):
+                continue
+        if parsed is None:
+            raise ValueError(f"undecodable celery field: {text[:120]!r}")
+        obj = parsed
+    return default if obj is None else obj
+
+
 def reconcile_orphans(
    grace_minutes: int = 2,
    max_attempts: int = 3,
@@ -284,10 +313,8 @@ def _recover_task(task_result, max_attempts: int, window_hours: int) -> str:
        return "failed"

    try:
-        args = decode_celery_field(args_repr, [])
-        kwargs = decode_celery_field(kwargs_repr, {})
-        if not isinstance(args, (list, tuple)) or not isinstance(kwargs, dict):
-            raise ValueError("Stored task arguments have invalid types")
+        args = _decode_celery_field(args_repr, [])
+        kwargs = _decode_celery_field(kwargs_repr, {})
    except ValueError:
        logger.error(
            "Orphan %s (%s): could not decode stored args/kwargs, not re-enqueuing",
@@ -297,8 +324,8 @@ def _recover_task(task_result, max_attempts: int, window_hours: int) -> str:
        return "failed"
    new_task_id = str(uuid4())
    task_obj.apply_async(
-        args=list(args),
-        kwargs=kwargs,
+        args=list(args) if isinstance(args, (list, tuple)) else [],
+        kwargs=kwargs if isinstance(kwargs, dict) else {},
        task_id=new_task_id,
    )
    logger.info(
@@ -1,4 +1,3 @@
-from datetime import UTC, datetime
 from unittest.mock import MagicMock, patch

 import pytest
@@ -672,8 +671,6 @@ class TestSecurityHubIntegrationUploads:
        mock_integration = MagicMock()
        mock_integration.configuration = {"send_only_fails": True}
        mock_integration.credentials = {}  # Empty credentials, use provider
-        mock_integration.connected = False
-        mock_integration.connection_last_checked_at = None

        # Mock tenant_id
        tenant_id = "550e8400-e29b-41d4-a716-446655440000"  # Valid UUID
@@ -726,22 +723,12 @@ class TestSecurityHubIntegrationUploads:
            # Configure the test_connection to return our mock_connection
            mock_security_hub_class.test_connection = mock_test_connection

-            checked_at_before = datetime.now(tz=UTC)
            connected, security_hub = get_security_hub_client_from_integration(
                mock_integration, tenant_id, mock_findings
            )
-            checked_at_after = datetime.now(tz=UTC)

        assert connected is True
        assert security_hub == mock_security_hub
-        assert mock_integration.connected is True
-        assert mock_integration.connection_last_checked_at.tzinfo is UTC
-        assert (
-            checked_at_before
-            <= mock_integration.connection_last_checked_at
-            <= checked_at_after
-        )
-        mock_integration.save.assert_called_once()

        # Verify SecurityHub was called once to create the client
        assert mock_security_hub_class.call_count == 1
@@ -3,13 +3,12 @@ from unittest.mock import MagicMock, patch
 from uuid import uuid4

 import pytest
-from api.celery_utils import decode_celery_field
 from celery import states
-from celery.utils.saferepr import saferepr
 from django.test import override_settings
 from django_celery_results.models import TaskResult
 from tasks.jobs.orphan_recovery import (
    _SKIP_RECOVERY,
+    _decode_celery_field,
    _reconcile_task_results,
    _recovery_attempt_count,
    advisory_lock,
@@ -37,77 +36,24 @@ def _orphan_result(*, name, kwargs, worker, created_minutes_ago, status=states.S
    return tr


+@pytest.mark.django_db
 class TestDecodeCeleryField:
-    def test_decodes_strict_json(self):
-        assert decode_celery_field('{"enabled": true, "scan_id": null}', {}) == {
-            "enabled": True,
-            "scan_id": None,
-        }
-
    def test_decodes_single_encoded_repr(self):
-        assert decode_celery_field("{'tenant_id': 'abc'}", {}) == {"tenant_id": "abc"}
+        assert _decode_celery_field("{'tenant_id': 'abc'}", {}) == {"tenant_id": "abc"}

    def test_decodes_double_encoded(self):
        import json

        stored = json.dumps(repr({"tenant_id": "abc", "scan_id": "s1"}))
-        assert decode_celery_field(stored, {}) == {
-            "tenant_id": "abc",
-            "scan_id": "s1",
-        }
-
-    def test_python_words_inside_strings_are_preserved(self):
-        stored = repr(
-            {
-                "enabled": True,
-                "scan_id": None,
-                "label": "True North",
-                "note": "None",
-            }
-        )
-
-        assert decode_celery_field(stored, {}) == {
-            "enabled": True,
-            "scan_id": None,
-            "label": "True North",
-            "note": "None",
-        }
+        assert _decode_celery_field(stored, {}) == {"tenant_id": "abc", "scan_id": "s1"}

    def test_empty_returns_default(self):
-        assert decode_celery_field(None, {}) == {}
-        assert decode_celery_field("", []) == []
-        assert decode_celery_field("null", {}) == {}
-        assert decode_celery_field("None", []) == []
-
-    def test_empty_validates_default(self):
-        with pytest.raises(ValueError):
-            decode_celery_field("", {"value": ...})
+        assert _decode_celery_field(None, {}) == {}
+        assert _decode_celery_field("", []) == []

    def test_unparseable_raises(self):
        with pytest.raises(ValueError):
-            decode_celery_field("<<not a literal>>", {})
-
-    @pytest.mark.parametrize(
-        "value",
-        (
-            "{'value': ...}",
-            "{'value': {1, 2}}",
-            "{'value': b'bytes'}",
-            '{"value": NaN}',
-        ),
-    )
-    def test_non_json_values_raise(self, value):
-        with pytest.raises(ValueError):
-            decode_celery_field(value, {})
-
-    def test_truncated_repr_raises(self):
-        kwargs_repr = saferepr(
-            {"finding_ids": [str(uuid4()) for _ in range(30)]}, maxlen=1024
-        )
-        assert "..." in kwargs_repr
-
-        with pytest.raises(ValueError):
-            decode_celery_field(kwargs_repr, {})
+            _decode_celery_field("<<not a literal>>", {})


@pytest.mark.django_db
@@ -152,58 +98,6 @@ class TestReconcileTaskResults:
        assert call["kwargs"] == {"tenant_id": str(tenant.id)}
        assert call["task_id"] != tr.task_id  # fresh task id

-    def test_truncated_kwargs_are_not_reenqueued(self, tenants_fixture):
-        tenant = tenants_fixture[0]
-        tr = _orphan_result(
-            name="tenant-deletion",
-            kwargs={"tenant_id": str(tenant.id)},
-            worker="dead@gone",
-            created_minutes_ago=60,
-        )
-        tr.task_kwargs = saferepr(
-            {"finding_ids": [str(uuid4()) for _ in range(30)]}, maxlen=1024
-        )
-        assert "..." in tr.task_kwargs
-        tr.save(update_fields=["task_kwargs"])
-        p_alive, p_revoke, p_app, mock_task = self._patches(alive=False)
-
-        with (
-            p_alive,
-            p_revoke,
-            p_app,
-            patch("tasks.jobs.orphan_recovery._recovery_attempt_count", return_value=1),
-        ):
-            result = _reconcile_task_results(
-                grace_minutes=2, max_attempts=3, window_hours=6, dry_run=False
-            )
-
-        assert tr.task_id in result["failed"]
-        mock_task.apply_async.assert_not_called()
-
-    def test_wrong_kwargs_shape_is_not_reenqueued(self, tenants_fixture):
-        tr = _orphan_result(
-            name="tenant-deletion",
-            kwargs={"tenant_id": str(tenants_fixture[0].id)},
-            worker="dead@gone",
-            created_minutes_ago=60,
-        )
-        tr.task_kwargs = "[]"
-        tr.save(update_fields=["task_kwargs"])
-        p_alive, p_revoke, p_app, mock_task = self._patches(alive=False)
-
-        with (
-            p_alive,
-            p_revoke,
-            p_app,
-            patch("tasks.jobs.orphan_recovery._recovery_attempt_count", return_value=1),
-        ):
-            result = _reconcile_task_results(
-                grace_minutes=2, max_attempts=3, window_hours=6, dry_run=False
-            )
-
-        assert tr.task_id in result["failed"]
-        mock_task.apply_async.assert_not_called()
-
    def test_external_integration_task_is_not_reenqueued_by_default(
        self, tenants_fixture
    ):
@@ -45,7 +45,7 @@ constraints = [
    { name = "alibabacloud-sls20201230", specifier = "==5.9.0" },
    { name = "alibabacloud-sts20150401", specifier = "==1.1.6" },
    { name = "alibabacloud-tea", specifier = "==0.4.3" },
-    { name = "alibabacloud-tea-openapi", specifier = "==0.4.5" },
+    { name = "alibabacloud-tea-openapi", specifier = "==0.4.4" },
    { name = "alibabacloud-tea-util", specifier = "==0.3.14" },
    { name = "alibabacloud-tea-xml", specifier = "==0.0.3" },
    { name = "alibabacloud-vpc20160428", specifier = "==6.13.0" },
@@ -127,9 +127,9 @@ constraints = [
    { name = "coverage", specifier = "==7.5.4" },
    { name = "cron-descriptor", specifier = "==1.4.5" },
    { name = "crowdstrike-falconpy", specifier = "==1.6.0" },
-    { name = "cryptography", specifier = "==48.0.1" },
+    { name = "cryptography", specifier = "==46.0.7" },
    { name = "cycler", specifier = "==0.12.1" },
-    { name = "darabonba-core", specifier = "==1.0.8" },
+    { name = "darabonba-core", specifier = "==1.0.5" },
    { name = "dash", specifier = "==3.1.1" },
    { name = "dash-bootstrap-components", specifier = "==2.0.3" },
    { name = "debugpy", specifier = "==1.8.20" },
@@ -194,7 +194,7 @@ constraints = [
    { name = "h2", specifier = "==4.3.0" },
    { name = "hpack", specifier = "==4.1.0" },
    { name = "httpcore", specifier = "==1.0.9" },
-    { name = "httplib2", specifier = "==0.32.0" },
+    { name = "httplib2", specifier = "==0.31.2" },
    { name = "httpx", specifier = "==0.28.1" },
    { name = "humanfriendly", specifier = "==10.0" },
    { name = "hyperframe", specifier = "==6.1.0" },
@@ -231,13 +231,13 @@ constraints = [
    { name = "matplotlib", specifier = "==3.10.8" },
    { name = "mccabe", specifier = "==0.7.0" },
    { name = "mdurl", specifier = "==0.1.2" },
-    { name = "microsoft-kiota-abstractions", specifier = "==1.9.10" },
-    { name = "microsoft-kiota-authentication-azure", specifier = "==1.9.10" },
-    { name = "microsoft-kiota-http", specifier = "==1.9.10" },
-    { name = "microsoft-kiota-serialization-form", specifier = "==1.9.10" },
-    { name = "microsoft-kiota-serialization-json", specifier = "==1.9.10" },
-    { name = "microsoft-kiota-serialization-multipart", specifier = "==1.9.10" },
-    { name = "microsoft-kiota-serialization-text", specifier = "==1.9.10" },
+    { name = "microsoft-kiota-abstractions", specifier = "==1.9.9" },
+    { name = "microsoft-kiota-authentication-azure", specifier = "==1.9.9" },
+    { name = "microsoft-kiota-http", specifier = "==1.9.9" },
+    { name = "microsoft-kiota-serialization-form", specifier = "==1.9.9" },
+    { name = "microsoft-kiota-serialization-json", specifier = "==1.9.9" },
+    { name = "microsoft-kiota-serialization-multipart", specifier = "==1.9.9" },
+    { name = "microsoft-kiota-serialization-text", specifier = "==1.9.9" },
    { name = "microsoft-security-utilities-secret-masker", specifier = "==1.0.0b4" },
    { name = "msal", specifier = "==1.35.0b1" },
    { name = "msal-extensions", specifier = "==1.2.0" },
@@ -254,7 +254,7 @@ constraints = [
    { name = "nltk", specifier = "==3.9.4" },
    { name = "numpy", specifier = "==2.2.6" },
    { name = "oauthlib", specifier = "==3.3.1" },
-    { name = "oci", specifier = "==2.183.0" },
+    { name = "oci", specifier = "==2.169.0" },
    { name = "openai", specifier = "==1.109.1" },
    { name = "openstacksdk", specifier = "==4.2.0" },
    { name = "opentelemetry-api", specifier = "==1.39.1" },
@@ -266,7 +266,7 @@ constraints = [
    { name = "pagerduty", specifier = "==6.1.0" },
    { name = "pandas", specifier = "==2.2.3" },
    { name = "pbr", specifier = "==7.0.3" },
-    { name = "pillow", specifier = "==12.3.0" },
+    { name = "pillow", specifier = "==12.2.0" },
    { name = "pkginfo", specifier = "==1.12.1.2" },
    { name = "platformdirs", specifier = "==4.5.1" },
    { name = "plotly", specifier = "==6.5.2" },
@@ -282,8 +282,8 @@ constraints = [
    { name = "psycopg2-binary", specifier = "==2.9.9" },
    { name = "py-deviceid", specifier = "==0.1.1" },
    { name = "py-iam-expand", specifier = "==0.3.0" },
-    { name = "py-ocsf-models", specifier = "==0.10.0" },
-    { name = "pyasn1", specifier = "==0.6.4" },
+    { name = "py-ocsf-models", specifier = "==0.8.1" },
+    { name = "pyasn1", specifier = "==0.6.3" },
    { name = "pyasn1-modules", specifier = "==0.4.2" },
    { name = "pycodestyle", specifier = "==2.14.0" },
    { name = "pycparser", specifier = "==3.0" },
@@ -295,7 +295,7 @@ constraints = [
    { name = "pylint", specifier = "==3.2.5" },
    { name = "pymsalruntime", specifier = "==0.18.1" },
    { name = "pynacl", specifier = "==1.6.2" },
-    { name = "pyopenssl", specifier = "==26.2.0" },
+    { name = "pyopenssl", specifier = "==26.0.0" },
    { name = "pyparsing", specifier = "==3.3.2" },
    { name = "pyreadline3", specifier = "==3.5.4" },
    { name = "pysocks", specifier = "==1.7.1" },
@@ -364,7 +364,7 @@ constraints = [
    { name = "wcwidth", specifier = "==0.5.3" },
    { name = "websocket-client", specifier = "==1.9.0" },
    { name = "werkzeug", specifier = "==3.1.7" },
-    { name = "workos", specifier = "==8.3.0" },
+    { name = "workos", specifier = "==6.0.8" },
    { name = "wrapt", specifier = "==1.17.3" },
    { name = "xlsxwriter", specifier = "==3.2.9" },
    { name = "xmlsec", specifier = "==1.3.17" },
@@ -378,13 +378,7 @@ constraints = [
 overrides = [
    { name = "azure-mgmt-containerservice", specifier = "==34.1.0" },
    { name = "dulwich", specifier = "==1.2.5" },
-    { name = "microsoft-kiota-abstractions", specifier = "==1.9.10" },
-    { name = "microsoft-kiota-authentication-azure", specifier = "==1.9.10" },
-    { name = "microsoft-kiota-http", specifier = "==1.9.10" },
-    { name = "microsoft-kiota-serialization-form", specifier = "==1.9.10" },
-    { name = "microsoft-kiota-serialization-json", specifier = "==1.9.10" },
-    { name = "microsoft-kiota-serialization-multipart", specifier = "==1.9.10" },
-    { name = "microsoft-kiota-serialization-text", specifier = "==1.9.10" },
+    { name = "microsoft-kiota-abstractions", specifier = "==1.9.9" },
    { name = "okta", specifier = "==3.4.2" },
    { name = "pyjwt", extras = ["crypto"], specifier = "==2.13.0" },
 ]
@@ -859,7 +853,7 @@ sdist = { url = "https://files.pythonhosted.org/packages/9a/7d/b22cb9a0d4f396ee0

 [[package]]
 name = "alibabacloud-tea-openapi"
-version = "0.4.5"
+version = "0.4.4"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
    { name = "alibabacloud-credentials" },
@@ -868,9 +862,9 @@ dependencies = [
    { name = "cryptography" },
    { name = "darabonba-core" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/3b/73/fb0c4d44759791ecdf269fc715c1e810fa1aba3981bfaaf8a01f61899296/alibabacloud_tea_openapi-0.4.5.tar.gz", hash = "sha256:75fa1f4360a46e41f5bf5f8d4917e52efb6f64885839bc1328c35590670c97b9", size = 26616, upload-time = "2026-07-14T13:15:39.364Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/30/93/138bcdc8fc596add73e37cf2073798f285284d1240bda9ee02f9384fc6be/alibabacloud_tea_openapi-0.4.4.tar.gz", hash = "sha256:1b0917bc03cd49417da64945e92731716d53e2eb8707b235f54e45b7473221ce", size = 21960, upload-time = "2026-03-26T10:16:16.792Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/8d/ec/6b368a10e9c2e8b1b394c69b96ac213ae66e8c4895e0baa1ffaf7178fd32/alibabacloud_tea_openapi-0.4.5-py3-none-any.whl", hash = "sha256:338979095c7beda80a5b413c31262892cafdc12069dde4ce4fc2e4f7ce0fc609", size = 33333, upload-time = "2026-07-14T13:15:38.365Z" },
+    { url = "https://files.pythonhosted.org/packages/f5/5a/6bfc4506438c1809c486f66217ad11eab78157192b3d5707b4e2f4212f6c/alibabacloud_tea_openapi-0.4.4-py3-none-any.whl", hash = "sha256:cea6bc1fe35b0319a8752cb99eb0ecb0dab7ca1a71b99c12970ba0867410995f", size = 26236, upload-time = "2026-03-26T10:16:15.861Z" },
 ]

 [[package]]
@@ -2094,37 +2088,6 @@ toml = [
    { name = "tomli", marker = "python_full_version <= '3.11'" },
 ]

-[[package]]
-name = "crc32c"
-version = "2.8"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/e3/66/7e97aa77af7cf6afbff26e3651b564fe41932599bc2d3dce0b2f73d4829a/crc32c-2.8.tar.gz", hash = "sha256:578728964e59c47c356aeeedee6220e021e124b9d3e8631d95d9a5e5f06e261c", size = 48179, upload-time = "2025-10-17T06:20:13.61Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/dc/0b/5e03b22d913698e9cc563f39b9f6bbd508606bf6b8e9122cd6bf196b87ea/crc32c-2.8-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:e560a97fbb96c9897cb1d9b5076ef12fc12e2e25622530a1afd0de4240f17e1f", size = 66329, upload-time = "2025-10-17T06:19:01.771Z" },
-    { url = "https://files.pythonhosted.org/packages/6b/38/2fe0051ffe8c6a650c8b1ac0da31b8802d1dbe5fa40a84e4b6b6f5583db5/crc32c-2.8-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:6762d276d90331a490ef7e71ffee53b9c0eb053bd75a272d786f3b08d3fe3671", size = 62988, upload-time = "2025-10-17T06:19:02.953Z" },
-    { url = "https://files.pythonhosted.org/packages/3e/30/5837a71c014be83aba1469c58820d287fc836512a0cad6b8fdd43868accd/crc32c-2.8-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:60670569f5ede91e39f48fb0cb4060e05b8d8704dd9e17ede930bf441b2f73ef", size = 61522, upload-time = "2025-10-17T06:19:03.796Z" },
-    { url = "https://files.pythonhosted.org/packages/ca/29/63972fc1452778e2092ae998c50cbfc2fc93e3fa9798a0278650cd6169c5/crc32c-2.8-cp311-cp311-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:711743da6ccc70b3c6718c328947b0b6f34a1fe6a6c27cc6c1d69cc226bf70e9", size = 80200, upload-time = "2025-10-17T06:19:04.617Z" },
-    { url = "https://files.pythonhosted.org/packages/cb/3a/60eb49d7bdada4122b3ffd45b0df54bdc1b8dd092cda4b069a287bdfcff4/crc32c-2.8-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:5eb4094a2054774f13b26f21bf56792bb44fa1fcee6c6ad099387a43ffbfb4fa", size = 81757, upload-time = "2025-10-17T06:19:05.496Z" },
-    { url = "https://files.pythonhosted.org/packages/f5/63/6efc1b64429ef7d23bd58b75b7ac24d15df327e3ebbe9c247a0f7b1c2ed1/crc32c-2.8-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:fff15bf2bd3e95780516baae935ed12be88deaa5ebe6143c53eb0d26a7bdc7b7", size = 80830, upload-time = "2025-10-17T06:19:06.621Z" },
-    { url = "https://files.pythonhosted.org/packages/e1/eb/0ae9f436f8004f1c88f7429e659a7218a3879bd11a6b18ed1257aad7e98b/crc32c-2.8-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:4c0e11e3826668121fa53e0745635baf5e4f0ded437e8ff63ea56f38fc4f970a", size = 80095, upload-time = "2025-10-17T06:19:07.381Z" },
-    { url = "https://files.pythonhosted.org/packages/9e/81/4afc9d468977a4cd94a2eb62908553345009a7c0d30e74463a15d4b48ec3/crc32c-2.8-cp311-cp311-win32.whl", hash = "sha256:38f915336715d1f1353ab07d7d786f8a789b119e273aea106ba55355dfc9101d", size = 64886, upload-time = "2025-10-17T06:19:08.497Z" },
-    { url = "https://files.pythonhosted.org/packages/d6/e8/94e839c9f7e767bf8479046a207afd440a08f5c59b52586e1af5e64fa4a0/crc32c-2.8-cp311-cp311-win_amd64.whl", hash = "sha256:60e0a765b1caab8d31b2ea80840639253906a9351d4b861551c8c8625ea20f86", size = 66639, upload-time = "2025-10-17T06:19:09.338Z" },
-    { url = "https://files.pythonhosted.org/packages/b6/36/fd18ef23c42926b79c7003e16cb0f79043b5b179c633521343d3b499e996/crc32c-2.8-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:572ffb1b78cce3d88e8d4143e154d31044a44be42cb3f6fbbf77f1e7a941c5ab", size = 66379, upload-time = "2025-10-17T06:19:10.115Z" },
-    { url = "https://files.pythonhosted.org/packages/7f/b8/c584958e53f7798dd358f5bdb1bbfc97483134f053ee399d3eeb26cca075/crc32c-2.8-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:cf827b3758ee0c4aacd21ceca0e2da83681f10295c38a10bfeb105f7d98f7a68", size = 63042, upload-time = "2025-10-17T06:19:10.946Z" },
-    { url = "https://files.pythonhosted.org/packages/62/e6/6f2af0ec64a668a46c861e5bc778ea3ee42171fedfc5440f791f470fd783/crc32c-2.8-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:106fbd79013e06fa92bc3b51031694fcc1249811ed4364ef1554ee3dd2c7f5a2", size = 61528, upload-time = "2025-10-17T06:19:11.768Z" },
-    { url = "https://files.pythonhosted.org/packages/17/8b/4a04bd80a024f1a23978f19ae99407783e06549e361ab56e9c08bba3c1d3/crc32c-2.8-cp312-cp312-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:6dde035f91ffbfe23163e68605ee5a4bb8ceebd71ed54bb1fb1d0526cdd125a2", size = 80028, upload-time = "2025-10-17T06:19:12.554Z" },
-    { url = "https://files.pythonhosted.org/packages/21/8f/01c7afdc76ac2007d0e6a98e7300b4470b170480f8188475b597d1f4b4c6/crc32c-2.8-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:e41ebe7c2f0fdcd9f3a3fd206989a36b460b4d3f24816d53e5be6c7dba72c5e1", size = 81531, upload-time = "2025-10-17T06:19:13.406Z" },
-    { url = "https://files.pythonhosted.org/packages/32/2b/8f78c5a8cc66486be5f51b6f038fc347c3ba748d3ea68be17a014283c331/crc32c-2.8-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:ecf66cf90266d9c15cea597d5cc86c01917cd1a238dc3c51420c7886fa750d7e", size = 80608, upload-time = "2025-10-17T06:19:14.223Z" },
-    { url = "https://files.pythonhosted.org/packages/db/86/fad1a94cdeeeb6b6e2323c87f970186e74bfd6fbfbc247bf5c88ad0873d5/crc32c-2.8-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:59eee5f3a69ad0793d5fa9cdc9b9d743b0cd50edf7fccc0a3988a821fef0208c", size = 79886, upload-time = "2025-10-17T06:19:15.345Z" },
-    { url = "https://files.pythonhosted.org/packages/d5/db/1a7cb6757a1e32376fa2dfce00c815ea4ee614a94f9bff8228e37420c183/crc32c-2.8-cp312-cp312-win32.whl", hash = "sha256:a73d03ce3604aa5d7a2698e9057a0eef69f529c46497b27ee1c38158e90ceb76", size = 64896, upload-time = "2025-10-17T06:19:16.457Z" },
-    { url = "https://files.pythonhosted.org/packages/bf/8e/2024de34399b2e401a37dcb54b224b56c747b0dc46de4966886827b4d370/crc32c-2.8-cp312-cp312-win_amd64.whl", hash = "sha256:56b3b7d015247962cf58186e06d18c3d75a1a63d709d3233509e1c50a2d36aa2", size = 66645, upload-time = "2025-10-17T06:19:17.235Z" },
-    { url = "https://files.pythonhosted.org/packages/a7/1d/dd926c68eb8aac8b142a1a10b8eb62d95212c1cf81775644373fe7cceac2/crc32c-2.8-pp311-pypy311_pp73-macosx_10_15_x86_64.whl", hash = "sha256:5833f4071da7ea182c514ba17d1eee8aec3c5be927d798222fbfbbd0f5eea02c", size = 62345, upload-time = "2025-10-17T06:20:09.39Z" },
-    { url = "https://files.pythonhosted.org/packages/51/be/803404e5abea2ef2c15042edca04bbb7f625044cca879e47f186b43887c2/crc32c-2.8-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:1dc4da036126ac07b39dd9d03e93e585ec615a2ad28ff12757aef7de175295a8", size = 61229, upload-time = "2025-10-17T06:20:10.236Z" },
-    { url = "https://files.pythonhosted.org/packages/fc/3a/00cc578cd27ed0b22c9be25cef2c24539d92df9fa80ebd67a3fc5419724c/crc32c-2.8-pp311-pypy311_pp73-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:15905fa78344654e241371c47e6ed2411f9eeb2b8095311c68c88eccf541e8b4", size = 64108, upload-time = "2025-10-17T06:20:11.072Z" },
-    { url = "https://files.pythonhosted.org/packages/6b/bc/0587ef99a1c7629f95dd0c9d4f3d894de383a0df85831eb16c48a6afdae4/crc32c-2.8-pp311-pypy311_pp73-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:c596f918688821f796434e89b431b1698396c38bf0b56de873621528fe3ecb1e", size = 64815, upload-time = "2025-10-17T06:20:11.919Z" },
-    { url = "https://files.pythonhosted.org/packages/73/42/94f2b8b92eae9064fcfb8deef2b971514065bd606231f8857ff8ae02bebd/crc32c-2.8-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:8d23c4fe01b3844cb6e091044bc1cebdef7d16472e058ce12d9fadf10d2614af", size = 66659, upload-time = "2025-10-17T06:20:12.766Z" },
-]
-
 [[package]]
 name = "cron-descriptor"
 version = "1.4.5"
@@ -2149,47 +2112,47 @@ wheels = [

 [[package]]
 name = "cryptography"
-version = "48.0.1"
+version = "46.0.7"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
    { name = "cffi", marker = "platform_python_implementation != 'PyPy'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/12/45/870e7f4bef50e5f53b9f51d4428aee5290eedf58ba443f16b1ebb7ab8e66/cryptography-48.0.1.tar.gz", hash = "sha256:266f4ee051abb2f725b74ef8072b521ce1feacf685a3364fa6a6b45548db791a", size = 832989, upload-time = "2026-06-09T22:32:31.8Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/47/93/ac8f3d5ff04d54bc814e961a43ae5b0b146154c89c61b47bb07557679b18/cryptography-46.0.7.tar.gz", hash = "sha256:e4cfd68c5f3e0bfdad0d38e023239b96a2fe84146481852dffbcca442c245aa5", size = 750652, upload-time = "2026-04-08T01:57:54.692Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/1b/bc/ee4137cbbe105652c0ee4252792b78fc8e7afa4b8e61d9d5dc05a7f45731/cryptography-48.0.1-cp311-abi3-macosx_10_9_universal2.whl", hash = "sha256:3e4a1a3232eef2e6c732827d5722db29a0cc8b27af2a4d865b094cf954be9ca1", size = 8008324, upload-time = "2026-06-09T22:31:00.702Z" },
-    { url = "https://files.pythonhosted.org/packages/d5/85/6379d42181bfc713094f081360fc5784d6c816b599d45e7f082502d173ce/cryptography-48.0.1-cp311-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:32143b24adb918f078134e1e230f1eb8cc04886b92c28b5f0041aaf3e5699225", size = 4696243, upload-time = "2026-06-09T22:32:33.446Z" },
-    { url = "https://files.pythonhosted.org/packages/9c/87/c85d147b53323c7eb4d850920c8901377323c2a0ff8d79c262d4fee89aa2/cryptography-48.0.1-cp311-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:f0d27a5696721ef7a672b8c810f6aded391058e0b9486e63e6d93baf765da691", size = 4713235, upload-time = "2026-06-09T22:31:40.141Z" },
-    { url = "https://files.pythonhosted.org/packages/79/58/67cbf8cf1ee7c54b439ca07bbecf8362c07afc11a3724fea70f745784add/cryptography-48.0.1-cp311-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:eb86ce1af36fe65041b6db9a8bb064ee621a7e5fded0f80d475ec243477cd242", size = 4702323, upload-time = "2026-06-09T22:31:42.191Z" },
-    { url = "https://files.pythonhosted.org/packages/89/c6/24266ac10c47f6cd2a865f4446062b466da1d1f10b27189eac00e61bf0c9/cryptography-48.0.1-cp311-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:b024e784ad6c077ee0147b35ea9cbfc1e34e1fd4c1dcca214c2794d73a12df08", size = 5300085, upload-time = "2026-06-09T22:31:58.703Z" },
-    { url = "https://files.pythonhosted.org/packages/d2/bb/cc4b78784f97efc8c5874c2a9743708d172be6663024b34a0467885ae0c8/cryptography-48.0.1-cp311-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:3752f2dbc8f07a30aad2932c986cea495b03bb554887828225da104f732852b6", size = 4746137, upload-time = "2026-06-09T22:31:31.01Z" },
-    { url = "https://files.pythonhosted.org/packages/1f/52/0c44de3f5267f8fbe8e835138017522a333436166e406f0db9b9e6e3033f/cryptography-48.0.1-cp311-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:bd81490cd5801d755cf97bb68ac191f14b708470b1c7cf4580f669b9c9264cd8", size = 4333867, upload-time = "2026-06-09T22:32:28.096Z" },
-    { url = "https://files.pythonhosted.org/packages/9a/2e/772d7adbfa931537bc401640b7cac9976bff689bda187833e5d63b428e49/cryptography-48.0.1-cp311-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:66fd0771e7b9c6dcd44cf1120690d2338d16d72795cf40cae2786a39eba65429", size = 4701805, upload-time = "2026-06-09T22:31:38.284Z" },
-    { url = "https://files.pythonhosted.org/packages/f8/a3/b06844f303873493c963caf581c04df31c7035e0c1b0f02c4814d319ec80/cryptography-48.0.1-cp311-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:3fd2ca57062b241c856670b073487d2e86c4637937ca5601e48f97bf8e11fc8f", size = 5258461, upload-time = "2026-06-09T22:31:04.187Z" },
-    { url = "https://files.pythonhosted.org/packages/9f/13/8b765e2e12b07c74941caadb9d1c8fdc006c4dfbf2b8f2d610519758954d/cryptography-48.0.1-cp311-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:0ee6ea481db1ab889cba043ec1eda17bb9c1ea79db6722f779c3667f9f70322f", size = 4745488, upload-time = "2026-06-09T22:32:30.07Z" },
-    { url = "https://files.pythonhosted.org/packages/2e/aa/48972bce55049b32a94f4907eda4d75fa385aad8a39506cc2fc72196ecf0/cryptography-48.0.1-cp311-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:f2ceef93cb096aa3c4cc4b5c94ca6131f9196d28c64d6111533402a9b2054d41", size = 4830256, upload-time = "2026-06-09T22:31:43.868Z" },
-    { url = "https://files.pythonhosted.org/packages/47/a2/e5079a032fb85cf6005046ca92bbd78b0c82dad2b5751ab8c311659da06f/cryptography-48.0.1-cp311-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:9bd3f92d76217892b15df84ca256c2c113d386fdda7a7d8691aeeced976507c6", size = 4979117, upload-time = "2026-06-09T22:31:05.845Z" },
-    { url = "https://files.pythonhosted.org/packages/b7/a0/8f50cae9c74e718ed769d63ed5c74bd0ea830c9550a74629cebd1b9c7bc7/cryptography-48.0.1-cp311-abi3-win32.whl", hash = "sha256:b9a32b876490d66c8bcc9963ef220199569748434ab01a9d6aaeabf88e7f5158", size = 3304154, upload-time = "2026-06-09T22:32:16.845Z" },
-    { url = "https://files.pythonhosted.org/packages/c5/69/0572c77dbace6fef72f33755bd52ea399c71367250d366237f8691826b9e/cryptography-48.0.1-cp311-abi3-win_amd64.whl", hash = "sha256:39489bfca54c7a1f6b297efcd8bc608ab92d16c4ca631b0cad4da46724588b24", size = 3817138, upload-time = "2026-06-09T22:32:00.388Z" },
-    { url = "https://files.pythonhosted.org/packages/ca/6c/00fa2a95997164c8b2072ce327c23d4ab20809ccc323ea5fab91e53a4bba/cryptography-48.0.1-cp39-abi3-macosx_10_9_universal2.whl", hash = "sha256:4fdc69f8e4316bcf0c8c8ec1f26f285d12e8142d88d96c876a59a03be3f6ae67", size = 7987408, upload-time = "2026-06-09T22:32:20.777Z" },
-    { url = "https://files.pythonhosted.org/packages/b0/d9/45f309a7e4e5f3f8f121d6d3be9e94024a7726ec598d6e08ae04edb2f04d/cryptography-48.0.1-cp39-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:48fe40804d4caa2288f24e70ca8c64c42dd826da0ad7e4f1b41b2128d679e6c8", size = 4690196, upload-time = "2026-06-09T22:31:54.74Z" },
-    { url = "https://files.pythonhosted.org/packages/5f/9f/a1bc8bcc798811b8527eb374bbccf30a3f3e806829d967118222bf1125eb/cryptography-48.0.1-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:86be3b1b0b6bf09482fb50a979c508d2950ed95f5621ec77f4e385962006b83a", size = 4696782, upload-time = "2026-06-09T22:31:45.615Z" },
-    { url = "https://files.pythonhosted.org/packages/66/c2/81a4fb4e4373c500bb526bc337ac5719dd31dd15b970b84a238168c6aa08/cryptography-48.0.1-cp39-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:4ab0a343c807bbcd90c971cd1ecf072937cd01847a9e002bef88fb47ac6be577", size = 4696618, upload-time = "2026-06-09T22:31:11.564Z" },
-    { url = "https://files.pythonhosted.org/packages/e5/0b/aa68b221dde92d09cb29a024ede17550ee21e77a404e59fc093c82bb51e1/cryptography-48.0.1-cp39-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:9621de99d2da096006b629979efd8ae7eb2d8b822488d0c89ee4000c306c59b1", size = 5289970, upload-time = "2026-06-09T22:31:20.368Z" },
-    { url = "https://files.pythonhosted.org/packages/78/13/fba657f958d2af66ea959a4ba01212632089249d34af1ae48054136344d7/cryptography-48.0.1-cp39-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:88c852a0ae366e262e5a1744b685e6a433dc8788dd2a277e418bf4904203609d", size = 4731873, upload-time = "2026-06-09T22:31:22.253Z" },
-    { url = "https://files.pythonhosted.org/packages/4c/4c/9a964756d24a26b3e34dfcb16f961b89838786e6700b635b0d1e3adff4b6/cryptography-48.0.1-cp39-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:43c5835e2cb98c8733d86f57d6fc879b613f5c3478607281c3e36daffc6dd8a6", size = 4330804, upload-time = "2026-06-09T22:31:36.56Z" },
-    { url = "https://files.pythonhosted.org/packages/4b/0f/a10f3a6eb12950a10e3a874070283aa2dd5875b2bfd15fad8a3e17b3f13e/cryptography-48.0.1-cp39-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:fe0180af5bf9236518a087e35bf2d9a347d5f5f51e63c579d683ddff424e3d46", size = 4696217, upload-time = "2026-06-09T22:31:13.351Z" },
-    { url = "https://files.pythonhosted.org/packages/f3/6f/5cd12f951165ea73ef85266775d97e4c763b2474ccfd816dd69d3a18d6f8/cryptography-48.0.1-cp39-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:b7a2d1a937a738a881737cec135a38bb61470589b17515b9f73f571d0ae10401", size = 5245252, upload-time = "2026-06-09T22:32:02.193Z" },
-    { url = "https://files.pythonhosted.org/packages/68/ab/8aaa12e4516ec4464033ab79b6f3b592bd5a92102467c4ace8a0d970203f/cryptography-48.0.1-cp39-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:b74ca3b8e5ecdd833bf6a002ca41b4793bb27fb8f1c06ffaf2643c9e9140e31b", size = 4731388, upload-time = "2026-06-09T22:32:04.019Z" },
-    { url = "https://files.pythonhosted.org/packages/1b/24/50027ea4dca85ec1f40688f3c24fb32ccacd520583c9592c3cc95628e6fb/cryptography-48.0.1-cp39-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:2c37f2461406063b417837f5f3daab668652acd82423efcd7f0a9f04be972de1", size = 4824186, upload-time = "2026-06-09T22:32:18.707Z" },
-    { url = "https://files.pythonhosted.org/packages/52/41/04cb5eb17085ade6f50cc611fb657df6a0f5885350de8764ece89c050197/cryptography-48.0.1-cp39-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:86fe77abb1bd87afb251d4d02ada7ecf53a32cee9b67d976abb2e45a13297475", size = 4964539, upload-time = "2026-06-09T22:31:18.793Z" },
-    { url = "https://files.pythonhosted.org/packages/36/bf/ed70785c496e89d7e73b7cda2d21f2447fd6d4e821714b8d04ff217fed92/cryptography-48.0.1-cp39-abi3-win32.whl", hash = "sha256:6b2c0c3e6ccf3ade7750f836ef3ee36eea250cc467d45c256895573ac08cc6f1", size = 3282307, upload-time = "2026-06-09T22:30:53.162Z" },
-    { url = "https://files.pythonhosted.org/packages/b3/ff/371ea7d252656ee1eb6d83eeeef3d1d0c6baf1d6497687d081ea03814670/cryptography-48.0.1-cp39-abi3-win_amd64.whl", hash = "sha256:9a49ca6c81417f6a5edb50375a60cccdd70fa0a91a5211829dbea74eba94d2ac", size = 3793408, upload-time = "2026-06-09T22:32:15.191Z" },
-    { url = "https://files.pythonhosted.org/packages/a9/d3/eb4e394e587341fdad09a09101fa76478ead3a78b0ad63e55c22f0d75c02/cryptography-48.0.1-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:08a597acce1ff37f347400087776599e2348a3a8bc53b44120e463cd274efe4a", size = 3951747, upload-time = "2026-06-09T22:31:23.871Z" },
-    { url = "https://files.pythonhosted.org/packages/e0/4a/3f43451b4f858bfceaaaffc649e6e787e8d4fb332a1d443af39ab02cc8f1/cryptography-48.0.1-pp311-pypy311_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:735824ec41b7f74a7c45fb1591349333e4c696cb6c044e5f46356e560143e4cd", size = 4641226, upload-time = "2026-06-09T22:31:02.532Z" },
-    { url = "https://files.pythonhosted.org/packages/73/4e/855584c2c23b09e4ce2d3b9c30e983e679cd60b068c513c6bbdb91e11782/cryptography-48.0.1-pp311-pypy311_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:92a46e1d638daa264ba2971c0b0489c9409787943efae4d60ffda3d091ef832c", size = 4668958, upload-time = "2026-06-09T22:32:06.213Z" },
-    { url = "https://files.pythonhosted.org/packages/42/3b/d35750e41d803d1e516fd6d6011f065424924da7af1748cef4cc9cb3ede1/cryptography-48.0.1-pp311-pypy311_pp73-manylinux_2_34_aarch64.whl", hash = "sha256:7e234ac052af99f2700826a5c29ea99d9c1b1f80341cde62d11c8154dc8e0bd9", size = 4640793, upload-time = "2026-06-09T22:32:26.331Z" },
-    { url = "https://files.pythonhosted.org/packages/ca/aa/cdb7181fe865285e87e96825aaab239400f1de0c3bfba9bd9769b79f1a92/cryptography-48.0.1-pp311-pypy311_pp73-manylinux_2_34_x86_64.whl", hash = "sha256:33842cf0888951cef5bc7ac724ab844a42044c1727b967b7f8997289a0464f92", size = 4668505, upload-time = "2026-06-09T22:31:27.534Z" },
-    { url = "https://files.pythonhosted.org/packages/5d/8c/ce3823c06c2804f194f9e64f0d67fa3f4094a39f2bb1a990cd03603af8fc/cryptography-48.0.1-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:6184ca7b174f28d7c703f1290d4b297217c45355f77a98f67e9b7f14549ac54a", size = 3742204, upload-time = "2026-06-09T22:31:34.773Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/5d/4a8f770695d73be252331e60e526291e3df0c9b27556a90a6b47bccca4c2/cryptography-46.0.7-cp311-abi3-macosx_10_9_universal2.whl", hash = "sha256:ea42cbe97209df307fdc3b155f1b6fa2577c0defa8f1f7d3be7d31d189108ad4", size = 7179869, upload-time = "2026-04-08T01:56:17.157Z" },
+    { url = "https://files.pythonhosted.org/packages/5f/45/6d80dc379b0bbc1f9d1e429f42e4cb9e1d319c7a8201beffd967c516ea01/cryptography-46.0.7-cp311-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:b36a4695e29fe69215d75960b22577197aca3f7a25b9cf9d165dcfe9d80bc325", size = 4275492, upload-time = "2026-04-08T01:56:19.36Z" },
+    { url = "https://files.pythonhosted.org/packages/4a/9a/1765afe9f572e239c3469f2cb429f3ba7b31878c893b246b4b2994ffe2fe/cryptography-46.0.7-cp311-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:5ad9ef796328c5e3c4ceed237a183f5d41d21150f972455a9d926593a1dcb308", size = 4426670, upload-time = "2026-04-08T01:56:21.415Z" },
+    { url = "https://files.pythonhosted.org/packages/8f/3e/af9246aaf23cd4ee060699adab1e47ced3f5f7e7a8ffdd339f817b446462/cryptography-46.0.7-cp311-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:73510b83623e080a2c35c62c15298096e2a5dc8d51c3b4e1740211839d0dea77", size = 4280275, upload-time = "2026-04-08T01:56:23.539Z" },
+    { url = "https://files.pythonhosted.org/packages/0f/54/6bbbfc5efe86f9d71041827b793c24811a017c6ac0fd12883e4caa86b8ed/cryptography-46.0.7-cp311-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:cbd5fb06b62bd0721e1170273d3f4d5a277044c47ca27ee257025146c34cbdd1", size = 4928402, upload-time = "2026-04-08T01:56:25.624Z" },
+    { url = "https://files.pythonhosted.org/packages/2d/cf/054b9d8220f81509939599c8bdbc0c408dbd2bdd41688616a20731371fe0/cryptography-46.0.7-cp311-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:420b1e4109cc95f0e5700eed79908cef9268265c773d3a66f7af1eef53d409ef", size = 4459985, upload-time = "2026-04-08T01:56:27.309Z" },
+    { url = "https://files.pythonhosted.org/packages/f9/46/4e4e9c6040fb01c7467d47217d2f882daddeb8828f7df800cb806d8a2288/cryptography-46.0.7-cp311-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:24402210aa54baae71d99441d15bb5a1919c195398a87b563df84468160a65de", size = 3990652, upload-time = "2026-04-08T01:56:29.095Z" },
+    { url = "https://files.pythonhosted.org/packages/36/5f/313586c3be5a2fbe87e4c9a254207b860155a8e1f3cca99f9910008e7d08/cryptography-46.0.7-cp311-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:8a469028a86f12eb7d2fe97162d0634026d92a21f3ae0ac87ed1c4a447886c83", size = 4279805, upload-time = "2026-04-08T01:56:30.928Z" },
+    { url = "https://files.pythonhosted.org/packages/69/33/60dfc4595f334a2082749673386a4d05e4f0cf4df8248e63b2c3437585f2/cryptography-46.0.7-cp311-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:9694078c5d44c157ef3162e3bf3946510b857df5a3955458381d1c7cfc143ddb", size = 4892883, upload-time = "2026-04-08T01:56:32.614Z" },
+    { url = "https://files.pythonhosted.org/packages/c7/0b/333ddab4270c4f5b972f980adef4faa66951a4aaf646ca067af597f15563/cryptography-46.0.7-cp311-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:42a1e5f98abb6391717978baf9f90dc28a743b7d9be7f0751a6f56a75d14065b", size = 4459756, upload-time = "2026-04-08T01:56:34.306Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/14/633913398b43b75f1234834170947957c6b623d1701ffc7a9600da907e89/cryptography-46.0.7-cp311-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:91bbcb08347344f810cbe49065914fe048949648f6bd5c2519f34619142bbe85", size = 4410244, upload-time = "2026-04-08T01:56:35.977Z" },
+    { url = "https://files.pythonhosted.org/packages/10/f2/19ceb3b3dc14009373432af0c13f46aa08e3ce334ec6eff13492e1812ccd/cryptography-46.0.7-cp311-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:5d1c02a14ceb9148cc7816249f64f623fbfee39e8c03b3650d842ad3f34d637e", size = 4674868, upload-time = "2026-04-08T01:56:38.034Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/bb/a5c213c19ee94b15dfccc48f363738633a493812687f5567addbcbba9f6f/cryptography-46.0.7-cp311-abi3-win32.whl", hash = "sha256:d23c8ca48e44ee015cd0a54aeccdf9f09004eba9fc96f38c911011d9ff1bd457", size = 3026504, upload-time = "2026-04-08T01:56:39.666Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/02/7788f9fefa1d060ca68717c3901ae7fffa21ee087a90b7f23c7a603c32ae/cryptography-46.0.7-cp311-abi3-win_amd64.whl", hash = "sha256:397655da831414d165029da9bc483bed2fe0e75dde6a1523ec2fe63f3c46046b", size = 3488363, upload-time = "2026-04-08T01:56:41.893Z" },
+    { url = "https://files.pythonhosted.org/packages/a7/7f/cd42fc3614386bc0c12f0cb3c4ae1fc2bbca5c9662dfed031514911d513d/cryptography-46.0.7-cp38-abi3-macosx_10_9_universal2.whl", hash = "sha256:462ad5cb1c148a22b2e3bcc5ad52504dff325d17daf5df8d88c17dda1f75f2a4", size = 7165618, upload-time = "2026-04-08T01:57:10.645Z" },
+    { url = "https://files.pythonhosted.org/packages/a5/d0/36a49f0262d2319139d2829f773f1b97ef8aef7f97e6e5bd21455e5a8fb5/cryptography-46.0.7-cp38-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:84d4cced91f0f159a7ddacad249cc077e63195c36aac40b4150e7a57e84fffe7", size = 4270628, upload-time = "2026-04-08T01:57:12.885Z" },
+    { url = "https://files.pythonhosted.org/packages/8a/6c/1a42450f464dda6ffbe578a911f773e54dd48c10f9895a23a7e88b3e7db5/cryptography-46.0.7-cp38-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:128c5edfe5e5938b86b03941e94fac9ee793a94452ad1365c9fc3f4f62216832", size = 4415405, upload-time = "2026-04-08T01:57:14.923Z" },
+    { url = "https://files.pythonhosted.org/packages/9a/92/4ed714dbe93a066dc1f4b4581a464d2d7dbec9046f7c8b7016f5286329e2/cryptography-46.0.7-cp38-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:5e51be372b26ef4ba3de3c167cd3d1022934bc838ae9eaad7e644986d2a3d163", size = 4272715, upload-time = "2026-04-08T01:57:16.638Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/e6/a26b84096eddd51494bba19111f8fffe976f6a09f132706f8f1bf03f51f7/cryptography-46.0.7-cp38-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:cdf1a610ef82abb396451862739e3fc93b071c844399e15b90726ef7470eeaf2", size = 4918400, upload-time = "2026-04-08T01:57:19.021Z" },
+    { url = "https://files.pythonhosted.org/packages/c7/08/ffd537b605568a148543ac3c2b239708ae0bd635064bab41359252ef88ed/cryptography-46.0.7-cp38-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:1d25aee46d0c6f1a501adcddb2d2fee4b979381346a78558ed13e50aa8a59067", size = 4450634, upload-time = "2026-04-08T01:57:21.185Z" },
+    { url = "https://files.pythonhosted.org/packages/16/01/0cd51dd86ab5b9befe0d031e276510491976c3a80e9f6e31810cce46c4ad/cryptography-46.0.7-cp38-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:cdfbe22376065ffcf8be74dc9a909f032df19bc58a699456a21712d6e5eabfd0", size = 3985233, upload-time = "2026-04-08T01:57:22.862Z" },
+    { url = "https://files.pythonhosted.org/packages/92/49/819d6ed3a7d9349c2939f81b500a738cb733ab62fbecdbc1e38e83d45e12/cryptography-46.0.7-cp38-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:abad9dac36cbf55de6eb49badd4016806b3165d396f64925bf2999bcb67837ba", size = 4271955, upload-time = "2026-04-08T01:57:24.814Z" },
+    { url = "https://files.pythonhosted.org/packages/80/07/ad9b3c56ebb95ed2473d46df0847357e01583f4c52a85754d1a55e29e4d0/cryptography-46.0.7-cp38-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:935ce7e3cfdb53e3536119a542b839bb94ec1ad081013e9ab9b7cfd478b05006", size = 4879888, upload-time = "2026-04-08T01:57:26.88Z" },
+    { url = "https://files.pythonhosted.org/packages/b8/c7/201d3d58f30c4c2bdbe9b03844c291feb77c20511cc3586daf7edc12a47b/cryptography-46.0.7-cp38-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:35719dc79d4730d30f1c2b6474bd6acda36ae2dfae1e3c16f2051f215df33ce0", size = 4449961, upload-time = "2026-04-08T01:57:29.068Z" },
+    { url = "https://files.pythonhosted.org/packages/a5/ef/649750cbf96f3033c3c976e112265c33906f8e462291a33d77f90356548c/cryptography-46.0.7-cp38-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:7bbc6ccf49d05ac8f7d7b5e2e2c33830d4fe2061def88210a126d130d7f71a85", size = 4401696, upload-time = "2026-04-08T01:57:31.029Z" },
+    { url = "https://files.pythonhosted.org/packages/41/52/a8908dcb1a389a459a29008c29966c1d552588d4ae6d43f3a1a4512e0ebe/cryptography-46.0.7-cp38-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:a1529d614f44b863a7b480c6d000fe93b59acee9c82ffa027cfadc77521a9f5e", size = 4664256, upload-time = "2026-04-08T01:57:33.144Z" },
+    { url = "https://files.pythonhosted.org/packages/4b/fa/f0ab06238e899cc3fb332623f337a7364f36f4bb3f2534c2bb95a35b132c/cryptography-46.0.7-cp38-abi3-win32.whl", hash = "sha256:f247c8c1a1fb45e12586afbb436ef21ff1e80670b2861a90353d9b025583d246", size = 3013001, upload-time = "2026-04-08T01:57:34.933Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/f1/00ce3bde3ca542d1acd8f8cfa38e446840945aa6363f9b74746394b14127/cryptography-46.0.7-cp38-abi3-win_amd64.whl", hash = "sha256:506c4ff91eff4f82bdac7633318a526b1d1309fc07ca76a3ad182cb5b686d6d3", size = 3472985, upload-time = "2026-04-08T01:57:36.714Z" },
+    { url = "https://files.pythonhosted.org/packages/63/0c/dca8abb64e7ca4f6b2978769f6fea5ad06686a190cec381f0a796fdcaaba/cryptography-46.0.7-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:fc9ab8856ae6cf7c9358430e49b368f3108f050031442eaeb6b9d87e4dcf4e4f", size = 3476879, upload-time = "2026-04-08T01:57:38.664Z" },
+    { url = "https://files.pythonhosted.org/packages/3a/ea/075aac6a84b7c271578d81a2f9968acb6e273002408729f2ddff517fed4a/cryptography-46.0.7-pp311-pypy311_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:d3b99c535a9de0adced13d159c5a9cf65c325601aa30f4be08afd680643e9c15", size = 4219700, upload-time = "2026-04-08T01:57:40.625Z" },
+    { url = "https://files.pythonhosted.org/packages/6c/7b/1c55db7242b5e5612b29fc7a630e91ee7a6e3c8e7bf5406d22e206875fbd/cryptography-46.0.7-pp311-pypy311_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:d02c738dacda7dc2a74d1b2b3177042009d5cab7c7079db74afc19e56ca1b455", size = 4385982, upload-time = "2026-04-08T01:57:42.725Z" },
+    { url = "https://files.pythonhosted.org/packages/cb/da/9870eec4b69c63ef5925bf7d8342b7e13bc2ee3d47791461c4e49ca212f4/cryptography-46.0.7-pp311-pypy311_pp73-manylinux_2_34_aarch64.whl", hash = "sha256:04959522f938493042d595a736e7dbdff6eb6cc2339c11465b3ff89343b65f65", size = 4219115, upload-time = "2026-04-08T01:57:44.939Z" },
+    { url = "https://files.pythonhosted.org/packages/f4/72/05aa5832b82dd341969e9a734d1812a6aadb088d9eb6f0430fc337cc5a8f/cryptography-46.0.7-pp311-pypy311_pp73-manylinux_2_34_x86_64.whl", hash = "sha256:3986ac1dee6def53797289999eabe84798ad7817f3e97779b5061a95b0ee4968", size = 4385479, upload-time = "2026-04-08T01:57:46.86Z" },
+    { url = "https://files.pythonhosted.org/packages/20/2a/1b016902351a523aa2bd446b50a5bc1175d7a7d1cf90fe2ef904f9b84ebc/cryptography-46.0.7-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:258514877e15963bd43b558917bc9f54cf7cf866c38aa576ebf47a77ddbc43a4", size = 3412829, upload-time = "2026-04-08T01:57:48.874Z" },
 ]

 [[package]]
@@ -2203,17 +2166,15 @@ wheels = [

 [[package]]
 name = "darabonba-core"
-version = "1.0.8"
+version = "1.0.5"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
    { name = "aiohttp" },
    { name = "alibabacloud-tea" },
    { name = "requests" },
-    { name = "websocket-client" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/f5/83/9321ccdb7a800c2cb97d8fa34bead5f20141f27f804594fd1fd815c4cd07/darabonba_core-1.0.8.tar.gz", hash = "sha256:f1661960b368e342d3d36434be82d264b70a01c49e843921d8a4dacd217376ae", size = 27604, upload-time = "2026-07-13T02:07:34.093Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/6d/88/38800ca22f39a31fdb75c7b2867c61d3af5e2792cee0b72942a639c88a79/darabonba_core-1.0.8-py3-none-any.whl", hash = "sha256:ac093fdd40f88f2f9dfbbbfd7bc143495a3cb031f35b397c98d24edfa6b69483", size = 30957, upload-time = "2026-07-13T02:07:33.138Z" },
+    { url = "https://files.pythonhosted.org/packages/66/d3/a7daaee544c904548e665829b51a9fa2572acb82c73ad787a8ff90273002/darabonba_core-1.0.5-py3-none-any.whl", hash = "sha256:671ab8dbc4edc2a8f88013da71646839bb8914f1259efc069353243ef52ea27c", size = 24580, upload-time = "2025-12-12T07:53:59.494Z" },
 ]

 [[package]]
@@ -3366,14 +3327,14 @@ wheels = [

 [[package]]
 name = "httplib2"
-version = "0.32.0"
+version = "0.31.2"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
    { name = "pyparsing" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/84/f5/ccf58de92d61e3ad921119668f54ed36ca1d0cf5dcc5c1657dfb164fd78b/httplib2-0.32.0.tar.gz", hash = "sha256:48a0ef30a42db65d8f3399045e1d09ab0ba66e3b9efc360d07f80ea55d286025", size = 254283, upload-time = "2026-06-26T10:13:56.265Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/c1/1f/e86365613582c027dda5ddb64e1010e57a3d53e99ab8a72093fa13d565ec/httplib2-0.31.2.tar.gz", hash = "sha256:385e0869d7397484f4eab426197a4c020b606edd43372492337c0b4010ae5d24", size = 250800, upload-time = "2026-01-23T11:04:44.165Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/33/a0/550eec327e5f5c7b732531c489f5307efec41f047b0d703bd4ca1e5ad2db/httplib2-0.32.0-py3-none-any.whl", hash = "sha256:dc6705cacdf3fb0a2aba7629fa33c90fd93e30035db0c157325826be177e4816", size = 93148, upload-time = "2026-06-26T10:13:54.985Z" },
+    { url = "https://files.pythonhosted.org/packages/2f/90/fd509079dfcab01102c0fdd87f3a9506894bc70afcf9e9785ef6b2b3aff6/httplib2-0.31.2-py3-none-any.whl", hash = "sha256:dbf0c2fa3862acf3c55c078ea9c0bc4481d7dc5117cae71be9514912cf9f8349", size = 91099, upload-time = "2026-01-23T11:04:42.78Z" },
 ]

 [[package]]
@@ -3396,134 +3357,6 @@ http2 = [
    { name = "h2" },
 ]

-[[package]]
-name = "huaweicloudsdkcore"
-version = "3.1.204"
-source = { registry = "https://pypi.org/simple" }
-dependencies = [
-    { name = "certifi" },
-    { name = "defusedxml" },
-    { name = "pyasn1" },
-    { name = "pymongo" },
-    { name = "pyyaml" },
-    { name = "requests-toolbelt" },
-    { name = "simplejson" },
-    { name = "six" },
-]
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/e4/f5/65e90764ea3bbfef50fb68cd5e12340acf1f51e9276b11745fbf5feb7e0e/huaweicloudsdkcore-3.1.204-py3-none-any.whl", hash = "sha256:9ae17744795ebdc8ce9291373a3a27bf72e90aa98677cfce0ea9394376875a95", size = 69578, upload-time = "2026-07-09T09:01:59.715Z" },
-]
-
-[[package]]
-name = "huaweicloudsdkcts"
-version = "3.1.204"
-source = { registry = "https://pypi.org/simple" }
-dependencies = [
-    { name = "huaweicloudsdkcore" },
-]
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/58/32/d06328e35375d4aa606719a27856cdf57b1f7fb0c49d4dfd22a9609dba19/huaweicloudsdkcts-3.1.204-py3-none-any.whl", hash = "sha256:9def561aa784a6ee13b46bfc96888cd1df5bfc42f8a89e60b42c91c608bf6d60", size = 121768, upload-time = "2026-07-09T09:02:08.16Z" },
-]
-
-[[package]]
-name = "huaweicloudsdkecs"
-version = "3.1.204"
-source = { registry = "https://pypi.org/simple" }
-dependencies = [
-    { name = "huaweicloudsdkcore" },
-]
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/88/66/f8e4a3b9ca70d3ea79c4d200f928ed9ffdf4910ac01be4864967408c8f18/huaweicloudsdkecs-3.1.204-py3-none-any.whl", hash = "sha256:dc5715d782c0260b901c793d009d5e632257acb04257b6f2c6631e415c589343", size = 765699, upload-time = "2026-07-09T09:02:39.272Z" },
-]
-
-[[package]]
-name = "huaweicloudsdkelb"
-version = "3.1.204"
-source = { registry = "https://pypi.org/simple" }
-dependencies = [
-    { name = "huaweicloudsdkcore" },
-]
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/34/4b/9bdc7e2066419d967e9b812cfacfb9c4996a8e977dc39853309a3c1ac9e2/huaweicloudsdkelb-3.1.204-py3-none-any.whl", hash = "sha256:620247c2b2a7f20e7da8b18fe9c64e29972055f015bc35270fb5b43243dc4830", size = 1292397, upload-time = "2026-07-09T09:02:45.656Z" },
-]
-
-[[package]]
-name = "huaweicloudsdkevs"
-version = "3.1.204"
-source = { registry = "https://pypi.org/simple" }
-dependencies = [
-    { name = "huaweicloudsdkcore" },
-]
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/f7/cf/531dc55fd9d0f3bbd3eef24c7e4d78c6a1ba8eb80fa506e3574d72bcc98a/huaweicloudsdkevs-3.1.204-py3-none-any.whl", hash = "sha256:9118ac4c576e54aa7eaa926949e2b6824c5f038a2274b51d9a304d37fc0d7e2f", size = 251404, upload-time = "2026-07-09T09:02:50.05Z" },
-]
-
-[[package]]
-name = "huaweicloudsdkiam"
-version = "3.1.204"
-source = { registry = "https://pypi.org/simple" }
-dependencies = [
-    { name = "huaweicloudsdkcore" },
-]
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/f7/9a/7da0fbe9b83bc7a7f6d586366b81e829ed355a57419d2184b7dd51f8c2a3/huaweicloudsdkiam-3.1.204-py3-none-any.whl", hash = "sha256:0021e204f81ceef2640017e517adb72ba56c9ced03f071a0265b10bc9759badf", size = 1251350, upload-time = "2026-07-09T09:03:05.467Z" },
-]
-
-[[package]]
-name = "huaweicloudsdkkms"
-version = "3.1.204"
-source = { registry = "https://pypi.org/simple" }
-dependencies = [
-    { name = "huaweicloudsdkcore" },
-]
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/28/3a/7392617d585cb2005f7d9ade0b0e0e493a7a88daf56e8dc39e4e219cc5d0/huaweicloudsdkkms-3.1.204-py3-none-any.whl", hash = "sha256:378986f33113ce99f445ef318d1c7dda89e361d16c008e5ef9793981d8385376", size = 275690, upload-time = "2026-07-09T09:03:29.833Z" },
-]
-
-[[package]]
-name = "huaweicloudsdkobs"
-version = "3.1.204"
-source = { registry = "https://pypi.org/simple" }
-dependencies = [
-    { name = "huaweicloudsdkcore" },
-]
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/af/49/28a09e1e33d1c039be22ee4171efaa739351653c7aa88d3a2f7a78d90217/huaweicloudsdkobs-3.1.204-py3-none-any.whl", hash = "sha256:8c5830fa30293185964d98e524887fc510c8e17ca2fadb4563dad10910f37b13", size = 235360, upload-time = "2026-07-09T09:03:52.171Z" },
-]
-
-[[package]]
-name = "huaweicloudsdkrds"
-version = "3.1.204"
-source = { registry = "https://pypi.org/simple" }
-dependencies = [
-    { name = "huaweicloudsdkcore" },
-]
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/18/7d/721f162c46e3de604a73674223bf6c6bc6cf7ade25b3751a71288f4dd122/huaweicloudsdkrds-3.1.204-py3-none-any.whl", hash = "sha256:a790b5b3c457a608e5679c101f463b4d037dd9a8a66f6e46144a9e5a4b37780f", size = 1626906, upload-time = "2026-07-09T09:04:06.936Z" },
-]
-
-[[package]]
-name = "huaweicloudsdkvpc"
-version = "3.1.204"
-source = { registry = "https://pypi.org/simple" }
-dependencies = [
-    { name = "huaweicloudsdkcore" },
-]
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/de/b5/4baa27c3a275ea92806068e35e06f249a30add8dd57c777bb45841f63406/huaweicloudsdkvpc-3.1.204-py3-none-any.whl", hash = "sha256:c57d6b6d2f70deca91e86f7956b33fc9ac4991b431f0d608c3632231119f8970", size = 1124332, upload-time = "2026-07-09T09:04:39.797Z" },
-]
-
-[[package]]
-name = "huaweicloudsdkwaf"
-version = "3.1.204"
-source = { registry = "https://pypi.org/simple" }
-dependencies = [
-    { name = "huaweicloudsdkcore" },
-]
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/9e/21/01590dce200be487756451f5e9efb99da7810688062d177e4b58d6062465/huaweicloudsdkwaf-3.1.204-py3-none-any.whl", hash = "sha256:b2355276e0029808f45e2d1bd3eb14b37d2da9417e61e642ffe0e2b748ca8283", size = 1337762, upload-time = "2026-07-09T09:04:43.688Z" },
-]
-
 [[package]]
 name = "humanfriendly"
 version = "10.0"
@@ -4087,21 +3920,21 @@ wheels = [

 [[package]]
 name = "microsoft-kiota-abstractions"
-version = "1.9.10"
+version = "1.9.9"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
    { name = "opentelemetry-api" },
    { name = "opentelemetry-sdk" },
    { name = "std-uritemplate" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/45/e1/39de28380fc0eddf12f66099469fb7561bc38f577ea06e3a074751ebbcd9/microsoft_kiota_abstractions-1.9.10.tar.gz", hash = "sha256:8eb62d64c35ad0eeb4e8bcdbb143c0b308dc4a494e757f8e44cb959d34f44ecf", size = 24473, upload-time = "2026-03-12T17:27:15.398Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/8f/94/37315b82a1bcc08145e5bc2af7396a4be8160ac138ec269611c3b9589b7a/microsoft_kiota_abstractions-1.9.9.tar.gz", hash = "sha256:5df9a8e0517a4568726c2cac6d9789284cc6ffa66043b68eba42ae55749fb861", size = 24468, upload-time = "2026-03-02T21:03:50.133Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/4d/59/bf0cb26c80fbd3fa882df8474ad87e9dbd742656c376388c427c4e314171/microsoft_kiota_abstractions-1.9.10-py3-none-any.whl", hash = "sha256:cd169067ebe48e6feea1258630807034239e0c61c2abe5fd66896a58177e8f05", size = 44462, upload-time = "2026-03-12T17:27:16.532Z" },
+    { url = "https://files.pythonhosted.org/packages/53/6a/7d5a1a8131f0eccc6b45839c091aa00ba29661854e7defaa7936cf342fa7/microsoft_kiota_abstractions-1.9.9-py3-none-any.whl", hash = "sha256:8d0a14eda42f3f0ccac2e9512227a338f69998dc9b782fd21cb8ca7c48302caa", size = 44453, upload-time = "2026-03-02T21:03:51.11Z" },
 ]

 [[package]]
 name = "microsoft-kiota-authentication-azure"
-version = "1.9.10"
+version = "1.9.9"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
    { name = "aiohttp" },
@@ -4110,14 +3943,14 @@ dependencies = [
    { name = "opentelemetry-api" },
    { name = "opentelemetry-sdk" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/d5/53/7760f979c141ec590f0c1cfcb92b3e410eb2909cc19feb42f3fce78db171/microsoft_kiota_authentication_azure-1.9.10.tar.gz", hash = "sha256:b9f10a9fa86e36114abfee448d2dab91a502d6a55d349a306e2e41a1218fe1ad", size = 4999, upload-time = "2026-03-12T17:27:26.323Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/ca/ce/5ae8b37ee4a50f0ed5e092c2d0105d60b592e6102a190959f76658a0994c/microsoft_kiota_authentication_azure-1.9.9.tar.gz", hash = "sha256:aca5e7dc8a0a28224f9025a479349ac2f9aaf166bfd6bc707f232658b45eec28", size = 5000, upload-time = "2026-03-02T21:04:02.355Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/1e/4a/e7852f9358d897ada1eec4e825c815761befe36df4defa79f1ae6c7b588c/microsoft_kiota_authentication_azure-1.9.10-py3-none-any.whl", hash = "sha256:b5d98b0d17173c61c0c7ab4274ea4ca69253b3c13424137758034506694964e9", size = 6961, upload-time = "2026-03-12T17:27:27.238Z" },
+    { url = "https://files.pythonhosted.org/packages/98/de/dc504324b776d00a420886cc6f39e04be2cf48cab0e9b18f8450a5efcc29/microsoft_kiota_authentication_azure-1.9.9-py3-none-any.whl", hash = "sha256:73dc21a1a2861ea78a135327291db3322e2255542a18b311dd03fd908342e902", size = 6951, upload-time = "2026-03-02T21:04:03.18Z" },
 ]

 [[package]]
 name = "microsoft-kiota-http"
-version = "1.9.10"
+version = "1.9.9"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
    { name = "httpx", extra = ["http2"] },
@@ -4125,57 +3958,57 @@ dependencies = [
    { name = "opentelemetry-api" },
    { name = "opentelemetry-sdk" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/a7/e5/20972b620bd8cca086c284e97b285d437c108a23fee122ad7b92bd246c1a/microsoft_kiota_http-1.9.10.tar.gz", hash = "sha256:af1838d091f76426c974897357093ed977ce66f1d808cb161c190de873bb5833", size = 21493, upload-time = "2026-03-12T17:27:35.393Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/5d/3f/fc18eb0d1d845daf6355fd54fd990af7f7e10043ef6a6da39b9e5981cbaf/microsoft_kiota_http-1.9.9.tar.gz", hash = "sha256:ae672b145df71b644f8da0951767a12a4ce47a40576d86eba19b7c22d9e160f9", size = 21493, upload-time = "2026-03-02T21:04:11.662Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/ce/f4/78ce18330a626138b2ff6bb62574adac01e8b9ee87c1349ddfeb9cab0556/microsoft_kiota_http-1.9.10-py3-none-any.whl", hash = "sha256:6127032c8d94f8607e4d36d0822b88bc8689ab368b4c00d6c7beb7d2d0f2ab10", size = 31960, upload-time = "2026-03-12T17:27:36.1Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/6a/cc1b1055b4b6d4dfc1be7a71917c2f0ef19c070c6a18b16d3c1032d20925/microsoft_kiota_http-1.9.9-py3-none-any.whl", hash = "sha256:a5b1b217ac9afeb4054f12515417e3b1d2be12a9385a70a41d18d64379ea2e7e", size = 31945, upload-time = "2026-03-02T21:04:12.328Z" },
 ]

 [[package]]
 name = "microsoft-kiota-serialization-form"
-version = "1.9.10"
+version = "1.9.9"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
    { name = "microsoft-kiota-abstractions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/56/90/7e1a090a2099acae1a1baa9a0762214b73b63d9268369b510994f75f54e4/microsoft_kiota_serialization_form-1.9.10.tar.gz", hash = "sha256:4c6655d8cd479d1ada63fdfe6a272e50d87d7c8369dbc8e13833ba4787fc798b", size = 9012, upload-time = "2026-03-12T17:27:44.214Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/ee/b4/18e9fce60a30c8b6ea0a6278fb81cf352127340d48df2d7c52ff1b579488/microsoft_kiota_serialization_form-1.9.9.tar.gz", hash = "sha256:3cdc8b172baec5b5282af72f2ce02715edcd23252ce0b5af96075256edd75114", size = 9015, upload-time = "2026-03-02T21:04:20.39Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/d9/4c/5092fc896b34c21e8b9c03c63006b313a81e2377176a69c97aa6a9c8f5bb/microsoft_kiota_serialization_form-1.9.10-py3-none-any.whl", hash = "sha256:765d3f6408668f58bfdf892c32b45967c579d9131f3ba5a6b6868cb7ab956bfe", size = 10728, upload-time = "2026-03-12T17:27:45.103Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/24/eb8436b882f1473bd0a868848d214df3df2d9b3db8e5422d111032f1114f/microsoft_kiota_serialization_form-1.9.9-py3-none-any.whl", hash = "sha256:1c426d4f0d463fc9215c41d7fa0f3dc5fe8d3c80573d555cf63ea67000148d84", size = 10718, upload-time = "2026-03-02T21:04:21.25Z" },
 ]

 [[package]]
 name = "microsoft-kiota-serialization-json"
-version = "1.9.10"
+version = "1.9.9"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
    { name = "microsoft-kiota-abstractions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/67/0e/55afd533a764ba77da988b7ca4242c84867a3a25f2ff0bf4c2b24b5e8fca/microsoft_kiota_serialization_json-1.9.10.tar.gz", hash = "sha256:6063028f30dd67afa2db20a72d9bde5e5d26d468f8bdedadd1445cf7c7630e17", size = 9746, upload-time = "2026-03-12T17:27:53.015Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/b8/2f/d36eba916c00136da122d1701acb862c5b1f2e22b6dc6fa4e0f4abda2786/microsoft_kiota_serialization_json-1.9.9.tar.gz", hash = "sha256:9b27479427f49bbac15ead8e8ff0176e47fcdf81153611acc408f5f399342079", size = 9545, upload-time = "2026-03-02T21:04:29.177Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/2f/56/d14c0185c8092abde1a60ad2bdd4480bb2ddb551ce71c6de1e6133a4d8d1/microsoft_kiota_serialization_json-1.9.10-py3-none-any.whl", hash = "sha256:0545ae910160b19caaa8c30c90c7416e1966294fbd6cc5af01f0e116a18f223a", size = 11452, upload-time = "2026-03-12T17:27:53.909Z" },
+    { url = "https://files.pythonhosted.org/packages/3f/7b/b3f606ef2dcbdebe12ae27004ed6e7542370cb2494265f11a8877a1de2d1/microsoft_kiota_serialization_json-1.9.9-py3-none-any.whl", hash = "sha256:bb80b93e81bab41dc142e9b254f79bf0b7b9fe49a796ca0c8e8691925bd3967f", size = 11210, upload-time = "2026-03-02T21:04:29.844Z" },
 ]

 [[package]]
 name = "microsoft-kiota-serialization-multipart"
-version = "1.9.10"
+version = "1.9.9"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
    { name = "microsoft-kiota-abstractions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/24/34/eadc15c2a3131e2a76126f3112c32b73502cb5a335e2e40cac2877e5d843/microsoft_kiota_serialization_multipart-1.9.10.tar.gz", hash = "sha256:8f2da4f93e79b09f9738b6889685e47acfafcca870db94ab1d4cd233d69e4268", size = 5167, upload-time = "2026-03-12T17:28:18.507Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/5f/44/24087f0fac7c5682c13c7fb61468a0c5a5185b9f243de3a99309aa6fcaa7/microsoft_kiota_serialization_multipart-1.9.9.tar.gz", hash = "sha256:f8730be6da5f6c63a6bf4ea310a9723b9998a47a04745887dc156d08f119a829", size = 5162, upload-time = "2026-03-02T21:04:48.1Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/fa/40/345cbcee6c52b4261fedf4ae2ff8573aec47ce4ae2015ea8b57c75ef978b/microsoft_kiota_serialization_multipart-1.9.10-py3-none-any.whl", hash = "sha256:7cadc26483b567c738f926b044521569e0b797446053c9e8eab02269d4a81062", size = 6708, upload-time = "2026-03-12T17:28:19.397Z" },
+    { url = "https://files.pythonhosted.org/packages/61/db/6b988fdf771c3d07dff4a116176d575832daf2a43823444d145d71da5b61/microsoft_kiota_serialization_multipart-1.9.9-py3-none-any.whl", hash = "sha256:572e9cbafa2eb946452cdadfb019a4e9245768c0d61c3089d3436d4f5106c550", size = 6696, upload-time = "2026-03-02T21:04:48.98Z" },
 ]

 [[package]]
 name = "microsoft-kiota-serialization-text"
-version = "1.9.10"
+version = "1.9.9"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
    { name = "microsoft-kiota-abstractions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/74/a6/28a4a8d5c01f08e363135fc9585cab3c02d1b1a69c3c16032e6abb35dfed/microsoft_kiota_serialization_text-1.9.10.tar.gz", hash = "sha256:cfc433c2a95ea3c3ec43c8b09002fbf65c998c5c0571205df161fe0e9d5d8de7", size = 7326, upload-time = "2026-03-12T17:28:01.621Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/a3/3c/d244ad08e03003134871698aa54de8243bcc61c0faf3ab114293bb76d6ad/microsoft_kiota_serialization_text-1.9.9.tar.gz", hash = "sha256:18bc0764dda4078a4c953300253344e05d0cdb9c17136f1a2f695d438cedb402", size = 7325, upload-time = "2026-03-02T21:04:37.567Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/dd/bf/dd36e4a6d1cff3f2d30f03e2479cd38210e32d4715bb6a9f0e2737f13604/microsoft_kiota_serialization_text-1.9.10-py3-none-any.whl", hash = "sha256:742890cfd4450d12f58d42da7cfa474fe1ee5d6442e016bf70ab76e5c876c0ea", size = 8896, upload-time = "2026-03-12T17:28:02.328Z" },
+    { url = "https://files.pythonhosted.org/packages/37/f8/43f8d00fed6e090810d3ce0c05e06c23eaa5dee6e87ab1fb89d96ca9559f/microsoft_kiota_serialization_text-1.9.9-py3-none-any.whl", hash = "sha256:84418119d4929a76fde7f31e957e240e003bf145757838b9aa3a0f36dec1b789", size = 8885, upload-time = "2026-03-02T21:04:38.76Z" },
 ]

 [[package]]
@@ -4203,7 +4036,7 @@ wheels = [

 [package.optional-dependencies]
 broker = [
-    { name = "pymsalruntime" },
+    { name = "pymsalruntime", marker = "sys_platform == 'win32'" },
 ]

 [[package]]
@@ -4427,22 +4260,20 @@ wheels = [

 [[package]]
 name = "oci"
-version = "2.183.0"
+version = "2.169.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
    { name = "certifi" },
    { name = "circuitbreaker" },
-    { name = "crc32c" },
    { name = "cryptography" },
-    { name = "pyjwt", extra = ["crypto"] },
    { name = "pyopenssl" },
    { name = "python-dateutil" },
    { name = "pytz" },
    { name = "urllib3" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/1e/2a/77bd6cbf1c69b2f368fe3d6462d84369b0cba15e37ce713cdc08d459b95a/oci-2.183.0.tar.gz", hash = "sha256:ff572ef5f2030a788796bb509d257e6a41c6510ef9b4b6a75a079efd06e533ce", size = 17759723, upload-time = "2026-07-28T06:02:29.76Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/11/f4/3c2eddccc75dd06a692dbb3290f20f4bc733d99dc60de21f22d65efdeae4/oci-2.169.0.tar.gz", hash = "sha256:f3c5fff00b01783b5325ea7b13bf140053ec1e9f41da20bfb9c8a349ee7662fa", size = 16885837, upload-time = "2026-03-31T06:14:58.981Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/a9/de/8574b3e527996a099d196e87794a4652d91a0c3185fcc7fdbb5649b75a8a/oci-2.183.0-py3-none-any.whl", hash = "sha256:bd789c98a94d7c5ea08c20d11dcf68c9cd1ad479b134727d80a930b84387070b", size = 36133501, upload-time = "2026-07-28T06:02:18.239Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/bf/19643bd939ab595193779ee25c2c12aef8e9a54e0a68de5ed79f209702e3/oci-2.169.0-py3-none-any.whl", hash = "sha256:c71bb5143f307791082b3e33cc1545c2490a518cfed85ab1948ef5107c36d30b", size = 34460447, upload-time = "2026-03-31T06:14:51.373Z" },
 ]

 [[package]]
@@ -4636,33 +4467,39 @@ wheels = [

 [[package]]
 name = "pillow"
-version = "12.3.0"
+version = "12.2.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/1c/3d/bb7fca845737cf9d7dbde16ed1843984665ff2e0a518f5db43e77ec540b9/pillow-12.3.0.tar.gz", hash = "sha256:3b8182a766685eaa002637e28b4ec8d6b18819a0c71f579bf0dbaa5830297cce", size = 47025035, upload-time = "2026-07-01T11:56:38.965Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/8c/21/c2bcdd5906101a30244eaffc1b6e6ce71a31bd0742a01eb89e660ebfac2d/pillow-12.2.0.tar.gz", hash = "sha256:a830b1a40919539d07806aa58e1b114df53ddd43213d9c8b75847eee6c0182b5", size = 46987819, upload-time = "2026-04-01T14:46:17.687Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/fb/c8/0a78b0e02d7ac54bc03e5321c9220da52f0c2ea83b21f7c40e7f3169c502/pillow-12.3.0-cp311-cp311-macosx_10_10_x86_64.whl", hash = "sha256:00808c5e14ef63ac5161091d242999076604ff74b883423a11e5d7bbb38bf756", size = 5392415, upload-time = "2026-07-01T11:53:47.162Z" },
-    { url = "https://files.pythonhosted.org/packages/b2/5b/a02d30018abd97ced9f5a6c63d28597694a00d066516b9c1c6de45859fc9/pillow-12.3.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:37d6d0a00072fd2948eb22bce7e1475f34569d90c87c59f7a2ec59541b77f7a6", size = 4785266, upload-time = "2026-07-01T11:53:49.079Z" },
-    { url = "https://files.pythonhosted.org/packages/c8/98/766667a4be768150a202836acd9fad19c06824ca86c4286d3cf6b274964e/pillow-12.3.0-cp311-cp311-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:bcb46e2f9feff8d06323983bd83ed00c201fdcab3d74973e7072a889b3979fcd", size = 6263814, upload-time = "2026-07-01T11:53:51.32Z" },
-    { url = "https://files.pythonhosted.org/packages/3b/2d/ede717bc1144f63886c21fd349bb95860b0d1a21149ff16f2bb362b612b6/pillow-12.3.0-cp311-cp311-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:23d27a3e0307ec2244cc51e7287b919aa68d097504ebe19df4e76a98a3eea5bd", size = 6934408, upload-time = "2026-07-01T11:53:53.487Z" },
-    { url = "https://files.pythonhosted.org/packages/a3/48/9c58b685e69d49c31af6c8eb9012055fab7e665785165c84796e2c73ce72/pillow-12.3.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:4f883547d4b7f0495ebe7056b0cc2aea76094e7a4abc8e933540f3271df27d9c", size = 6337160, upload-time = "2026-07-01T11:53:55.457Z" },
-    { url = "https://files.pythonhosted.org/packages/ff/fa/dc2a5c0ba6df93f67c31d34b808b7ce440b40cdbf96f0b81cde1d1e6fa93/pillow-12.3.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:236ff70b9312fb68943c703aa842ca6a758abfa45ac187a5e7c1452e96ef72b5", size = 7045172, upload-time = "2026-07-01T11:53:57.736Z" },
-    { url = "https://files.pythonhosted.org/packages/86/a5/444817a4d4c4c2417df00513086ca196f388d8f9ef40c2e4ccd1ad1af54b/pillow-12.3.0-cp311-cp311-win32.whl", hash = "sha256:10e41f0fbf1eec8cfd234b8fe17a4caac7c9d0db4c204d3c173a8f9f6ef3232b", size = 6472232, upload-time = "2026-07-01T11:53:59.767Z" },
-    { url = "https://files.pythonhosted.org/packages/63/c6/4bad1b18d132a50b27e1365e1ab163616f7a5bb56d330f66f9d1d9d4f9d4/pillow-12.3.0-cp311-cp311-win_amd64.whl", hash = "sha256:8e95e1385e4998ae9694eeaa4730ba5457ff61185b3a55e2e7bea0880aef452a", size = 7233653, upload-time = "2026-07-01T11:54:02.066Z" },
-    { url = "https://files.pythonhosted.org/packages/fd/16/00f91ab7760dc842f5aad55217e80fc4a7067a0604535249bc8a2d6d9870/pillow-12.3.0-cp311-cp311-win_arm64.whl", hash = "sha256:ebaea975e03d3141d9d3a507df75c9b3ec90fa9d2ffd07567b3a978d9d790b26", size = 2568195, upload-time = "2026-07-01T11:54:04.622Z" },
-    { url = "https://files.pythonhosted.org/packages/37/bf/fb3ebff8ddcb76aac5a01389251bbbb9519922a9b520d8247c1ca864a25d/pillow-12.3.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:ba09209fbe443b4acccebe845d8a138b89a8f4fbaeedd44953490b5315d5e965", size = 5345969, upload-time = "2026-07-01T11:54:06.397Z" },
-    { url = "https://files.pythonhosted.org/packages/d8/66/9a386a92561f402389a4fc70c18838bf6d35eb5eb5c6850b4b2dc64f5048/pillow-12.3.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:ffd0c5368496f41b0944be820fcb7a838aa6e623d250b01acf2643939c3f99d7", size = 4780323, upload-time = "2026-07-01T11:54:09.351Z" },
-    { url = "https://files.pythonhosted.org/packages/25/27/ac8f99618ffd3dde21db0f4d4b1d2ab00c0880595bfd17df103f7f39fd0c/pillow-12.3.0-cp312-cp312-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:d9c7f76c0673154f044e9d78c8655fb4213f6ca31a836df48b40fe5d187717b9", size = 6266838, upload-time = "2026-07-01T11:54:11.71Z" },
-    { url = "https://files.pythonhosted.org/packages/84/21/a35af28dcc61f37ed850a2d64c65c701321dfbf25085e469d5559360cbbf/pillow-12.3.0-cp312-cp312-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:78cb2c6865a35ab8ff8b75fd122f6033b92a62c82801110e48ddd6c936a45d91", size = 6940830, upload-time = "2026-07-01T11:54:13.732Z" },
-    { url = "https://files.pythonhosted.org/packages/eb/51/8b08617af3ad95e33ce6d7dd2c99ed6c8298f7fb131636303956be022e25/pillow-12.3.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:e491916b378fba47242221bb9ead245211b70d504f495d105d17b14a24b4907c", size = 6344383, upload-time = "2026-07-01T11:54:15.756Z" },
-    { url = "https://files.pythonhosted.org/packages/1d/72/cf78ac9780bb93c28328f408973845a309d4d145041665f734572ced1b52/pillow-12.3.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:0dd2064cbc55aaec028ef5fbb60fa47bb6c3e7918e07ff17935284b227a9d2df", size = 7052934, upload-time = "2026-07-01T11:54:17.721Z" },
-    { url = "https://files.pythonhosted.org/packages/20/20/25e0f4dc178a6bc0696793720055519a0de89e7661dae886992decbd2f81/pillow-12.3.0-cp312-cp312-win32.whl", hash = "sha256:dbce0b29841537a2fa4a214c2bbf14de3587c9680caa9b4e217568472490b28f", size = 6472684, upload-time = "2026-07-01T11:54:19.839Z" },
-    { url = "https://files.pythonhosted.org/packages/45/89/da2f7971a317f83d807fdd4065c0af40208e59e692cc43d315a71a0e96d1/pillow-12.3.0-cp312-cp312-win_amd64.whl", hash = "sha256:a2b55dd6b2a4c4b7d87ffa56bdb33fdc5fdb9a462173861a7bc097f17d91cb09", size = 7227137, upload-time = "2026-07-01T11:54:22.025Z" },
-    { url = "https://files.pythonhosted.org/packages/de/47/4845a0a6c0dbf1db8456bd9fc791f13c5ced7ced20606d08a0aacfd25b49/pillow-12.3.0-cp312-cp312-win_arm64.whl", hash = "sha256:331b624368d4f1d069149002f25f44bc61c8919ce8ddb3c45bdad8f6e2d89510", size = 2568267, upload-time = "2026-07-01T11:54:24.051Z" },
-    { url = "https://files.pythonhosted.org/packages/75/18/2e8b40223153ccbc60df07f9e8928dc0c76202aa4e55ae9f53962b6510d6/pillow-12.3.0-pp311-pypy311_pp73-macosx_10_15_x86_64.whl", hash = "sha256:b3c777e849237620b022f7f297dd67705f9f5cf1685f09f02e46f93e92725468", size = 5302510, upload-time = "2026-07-01T11:56:25.736Z" },
-    { url = "https://files.pythonhosted.org/packages/46/3e/51fabf59d5ab801ceab709453d3ab6b180083496579549de4c45ced6528a/pillow-12.3.0-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:b343699e8308bdc51978310e1c959c584e7869cc8c40780058c87da7781a1e94", size = 4736058, upload-time = "2026-07-01T11:56:28.041Z" },
-    { url = "https://files.pythonhosted.org/packages/bf/20/22fe9384b7949e25fb1293bcfc84fb82590ff4ea6b37c95b24d26d793d86/pillow-12.3.0-pp311-pypy311_pp73-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:fbd139c8447d25dd750ab79ee274cc5e1fe80fc56340ab10b18a195e1b6eca3e", size = 5237776, upload-time = "2026-07-01T11:56:30.263Z" },
-    { url = "https://files.pythonhosted.org/packages/08/14/f6ba68107680ffa74b39985f3f30884e41318fbc4250caa423c79b4788bb/pillow-12.3.0-pp311-pypy311_pp73-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:e7e480451b9fa137494bccd3a7d69adbe8ac65a87d97be61e11f1b1050a5bac3", size = 5860358, upload-time = "2026-07-01T11:56:32.68Z" },
-    { url = "https://files.pythonhosted.org/packages/36/54/0169bc772ec491108b62f644f8ecf1fe5d8ae5ebafde2ee2142210166903/pillow-12.3.0-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:04f01d28a6aaff387bf842a13be313df23ba0597a44f1a976c9feb3c6ff4711a", size = 7231786, upload-time = "2026-07-01T11:56:35.046Z" },
+    { url = "https://files.pythonhosted.org/packages/68/e1/748f5663efe6edcfc4e74b2b93edfb9b8b99b67f21a854c3ae416500a2d9/pillow-12.2.0-cp311-cp311-macosx_10_10_x86_64.whl", hash = "sha256:8be29e59487a79f173507c30ddf57e733a357f67881430449bb32614075a40ab", size = 5354347, upload-time = "2026-04-01T14:42:44.255Z" },
+    { url = "https://files.pythonhosted.org/packages/47/a1/d5ff69e747374c33a3b53b9f98cca7889fce1fd03d79cdc4e1bccc6c5a87/pillow-12.2.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:71cde9a1e1551df7d34a25462fc60325e8a11a82cc2e2f54578e5e9a1e153d65", size = 4695873, upload-time = "2026-04-01T14:42:46.452Z" },
+    { url = "https://files.pythonhosted.org/packages/df/21/e3fbdf54408a973c7f7f89a23b2cb97a7ef30c61ab4142af31eee6aebc88/pillow-12.2.0-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:f490f9368b6fc026f021db16d7ec2fbf7d89e2edb42e8ec09d2c60505f5729c7", size = 6280168, upload-time = "2026-04-01T14:42:49.228Z" },
+    { url = "https://files.pythonhosted.org/packages/d3/f1/00b7278c7dd52b17ad4329153748f87b6756ec195ff786c2bdf12518337d/pillow-12.2.0-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:8bd7903a5f2a4545f6fd5935c90058b89d30045568985a71c79f5fd6edf9b91e", size = 8088188, upload-time = "2026-04-01T14:42:51.735Z" },
+    { url = "https://files.pythonhosted.org/packages/ad/cf/220a5994ef1b10e70e85748b75649d77d506499352be135a4989c957b701/pillow-12.2.0-cp311-cp311-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:3997232e10d2920a68d25191392e3a4487d8183039e1c74c2297f00ed1c50705", size = 6394401, upload-time = "2026-04-01T14:42:54.343Z" },
+    { url = "https://files.pythonhosted.org/packages/e9/bd/e51a61b1054f09437acfbc2ff9106c30d1eb76bc1453d428399946781253/pillow-12.2.0-cp311-cp311-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:e74473c875d78b8e9d5da2a70f7099549f9eb37ded4e2f6a463e60125bccd176", size = 7079655, upload-time = "2026-04-01T14:42:56.954Z" },
+    { url = "https://files.pythonhosted.org/packages/6b/3d/45132c57d5fb4b5744567c3817026480ac7fc3ce5d4c47902bc0e7f6f853/pillow-12.2.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:56a3f9c60a13133a98ecff6197af34d7824de9b7b38c3654861a725c970c197b", size = 6503105, upload-time = "2026-04-01T14:42:59.847Z" },
+    { url = "https://files.pythonhosted.org/packages/7d/2e/9df2fc1e82097b1df3dce58dc43286aa01068e918c07574711fcc53e6fb4/pillow-12.2.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:90e6f81de50ad6b534cab6e5aef77ff6e37722b2f5d908686f4a5c9eba17a909", size = 7203402, upload-time = "2026-04-01T14:43:02.664Z" },
+    { url = "https://files.pythonhosted.org/packages/bd/2e/2941e42858ebb67e50ae741473de81c2984e6eff7b397017623c676e2e8d/pillow-12.2.0-cp311-cp311-win32.whl", hash = "sha256:8c984051042858021a54926eb597d6ee3012393ce9c181814115df4c60b9a808", size = 6378149, upload-time = "2026-04-01T14:43:05.274Z" },
+    { url = "https://files.pythonhosted.org/packages/69/42/836b6f3cd7f3e5fa10a1f1a5420447c17966044c8fbf589cc0452d5502db/pillow-12.2.0-cp311-cp311-win_amd64.whl", hash = "sha256:6e6b2a0c538fc200b38ff9eb6628228b77908c319a005815f2dde585a0664b60", size = 7082626, upload-time = "2026-04-01T14:43:08.557Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/88/549194b5d6f1f494b485e493edc6693c0a16f4ada488e5bd974ed1f42fad/pillow-12.2.0-cp311-cp311-win_arm64.whl", hash = "sha256:9a8a34cc89c67a65ea7437ce257cea81a9dad65b29805f3ecee8c8fe8ff25ffe", size = 2463531, upload-time = "2026-04-01T14:43:10.743Z" },
+    { url = "https://files.pythonhosted.org/packages/58/be/7482c8a5ebebbc6470b3eb791812fff7d5e0216c2be3827b30b8bb6603ed/pillow-12.2.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:2d192a155bbcec180f8564f693e6fd9bccff5a7af9b32e2e4bf8c9c69dbad6b5", size = 5308279, upload-time = "2026-04-01T14:43:13.246Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/95/0a351b9289c2b5cbde0bacd4a83ebc44023e835490a727b2a3bd60ddc0f4/pillow-12.2.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:f3f40b3c5a968281fd507d519e444c35f0ff171237f4fdde090dd60699458421", size = 4695490, upload-time = "2026-04-01T14:43:15.584Z" },
+    { url = "https://files.pythonhosted.org/packages/de/af/4e8e6869cbed569d43c416fad3dc4ecb944cb5d9492defaed89ddd6fe871/pillow-12.2.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:03e7e372d5240cc23e9f07deca4d775c0817bffc641b01e9c3af208dbd300987", size = 6284462, upload-time = "2026-04-01T14:43:18.268Z" },
+    { url = "https://files.pythonhosted.org/packages/e9/9e/c05e19657fd57841e476be1ab46c4d501bffbadbafdc31a6d665f8b737b6/pillow-12.2.0-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:b86024e52a1b269467a802258c25521e6d742349d760728092e1bc2d135b4d76", size = 8094744, upload-time = "2026-04-01T14:43:20.716Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/54/1789c455ed10176066b6e7e6da1b01e50e36f94ba584dc68d9eebfe9156d/pillow-12.2.0-cp312-cp312-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:7371b48c4fa448d20d2714c9a1f775a81155050d383333e0a6c15b1123dda005", size = 6398371, upload-time = "2026-04-01T14:43:23.443Z" },
+    { url = "https://files.pythonhosted.org/packages/43/e3/fdc657359e919462369869f1c9f0e973f353f9a9ee295a39b1fea8ee1a77/pillow-12.2.0-cp312-cp312-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:62f5409336adb0663b7caa0da5c7d9e7bdbaae9ce761d34669420c2a801b2780", size = 7087215, upload-time = "2026-04-01T14:43:26.758Z" },
+    { url = "https://files.pythonhosted.org/packages/8b/f8/2f6825e441d5b1959d2ca5adec984210f1ec086435b0ed5f52c19b3b8a6e/pillow-12.2.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:01afa7cf67f74f09523699b4e88c73fb55c13346d212a59a2db1f86b0a63e8c5", size = 6509783, upload-time = "2026-04-01T14:43:29.56Z" },
+    { url = "https://files.pythonhosted.org/packages/67/f9/029a27095ad20f854f9dba026b3ea6428548316e057e6fc3545409e86651/pillow-12.2.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:fc3d34d4a8fbec3e88a79b92e5465e0f9b842b628675850d860b8bd300b159f5", size = 7212112, upload-time = "2026-04-01T14:43:32.091Z" },
+    { url = "https://files.pythonhosted.org/packages/be/42/025cfe05d1be22dbfdb4f264fe9de1ccda83f66e4fc3aac94748e784af04/pillow-12.2.0-cp312-cp312-win32.whl", hash = "sha256:58f62cc0f00fd29e64b29f4fd923ffdb3859c9f9e6105bfc37ba1d08994e8940", size = 6378489, upload-time = "2026-04-01T14:43:34.601Z" },
+    { url = "https://files.pythonhosted.org/packages/5d/7b/25a221d2c761c6a8ae21bfa3874988ff2583e19cf8a27bf2fee358df7942/pillow-12.2.0-cp312-cp312-win_amd64.whl", hash = "sha256:7f84204dee22a783350679a0333981df803dac21a0190d706a50475e361c93f5", size = 7084129, upload-time = "2026-04-01T14:43:37.213Z" },
+    { url = "https://files.pythonhosted.org/packages/10/e1/542a474affab20fd4a0f1836cb234e8493519da6b76899e30bcc5d990b8b/pillow-12.2.0-cp312-cp312-win_arm64.whl", hash = "sha256:af73337013e0b3b46f175e79492d96845b16126ddf79c438d7ea7ff27783a414", size = 2463612, upload-time = "2026-04-01T14:43:39.421Z" },
+    { url = "https://files.pythonhosted.org/packages/4e/b7/2437044fb910f499610356d1352e3423753c98e34f915252aafecc64889f/pillow-12.2.0-pp311-pypy311_pp73-macosx_10_15_x86_64.whl", hash = "sha256:0538bd5e05efec03ae613fd89c4ce0368ecd2ba239cc25b9f9be7ed426b0af1f", size = 5273969, upload-time = "2026-04-01T14:45:55.538Z" },
+    { url = "https://files.pythonhosted.org/packages/f6/f4/8316e31de11b780f4ac08ef3654a75555e624a98db1056ecb2122d008d5a/pillow-12.2.0-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:394167b21da716608eac917c60aa9b969421b5dcbbe02ae7f013e7b85811c69d", size = 4659674, upload-time = "2026-04-01T14:45:58.093Z" },
+    { url = "https://files.pythonhosted.org/packages/d4/37/664fca7201f8bb2aa1d20e2c3d5564a62e6ae5111741966c8319ca802361/pillow-12.2.0-pp311-pypy311_pp73-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:5d04bfa02cc2d23b497d1e90a0f927070043f6cbf303e738300532379a4b4e0f", size = 5288479, upload-time = "2026-04-01T14:46:01.141Z" },
+    { url = "https://files.pythonhosted.org/packages/49/62/5b0ed78fce87346be7a5cfcfaaad91f6a1f98c26f86bdbafa2066c647ef6/pillow-12.2.0-pp311-pypy311_pp73-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:0c838a5125cee37e68edec915651521191cef1e6aa336b855f495766e77a366e", size = 7032230, upload-time = "2026-04-01T14:46:03.874Z" },
+    { url = "https://files.pythonhosted.org/packages/c3/28/ec0fc38107fc32536908034e990c47914c57cd7c5a3ece4d8d8f7ffd7e27/pillow-12.2.0-pp311-pypy311_pp73-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:4a6c9fa44005fa37a91ebfc95d081e8079757d2e904b27103f4f5fa6f0bf78c0", size = 5355404, upload-time = "2026-04-01T14:46:06.33Z" },
+    { url = "https://files.pythonhosted.org/packages/5e/8b/51b0eddcfa2180d60e41f06bd6d0a62202b20b59c68f5a132e615b75aecf/pillow-12.2.0-pp311-pypy311_pp73-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:25373b66e0dd5905ed63fa3cae13c82fbddf3079f2c8bf15c6fb6a35586324c1", size = 6002215, upload-time = "2026-04-01T14:46:08.83Z" },
+    { url = "https://files.pythonhosted.org/packages/bc/60/5382c03e1970de634027cee8e1b7d39776b778b81812aaf45b694dfe9e28/pillow-12.2.0-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:bfa9c230d2fe991bed5318a5f119bd6780cda2915cca595393649fc118ab895e", size = 7080946, upload-time = "2026-04-01T14:46:11.734Z" },
 ]

 [[package]]
@@ -4836,8 +4673,8 @@ wheels = [

 [[package]]
 name = "prowler"
-version = "5.37.1"
-source = { git = "https://github.com/prowler-cloud/prowler.git?rev=v5.37#fbbf9fe1cdfbac1869b950a078ac36098dbb4ddc" }
+version = "5.35.0"
+source = { git = "https://github.com/prowler-cloud/prowler.git?rev=master#f5ea116763aeffede9f399c8934fc280eaccd315" }
 dependencies = [
    { name = "alibabacloud-actiontrail20200706" },
    { name = "alibabacloud-credentials" },
@@ -4892,17 +4729,6 @@ dependencies = [
    { name = "google-api-python-client" },
    { name = "google-auth-httplib2" },
    { name = "h2" },
-    { name = "huaweicloudsdkcore" },
-    { name = "huaweicloudsdkcts" },
-    { name = "huaweicloudsdkecs" },
-    { name = "huaweicloudsdkelb" },
-    { name = "huaweicloudsdkevs" },
-    { name = "huaweicloudsdkiam" },
-    { name = "huaweicloudsdkkms" },
-    { name = "huaweicloudsdkobs" },
-    { name = "huaweicloudsdkrds" },
-    { name = "huaweicloudsdkvpc" },
-    { name = "huaweicloudsdkwaf" },
    { name = "jsonschema" },
    { name = "kingfisher-bin" },
    { name = "kubernetes" },
@@ -4936,7 +4762,7 @@ dependencies = [

 [[package]]
 name = "prowler-api"
-version = "1.38.1"
+version = "1.38.0"
 source = { virtual = "." }
 dependencies = [
    { name = "cartography" },
@@ -5036,7 +4862,7 @@ requires-dist = [
    { name = "matplotlib", specifier = "==3.10.8" },
    { name = "neo4j", specifier = "==6.1.0" },
    { name = "openai", specifier = "==1.109.1" },
-    { name = "prowler", git = "https://github.com/prowler-cloud/prowler.git?rev=v5.37" },
+    { name = "prowler", git = "https://github.com/prowler-cloud/prowler.git?rev=master" },
    { name = "psycopg2-binary", specifier = "==2.9.9" },
    { name = "pytest-celery", extras = ["redis"], specifier = "==1.3.0" },
    { name = "reportlab", specifier = "==4.4.10" },
@@ -5152,24 +4978,25 @@ wheels = [

 [[package]]
 name = "py-ocsf-models"
-version = "0.10.0"
+version = "0.8.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
+    { name = "cryptography" },
    { name = "email-validator" },
    { name = "pydantic" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/70/d6/f0787cbe953e3cf6ef4430f3cc7d66cbbaabe4b20cb82cc27cc2d21e622a/py_ocsf_models-0.10.0.tar.gz", hash = "sha256:29abaa5a3d4ebba0e2a21757508a4848fa5e1d57da233af57e580f97f0223c59", size = 36498, upload-time = "2026-07-13T07:05:44.448Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/f5/70/61e2f9ce3d7e83aa5339ed6ae17e473c15c7a36f161c6dbea0e939e3af0c/py_ocsf_models-0.8.1.tar.gz", hash = "sha256:c9045237857f951e073c9f9d1f57954c90d86875b469260725292d47f7a7d73c", size = 36540, upload-time = "2026-02-12T16:50:15.233Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/75/56/eca45ec87a02f930cc7eaa7cb36660f69fb00c3d77bb4a84bb92d6c94c25/py_ocsf_models-0.10.0-py3-none-any.whl", hash = "sha256:a9d1e245b1c9fba1d2cb8c042253ef1b83a2dbfec30ed69975bbce599b4510bb", size = 64334, upload-time = "2026-07-13T07:05:42.93Z" },
+    { url = "https://files.pythonhosted.org/packages/f9/18/63790884bf33f820e2c60f8d5038b5d6de967a03343ddf237c054e1d6d08/py_ocsf_models-0.8.1-py3-none-any.whl", hash = "sha256:061eb446c4171534c09a8b37f5a9d2a2fe9f87c5db32edbd1182446bc5fd097e", size = 64354, upload-time = "2026-02-12T16:50:12.983Z" },
 ]

 [[package]]
 name = "pyasn1"
-version = "0.6.4"
+version = "0.6.3"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/a4/9a/23310166d960def5897e91fe20e5b724601b02a22e84ba1f94232c0b7f67/pyasn1-0.6.4.tar.gz", hash = "sha256:9c447d8431c947fe4c8febc4ed9e760bc29011a5b01e5c74b67025bd9fb8ce81", size = 151262, upload-time = "2026-07-09T01:12:33.988Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/5c/5f/6583902b6f79b399c9c40674ac384fd9cd77805f9e6205075f828ef11fb2/pyasn1-0.6.3.tar.gz", hash = "sha256:697a8ecd6d98891189184ca1fa05d1bb00e2f84b5977c481452050549c8a72cf", size = 148685, upload-time = "2026-03-17T01:06:53.382Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/9a/3b/6163796d69c3977d1e4287bea4a6979161cbbdd170ebb430511e8e1999ce/pyasn1-0.6.4-py3-none-any.whl", hash = "sha256:deda9277cfd454080ec40b207fb6df82206a3a2688735233cdcd8d3d565f088b", size = 84410, upload-time = "2026-07-09T01:12:32.92Z" },
+    { url = "https://files.pythonhosted.org/packages/5d/a0/7d793dce3fa811fe047d6ae2431c672364b462850c6235ae306c0efd025f/pyasn1-0.6.3-py3-none-any.whl", hash = "sha256:a80184d120f0864a52a073acc6fc642847d0be408e7c7252f31390c0f4eadcde", size = 83997, upload-time = "2026-03-17T01:06:52.036Z" },
 ]

 [[package]]
@@ -5360,37 +5187,6 @@ wheels = [
    { url = "https://files.pythonhosted.org/packages/2e/ff/7f52c1461d8ceaefa989d2700a027f84427879bb7571145bbffdec5d5f4a/pylint-3.2.5-py3-none-any.whl", hash = "sha256:32cd6c042b5004b8e857d727708720c54a676d1e22917cf1a2df9b4d4868abd6", size = 519603, upload-time = "2024-06-28T13:10:23.526Z" },
 ]

-[[package]]
-name = "pymongo"
-version = "4.15.1"
-source = { registry = "https://pypi.org/simple" }
-dependencies = [
-    { name = "dnspython" },
-]
-sdist = { url = "https://files.pythonhosted.org/packages/22/f5/c0c6732fbd358b75a07e17d7e588fd23d481b9812ca96ceeff90bbf879fc/pymongo-4.15.1.tar.gz", hash = "sha256:b9f379a4333dc3779a6bf7adfd077d4387404ed1561472743486a9c58286f705", size = 2470613, upload-time = "2025-09-16T16:39:47.24Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/c9/da/89066930a70b4299844f1155fc23baaa7e30e77c8a0cbf62a2ae06ee34a5/pymongo-4.15.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:363445cc0e899b9e55ac9904a868c8a16a6c81f71c48dbadfd78c98e0b54de27", size = 865410, upload-time = "2025-09-16T16:38:16.279Z" },
-    { url = "https://files.pythonhosted.org/packages/99/8f/a1d0402d52e5ebd14283718abefdc0c16f308cf10bee56cdff04b1f5119b/pymongo-4.15.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:da0a13f345f4b101776dbab92cec66f0b75015df0b007b47bd73bfd0305cc56a", size = 865695, upload-time = "2025-09-16T16:38:18.015Z" },
-    { url = "https://files.pythonhosted.org/packages/53/38/d1ef69028923f86fd00638d9eb16400d4e60a89eabd2011fe631fd3186cf/pymongo-4.15.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:9481a492851e432122a83755d4e69c06aeb087bbf8370bac9f96d112ac1303fd", size = 1434758, upload-time = "2025-09-16T16:38:20.141Z" },
-    { url = "https://files.pythonhosted.org/packages/b0/eb/a8d5dff748a2dd333610b2e4c8120b623e38ea2b5e30ad190d0ce2803840/pymongo-4.15.1-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:625dec3e9cd7c3d336285a20728c01bfc56d37230a99ec537a6a8625af783a43", size = 1485716, upload-time = "2025-09-16T16:38:21.607Z" },
-    { url = "https://files.pythonhosted.org/packages/c4/d4/17ba457a828b733182ddc01a202872fef3006eed6b54450b20dc95a2f77d/pymongo-4.15.1-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:26a31af455bffcc64537a7f67e2f84833a57855a82d05a085a1030c471138990", size = 1460160, upload-time = "2025-09-16T16:38:23.509Z" },
-    { url = "https://files.pythonhosted.org/packages/c3/25/42b8662c09f5ca9c81d18d160f48e58842e0fa4c314ea02613c5e5d54542/pymongo-4.15.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:ea4415970d2a074d5890696af10e174d84cb735f1fa7673020c7538431e1cb6e", size = 1439284, upload-time = "2025-09-16T16:38:25.248Z" },
-    { url = "https://files.pythonhosted.org/packages/b3/bb/46b9d978161828eb91973bd441a3f05f73c789203e976332a8de2832d5db/pymongo-4.15.1-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:51ee050a2e026e2b224d2ed382830194be20a81c78e1ef98f467e469071df3ac", size = 1407933, upload-time = "2025-09-16T16:38:27.045Z" },
-    { url = "https://files.pythonhosted.org/packages/4b/55/bd5af98f675001f4b06f7314b3918e45809424a7ad3510f823f6703cd8f2/pymongo-4.15.1-cp311-cp311-win32.whl", hash = "sha256:9aef07d33839f6429dc24f2ef36e4ec906979cb4f628c57a1c2676cc66625711", size = 844328, upload-time = "2025-09-16T16:38:28.513Z" },
-    { url = "https://files.pythonhosted.org/packages/c3/78/90989a290dd458ed43a8a04fa561ac9c7b3391f395cdacd42e21f0f22ce4/pymongo-4.15.1-cp311-cp311-win_amd64.whl", hash = "sha256:8ea6e5ff4d6747e7b64966629a964db3089e9c1e0206d8f9cc8720c90f5a7af1", size = 858951, upload-time = "2025-09-16T16:38:30.074Z" },
-    { url = "https://files.pythonhosted.org/packages/de/bb/d4d23f06e166cd773f2324cff73841a62d78a1ad16fb799cf7c5490ce32c/pymongo-4.15.1-cp311-cp311-win_arm64.whl", hash = "sha256:bb783d9001b464a6ef3ee76c30ebbb6f977caee7bbc3a9bb1bd2ff596e818c46", size = 848290, upload-time = "2025-09-16T16:38:31.741Z" },
-    { url = "https://files.pythonhosted.org/packages/7e/31/bc4525312083706a59fffe6e8de868054472308230fdee8db0c452c2b831/pymongo-4.15.1-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:bab357c5ff36ba2340dfc94f3338ef399032089d35c3d257ce0c48630b7848b2", size = 920261, upload-time = "2025-09-16T16:38:33.614Z" },
-    { url = "https://files.pythonhosted.org/packages/ae/55/4d99aec625494f21151b8b31e12e06b8ccd3b9dcff609b0dd1acf9bbbc0e/pymongo-4.15.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:46d1af3eb2c274f07815372b5a68f99ecd48750e8ab54d5c3ff36a280fb41c8e", size = 919956, upload-time = "2025-09-16T16:38:35.121Z" },
-    { url = "https://files.pythonhosted.org/packages/be/60/8f1afa41521df950e13f6490ecdef48155fc63b78f926e7649045e07afd1/pymongo-4.15.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:7dc31357379318881186213dc5fc49b62601c955504f65c8e72032b5048950a1", size = 1698596, upload-time = "2025-09-16T16:38:36.586Z" },
-    { url = "https://files.pythonhosted.org/packages/bc/3f/e48d50ee8d6aa0a4cda7889dd73076ec2ab79a232716a5eb0b9df070ffcf/pymongo-4.15.1-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:12140d29da1ecbaefee2a9e65433ef15d6c2c38f97bc6dab0ff246a96f9d20cd", size = 1762833, upload-time = "2025-09-16T16:38:38.09Z" },
-    { url = "https://files.pythonhosted.org/packages/63/87/db976859efc617f608754e051e1468459d9a818fe1ad5d0862e8af57720b/pymongo-4.15.1-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:cf193d2dcd91fa1d1dfa1fd036a3b54f792915a4842d323c0548d23d30461b59", size = 1731875, upload-time = "2025-09-16T16:38:39.742Z" },
-    { url = "https://files.pythonhosted.org/packages/18/59/3643ad52a5064ad3ef8c32910de6da28eb658234c25f2db5366f16bffbfb/pymongo-4.15.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:a2c0bdcf4d57e4861ed323ba430b585ad98c010a83e46cb8aa3b29c248a82be1", size = 1701853, upload-time = "2025-09-16T16:38:41.333Z" },
-    { url = "https://files.pythonhosted.org/packages/d8/96/441c190823f855fc6445ea574b39dca41156acf723c5e6a69ee718421700/pymongo-4.15.1-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:43fcfc19446e0706bbfe86f683a477d1e699b02369dd9c114ec17c7182d1fe2b", size = 1660978, upload-time = "2025-09-16T16:38:42.877Z" },
-    { url = "https://files.pythonhosted.org/packages/47/49/bd7e783fb78aaf9bdaa3f88cc238449be5bc5546e930ec98845ef235f809/pymongo-4.15.1-cp312-cp312-win32.whl", hash = "sha256:e5fedea0e7b3747da836cd5f88b0fa3e2ec5a394371f9b6a6b15927cfeb5455d", size = 891175, upload-time = "2025-09-16T16:38:44.658Z" },
-    { url = "https://files.pythonhosted.org/packages/2e/28/7de5858bdeaa07ea4b277f9eb06123ea358003659fe55e72e4e7c898b321/pymongo-4.15.1-cp312-cp312-win_amd64.whl", hash = "sha256:330a17c1c89e2c3bf03ed391108f928d5881298c17692199d3e0cdf097a20082", size = 910619, upload-time = "2025-09-16T16:38:46.124Z" },
-    { url = "https://files.pythonhosted.org/packages/17/87/c39f4f8415e7c65f8b66413f53a9272211ff7dfe78a5128b27027bf88864/pymongo-4.15.1-cp312-cp312-win_arm64.whl", hash = "sha256:756b7a2a80ec3dd5b89cd62e9d13c573afd456452a53d05663e8ad0c5ff6632b", size = 896229, upload-time = "2025-09-16T16:38:48.563Z" },
-]
-
 [[package]]
 name = "pymsalruntime"
 version = "0.18.1"
@@ -5427,15 +5223,15 @@ wheels = [

 [[package]]
 name = "pyopenssl"
-version = "26.2.0"
+version = "26.0.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
    { name = "cryptography" },
    { name = "typing-extensions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/1a/51/27a5ad5f939d08f690a326ef9582cda7140555180db71695f6fb747d6a36/pyopenssl-26.2.0.tar.gz", hash = "sha256:8c6fcecd1183a7fc897548dfe388b0cdb7f37e018200d8409cf33959dbe35387", size = 182195, upload-time = "2026-05-04T23:06:09.72Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/8e/11/a62e1d33b373da2b2c2cd9eb508147871c80f12b1cacde3c5d314922afdd/pyopenssl-26.0.0.tar.gz", hash = "sha256:f293934e52936f2e3413b89c6ce36df66a0b34ae1ea3a053b8c5020ff2f513fc", size = 185534, upload-time = "2026-03-15T14:28:26.353Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/73/b8/a0e2790ae249d6f38c9f66de7a211621a7ab2650217bcd04e1262f578a56/pyopenssl-26.2.0-py3-none-any.whl", hash = "sha256:4f9d971bc5298b8bc1fab282803da04bf000c755d4ad9d99b52de2569ca19a70", size = 55823, upload-time = "2026-05-04T23:06:08.395Z" },
+    { url = "https://files.pythonhosted.org/packages/fb/7d/d4f7d908fa8415571771b30669251d57c3cf313b36a856e6d7548ae01619/pyopenssl-26.0.0-py3-none-any.whl", hash = "sha256:df94d28498848b98cc1c0ffb8ef1e71e40210d3b0a8064c9d29571ed2904bf81", size = 57969, upload-time = "2026-03-15T14:28:24.864Z" },
 ]

 [[package]]
@@ -5760,18 +5556,6 @@ wheels = [
    { url = "https://files.pythonhosted.org/packages/3b/5d/63d4ae3b9daea098d5d6f5da83984853c1bbacd5dc826764b249fe119d24/requests_oauthlib-2.0.0-py2.py3-none-any.whl", hash = "sha256:7dd8a5c40426b779b0868c404bdef9768deccf22749cde15852df527e6269b36", size = 24179, upload-time = "2024-03-22T20:32:28.055Z" },
 ]

-[[package]]
-name = "requests-toolbelt"
-version = "1.0.0"
-source = { registry = "https://pypi.org/simple" }
-dependencies = [
-    { name = "requests" },
-]
-sdist = { url = "https://files.pythonhosted.org/packages/f3/61/d7545dafb7ac2230c70d38d31cbfe4cc64f7144dc41f6e4e4b78ecd9f5bb/requests-toolbelt-1.0.0.tar.gz", hash = "sha256:7681a0a3d047012b5bdc0ee37d7f8f07ebe76ab08caeccfc3921ce23c88d5bc6", size = 206888, upload-time = "2023-05-01T04:11:33.229Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/3f/51/d4db610ef29373b879047326cbf6fa98b6c1969d6f6dc423279de2b1be2c/requests_toolbelt-1.0.0-py2.py3-none-any.whl", hash = "sha256:cccfdd665f0a24fcf4726e690f65639d272bb0637b9b92dfd91a5568ccf6bd06", size = 54481, upload-time = "2023-05-01T04:11:28.427Z" },
-]
-
 [[package]]
 name = "requestsexceptions"
 version = "1.4.0"
@@ -5990,37 +5774,6 @@ dependencies = [
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/c5/06/c6dcc975a1e7d89bc764fd271da8138b318e18080b48e7f1acd2ab63df28/shodan-1.31.0.tar.gz", hash = "sha256:c73275386ea02390e196c35c660706a28dd4d537c5a21eb387ab6236fac251f6", size = 57939, upload-time = "2023-12-17T01:42:02.426Z" }

-[[package]]
-name = "simplejson"
-version = "4.1.1"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/0e/2a/54837395a3487c725669428d513293612a48d82b95a0642c936932e5d898/simplejson-4.1.1.tar.gz", hash = "sha256:c08eb9f7a90f77ae470e19a07472e9a79ebc0d1c2315d86a72767665bd5ba79f", size = 118860, upload-time = "2026-04-24T19:24:59.819Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/1e/25/39013ffe279d90093ec1c848565b3683c586906c10fa55d9000ec29d046b/simplejson-4.1.1-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:2867c64d92abd1992c15666fae198203093f593e43d6b81adf176bae530d493a", size = 111538, upload-time = "2026-04-24T19:22:49.051Z" },
-    { url = "https://files.pythonhosted.org/packages/f2/ae/2c272971c8a87e2539c54a98eb6ff037bee1e2e93943c3986cf7500a4f3a/simplejson-4.1.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:4c47c46e16c8ea9e4850061e6ed5aa2b9cd2074cb2274bfd9c138cba15ce7453", size = 90594, upload-time = "2026-04-24T19:22:50.408Z" },
-    { url = "https://files.pythonhosted.org/packages/4e/a2/6eebfb99dedc139f549200f61ade6d1890ac5707c5d427bdfa6fe39c9313/simplejson-4.1.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:e294e33dbf316a9bbdd4030d46503c9b0f19470ae7ad6af5bae6c426bc2e869f", size = 90718, upload-time = "2026-04-24T19:22:51.694Z" },
-    { url = "https://files.pythonhosted.org/packages/80/7e/c9e6c0c4ad8415e64dad0c47f619b556b02680a41631b4dbc281d55dc54d/simplejson-4.1.1-cp311-cp311-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:7ce252b28fddbdd83db5bd7d93dad2a8a591d7ada098afec9c1b23d6b722a7a4", size = 180901, upload-time = "2026-04-24T19:22:53.025Z" },
-    { url = "https://files.pythonhosted.org/packages/34/09/69e331e3994b1ed9be6ce9ace4ade704e7ed503edf869929ca7bb404eda8/simplejson-4.1.1-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:4c44ef6b02a4eb67ed17a72342341792149b3ff46f15426c26e970e49addf327", size = 178133, upload-time = "2026-04-24T19:22:54.574Z" },
-    { url = "https://files.pythonhosted.org/packages/5d/40/ed806f24afef295c1032448f5ff6f6f2979392d5645ddb9f4fed7f38194d/simplejson-4.1.1-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:82bfca2b85a34178c25829c703f0a9e9f113a5af7539285bd3efb583a0bf1ba3", size = 188155, upload-time = "2026-04-24T19:22:56.044Z" },
-    { url = "https://files.pythonhosted.org/packages/38/94/8d6f515b827b0f7881a49c8c1ac6920b7ae9428939ef04238c973278b42a/simplejson-4.1.1-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:0e4b23f71dd781f8830f1663dc01a4944d3dbf87a1f93d78fba1cf64722d0ccf", size = 176225, upload-time = "2026-04-24T19:22:57.981Z" },
-    { url = "https://files.pythonhosted.org/packages/c9/fd/6dffb4956563d48bbe46b91ff341adae34920e94008fd6b8d728072abfc7/simplejson-4.1.1-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:82fee635d7b73ad801030b05a75fbd34a098da0c2ecf600667a03636d09e1e42", size = 185535, upload-time = "2026-04-24T19:22:59.618Z" },
-    { url = "https://files.pythonhosted.org/packages/de/d2/a509ee37763e79aec75d68f8521db1440306edeba3b8b4064ab4ee8bf1d9/simplejson-4.1.1-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:68e62eda21192c5ea9bb92d571ca46a4477fef48762f50d433de2b4253051551", size = 179302, upload-time = "2026-04-24T19:23:01.324Z" },
-    { url = "https://files.pythonhosted.org/packages/d8/23/5b343bfd2a79d3b6818e4db3586c405a001a090d4c89d336e31273ce7177/simplejson-4.1.1-cp311-cp311-win32.whl", hash = "sha256:ffd3d82294b47f5ec64050021ace95fd62628a0c1cc8bbf4d06d2d1fb697e055", size = 88408, upload-time = "2026-04-24T19:23:02.808Z" },
-    { url = "https://files.pythonhosted.org/packages/38/04/df9b37aedbd524dca20840d25ebe01d6ae486b89792aeff5d15b9c4114f7/simplejson-4.1.1-cp311-cp311-win_amd64.whl", hash = "sha256:78a3fe0995be42bed62a26aa78e0e0b4d87c6545785346b9cc898f3389569a35", size = 90526, upload-time = "2026-04-24T19:23:04.408Z" },
-    { url = "https://files.pythonhosted.org/packages/60/25/e90998fe8e480eb43b966c09e835379887d427567ebd496563d3b1e16b19/simplejson-4.1.1-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:19040a17154dc03d289bab68d73ce0a6a0be01de30c584bbdd93490bead14b22", size = 112414, upload-time = "2026-04-24T19:23:06.084Z" },
-    { url = "https://files.pythonhosted.org/packages/9c/a0/abd4785f36c3400f1fbb21f517be39295a750a714f04b7ee175adf6ef580/simplejson-4.1.1-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:a94ebaecdbaa80d9551a3ec6bf0c9302fc8b53ab6c1b2bfd498a1df4cb28158d", size = 91120, upload-time = "2026-04-24T19:23:07.877Z" },
-    { url = "https://files.pythonhosted.org/packages/b8/78/fc060d2e3b13c6ec59288574b8efac64075e316b2afba4396a56b2422f78/simplejson-4.1.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:67341c95c0a168ab4a6d1e807e50463f1c8da932c3286d81e201266c427061fa", size = 91055, upload-time = "2026-04-24T19:23:09.264Z" },
-    { url = "https://files.pythonhosted.org/packages/0c/b6/156a8de1e1b47694f0e7de6675866936608d45dc68388fd017d36f8693be/simplejson-4.1.1-cp312-cp312-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:45ec18e337fec538b7e902d489505c450b2454653d1290f3f50385e6fd8aa607", size = 190297, upload-time = "2026-04-24T19:23:11.226Z" },
-    { url = "https://files.pythonhosted.org/packages/86/1c/e4d0eab695be3eb21d0f46bce820752031f03e7113f9c80a9b3c73ee7157/simplejson-4.1.1-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:820c69a4710400e9b248d5670647d60be58824369282d3925e516b3ff1a7cd82", size = 187002, upload-time = "2026-04-24T19:23:12.982Z" },
-    { url = "https://files.pythonhosted.org/packages/76/0e/7f5a59d29426b062d5928fb88b403c3f797129d53be7102f955dbe51aa44/simplejson-4.1.1-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:2e708d373a10e4378ef2d59f8361850c7150fd907ed49efe49bc5492160476d1", size = 195146, upload-time = "2026-04-24T19:23:14.517Z" },
-    { url = "https://files.pythonhosted.org/packages/78/18/9943db224dd4d5fa3c090c3e56a94c37b254338c83995ec5680285111c40/simplejson-4.1.1-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:980fc33353f81fd12d8c49d44f8c2760d1dc8192285e627c5180d141035b228a", size = 183931, upload-time = "2026-04-24T19:23:16.742Z" },
-    { url = "https://files.pythonhosted.org/packages/c2/08/9a690da9a766161c06c627d805362cf159f1abe480969372b2897649b955/simplejson-4.1.1-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:de2ed102fff88dacf543699f53ee3a533cc11539a39baa176b7e09dd783069d6", size = 192228, upload-time = "2026-04-24T19:23:18.33Z" },
-    { url = "https://files.pythonhosted.org/packages/05/88/bd8aad36b451ffb0e0a3f721d695a88befa6d1ac7d1e02ae788ca7ff4029/simplejson-4.1.1-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:2785ff8edc0e28bf773a32543a6bbed46351453c997b3f6709c744e3c2f7eabb", size = 187808, upload-time = "2026-04-24T19:23:21.165Z" },
-    { url = "https://files.pythonhosted.org/packages/04/ee/14f91db0d1f481533b651dafbf8cd0da088d9817f7af30c68f7f19f9c847/simplejson-4.1.1-cp312-cp312-win32.whl", hash = "sha256:2e0d5ead6d14610467ec356ec1f6b5d8a56aa216abaad8d41c8b873b16cf313f", size = 88512, upload-time = "2026-04-24T19:23:22.764Z" },
-    { url = "https://files.pythonhosted.org/packages/b9/c4/90de06b2d8737c68c05ff9274113f854dbf6a5f28b7a955212111672cb57/simplejson-4.1.1-cp312-cp312-win_amd64.whl", hash = "sha256:63a5451f557d6be48a231bae932458655c620902b868170b2f1c8afed496f6b4", size = 90748, upload-time = "2026-04-24T19:23:24.494Z" },
-    { url = "https://files.pythonhosted.org/packages/ce/6a/8b74c52ffd33dbbde00fe7251fee6a0acdc8cea33f7a43805aed258fb79b/simplejson-4.1.1-py3-none-any.whl", hash = "sha256:2ce92b3748f02423e26d2bfb636fb9d7a8f67c8f5854dcae69d350d123b2eee2", size = 69195, upload-time = "2026-04-24T19:24:57.962Z" },
-]
-
 [[package]]
 name = "six"
 version = "1.17.0"
@@ -6450,16 +6203,16 @@ wheels = [

 [[package]]
 name = "workos"
-version = "8.3.0"
+version = "6.0.8"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
    { name = "cryptography" },
    { name = "httpx" },
    { name = "pyjwt", extra = ["crypto"] },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/cd/f6/bb27fe77e70b5e2c5da72500ca0ece8b0e8318010fec92c31d68483314e3/workos-8.3.0.tar.gz", hash = "sha256:07b66c2fb287adb593e4d77a2e6cb05b48bd8ff0b2722f343d18eeb5e14f7472", size = 201587, upload-time = "2026-06-30T15:19:22.834Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/ca/0d/0a7f78912657f99412c788932ea1f3f4089916e77bdef7d2463842febe08/workos-6.0.8.tar.gz", hash = "sha256:43aa3f1992a0a4ca8933d9b6e5ada846dd3b1fe0ee10e64c876ee2000fc6090d", size = 178137, upload-time = "2026-04-24T18:48:03.203Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/49/ed/7e6fe07c5bc0222fd92c1cf1f3c4c24293e4e5fc7bb5d7df90e4ee61c17f/workos-8.3.0-py3-none-any.whl", hash = "sha256:d0fa842b93bfc5fb33bf49e69cf8c379936cf54b87c6e2f50bcc6dd2e84f8fe4", size = 592275, upload-time = "2026-06-30T15:19:21.333Z" },
+    { url = "https://files.pythonhosted.org/packages/b2/3f/3d96da80d650b2f97d58af626053354584f619dbb769051e118bd9cd1ca5/workos-6.0.8-py3-none-any.whl", hash = "sha256:a00dd4930333aded2babbba824f8032eea05c5ca8c44d04a3fa068cf6be6e21a", size = 524505, upload-time = "2026-04-24T18:48:01.389Z" },
 ]

 [[package]]
@@ -7,11 +7,5 @@ component_management:
      paths:
        - "api/**"

-flags:
-  api:
-    paths:
-      - "api/**"
-    carryforward: true
-
 comment:
  layout: "header, diff, flags, components"
@@ -18,12 +18,15 @@ spec:
  triggers:
    - type: {{ .Values.worker.keda.triggerType }}
      metadata:
-        userName: {{ .Values.worker.keda.postgresql.userName | quote }}
-        passwordFromEnv: {{ .Values.worker.keda.postgresql.passwordFromEnv | quote }}
-        host: {{ .Values.worker.keda.postgresql.host | default (printf "%s-postgresql.%s.svc.cluster.local" .Release.Name .Release.Namespace) | quote }}
-        port: {{ .Values.worker.keda.postgresql.port | quote }}
-        dbName: {{ .Values.worker.keda.postgresql.database | default .Values.postgresql.auth.database | quote }}
-        sslmode: {{ .Values.worker.keda.postgresql.sslmode | quote }}
-        query: {{ .Values.worker.keda.query | quote }}
-        targetQueryValue: {{ .Values.worker.keda.targetQueryValue | quote }}
+        userName: "postgres"
+        passwordFromEnv: POSTGRES_ADMIN_PASSWORD
+        host: {{ .Release.Name }}-postgresql
+        port: {{ .Values.postgresql.port | quote }}
+        dbName: {{ .Values.postgresql.auth.database | quote }}
+        sslmode: disable
+        # Query for KEDA to count the number of scans that are in executing, available, or scheduled states,
+        # where the scheduled time is within the last 2 hours and is before NOW(). Used for scaling workers.
+        query: >-
+          SELECT COUNT(*) FROM scans WHERE ((state='executing' OR state='available' OR state='scheduled') and scheduled_at < NOW() and scheduled_at > NOW() - INTERVAL '2 hours')
+        targetQueryValue: "1"
 {{- end }}
@@ -427,61 +427,10 @@ worker:
    pollingInterval: 30
    # -- The cooldown period in seconds for scaling
    cooldownPeriod: 120
-    # -- The KEDA scaler type. Only `postgresql` is supported by the default query below.
+    # -- The trigger type for scaling (cpu or memory)
    triggerType: "postgresql"
-    # PostgreSQL connection used by the scaler query. The KEDA operator opens this
-    # connection from its own namespace, so `host` must resolve from there. The
-    # defaults target the bundled postgresql subchart; set them explicitly when
-    # using an external database (postgresql.enabled: false).
-    postgresql:
-      # -- Scaler database host. Defaults to the bundled "<release>-postgresql.<namespace>.svc.cluster.local" service.
-      host: ""
-      # -- Scaler database port.
-      port: "5432"
-      # -- Scaler database name. Defaults to `postgresql.auth.database`.
-      database: ""
-      # -- User the scaler authenticates as.
-      userName: "postgres"
-      # -- Name of an env var on the worker container holding the password.
-      passwordFromEnv: "POSTGRES_ADMIN_PASSWORD"
-      # -- sslmode for the scaler connection.
-      sslmode: "disable"
-    # -- The scaler divides the query result by this value to get the desired replica count.
-    targetQueryValue: "1"
-    # -- Query the scaler runs to measure pending work. It replaces the previous
-    # 2-hour scheduled-only window, which missed manual scans, older backlogs and
-    # in-progress scans. Override to tune scaling for your workload.
-    #
-    # The default sums three signals:
-    #   1. Scans executing or available, bounded to rows updated in the last 24h so
-    #      orphaned rows do not pin the worker up, plus scheduled scans that are due
-    #      (no lower bound, so an overdue backlog still scales up).
-    #   2. Scan tasks published in the last 48h that no worker has finished. A PENDING
-    #      TaskResult is written at publish time (before_task_publish in api/signals.py),
-    #      so Beat's daily publishes are visible even with zero workers. Signal 1 alone
-    #      deadlocks with minReplicas 0: every scan row after the first is created by
-    #      the worker, so once the initial row ages out of the 24h bound there is
-    #      nothing to count and nothing to create more.
-    #   3. Non-scan tasks pending in the last hour. Provider connection checks,
-    #      deletions, reports and backfills never touch the scans table, so without
-    #      this they are never picked up while the worker is scaled to zero.
-    #      This includes reconcile-orphan-tasks, a Beat watchdog that runs every two
-    #      minutes, so with minReplicas 0 the worker is woken about that often. Add
-    #      it to the excluded task names below, or raise cooldownPeriod, if you would
-    #      rather trade watchdog latency for longer idle periods.
-    query: >-
-      SELECT
-      (SELECT COUNT(*) FROM scans
-      WHERE (state IN ('executing', 'available') AND updated_at > NOW() - INTERVAL '24 hours')
-      OR (state = 'scheduled' AND scheduled_at < NOW()))
-      + (SELECT COUNT(*) FROM django_celery_results_taskresult
-      WHERE task_name IN ('scan-perform', 'scan-perform-scheduled')
-      AND status IN ('PENDING', 'RECEIVED', 'STARTED')
-      AND date_created > NOW() - INTERVAL '48 hours')
-      + (SELECT COUNT(*) FROM django_celery_results_taskresult
-      WHERE task_name NOT IN ('scan-perform', 'scan-perform-scheduled')
-      AND status IN ('PENDING', 'RECEIVED', 'STARTED')
-      AND date_created > NOW() - INTERVAL '1 hour')
+    # -- The target utilization percentage for the worker pods
+    value: "50"

 worker_beat:
  # This will set the replicaset count more information can be found here: https://kubernetes.io/docs/concepts/workloads/controllers/replicaset/
@@ -64,7 +64,7 @@ services:
        condition: service_healthy

  postgres:
-    image: postgres:16-alpine@sha256:57c72fd2a128e416c7fcc499958864df5301e940bca0a56f58fddf30ffc07777
+    image: postgres:16.3-alpine3.20@sha256:36ed71227ae36305d26382657c0b96cbaf298427b3f1eaeb10d77a6dea3eec41
    hostname: "postgres-db"
    volumes:
      - ./_data/postgres:/var/lib/postgresql/data
@@ -88,7 +88,7 @@ services:
      retries: 5

  valkey:
-    image: valkey/valkey:8-alpine@sha256:a038175878d66b9d274fbf8be73c0305e93798b83917647f167e18cef3c71eec
+    image: valkey/valkey:7-alpine3.19@sha256:4054fe7fc607b9326ac7c4691ed26e9670d2ff17a9fb28c2577adecf928acbcc
    hostname: "valkey"
    volumes:
      - ./_data/valkey:/data
@@ -60,7 +60,7 @@ services:
      start_period: 60s

  postgres:
-    image: postgres:16-alpine@sha256:57c72fd2a128e416c7fcc499958864df5301e940bca0a56f58fddf30ffc07777
+    image: postgres:16.3-alpine3.20@sha256:36ed71227ae36305d26382657c0b96cbaf298427b3f1eaeb10d77a6dea3eec41
    hostname: "postgres-db"
    volumes:
      - ./_data/postgres:/var/lib/postgresql/data
@@ -80,7 +80,7 @@ services:
      retries: 5

  valkey:
-    image: valkey/valkey:8-alpine@sha256:a038175878d66b9d274fbf8be73c0305e93798b83917647f167e18cef3c71eec
+    image: valkey/valkey:7-alpine3.19@sha256:4054fe7fc607b9326ac7c4691ed26e9670d2ff17a9fb28c2577adecf928acbcc
    hostname: "valkey"
    volumes:
      - ./_data/valkey:/data
@@ -39,7 +39,7 @@ The AWS provider implementation follows the general [Provider structure](/develo
 - **Key AWS Responsibilities:**
    - Receives an `AwsProvider` instance to access session, identity, and configuration.
    - Manages clients for all services by regions.
-    - Provides `__threading_call__` method to make boto3 calls in parallel. By default, these calls are made by region, but it can be overridden with the first parameter of the method and use by resource.
+    - Provides `__threading_call__` method to make boto3 calls in parallel. By default, this calls are made by region, but it can be overridden with the first parameter of the method and use by resource.
    - Exposes common audit context (`audited_account`, `audited_account_arn`, `audited_partition`, `audited_resources`) to subclasses.

 ### Exception Handling
@@ -59,7 +59,7 @@ The generic service pattern is described in [service page](/developer-guide/serv
 - Directly in the code, in location [`prowler/providers/aws/services/`](https://github.com/prowler-cloud/prowler/tree/master/prowler/providers/aws/services)
 - In the [Prowler Hub](https://hub.prowler.com/). For a more human-readable view.

-The best reference to understand how to implement a new service is following the [service implementation documentation](/developer-guide/services#adding-a-new-service) and taking other services already implemented as reference. In next subsection you can find a list of common patterns that are used across all AWS services.
+The best reference to understand how to implement a new service is following the [service implementation documentation](/developer-guide/services#adding-a-new-service) and taking other services already implemented as reference. In next subsection you can find a list of common patterns that are used accross all AWS services.

 ### AWS Service Common Patterns

@@ -68,7 +68,7 @@ The best reference to understand how to implement a new service is following the
 - The constructor (`__init__`) always calls `super().__init__` with the service name and provider (e.g. `super().__init__(__class__.__name__, provider))`). Ensure that the service name in boto3 is the same that you use in the constructor. Usually is used the `__class__.__name__` to get the service name because it is the same as the class name.
 - Resource containers **must** be initialized in the constructor. They should be dictionaries, with the key being the resource ARN or equivalent unique identifier and the value being the resource object.
 - Resource discovery and attribute collection are parallelized using `self.__threading_call__`, typically by region or resource, for performance. The first parameter of the method is the iterator, if not provided, it will be the region; but if present indicate an array of the resources to be processed.
- Resource filtering is consistently enforced using `self.audit_resources` attribute and `is_resource_filtered` function, it is used to see if user has provided some resource that is not in the audit scope, so we can skip it in the service logic. Normally it is used before storing the resource in the service container as follows: `if not self.audit_resources or (is_resource_filtered(resource["arn"], self.audit_resources)):`.
+- Resource filtering is consistently enforced using `self.audit_resources` attribute and `is_resource_filtered` function, it is used to see if user has provided some resource that is not in the audit scope, so we can skip it in the service logic. Normally it is used befor storing the resource in the service container as follows: `if not self.audit_resources or (is_resource_filtered(resource["arn"], self.audit_resources)):`.
 - All AWS resources are represented as Pydantic `BaseModel` classes, providing type safety and structured access to resource attributes.
 - AWS API calls are wrapped in try/except blocks, with specific handling for `ClientError` and generic exceptions, always logging errors.
 - If ARN is not present for some resource, it can be constructed using string interpolation, always including partition, service, region, account, and resource ID.
@@ -162,7 +162,7 @@ When you instantiate `Check_Report_AWS`, you must provide the check metadata and

 If the resource object does not contain the required attributes, you must set them manually in the check logic.

-Other attributes are inherited from the `Check_Report` class, from those you **always** have to set the `status` and `status_extended` attributes in the check logic.
+Other attributes are inherited from the `Check_Report` class, from that ones you **always** have to set the `status` and `status_extended` attributes in the check logic.

 #### Example Usage

@@ -57,7 +57,7 @@ The generic service pattern is described in [service page](/developer-guide/serv
 - Directly in the code, in location [`prowler/providers/azure/services/`](https://github.com/prowler-cloud/prowler/tree/master/prowler/providers/azure/services)
 - In the [Prowler Hub](https://hub.prowler.com/) for a more human-readable view.

-The best reference to understand how to implement a new service is following the [service implementation documentation](/developer-guide/services#adding-a-new-service) and taking other services already implemented as reference. In next subsection you can find a list of common patterns that are used across all Azure services.
+The best reference to understand how to implement a new service is following the [service implementation documentation](/developer-guide/services#adding-a-new-service) and taking other services already implemented as reference. In next subsection you can find a list of common patterns that are used accross all Azure services.

 ### Azure Service Common Patterns

@@ -172,7 +172,7 @@ else:

 ### Resource Identification in Prowler

-Each check **must** populate the report with a unique identifier for the audited resource. This identifier or identifiers are going to depend on the provider and the resource that is being audited. Here are the criteria for each provider:
+Each check **must** populate the report with an unique identifier for the audited resource. This identifier or identifiers are going to depend on the provider and the resource that is being audited. Here are the criteria for each provider:

 - AWS
    - Amazon Resource ID — `report.resource_id`.
@@ -102,7 +102,7 @@ The generic service pattern is described in [service page](/developer-guide/serv
 - Directly in the code, in location [`prowler/providers/gcp/services/`](https://github.com/prowler-cloud/prowler/tree/master/prowler/providers/gcp/services)
 - In the [Prowler Hub](https://hub.prowler.com/) for a more human-readable view.

-The best reference to understand how to implement a new service is following the [service implementation documentation](/developer-guide/services#adding-a-new-service) and taking other services already implemented as reference. In next subsection you can find a list of common patterns that are used across all GCP services.
+The best reference to understand how to implement a new service is following the [service implementation documentation](/developer-guide/services#adding-a-new-service) and taking other services already implemented as reference. In next subsection you can find a list of common patterns that are used accross all GCP services.

 ### GCP Service Common Patterns

@@ -113,7 +113,7 @@ The best reference to understand how to implement a new service is following the
 - Only projects with the API enabled are included in the audit scope.
 - Resource discovery and attribute collection can be parallelized using `self.__threading_call__`, typically by region/zone or resource.
 - All GCP resources are represented as Pydantic `BaseModel` classes, providing type safety and structured access to resource attributes.
- Each GCP API call is wrapped in try/except blocks, always logging errors.
+- Each GCP API calls are wrapped in try/except blocks, always logging errors.
 - **Retry Configuration**: All `request.execute()` calls must include `num_retries=DEFAULT_RETRY_ATTEMPTS` for automatic retry on rate limiting errors (HTTP 429).
 - Tags and additional attributes that cannot be retrieved from the default call should be collected and stored for each resource using dedicated methods and threading.

@@ -161,7 +161,7 @@ When you instantiate `Check_Report_GCP`, you must provide the check metadata and
    - Defaults to "global" if none are available.

 All these attributes can be overridden by passing the corresponding argument to the constructor. If the resource object does not contain the required attributes, you must set them manually.
-Other attributes are inherited from the `Check_Report` class, from those you **always** have to set the `status` and `status_extended` attributes in the check logic.
+Others attributes are inherited from the `Check_Report` class, from that ones you **always** have to set the `status` and `status_extended` attributes in the check logic.

 #### Example Usage

@@ -75,7 +75,7 @@ Remember, our community is here to help! If you need guidance, do not hesitate t



-## Setting Up Your Development Environment
+## Setting up your development environment

 ### Prerequisites

@@ -352,7 +352,7 @@ result = await self.api_client.poll_task_until_complete(

 ### Tool Docstrings

-Tool docstrings become the description that is going to be read by the LLM. Provide clear usage instructions and common workflows:
+Tool docstrings become description that is going to be read by the LLM. Provide clear usage instructions and common workflows:

 ```python
 async def search_items(self, status: str = Field(...)) -> dict:
@@ -31,7 +31,7 @@ Before implementing a new provider, you need to determine which type it belongs

 #### Decision Criteria

-Once you have decided the provider you want or need to add to Prowler, the next step is to study how to retrieve data from it. Based on that, the provider will fall into one of the following types: SDK, API or Tool/Wrapper (maybe in the future there will be new types but for now these are the only ones).
+Once you have decided the provider you want or need to add to Prowler, the next step is to study how to retrieve data from it. Based on that, the provider will fall into one of the following types: SDK, API or Tool/Wrapper (maybe in the future there will be new types but for now this are the only ones).

 **Choose SDK Provider if:**

@@ -658,7 +658,7 @@ uv run pytest -n auto \
  tests/lib/outputs/compliance/
 ```

-## Version Handling
+## Version handling

 Prowler matches frameworks by concatenating `Framework` and `Version`. A missing or empty `Version` collapses several frameworks to the same key and breaks CLI filtering with `--compliance`.

@@ -756,7 +756,7 @@ uv run pytest -n auto tests/lib/check/universal_compliance_models_test.py \

 For guidance on writing Prowler SDK tests, refer to [Unit Testing](/developer-guide/unit-testing).

-## Running and Listing Your Framework
+## Running and listing your framework

 Once the file is in place, the CLI auto-discovers it:

@@ -769,7 +769,7 @@ prowler <provider> --compliance <framework_key> --list-compliance-requirements <

 For end-user-facing tutorials (recommended for high-profile frameworks), add a dedicated page under `docs/user-guide/compliance/tutorials/` and register it in the `"Compliance"` group of `docs/docs.json`. See `docs/user-guide/compliance/tutorials/threatscore.mdx` as a reference.

-## Submitting the Pull Request
+## Submitting the pull request

 Before opening the pull request:

@@ -794,7 +794,7 @@ The following issues are the most common when contributing a compliance framewor
 - **CSV file is missing after the scan (legacy).** The transformer class is not registered in `prowler/lib/outputs/compliance/compliance_output.py`, or `transform()` raises silently. Run the scan with `--log-level DEBUG`.
 - **Findings do not roll up under a requirement.** A check listed in `Checks` either does not exist for that provider or is spelled incorrectly. Run `--list-checks | grep <check_name>` to confirm, or run the check-existence cross-check from "Validating Your Framework".

-## Reference Examples
+## Reference examples

 Use the following files as templates when modeling a new contribution.

@@ -9,7 +9,7 @@ First ensure that the provider you want to add the service is already created. I
 </Note>
 ## Introduction

-In Prowler, a **service** represents a specific solution or resource offered by one of the supported [Prowler Providers](/developer-guide/provider), for example, [EC2](https://aws.amazon.com/ec2/) in AWS, or [Microsoft Exchange](https://www.microsoft.com/en-us/microsoft-365/exchange/exchange-online) in M365. Services are the building blocks that allow Prowler to interact directly with the various resources exposed by each provider.
+In Prowler, a **service** represents a specific solution or resource offered by one of the supported [Prowler Providers](/developer-guide/provider), for example, [EC2](https://aws.amazon.com/ec2/) in AWS, or [Microsoft Exchange](https://www.microsoft.com/en-us/microsoft-365/exchange/exchange-online) in M365. Services are the building blocks that allow Prowler interact directly with the various resources exposed by each provider.

 Each service is implemented as a class that encapsulates all the logic, data models, and API interactions required to gather and store information about that service's resources. All of this data is used by the [Prowler checks](/developer-guide/checks) to generate the security findings.

@@ -21,9 +21,9 @@ Within this folder the following files are also to be created:

 - `__init__.py` (empty) – Ensures Python recognizes this folder as a package.
 - `<new_service_name>_service.py` – Contains all the logic and API calls of the service.
- `<new_service_name>_client.py` – Contains the initialization of the freshly created service's class so that the checks can use it.
+- `<new_service_name>_client_.py` – Contains the initialization of the freshly created service's class so that the checks can use it.

-Once the files are created, you can check that the service has been created by running the following command: `uv run python prowler-cli.py <provider> --list-services | grep <new_service_name>`.
+Once the files are create, you can check that the service has been created by running the following command: `uv run python prowler-cli.py <provider> --list-services | grep <new_service_name>`.

 ## Service Structure and Initialisation

@@ -31,7 +31,7 @@ The Prowler's service structure is as outlined below. To initialise it, just imp

 ### Service Base Class

-All Prowler provider services should inherit from a common base class to avoid code duplication. This base class handles initialization and storage of functions and objects needed across services. The exact implementation depends on the provider's API requirements, but the following are the most common responsibilities:
+All Prowler provider service should inherit from a common base class to avoid code duplication. This base class handles initialization and storage of functions and objects needed across services. The exact implementation depends on the provider's API requirements, but the following are the most common responsibilities:

 - Initialize/store clients to interact with the provider's API.
 - Store the audit and fixer configuration.
@@ -164,7 +164,6 @@
                "group": "Compliance",
                "pages": [
                  "user-guide/compliance/tutorials/compliance",
-                  "user-guide/compliance/tutorials/cross-provider-type-compliance",
                  "user-guide/compliance/tutorials/cross-provider-compliance",
                  "user-guide/compliance/tutorials/threatscore"
                ]
@@ -16,7 +16,7 @@ prowler <provider>
 ![Prowler Execution](/images/short-display.png)

 <Note>
-Running the `prowler` command without options will use environment variable credentials. Refer to the Authentication section of each provider for credential configuration details.
+Running the `prowler` command without options will uses environment variable credentials. Refer to the Authentication section of each provider for credential configuration details.

 </Note>
 ## Verbose Output
@@ -6,16 +6,11 @@ Complete reference guide for all tools available in the Prowler MCP Server. Tool

 ## Tool Categories Summary

-| Category | Tool Count | Authentication Required | Availability |
-|----------|------------|------------------------|--------------|
-| Prowler Hub | 10 tools | No | Cloud and Local MCP Server |
-| Prowler Documentation | 2 tools | No | Cloud and Local MCP Server |
-| Prowler Cloud, Private Cloud & Local Server | 49 tools | Yes | Cloud and Local MCP Server |
-| Prowler Cloud management | 32 tools | Yes | Cloud MCP Server only |
-
-<Note>
-48 of the 49 Prowler tools are available on both servers. `prowler_schedule_daily_scan` is the exception: it is Local-only, because the Cloud MCP Server supersedes it with the `prowler_cloud_*` [Scan Scheduling](#scan-scheduling) tools.
-</Note>
+| Category | Tool Count | Authentication Required |
+|----------|------------|------------------------|
+| Prowler Hub | 10 tools | No |
+| Prowler Documentation | 2 tools | No |
+| Prowler Cloud, Private Cloud & Local Server | 39 tools | Yes |

 ## Tool Naming Convention

@@ -24,11 +19,6 @@ All tools follow a consistent naming pattern with prefixes:
 - `prowler_hub_*` - Prowler Hub catalog and compliance tools
 - `prowler_docs_*` - Prowler documentation search and retrieval
 - `prowler_*` - Prowler Cloud, Prowler Private Cloud & Prowler Local Server management tools
- `prowler_cloud_*` - Prowler Cloud-only management tools
-
-<Note>
-`prowler_cloud_*` tools are exposed only by the [Cloud MCP Server](/getting-started/products/prowler-mcp#cloud-vs-local-mcp-server) at `https://mcp.prowler.com/mcp`, because they manage features that exist only in Prowler Cloud. Every other tool is available on both the Cloud and Local MCP Server.
-</Note>

 ## Prowler Tools

@@ -69,13 +59,9 @@ Tools for managing and monitoring security scans.
 - **`prowler_list_scans`** - List and filter security scans across all providers
 - **`prowler_get_scan`** - Get comprehensive details about a specific scan (progress, duration, resource counts)
 - **`prowler_trigger_scan`** - Trigger a manual security scan for a provider
- **`prowler_schedule_daily_scan`** - Schedule automated daily scans for continuous monitoring (**Local MCP Server only**)
+- **`prowler_schedule_daily_scan`** - Schedule automated daily scans for continuous monitoring
 - **`prowler_update_scan`** - Update scan name for better organization

-<Note>
-`prowler_schedule_daily_scan` is the scheduling tool for a self-hosted deployment, and it only does one thing: a daily scan. The Cloud MCP Server does not expose it — Prowler Cloud replaces it with the richer [Scan Scheduling](#scan-scheduling) tools, which add interval, weekly, and monthly frequencies, per-provider schedule retrieval, and bulk apply across providers.
-</Note>
-
 ### Resources Management

 Tools for searching, viewing, and analyzing cloud resources discovered by Prowler.
@@ -103,29 +89,6 @@ Tools for managing finding muting, including pattern-based bulk muting (mutelist
 - **`prowler_update_mute_rule`** - Update a mute rule's name, reason, or enabled status
 - **`prowler_delete_mute_rule`** - Delete a mute rule from the system

-### Integrations Management
-
-Tools for managing where Prowler sends its results: Amazon S3 buckets, AWS Security Hub, and Jira. Requires the **Manage Integrations** permission.
-
-#### Integration Lifecycle
-
- **`prowler_list_integrations`** - List the configured integrations with their enabled and connection state, optionally filtered by integration type
- **`prowler_get_integration`** - Get an integration with its complete, type-specific configuration (bucket and output directory, Security Hub settings and enabled regions, or Jira projects and issue types)
- **`prowler_update_integration`** - Update credentials, configuration, attached providers, or enabled state. Configuration changes are merged with the current one, and the connection is re-checked automatically whenever credentials, configuration, or attached providers change
- **`prowler_delete_integration`** - Permanently remove an integration and its stored credentials
- **`prowler_test_integration_connection`** - Check an integration connection and refresh the configuration Prowler discovers from the remote system (Jira projects, Security Hub regions)
-
-#### Integration Setup
-
- **`prowler_create_amazon_s3_integration`** - Export scan outputs (CSV, HTML, OCSF JSON, compliance reports) to an S3 bucket, using an IAM role or static credentials
- **`prowler_create_aws_security_hub_integration`** - Send findings to AWS Security Hub in ASFF format for a single AWS provider, reusing the provider credentials or dedicated ones
- **`prowler_create_jira_integration`** - Connect an Atlassian Jira site so findings can be turned into work items. Tenant-wide, not attached to any provider
-
-#### Jira Operations
-
- **`prowler_get_jira_issue_types`** - List the issue types available in a Jira project, fetched live from Jira
- **`prowler_send_findings_to_jira`** - Create one Jira work item per finding, with its severity, resource, risk, and remediation steps
-
 ### Attack Paths Analysis

 Tools for analyzing privilege escalation chains and security misconfigurations using graph-based analysis. Attack Paths maps relationships between cloud resources, permissions, and security findings to detect how privileges can be escalated and how misconfigurations can be exploited.
@@ -159,78 +122,6 @@ Tools for browsing RBAC roles and managing the role assigned to a user. A user h
 - **`prowler_get_user_roles`** - List the roles assigned to a specific user, with the capabilities each role grants
 - **`prowler_set_user_role`** - Set the role a user holds, replacing the role they had before (idempotent)

-## Prowler Cloud Tools
-
-Manage Prowler Cloud-only features and configuration. **Requires authentication.**
-
-<Note>
-These tools are available **only on the Cloud MCP Server** (`https://mcp.prowler.com/mcp`). A Local MCP Server does not expose them, because the features they manage exist only in Prowler Cloud.
-</Note>
-
-### Scan Configurations
-
-Tools for managing reusable scan configurations — per-provider check and compliance selections — and attaching them to providers. Providers without a configuration attached use the default.
-
- **`prowler_cloud_list_scan_configurations`** - List and filter the scan configurations defined in the tenant
- **`prowler_cloud_get_scan_configuration`** - Retrieve a scan configuration including its full configuration body
- **`prowler_cloud_get_scan_configuration_schema`** - Fetch the JSON Schema describing the keys a valid configuration body may set, optionally filtered to a single provider type
- **`prowler_cloud_create_scan_configuration`** - Create a scan configuration and optionally attach it to providers
- **`prowler_cloud_update_scan_configuration`** - Update a configuration's name, body, and/or attached providers
- **`prowler_cloud_delete_scan_configuration`** - Delete a scan configuration; attached providers revert to the default
-
-### Findings Triage
-
-Tools for recording a review decision on a finding and documenting the reasoning. Triage is keyed on the stable finding UID returned by `prowler_search_security_findings` and `prowler_get_finding_details`.
-
-<Note>
-Triage is distinct from [muting](#muting-management). Use mute rules and the mutelist to **suppress** findings; use triage to **record a decision** and its rationale while the finding stays visible. See the [Findings Triage tutorial](/user-guide/tutorials/prowler-app-findings-triage).
-</Note>
-
- **`prowler_cloud_list_finding_triages`** - List and filter persisted triage records by status, provider, check, and more
- **`prowler_cloud_get_finding_triage`** - Retrieve a single finding's triage state by finding UID
- **`prowler_cloud_set_finding_triage_status`** - Set a finding's triage status (`open`, `under_review`, `remediating`, `risk_accepted`, `false_positive`), optionally attaching a note. The `resolved` and `reopened` statuses are system-managed and cannot be set directly
- **`prowler_cloud_list_finding_triage_notes`** - List the notes attached to a finding's triage, newest first
- **`prowler_cloud_create_finding_triage_note`** - Add a new note to a finding's triage
- **`prowler_cloud_update_finding_triage_note`** - Update the body of an existing note
- **`prowler_cloud_delete_finding_triage_note`** - Delete a note from a finding's triage
-
-### Scan Scheduling
-
-Tools for configuring recurring scans. One schedule exists per provider, with daily, interval, weekly, or monthly frequency. These replace the Local-only `prowler_schedule_daily_scan`, which can only set up a daily scan. See the [Scan Scheduling tutorial](/user-guide/tutorials/prowler-scan-scheduling).
-
- **`prowler_cloud_list_scan_schedules`** - List scan schedules, one per visible provider
- **`prowler_cloud_get_scan_schedule`** - Retrieve a provider's schedule including all per-frequency fields
- **`prowler_cloud_set_scan_schedule`** - Configure or update a single provider's recurring scan schedule
- **`prowler_cloud_bulk_set_scan_schedules`** - Apply one schedule to many providers at once
- **`prowler_cloud_delete_scan_schedule`** - Delete a provider's scan schedule
-
-### Alerts
-
-Tools for notifying recipients when scan results match a rule condition. See the [Alerts tutorial](/user-guide/tutorials/prowler-alerts).
-
-#### Alert Rules
-
- **`prowler_cloud_list_alert_rules`** - List and filter the custom alert rules defined in the tenant
- **`prowler_cloud_get_alert_rule`** - Retrieve an alert rule including its condition DSL and recipient emails
- **`prowler_cloud_create_alert_rule`** - Create a tenant-scoped alert rule
- **`prowler_cloud_update_alert_rule`** - Update an alert rule; only the fields provided change
- **`prowler_cloud_delete_alert_rule`** - Delete an alert rule
- **`prowler_cloud_list_alert_rule_events`** - List the fired-alert history for a single rule, newest first
- **`prowler_cloud_build_alert_rule_condition`** - Build a condition from a findings filter and dry-run it in one call to preview what would match. Nothing is persisted
-
-#### Alert Recipients
-
- **`prowler_cloud_list_alert_recipients`** - List alert recipients with their confirmation status
- **`prowler_cloud_get_alert_recipient`** - Retrieve a single recipient with its confirmation status
- **`prowler_cloud_create_alert_recipient`** - Register a new recipient email
- **`prowler_cloud_resend_alert_recipient_confirmation`** - Re-send the confirmation email to a pending or unsubscribed recipient
- **`prowler_cloud_delete_alert_recipient`** - Delete an alert recipient
-
-#### Alert Events
-
- **`prowler_cloud_list_alert_events`** - List the fired alert events for the tenant
- **`prowler_cloud_get_alert_event`** - Retrieve a single alert event including its matched rule and scan
-
 ## Prowler Hub Tools

 Access Prowler's security check catalog and compliance frameworks. **No authentication required.**
@@ -271,8 +162,7 @@ Search and access official Prowler documentation. **No authentication required.*
 - Use natural language to interact with the tools through your AI assistant
 - Tools can be combined for complex workflows
 - Filter options are available on most list tools
- Authentication is only required for the `prowler_*` and `prowler_cloud_*` tools; Prowler Hub and Prowler Documentation tools work without a key
- If a `prowler_cloud_*` tool is missing from your client, you are connected to a Local MCP Server — point it at `https://mcp.prowler.com/mcp` instead
+- Authentication is only required for Prowler tools (Prowler Cloud, Prowler Private Cloud, or Prowler Local Server)

 ## Additional Resources

@@ -6,7 +6,7 @@ title: 'Microsoft Defender for Cloud'

 ---

-## Overview
+## **Overview**

 If you're using Microsoft Defender for Cloud to monitor your Azure infrastructure, Prowler can complement it with fully transparent, customizable scans across Azure, AWS, GCP, and Kubernetes. Prowler helps you validate policies, automate compliance, and gain deeper visibility—all from the CLI, API or our Prowler UI.

@@ -19,7 +19,7 @@ You can run Prowler alongside Defender for Cloud to:

 ---

-## Why Use Prowler with Defender for Cloud
+## **Why use Prowler with Defender for Cloud**

 Microsoft Defender for Cloud offers centralized dashboards, alerting, and some cross-cloud coverage. Prowler provides full transparency and control over what’s being checked and how those checks work—no vendor lock-in, no surprises.

@@ -32,11 +32,11 @@ Use them together to get:

 ---

-## Quickstart
+## **Quickstart**

 Here’s how to install Prowler and run a scan in your Azure account.

-### 1\. Install Prowler
+### **1\. Install Prowler**

 ```
 git clone https://github.com/prowler-cloud/prowler
@@ -44,7 +44,7 @@ cd prowler
 ./install.sh
 ```

-### 2\. Authenticate with Azure
+### **2\. Authenticate with Azure**

 Make sure you're signed in and select your subscription:

@@ -53,7 +53,7 @@ az login
 export AZURE_SUBSCRIPTION_ID=$(az account show --query id -o tsv)
 ```

-### 3\. Run a Scan
+### **3\. Run a scan**

 ```
 ./prowler -p Azure -f az-aks -f az-general
@@ -61,7 +61,7 @@ export AZURE_SUBSCRIPTION_ID=$(az account show --query id -o tsv)

 This will run checks focused on Azure Kubernetes Service (AKS) and general Azure best practices.

-### 4\. Review Results
+### **4\. Review results**

 ```
 cat output/prowler-output-*.json
@@ -72,7 +72,7 @@ You can export findings in JSON, CSV, JUnit, HTML, or AWS Security Hub–compati

 ---

-## Compare Capabilities
+## **Compare capabilities**

 | Feature | Microsoft Defender for Cloud | Prowler |
 | ----- | ----- | ----- |
@@ -86,7 +86,7 @@ You can export findings in JSON, CSV, JUnit, HTML, or AWS Security Hub–compati

 ---

-## Common Use Cases
+## **Common use cases**

 **✅ Validate policies**
 Run Prowler to confirm your Azure policies are configured as expected and compliant with frameworks like CIS or NIST.
@@ -178,9 +178,9 @@ The available versions of Prowler Local Server are the following:
 - `v4-latest`: in sync with `v4` branch (please note that it is not a stable version)
 - `v3-latest`: in sync with `v3` branch (please note that it is not a stable version)
 - `<x.y.z>` (release): you can find the releases [here](https://github.com/prowler-cloud/prowler/releases), those are stable releases.
- `stable`: this tag always points to the latest release.
- `v4-stable`: this tag always points to the latest release for v4.
- `v3-stable`: this tag always points to the latest release for v3.
+- `stable`: this tag always point to the latest release.
+- `v4-stable`: this tag always point to the latest release for v4.
+- `v3-stable`: this tag always point to the latest release for v3.

 The container images are available here:

@@ -234,9 +234,9 @@ The available versions of Prowler CLI are the following:
 - `v4-latest`: in sync with `v4` branch (please note that it is not a stable version)
 - `v3-latest`: in sync with `v3` branch (please note that it is not a stable version)
 - `<x.y.z>` (release): you can find the releases [here](https://github.com/prowler-cloud/prowler/releases), those are stable releases.
- `stable`: this tag always points to the latest release.
- `v4-stable`: this tag always points to the latest release for v4.
- `v3-stable`: this tag always points to the latest release for v3.
+- `stable`: this tag always point to the latest release.
+- `v4-stable`: this tag always point to the latest release for v4.
+- `v3-stable`: this tag always point to the latest release for v3.

 The container images are available here:

@@ -4,7 +4,7 @@ title: "AWS Marketplace"

 This section contains the instructions to subscribe to **Prowler Cloud** through the **AWS Marketplace**.

-## How to Subscribe
+## How to subscribe

 To get to the **Prowler Cloud** product listing in the AWS Marketplace, and click the `View purchase options` button:

@@ -16,15 +16,15 @@ To get to the **Prowler Cloud** product listing in the AWS Marketplace, and clic

    ![](/images/aws-marketplace/marketplace-subscribe.png)

-## Set Up Your Account
+## Set up your account

 After you have subscribed to the **Prowler Cloud** product, you will need to set up your **Prowler Cloud** account:

-1. Click the `Set up your account` button:
+1. Click the `Set up  your account` button:

    ![](/images/aws-marketplace/marketplace-message.png)

-2. You will be redirected to **Prowler Cloud Sign In** page. You can sign in with an existing account or sign up with a new account:
+2. You will be redirected to **Prowler Cloud Sign In** page. You can sign in with an exsiting account or sign up with a new account.:

    ![](/images/aws-marketplace/marketplace-sign-up.png)

@@ -4,7 +4,7 @@ title: "Overview"

 [Prowler Cloud](https://prowler.com) makes Cloud Security easy and enables your team to build trust in their deployed services and applications.

-Prowler Cloud automates scanning single or multiple accounts and has all of the benefits of Prowler Open Source, plus hands-off continuous monitoring, auto-scaling workers for faster execution, integrations, personalized support options and out of the box social authentication.
+Prowler Cloud Automates scanning single or multiple accounts and has all of the benefits of Prowler Open Source, plus hands-off continuous monitoring, auto-scaling workers for faster execution, integrations, personalized support options and out of the box social authentication.

 ![](/images/products/overview.png)

@@ -15,7 +15,7 @@ The console is available at [partners.prowler.com](https://partners.prowler.com)
 * **Delegated access:** open any customer's Prowler Cloud tenant from the console. Every action is attributed to you acting on behalf of that customer.
 * **Team and roles:** invite team members by email and assign a role that governs what they can do.
 * **Consolidated billing:** each customer carries its own plan, with month-to-date revenue reported across every customer.
-* **Branding:** upload your logo and preview its intended placement in Settings.
+* **Branding:** upload your logo to appear alongside Prowler branding in the console.

 ## Core Concepts

@@ -35,7 +35,7 @@ Three objects make up the model. Getting these straight makes the rest of the do
 | **Console** | [cloud.prowler.com](https://cloud.prowler.com) | [partners.prowler.com](https://partners.prowler.com) |
 | **Scope** | One organization's own cloud accounts | Many customer organizations |
 | **Billing** | Each organization pays for itself | The provider manages a plan per customer |
-| **Branding** | Prowler-branded | Logo upload and placement preview in Settings |
+| **Branding** | Prowler-branded | Your logo alongside Prowler branding |

 Your customers keep signing in to Prowler Cloud with their own users. Provider-side access is **additive** — it does not replace or restrict customer-side users.

@@ -46,7 +46,7 @@ Signing in lands you on the **Dashboard**. The sidebar carries:
 | Entry | What it does | Visible to |
 |---|---|---|
 | **Dashboard** | Partner Insights, a Billing Overview card and an Active Customers table | Everyone |
-| **Customers** | Review customer posture and billing and open customer tenants; Superadmins can also add customers | Everyone |
+| **Customers** | Add customers, review their posture and billing, and open their Prowler Cloud tenant | Everyone |
 | **Team** | Invite, re-invite, disable and remove team members | Roles with **Manage members** |
 | **Settings** | Profile, Partner Code, branding and security | Everyone; editing requires **Manage settings** |

@@ -54,7 +54,7 @@ Signing in lands you on the **Dashboard**. The sidebar carries:

 **Partner Insights** is the top row: **Total Customers**, broken down into active and non-paid; **Cloud Accounts**, broken down by cloud provider; and **Monitored Resources**, with a note on organizations whose critical risk has grown. Each card carries a 30-day trend.

-Below it, **Billing Overview** reports monthly expenses against the previous month and splits revenue for the period into annual, monthly and overage. **Active Customers** lists your customers with their provider count, resource count and last completed scan and, for Superadmins, carries its own **Add Customer** button.
+Below it, **Billing Overview** reports monthly expenses against the previous month and splits revenue for the period into annual, monthly and overage. **Active Customers** lists your customers with their provider count, resource count and last completed scan, and carries its own **Add Customer** button.

 ## Getting Access

@@ -96,7 +96,7 @@ Lighthouse AI supports three providers:

 For detailed configuration instructions, see [Using Multiple LLM Providers with Lighthouse](/user-guide/tutorials/prowler-app-lighthouse-multi-llm).

-**2. Why don't some models appear in Lighthouse AI?**
+**2. Why some models don't appear in Lighthouse AI?**

 LLM providers offer different types of models. Not every model can be integrated with Lighthouse AI (for example, text-to-speech, vision, embedding, computer use, etc.).

@@ -30,7 +30,7 @@ The fastest way to get started is the **Cloud MCP Server** at `https://mcp.prowl
 </Card>

 <Note>
-Prefer to run it yourself? The **Local MCP Server** runs on your own machine or infrastructure. The Cloud MCP Server additionally provides the `prowler_cloud_*` tools for Prowler Cloud-specific features: [Alerts](/user-guide/tutorials/prowler-alerts), [Findings Triage](/user-guide/tutorials/prowler-app-findings-triage), [Scan Scheduling](/user-guide/tutorials/prowler-scan-scheduling), and Scan Configurations. See [Cloud vs Local MCP Server](#cloud-vs-local-mcp-server).
+Prefer to run it yourself? The **Local MCP Server** runs on your own machine or infrastructure. The Cloud MCP Server additionally provides tools for Prowler Cloud-specific features such as [Alerts](/user-guide/tutorials/prowler-alerts), [Scan Scheduling](/user-guide/tutorials/prowler-scan-scheduling), and [Findings Triage](/user-guide/tutorials/prowler-app-findings-triage). See [Cloud vs Local MCP Server](#cloud-vs-local-mcp-server).
 </Note>

 ## What is the Model Context Protocol?
@@ -39,30 +39,20 @@ The [Model Context Protocol (MCP)](https://modelcontextprotocol.io) is an open s

 ## Key Capabilities

-The Prowler MCP Server provides four integration points:
+The Prowler MCP Server provides three main integration points:

 ### 1. Prowler Cloud, Private Cloud & Local Server

 Full access to your Prowler deployment — Prowler Cloud, Prowler Private Cloud, or Prowler Local Server — for:
 - **Findings Analysis**: Query, filter, and analyze security findings across all your cloud environments
 - **Provider Management**: Create, configure, and manage your configured Prowler providers (AWS, Azure, GCP, etc.)
- **Scan Orchestration**: Trigger on-demand scans, track their progress, and schedule a daily scan
+- **Scan Orchestration**: Trigger on-demand scans and schedule recurring security assessments
 - **Resource Inventory**: Search and view detailed information about your audited resources
 - **Muting Management**: Create and manage muting lists/rules to suppress non-relevant findings
 - **Attack Paths Analysis**: Analyze privilege escalation chains and security misconfigurations through graph-based analysis of cloud resource relationships
- **Integrations Management**: Set up and troubleshoot where Prowler sends its results (Amazon S3, AWS Security Hub, Jira), and turn findings into Jira work items
 - **User & Role Management**: List the users in your tenant, identify the authenticated user, browse RBAC roles, and set the role a user holds

-### 2. Prowler Cloud Management
-
-Prowler Cloud-only tools for configuration and workflows that a Prowler Local Server does not provide. These are exposed only by the [Cloud MCP Server](#cloud-vs-local-mcp-server):
-
- **Scan Configurations**: Create reusable check and compliance selections and attach them to providers.
- **Findings Triage**: Record review statuses and notes for individual findings, without suppressing them.
- **Scan Scheduling**: Configure daily, interval, weekly, or monthly recurring scans, one provider at a time or in bulk.
- **Alerts**: Build and dry-run alert rule conditions, manage email recipients, and review fired alerts.
-
-### 3. Prowler Hub
+### 2. Prowler Hub

 Access to Prowler's comprehensive security knowledge base:
 - **Security Checks Catalog**: Browse and search **over 2,000 security checks** across multiple cloud providers.
@@ -71,7 +61,7 @@ Access to Prowler's comprehensive security knowledge base:
 - **Compliance Frameworks**: Explore mappings to **over 70 compliance standards and frameworks**.
 - **Provider Services**: View available services and checks for each cloud provider.

-### 4. Prowler Documentation
+### 3. Prowler Documentation

 Search and retrieve official Prowler documentation:
 - **Intelligent Search**: Full-text search across all Prowler documentation.
@@ -80,7 +70,7 @@ Search and retrieve official Prowler documentation:

 ## MCP Server Architecture

-The following diagram illustrates the Prowler MCP Server architecture and its integration points. MCP clients connect to either the **Cloud MCP Server** (recommended) or a **Local MCP Server**. Both reach the same Prowler backends and share the `prowler_*`, `prowler_hub_*`, and `prowler_docs_*` tools; the Cloud MCP Server additionally exposes the Cloud-only `prowler_cloud_*` tools:
+The following diagram illustrates the Prowler MCP Server architecture and its integration points. MCP clients connect to either the **Cloud MCP Server** (recommended) or a **Local MCP Server**; both expose the same tools and reach the same Prowler backends:

 ```mermaid
 flowchart LR
@@ -92,13 +82,12 @@ flowchart LR

    subgraph SERVERS["Prowler MCP Server"]
        direction TB
-        cloud["Cloud MCP Server (Recommended)<br/>mcp.prowler.com/mcp · HTTP<br/>Managed by Prowler · always up to date<br/>Adds the Cloud-only prowler_cloud_* tools"]
-        local["Local MCP Server<br/>Self-run · STDIO or HTTP<br/>Python 3.12+ or Docker<br/>You manage updates"]
+        cloud["☁️ Cloud MCP Server (Recommended)<br/>mcp.prowler.com/mcp · HTTP<br/>Managed by Prowler · always up to date<br/>Adds Cloud-only tools (Alerts,<br/>Scan Scheduling, Findings Triage)"]
+        local["💻 Local MCP Server<br/>Self-run · STDIO or HTTP<br/>Python 3.12+ or Docker<br/>You manage updates"]
    end

    subgraph TOOLS["Prowler MCP Tools"]
-        prowler_tools["prowler_* tools<br/>(API key or JWT auth)<br/>Findings · Finding Groups · Providers<br/>Scans · Resources · Muting · Compliance<br/>Attack Paths · Integrations · Users · Roles"]
-        cloud_tools["prowler_cloud_* tools<br/>(API key or JWT auth · Cloud only)<br/>Alerts · Findings Triage<br/>Scan Scheduling · Scan Configurations"]
+        prowler_tools["prowler_* tools<br/>(API key or JWT auth)<br/>Findings · Providers · Scans<br/>Resources · Muting · Compliance<br/>Attack Paths"]
        hub_tools["prowler_hub_* tools<br/>(no auth)<br/>Checks Catalog · Check Code<br/>Fixers · Compliance Frameworks"]
        docs_tools["prowler_docs_* tools<br/>(no auth)<br/>Search · Document Retrieval"]
    end
@@ -115,7 +104,6 @@ flowchart LR
    apps -->|STDIO or HTTP| local

    cloud --> prowler_tools
-    cloud --> cloud_tools
    cloud --> hub_tools
    cloud --> docs_tools
    local --> prowler_tools
@@ -123,14 +111,12 @@ flowchart LR
    local --> docs_tools

    prowler_tools -->|REST| api
-    cloud_tools -->|REST| api
    hub_tools -->|REST| hub
    docs_tools -->|REST| docs
 ```

-The architecture shows how AI assistants connect through the MCP protocol to access Prowler's four namespaced components:
+The architecture shows how AI assistants connect through the MCP protocol to access Prowler's three main components:
 - Prowler Cloud, Prowler Private Cloud, or Prowler Local Server for security operations
- Prowler Cloud management for Cloud-only configuration and workflows
 - Prowler Hub for security knowledge
 - Prowler Documentation for guidance and reference.

@@ -141,15 +127,8 @@ The Prowler MCP Server enables powerful workflows through AI assistants:
 **Security Operations**
 - "Show me all critical findings from my AWS production accounts"
 - "Register my new AWS account in Prowler and run a scheduled scan every day"
- "List all muted findings and flag the ones whose mute reason is too weak for their severity"
+- "List all muted findings and detect what findgings are muted by a not enough good reason in relation to their severity"
 - "Run an attack paths query to find EC2 instances exposed to the Internet with access to sensitive S3 buckets"
- "Send my failed CIS findings for this provider to Jira as work items"
-
-**Prowler Cloud Management** (Cloud MCP Server only)
- "Preview an alert rule for critical AWS findings and create it for my confirmed recipients"
- "Show the triage notes for this finding and mark it as under review"
- "Apply a weekly Monday 06:00 scan schedule to every AWS provider"
- "Create a scan configuration that runs only CIS checks and attach it to my production providers"

 **Security Research**
 - "Explain what the S3 bucket public access Prowler check does"
@@ -220,17 +199,17 @@ There are two ways to run the Prowler MCP Server. For almost everyone, the **Clo

 | | ☁️ **Cloud MCP Server** (Recommended) | 💻 **Local MCP Server** |
 |---|---|---|
-| **Cloud-only tools** (`prowler_cloud_*`) | ✅ Alerts, Findings Triage, Scan Scheduling, Scan Configurations | ❌ Not available |
 | **Endpoint** | `https://mcp.prowler.com/mcp` | Runs on your machine or infrastructure |
 | **Setup** | Just configure your MCP client | Install via Docker, or source |
 | **Transport** | HTTP | STDIO (subprocess) or self-hosted HTTP |
 | **Maintenance** | Managed by Prowler, always up to date | You manage updates |
 | **Requirements** | None (just an MCP client) | Python 3.12+ or Docker |
+| **Cloud-only tools** | ✅ Alerts, Scan Scheduling, Findings Triage | ❌ Not available |
 | **Authentication** | API key or JWT token | API key/JWT (HTTP) or env vars (STDIO) |

 ### ☁️ Cloud MCP Server (Recommended)

-Prowler's managed MCP server at `https://mcp.prowler.com/mcp`. No installation, always up to date, and it includes the `prowler_cloud_*` tools for Prowler Cloud-specific features: Alerts, Findings Triage, Scan Scheduling, and Scan Configurations. This is the path we recommend for nearly all users — go straight to the [Configuration guide](/getting-started/basic-usage/prowler-mcp#cloud-mcp-server-configuration-recommended).
+Prowler's managed MCP server at `https://mcp.prowler.com/mcp`. No installation, always up to date, and it includes tools for Prowler Cloud-specific features such as Alerts, Scan Scheduling, and Findings Triage. This is the path we recommend for nearly all users — go straight to the [Configuration guide](/getting-started/basic-usage/prowler-mcp#cloud-mcp-server-configuration-recommended).

 ### 💻 Local MCP Server

--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Hugo P.Brito	8fcb8e53b7	fix(huaweicloud): preserve FunctionGraph region attribution - Carry regional client keys through function discovery - Cover regionless SDK clients with a regression test - Document FunctionGraph initialization behavior	2026-08-20 13:13:55 +01:00
Hugo P.Brito	84e9a91186	fix(huaweicloud): clarify FunctionGraph VPC guidance - Separate VPC attachment from public network access controls - Add supported remediation steps and API documentation	2026-08-20 12:49:36 +01:00
Hugo P.Brito	c1eceb9b5a	fix(huaweicloud): enable FunctionGraph runtime discovery - Add the pinned FunctionGraph SDK and regional session client - Paginate discovery without publishing partial API results - Preserve canonical function identities and VPC state in reports	2026-08-20 12:48:44 +01:00
tomitobio	082915cad9	Add changelog fragment for huaweicloud_functiongraph_function_vpc_configured	2026-08-12 04:41:20 +08:00
tomitobio	ec6878c824	feat(providers/huaweicloud): add functiongraph_function_vpc_configured check	2026-07-29 04:11:52 +08:00
				`@@ -0,0 +1 @@`
				`Attack Paths IAM privilege-escalation queries no longer build an all-nodes × all-resource-items cartesian product, fixing runtime errors and timeouts on accounts with many IAM roles, users, or groups`