chore(api): Update prowler dependency to v5.24 for release 5.24.0 (#10709 )

Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com>
2026-05-13 15:50:55 +00:00 · 2026-04-15 18:57:37 +02:00
34 changed files with 296 additions and 618 deletions
@@ -145,7 +145,7 @@ SENTRY_RELEASE=local
 NEXT_PUBLIC_SENTRY_ENVIRONMENT=${SENTRY_ENVIRONMENT}

 #### Prowler release version ####
-NEXT_PUBLIC_PROWLER_RELEASE_VERSION=v5.25.0
+NEXT_PUBLIC_PROWLER_RELEASE_VERSION=v5.24.0

 # Social login credentials
 SOCIAL_GOOGLE_OAUTH_CALLBACK_URL="${AUTH_URL}/api/auth/callback/google"
@@ -66,18 +66,6 @@ updates:
    cooldown:
      default-days: 7

-  - package-ecosystem: "pre-commit"
-    directory: "/"
-    schedule:
-      interval: "monthly"
-    open-pull-requests-limit: 25
-    target-branch: master
-    labels:
-      - "dependencies"
-      - "pre-commit"
-    cooldown:
-      default-days: 7
-
  # Dependabot Updates are temporary disabled - 2025/04/15
  # v4.6
  # - package-ecosystem: "pip"
@@ -61,12 +61,12 @@ jobs:
          persist-credentials: false

      - name: Initialize CodeQL
-        uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+        uses: github/codeql-action/init@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
        with:
          languages: ${{ matrix.language }}
          config-file: ./.github/codeql/api-codeql-config.yml

      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+        uses: github/codeql-action/analyze@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
        with:
          category: '/language:${{ matrix.language }}'
@@ -66,12 +66,12 @@ jobs:
          persist-credentials: false

      - name: Initialize CodeQL
-        uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+        uses: github/codeql-action/init@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
        with:
          languages: ${{ matrix.language }}
          config-file: ./.github/codeql/sdk-codeql-config.yml

      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+        uses: github/codeql-action/analyze@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
        with:
          category: '/language:${{ matrix.language }}'
@@ -62,12 +62,12 @@ jobs:
          persist-credentials: false

      - name: Initialize CodeQL
-        uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+        uses: github/codeql-action/init@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
        with:
          languages: ${{ matrix.language }}
          config-file: ./.github/codeql/ui-codeql-config.yml

      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+        uses: github/codeql-action/analyze@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
        with:
          category: '/language:${{ matrix.language }}'
@@ -1,7 +1,7 @@
 repos:
  ## GENERAL
  - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v6.0.0
+    rev: v4.6.0
    hooks:
      - id: check-merge-conflict
      - id: check-yaml
@@ -16,7 +16,7 @@ repos:

  ## TOML
  - repo: https://github.com/macisamuele/language-formatters-pre-commit-hooks
-    rev: v2.16.0
+    rev: v2.13.0
    hooks:
      - id: pretty-format-toml
        args: [--autofix]
@@ -24,21 +24,21 @@ repos:

  ## GITHUB ACTIONS
  - repo: https://github.com/zizmorcore/zizmor-pre-commit
-    rev: v1.24.1
+    rev: v1.6.0
    hooks:
      - id: zizmor
        files: ^\.github/

  ## BASH
  - repo: https://github.com/koalaman/shellcheck-precommit
-    rev: v0.11.0
+    rev: v0.10.0
    hooks:
      - id: shellcheck
        exclude: contrib

  ## PYTHON
  - repo: https://github.com/myint/autoflake
-    rev: v2.3.3
+    rev: v2.3.1
    hooks:
      - id: autoflake
        exclude: ^skills/
@@ -50,20 +50,20 @@ repos:
          ]

  - repo: https://github.com/pycqa/isort
-    rev: 8.0.1
+    rev: 5.13.2
    hooks:
      - id: isort
        exclude: ^skills/
        args: ["--profile", "black"]

  - repo: https://github.com/psf/black
-    rev: 26.3.1
+    rev: 24.4.2
    hooks:
      - id: black
        exclude: ^skills/

  - repo: https://github.com/pycqa/flake8
-    rev: 7.3.0
+    rev: 7.0.0
    hooks:
      - id: flake8
        exclude: (contrib|^skills/)
@@ -93,7 +93,7 @@ repos:
        pass_filenames: false

  - repo: https://github.com/hadolint/hadolint
-    rev: v2.14.0
+    rev: v2.13.0-beta
    hooks:
      - id: hadolint
        args: ["--ignore=DL3013"]
@@ -2,14 +2,6 @@

 All notable changes to the **Prowler API** are documented in this file.

-## [1.25.1] (Prowler v5.24.1)
-
-### 🐞 Fixed
-
- Attack Paths: Missing `tenant_id` filter while getting related findings after scan completes [(#10722)](https://github.com/prowler-cloud/prowler/pull/10722)
-
---
-
 ## [1.25.0] (Prowler v5.24.0)

 ### 🔄 Changed
@@ -21,7 +13,6 @@ All notable changes to the **Prowler API** are documented in this file.

 - Worker-beat race condition on cold start: replaced `sleep 15` with API service healthcheck dependency (Docker Compose) and init containers (Helm), aligned Gunicorn default port to `8080` [(#10603)](https://github.com/prowler-cloud/prowler/pull/10603)
 - API container startup crash on Linux due to root-owned bind-mount preventing JWT key generation [(#10646)](https://github.com/prowler-cloud/prowler/pull/10646)
- Finding group resources endpoints now include findings without associated resources (orphan IaC findings) as simulated resource rows, and return one row per finding when multiple findings share a resource [(#10708)](https://github.com/prowler-cloud/prowler/pull/10708)

 ### 🔐 Security

@@ -682,21 +682,21 @@ requests = ">=2.21.0,<3.0.0"

 [[package]]
 name = "alibabacloud-tea-openapi"
-version = "0.4.1"
+version = "0.4.4"
 description = "Alibaba Cloud openapi SDK Library for Python"
 optional = false
 python-versions = ">=3.7"
 groups = ["main"]
 files = [
-    {file = "alibabacloud_tea_openapi-0.4.1-py3-none-any.whl", hash = "sha256:e46bfa3ca34086d2c357d217a0b7284ecbd4b3bab5c88e075e73aec637b0e4a0"},
-    {file = "alibabacloud_tea_openapi-0.4.1.tar.gz", hash = "sha256:2384b090870fdb089c3c40f3fb8cf0145b8c7d6c14abbac521f86a01abb5edaf"},
+    {file = "alibabacloud_tea_openapi-0.4.4-py3-none-any.whl", hash = "sha256:cea6bc1fe35b0319a8752cb99eb0ecb0dab7ca1a71b99c12970ba0867410995f"},
+    {file = "alibabacloud_tea_openapi-0.4.4.tar.gz", hash = "sha256:1b0917bc03cd49417da64945e92731716d53e2eb8707b235f54e45b7473221ce"},
 ]

 [package.dependencies]
 alibabacloud-credentials = ">=1.0.2,<2.0.0"
 alibabacloud-gateway-spi = ">=0.0.2,<1.0.0"
 alibabacloud-tea-util = ">=0.3.13,<1.0.0"
-cryptography = ">=3.0.0,<45.0.0"
+cryptography = {version = ">=3.0.0,<47.0.0", markers = "python_version >= \"3.8\""}
 darabonba-core = ">=1.0.3,<2.0.0"

 [[package]]
@@ -2503,62 +2503,74 @@ dev = ["bandit", "coverage", "flake8", "pydocstyle", "pylint", "pytest", "pytest

 [[package]]
 name = "cryptography"
-version = "44.0.3"
+version = "46.0.6"
 description = "cryptography is a package which provides cryptographic recipes and primitives to Python developers."
 optional = false
-python-versions = "!=3.9.0,!=3.9.1,>=3.7"
+python-versions = "!=3.9.0,!=3.9.1,>=3.8"
 groups = ["main", "dev"]
 files = [
-    {file = "cryptography-44.0.3-cp37-abi3-macosx_10_9_universal2.whl", hash = "sha256:962bc30480a08d133e631e8dfd4783ab71cc9e33d5d7c1e192f0b7c06397bb88"},
-    {file = "cryptography-44.0.3-cp37-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:4ffc61e8f3bf5b60346d89cd3d37231019c17a081208dfbbd6e1605ba03fa137"},
-    {file = "cryptography-44.0.3-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:58968d331425a6f9eedcee087f77fd3c927c88f55368f43ff7e0a19891f2642c"},
-    {file = "cryptography-44.0.3-cp37-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:e28d62e59a4dbd1d22e747f57d4f00c459af22181f0b2f787ea83f5a876d7c76"},
-    {file = "cryptography-44.0.3-cp37-abi3-manylinux_2_28_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:af653022a0c25ef2e3ffb2c673a50e5a0d02fecc41608f4954176f1933b12359"},
-    {file = "cryptography-44.0.3-cp37-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:157f1f3b8d941c2bd8f3ffee0af9b049c9665c39d3da9db2dc338feca5e98a43"},
-    {file = "cryptography-44.0.3-cp37-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:c6cd67722619e4d55fdb42ead64ed8843d64638e9c07f4011163e46bc512cf01"},
-    {file = "cryptography-44.0.3-cp37-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:b424563394c369a804ecbee9b06dfb34997f19d00b3518e39f83a5642618397d"},
-    {file = "cryptography-44.0.3-cp37-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:c91fc8e8fd78af553f98bc7f2a1d8db977334e4eea302a4bfd75b9461c2d8904"},
-    {file = "cryptography-44.0.3-cp37-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:25cd194c39fa5a0aa4169125ee27d1172097857b27109a45fadc59653ec06f44"},
-    {file = "cryptography-44.0.3-cp37-abi3-win32.whl", hash = "sha256:3be3f649d91cb182c3a6bd336de8b61a0a71965bd13d1a04a0e15b39c3d5809d"},
-    {file = "cryptography-44.0.3-cp37-abi3-win_amd64.whl", hash = "sha256:3883076d5c4cc56dbef0b898a74eb6992fdac29a7b9013870b34efe4ddb39a0d"},
-    {file = "cryptography-44.0.3-cp39-abi3-macosx_10_9_universal2.whl", hash = "sha256:5639c2b16764c6f76eedf722dbad9a0914960d3489c0cc38694ddf9464f1bb2f"},
-    {file = "cryptography-44.0.3-cp39-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:f3ffef566ac88f75967d7abd852ed5f182da252d23fac11b4766da3957766759"},
-    {file = "cryptography-44.0.3-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:192ed30fac1728f7587c6f4613c29c584abdc565d7417c13904708db10206645"},
-    {file = "cryptography-44.0.3-cp39-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:7d5fe7195c27c32a64955740b949070f21cba664604291c298518d2e255931d2"},
-    {file = "cryptography-44.0.3-cp39-abi3-manylinux_2_28_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:3f07943aa4d7dad689e3bb1638ddc4944cc5e0921e3c227486daae0e31a05e54"},
-    {file = "cryptography-44.0.3-cp39-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:cb90f60e03d563ca2445099edf605c16ed1d5b15182d21831f58460c48bffb93"},
-    {file = "cryptography-44.0.3-cp39-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:ab0b005721cc0039e885ac3503825661bd9810b15d4f374e473f8c89b7d5460c"},
-    {file = "cryptography-44.0.3-cp39-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:3bb0847e6363c037df8f6ede57d88eaf3410ca2267fb12275370a76f85786a6f"},
-    {file = "cryptography-44.0.3-cp39-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:b0cc66c74c797e1db750aaa842ad5b8b78e14805a9b5d1348dc603612d3e3ff5"},
-    {file = "cryptography-44.0.3-cp39-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:6866df152b581f9429020320e5eb9794c8780e90f7ccb021940d7f50ee00ae0b"},
-    {file = "cryptography-44.0.3-cp39-abi3-win32.whl", hash = "sha256:c138abae3a12a94c75c10499f1cbae81294a6f983b3af066390adee73f433028"},
-    {file = "cryptography-44.0.3-cp39-abi3-win_amd64.whl", hash = "sha256:5d186f32e52e66994dce4f766884bcb9c68b8da62d61d9d215bfe5fb56d21334"},
-    {file = "cryptography-44.0.3-pp310-pypy310_pp73-macosx_10_9_x86_64.whl", hash = "sha256:cad399780053fb383dc067475135e41c9fe7d901a97dd5d9c5dfb5611afc0d7d"},
-    {file = "cryptography-44.0.3-pp310-pypy310_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:21a83f6f35b9cc656d71b5de8d519f566df01e660ac2578805ab245ffd8523f8"},
-    {file = "cryptography-44.0.3-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:fc3c9babc1e1faefd62704bb46a69f359a9819eb0292e40df3fb6e3574715cd4"},
-    {file = "cryptography-44.0.3-pp310-pypy310_pp73-manylinux_2_34_aarch64.whl", hash = "sha256:e909df4053064a97f1e6565153ff8bb389af12c5c8d29c343308760890560aff"},
-    {file = "cryptography-44.0.3-pp310-pypy310_pp73-manylinux_2_34_x86_64.whl", hash = "sha256:dad80b45c22e05b259e33ddd458e9e2ba099c86ccf4e88db7bbab4b747b18d06"},
-    {file = "cryptography-44.0.3-pp310-pypy310_pp73-win_amd64.whl", hash = "sha256:479d92908277bed6e1a1c69b277734a7771c2b78633c224445b5c60a9f4bc1d9"},
-    {file = "cryptography-44.0.3-pp311-pypy311_pp73-macosx_10_9_x86_64.whl", hash = "sha256:896530bc9107b226f265effa7ef3f21270f18a2026bc09fed1ebd7b66ddf6375"},
-    {file = "cryptography-44.0.3-pp311-pypy311_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:9b4d4a5dbee05a2c390bf212e78b99434efec37b17a4bff42f50285c5c8c9647"},
-    {file = "cryptography-44.0.3-pp311-pypy311_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:02f55fb4f8b79c1221b0961488eaae21015b69b210e18c386b69de182ebb1259"},
-    {file = "cryptography-44.0.3-pp311-pypy311_pp73-manylinux_2_34_aarch64.whl", hash = "sha256:dd3db61b8fe5be220eee484a17233287d0be6932d056cf5738225b9c05ef4fff"},
-    {file = "cryptography-44.0.3-pp311-pypy311_pp73-manylinux_2_34_x86_64.whl", hash = "sha256:978631ec51a6bbc0b7e58f23b68a8ce9e5f09721940933e9c217068388789fe5"},
-    {file = "cryptography-44.0.3-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:5d20cc348cca3a8aa7312f42ab953a56e15323800ca3ab0706b8cd452a3a056c"},
-    {file = "cryptography-44.0.3.tar.gz", hash = "sha256:fe19d8bc5536a91a24a8133328880a41831b6c5df54599a8417b62fe015d3053"},
+    {file = "cryptography-46.0.6-cp311-abi3-macosx_10_9_universal2.whl", hash = "sha256:64235194bad039a10bb6d2d930ab3323baaec67e2ce36215fd0952fad0930ca8"},
+    {file = "cryptography-46.0.6-cp311-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:26031f1e5ca62fcb9d1fcb34b2b60b390d1aacaa15dc8b895a9ed00968b97b30"},
+    {file = "cryptography-46.0.6-cp311-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:9a693028b9cbe51b5a1136232ee8f2bc242e4e19d456ded3fa7c86e43c713b4a"},
+    {file = "cryptography-46.0.6-cp311-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:67177e8a9f421aa2d3a170c3e56eca4e0128883cf52a071a7cbf53297f18b175"},
+    {file = "cryptography-46.0.6-cp311-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:d9528b535a6c4f8ff37847144b8986a9a143585f0540fbcb1a98115b543aa463"},
+    {file = "cryptography-46.0.6-cp311-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:22259338084d6ae497a19bae5d4c66b7ca1387d3264d1c2c0e72d9e9b6a77b97"},
+    {file = "cryptography-46.0.6-cp311-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:760997a4b950ff00d418398ad73fbc91aa2894b5c1db7ccb45b4f68b42a63b3c"},
+    {file = "cryptography-46.0.6-cp311-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:3dfa6567f2e9e4c5dceb8ccb5a708158a2a871052fa75c8b78cb0977063f1507"},
+    {file = "cryptography-46.0.6-cp311-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:cdcd3edcbc5d55757e5f5f3d330dd00007ae463a7e7aa5bf132d1f22a4b62b19"},
+    {file = "cryptography-46.0.6-cp311-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:d4e4aadb7fc1f88687f47ca20bb7227981b03afaae69287029da08096853b738"},
+    {file = "cryptography-46.0.6-cp311-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:2b417edbe8877cda9022dde3a008e2deb50be9c407eef034aeeb3a8b11d9db3c"},
+    {file = "cryptography-46.0.6-cp311-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:380343e0653b1c9d7e1f55b52aaa2dbb2fdf2730088d48c43ca1c7c0abb7cc2f"},
+    {file = "cryptography-46.0.6-cp311-abi3-win32.whl", hash = "sha256:bcb87663e1f7b075e48c3be3ecb5f0b46c8fc50b50a97cf264e7f60242dca3f2"},
+    {file = "cryptography-46.0.6-cp311-abi3-win_amd64.whl", hash = "sha256:6739d56300662c468fddb0e5e291f9b4d084bead381667b9e654c7dd81705124"},
+    {file = "cryptography-46.0.6-cp314-cp314t-macosx_10_9_universal2.whl", hash = "sha256:2ef9e69886cbb137c2aef9772c2e7138dc581fad4fcbcf13cc181eb5a3ab6275"},
+    {file = "cryptography-46.0.6-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:7f417f034f91dcec1cb6c5c35b07cdbb2ef262557f701b4ecd803ee8cefed4f4"},
+    {file = "cryptography-46.0.6-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:d24c13369e856b94892a89ddf70b332e0b70ad4a5c43cf3e9cb71d6d7ffa1f7b"},
+    {file = "cryptography-46.0.6-cp314-cp314t-manylinux_2_28_aarch64.whl", hash = "sha256:aad75154a7ac9039936d50cf431719a2f8d4ed3d3c277ac03f3339ded1a5e707"},
+    {file = "cryptography-46.0.6-cp314-cp314t-manylinux_2_28_ppc64le.whl", hash = "sha256:3c21d92ed15e9cfc6eb64c1f5a0326db22ca9c2566ca46d845119b45b4400361"},
+    {file = "cryptography-46.0.6-cp314-cp314t-manylinux_2_28_x86_64.whl", hash = "sha256:4668298aef7cddeaf5c6ecc244c2302a2b8e40f384255505c22875eebb47888b"},
+    {file = "cryptography-46.0.6-cp314-cp314t-manylinux_2_31_armv7l.whl", hash = "sha256:8ce35b77aaf02f3b59c90b2c8a05c73bac12cea5b4e8f3fbece1f5fddea5f0ca"},
+    {file = "cryptography-46.0.6-cp314-cp314t-manylinux_2_34_aarch64.whl", hash = "sha256:c89eb37fae9216985d8734c1afd172ba4927f5a05cfd9bf0e4863c6d5465b013"},
+    {file = "cryptography-46.0.6-cp314-cp314t-manylinux_2_34_ppc64le.whl", hash = "sha256:ed418c37d095aeddf5336898a132fba01091f0ac5844e3e8018506f014b6d2c4"},
+    {file = "cryptography-46.0.6-cp314-cp314t-manylinux_2_34_x86_64.whl", hash = "sha256:69cf0056d6947edc6e6760e5f17afe4bea06b56a9ac8a06de9d2bd6b532d4f3a"},
+    {file = "cryptography-46.0.6-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:8e7304c4f4e9490e11efe56af6713983460ee0780f16c63f219984dab3af9d2d"},
+    {file = "cryptography-46.0.6-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:b928a3ca837c77a10e81a814a693f2295200adb3352395fad024559b7be7a736"},
+    {file = "cryptography-46.0.6-cp314-cp314t-win32.whl", hash = "sha256:97c8115b27e19e592a05c45d0dd89c57f81f841cc9880e353e0d3bf25b2139ed"},
+    {file = "cryptography-46.0.6-cp314-cp314t-win_amd64.whl", hash = "sha256:c797e2517cb7880f8297e2c0f43bb910e91381339336f75d2c1c2cbf811b70b4"},
+    {file = "cryptography-46.0.6-cp38-abi3-macosx_10_9_universal2.whl", hash = "sha256:12cae594e9473bca1a7aceb90536060643128bb274fcea0fc459ab90f7d1ae7a"},
+    {file = "cryptography-46.0.6-cp38-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:639301950939d844a9e1c4464d7e07f902fe9a7f6b215bb0d4f28584729935d8"},
+    {file = "cryptography-46.0.6-cp38-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:ed3775295fb91f70b4027aeba878d79b3e55c0b3e97eaa4de71f8f23a9f2eb77"},
+    {file = "cryptography-46.0.6-cp38-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:8927ccfbe967c7df312ade694f987e7e9e22b2425976ddbf28271d7e58845290"},
+    {file = "cryptography-46.0.6-cp38-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:b12c6b1e1651e42ab5de8b1e00dc3b6354fdfd778e7fa60541ddacc27cd21410"},
+    {file = "cryptography-46.0.6-cp38-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:063b67749f338ca9c5a0b7fe438a52c25f9526b851e24e6c9310e7195aad3b4d"},
+    {file = "cryptography-46.0.6-cp38-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:02fad249cb0e090b574e30b276a3da6a149e04ee2f049725b1f69e7b8351ec70"},
+    {file = "cryptography-46.0.6-cp38-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:7e6142674f2a9291463e5e150090b95a8519b2fb6e6aaec8917dd8d094ce750d"},
+    {file = "cryptography-46.0.6-cp38-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:456b3215172aeefb9284550b162801d62f5f264a081049a3e94307fe20792cfa"},
+    {file = "cryptography-46.0.6-cp38-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:341359d6c9e68834e204ceaf25936dffeafea3829ab80e9503860dcc4f4dac58"},
+    {file = "cryptography-46.0.6-cp38-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:9a9c42a2723999a710445bc0d974e345c32adfd8d2fac6d8a251fa829ad31cfb"},
+    {file = "cryptography-46.0.6-cp38-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:6617f67b1606dfd9fe4dbfa354a9508d4a6d37afe30306fe6c101b7ce3274b72"},
+    {file = "cryptography-46.0.6-cp38-abi3-win32.whl", hash = "sha256:7f6690b6c55e9c5332c0b59b9c8a3fb232ebf059094c17f9019a51e9827df91c"},
+    {file = "cryptography-46.0.6-cp38-abi3-win_amd64.whl", hash = "sha256:79e865c642cfc5c0b3eb12af83c35c5aeff4fa5c672dc28c43721c2c9fdd2f0f"},
+    {file = "cryptography-46.0.6-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:2ea0f37e9a9cf0df2952893ad145fd9627d326a59daec9b0802480fa3bcd2ead"},
+    {file = "cryptography-46.0.6-pp311-pypy311_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:a3e84d5ec9ba01f8fd03802b2147ba77f0c8f2617b2aff254cedd551844209c8"},
+    {file = "cryptography-46.0.6-pp311-pypy311_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:12f0fa16cc247b13c43d56d7b35287ff1569b5b1f4c5e87e92cc4fcc00cd10c0"},
+    {file = "cryptography-46.0.6-pp311-pypy311_pp73-manylinux_2_34_aarch64.whl", hash = "sha256:50575a76e2951fe7dbd1f56d181f8c5ceeeb075e9ff88e7ad997d2f42af06e7b"},
+    {file = "cryptography-46.0.6-pp311-pypy311_pp73-manylinux_2_34_x86_64.whl", hash = "sha256:90e5f0a7b3be5f40c3a0a0eafb32c681d8d2c181fc2a1bdabe9b3f611d9f6b1a"},
+    {file = "cryptography-46.0.6-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:6728c49e3b2c180ef26f8e9f0a883a2c585638db64cf265b49c9ba10652d430e"},
+    {file = "cryptography-46.0.6.tar.gz", hash = "sha256:27550628a518c5c6c903d84f637fbecf287f6cb9ced3804838a1295dc1fd0759"},
 ]

 [package.dependencies]
-cffi = {version = ">=1.12", markers = "platform_python_implementation != \"PyPy\""}
+cffi = {version = ">=2.0.0", markers = "python_full_version >= \"3.9.0\" and platform_python_implementation != \"PyPy\""}

 [package.extras]
-docs = ["sphinx (>=5.3.0)", "sphinx-rtd-theme (>=3.0.0) ; python_version >= \"3.8\""]
+docs = ["sphinx (>=5.3.0)", "sphinx-inline-tabs", "sphinx-rtd-theme (>=3.0.0)"]
 docstest = ["pyenchant (>=3)", "readme-renderer (>=30.0)", "sphinxcontrib-spelling (>=7.3.1)"]
-nox = ["nox (>=2024.4.15)", "nox[uv] (>=2024.3.2) ; python_version >= \"3.8\""]
-pep8test = ["check-sdist ; python_version >= \"3.8\"", "click (>=8.0.1)", "mypy (>=1.4)", "ruff (>=0.3.6)"]
+nox = ["nox[uv] (>=2024.4.15)"]
+pep8test = ["check-sdist", "click (>=8.0.1)", "mypy (>=1.14)", "ruff (>=0.11.11)"]
 sdist = ["build (>=1.0.0)"]
 ssh = ["bcrypt (>=3.1.5)"]
-test = ["certifi (>=2024)", "cryptography-vectors (==44.0.3)", "pretend (>=0.7)", "pytest (>=7.4.0)", "pytest-benchmark (>=4.0)", "pytest-cov (>=2.10.1)", "pytest-xdist (>=3.5.0)"]
+test = ["certifi (>=2024)", "cryptography-vectors (==46.0.6)", "pretend (>=0.7)", "pytest (>=7.4.0)", "pytest-benchmark (>=4.0)", "pytest-cov (>=2.10.1)", "pytest-xdist (>=3.5.0)"]
 test-randomorder = ["pytest-randomly"]

 [[package]]
@@ -3740,19 +3752,19 @@ urllib3 = ["packaging", "urllib3"]

 [[package]]
 name = "google-auth-httplib2"
-version = "0.2.1"
+version = "0.2.0"
 description = "Google Authentication Library: httplib2 transport"
 optional = false
-python-versions = ">=3.7"
+python-versions = "*"
 groups = ["main"]
 files = [
-    {file = "google_auth_httplib2-0.2.1-py3-none-any.whl", hash = "sha256:1be94c611db91c01f9703e7f62b0a59bbd5587a95571c7b6fade510d648bc08b"},
-    {file = "google_auth_httplib2-0.2.1.tar.gz", hash = "sha256:5ef03be3927423c87fb69607b42df23a444e434ddb2555b73b3679793187b7de"},
+    {file = "google-auth-httplib2-0.2.0.tar.gz", hash = "sha256:38aa7badf48f974f1eb9861794e9c0cb2a0511a4ec0679b1f886d108f5640e05"},
+    {file = "google_auth_httplib2-0.2.0-py2.py3-none-any.whl", hash = "sha256:b65a0a2123300dd71281a7bf6e64d65a0759287df52729bdd1ae2e47dc311a3d"},
 ]

 [package.dependencies]
-google-auth = ">=1.32.0,<3.0.0"
-httplib2 = ">=0.19.0,<1.0.0"
+google-auth = "*"
+httplib2 = ">=0.19.0"

 [[package]]
 name = "google-cloud-access-context-manager"
@@ -5925,23 +5937,24 @@ signedtoken = ["cryptography (>=3.0.0)", "pyjwt (>=2.0.0,<3)"]

 [[package]]
 name = "oci"
-version = "2.160.3"
+version = "2.169.0"
 description = "Oracle Cloud Infrastructure Python SDK"
 optional = false
 python-versions = "*"
 groups = ["main"]
 files = [
-    {file = "oci-2.160.3-py3-none-any.whl", hash = "sha256:858bff3e697098bdda44833d2476bfb4632126f0182178e7dbde4dbd156d71f0"},
-    {file = "oci-2.160.3.tar.gz", hash = "sha256:57514889be3b713a8385d86e3ba8a33cf46e3563c2a7e29a93027fb30b8a2537"},
+    {file = "oci-2.169.0-py3-none-any.whl", hash = "sha256:c71bb5143f307791082b3e33cc1545c2490a518cfed85ab1948ef5107c36d30b"},
+    {file = "oci-2.169.0.tar.gz", hash = "sha256:f3c5fff00b01783b5325ea7b13bf140053ec1e9f41da20bfb9c8a349ee7662fa"},
 ]

 [package.dependencies]
 certifi = "*"
 circuitbreaker = {version = ">=1.3.1,<3.0.0", markers = "python_version >= \"3.7\""}
-cryptography = ">=3.2.1,<46.0.0"
-pyOpenSSL = ">=17.5.0,<25.0.0"
+cryptography = ">=3.2.1,<47.0.0"
+pyOpenSSL = ">=17.5.0,<27.0.0"
 python-dateutil = ">=2.5.3,<3.0.0"
 pytz = ">=2016.10"
+urllib3 = {version = ">=2.6.3", markers = "python_version >= \"3.10.0\""}

 [package.extras]
 adk = ["docstring-parser (>=0.16) ; python_version >= \"3.10\" and python_version < \"4\"", "mcp (>=1.6.0) ; python_version >= \"3.10\" and python_version < \"4\"", "pydantic (>=2.10.6) ; python_version >= \"3.10\" and python_version < \"4\"", "rich (>=13.9.4) ; python_version >= \"3.10\" and python_version < \"4\""]
@@ -6659,7 +6672,7 @@ files = [

 [[package]]
 name = "prowler"
-version = "5.23.0"
+version = "5.24.0"
 description = "Prowler is an Open Source security tool to perform AWS, GCP and Azure security best practices assessments, audits, incident response, continuous monitoring, hardening and forensics readiness. It contains hundreds of controls covering CIS, NIST 800, NIST CSF, CISA, RBI, FedRAMP, PCI-DSS, GDPR, HIPAA, FFIEC, SOC2, GXP, AWS Well-Architected Framework Security Pillar, AWS Foundational Technical Review (FTR), ENS (Spanish National Security Scheme) and your custom security frameworks."
 optional = false
 python-versions = ">=3.10,<3.13"
@@ -6679,7 +6692,7 @@ alibabacloud-rds20140815 = "12.0.0"
 alibabacloud_sas20181203 = "6.1.0"
 alibabacloud-sls20201230 = "5.9.0"
 alibabacloud_sts20150401 = "1.1.6"
-alibabacloud_tea_openapi = "0.4.1"
+alibabacloud_tea_openapi = "0.4.4"
 alibabacloud_vpc20160428 = "6.13.0"
 alive-progress = "3.3.0"
 awsipranges = "0.3.3"
@@ -6714,14 +6727,14 @@ boto3 = "1.40.61"
 botocore = "1.40.61"
 cloudflare = "4.3.1"
 colorama = "0.4.6"
-cryptography = "44.0.3"
+cryptography = "46.0.6"
 dash = "3.1.1"
 dash-bootstrap-components = "2.0.3"
-defusedxml = ">=0.7.1"
+defusedxml = "0.7.1"
 detect-secrets = "1.5.0"
 dulwich = "0.23.0"
 google-api-python-client = "2.163.0"
-google-auth-httplib2 = ">=0.1,<0.3"
+google-auth-httplib2 = "0.2.0"
 h2 = "4.3.0"
 jsonschema = "4.23.0"
 kubernetes = "32.0.1"
@@ -6729,14 +6742,14 @@ markdown = "3.10.2"
 microsoft-kiota-abstractions = "1.9.2"
 msgraph-sdk = "1.23.0"
 numpy = "2.0.2"
-oci = "2.160.3"
+oci = "2.169.0"
 openstacksdk = "4.2.0"
 pandas = "2.2.3"
 py-iam-expand = "0.1.0"
 py-ocsf-models = "0.8.1"
-pydantic = ">=2.0,<3.0"
+pydantic = "2.12.5"
 pygithub = "2.8.0"
-python-dateutil = ">=2.9.0.post0,<3.0.0"
+python-dateutil = "2.9.0.post0"
 pytz = "2025.1"
 schema = "0.7.5"
 shodan = "1.31.0"
@@ -6748,8 +6761,8 @@ uuid6 = "2024.7.10"
 [package.source]
 type = "git"
 url = "https://github.com/prowler-cloud/prowler.git"
-reference = "master"
-resolved_reference = "6ac90eb1b58590b6f2f51645dbef17b9231053f4"
+reference = "v5.24"
+resolved_reference = "ba5b23245f4805f46d67e67fc059aefd6831f7b3"

 [[package]]
 name = "psutil"
@@ -6958,11 +6971,11 @@ description = "C parser in Python"
 optional = false
 python-versions = ">=3.10"
 groups = ["main", "dev"]
-markers = "platform_python_implementation != \"PyPy\" and implementation_name != \"PyPy\""
 files = [
    {file = "pycparser-3.0-py3-none-any.whl", hash = "sha256:b727414169a36b7d524c1c3e31839a521725078d7b2ff038656844266160a992"},
    {file = "pycparser-3.0.tar.gz", hash = "sha256:600f49d217304a5902ac3c37e1281c9fe94e4d0489de643a9504c5cdfdfc6b29"},
 ]
+markers = {main = "implementation_name != \"PyPy\" and platform_python_implementation != \"PyPy\"", dev = "platform_python_implementation != \"PyPy\" and implementation_name != \"PyPy\""}

 [[package]]
 name = "pydantic"
@@ -7288,18 +7301,19 @@ tests = ["hypothesis (>=3.27.0)", "pytest (>=7.4.0)", "pytest-cov (>=2.10.1)", "

 [[package]]
 name = "pyopenssl"
-version = "24.3.0"
+version = "26.0.0"
 description = "Python wrapper module around the OpenSSL library"
 optional = false
-python-versions = ">=3.7"
+python-versions = ">=3.8"
 groups = ["main"]
 files = [
-    {file = "pyOpenSSL-24.3.0-py3-none-any.whl", hash = "sha256:e474f5a473cd7f92221cc04976e48f4d11502804657a08a989fb3be5514c904a"},
-    {file = "pyopenssl-24.3.0.tar.gz", hash = "sha256:49f7a019577d834746bc55c5fce6ecbcec0f2b4ec5ce1cf43a9a173b8138bb36"},
+    {file = "pyopenssl-26.0.0-py3-none-any.whl", hash = "sha256:df94d28498848b98cc1c0ffb8ef1e71e40210d3b0a8064c9d29571ed2904bf81"},
+    {file = "pyopenssl-26.0.0.tar.gz", hash = "sha256:f293934e52936f2e3413b89c6ce36df66a0b34ae1ea3a053b8c5020ff2f513fc"},
 ]

 [package.dependencies]
-cryptography = ">=41.0.5,<45"
+cryptography = ">=46.0.0,<47"
+typing-extensions = {version = ">=4.9", markers = "python_version < \"3.13\" and python_version >= \"3.8\""}

 [package.extras]
 docs = ["sphinx (!=5.2.0,!=5.2.0.post0,!=7.2.5)", "sphinx_rtd_theme"]
@@ -9400,4 +9414,4 @@ files = [
 [metadata]
 lock-version = "2.1"
 python-versions = ">=3.11,<3.13"
-content-hash = "077e89853cfe3a6d934841488cfa5a98ff6c92b71f74b817b71387d11559f143"
+content-hash = "44caea5e040c54d4c726144d644e67c942b5acf7e316b1fcb2c22b0947614fbe"
@@ -25,7 +25,7 @@ dependencies = [
  "defusedxml==0.7.1",
  "gunicorn==23.0.0",
  "lxml==5.3.2",
-  "prowler @ git+https://github.com/prowler-cloud/prowler.git@master",
+  "prowler @ git+https://github.com/prowler-cloud/prowler.git@v5.24",
  "psycopg2-binary==2.9.9",
  "pytest-celery[redis] (==1.3.0)",
  "sentry-sdk[django] (==2.56.0)",
@@ -50,7 +50,7 @@ name = "prowler-api"
 package-mode = false
 # Needed for the SDK compatibility
 requires-python = ">=3.11,<3.13"
-version = "1.26.0"
+version = "1.25.0"

 [project.scripts]
 celery = "src.backend.config.settings.celery"
@@ -1,7 +1,7 @@
 openapi: 3.0.3
 info:
  title: Prowler API
-  version: 1.26.0
+  version: 1.25.0
  description: |-
    Prowler API specification.

@@ -57,7 +57,6 @@ from api.models import (
    ProviderGroupMembership,
    ProviderSecret,
    Resource,
-    ResourceFindingMapping,
    Role,
    RoleProviderGroupRelationship,
    SAMLConfiguration,
@@ -16031,36 +16030,6 @@ class TestFindingGroupViewSet:
        # s3_bucket_public_access has 2 findings with 2 different resources
        assert len(data) == 2

-    def test_resources_id_matches_resource_id_for_mapped_findings(
-        self, authenticated_client, finding_groups_fixture
-    ):
-        """Findings with a resource expose the resource id as row id (hot path contract)."""
-        response = authenticated_client.get(
-            reverse(
-                "finding-group-resources", kwargs={"pk": "s3_bucket_public_access"}
-            ),
-            {"filter[inserted_at]": TODAY},
-        )
-
-        assert response.status_code == status.HTTP_200_OK
-        data = response.json()["data"]
-        assert data, "expected resources in response"
-
-        resource_ids = set(
-            ResourceFindingMapping.objects.filter(
-                finding__check_id="s3_bucket_public_access",
-            ).values_list("resource_id", flat=True)
-        )
-        finding_ids = set(
-            Finding.objects.filter(
-                check_id="s3_bucket_public_access",
-            ).values_list("id", flat=True)
-        )
-
-        returned_ids = {item["id"] for item in data}
-        assert returned_ids <= {str(rid) for rid in resource_ids}
-        assert returned_ids.isdisjoint({str(fid) for fid in finding_ids})
-
    def test_resources_fields(self, authenticated_client, finding_groups_fixture):
        """Test resource fields (uid, name, service, region, type) have valid values."""
        response = authenticated_client.get(
@@ -4225,11 +4225,10 @@ class FindingGroupResourceSerializer(BaseSerializerV1):
    Serializer for Finding Group Resources - resources within a finding group.

    Returns individual resources with their current status, severity,
-    and timing information. Orphan findings (without any resource) expose the
-    finding id as `id` so the row stays identifiable in the UI.
+    and timing information.
    """

-    id = serializers.UUIDField(source="row_id")
+    id = serializers.UUIDField(source="resource_id")
    resource = serializers.SerializerMethodField()
    provider = serializers.SerializerMethodField()
    finding_id = serializers.UUIDField()
@@ -35,13 +35,11 @@ from django.db.models import (
    CharField,
    Count,
    DecimalField,
-    Exists,
    ExpressionWrapper,
    F,
    IntegerField,
    Max,
    Min,
-    OuterRef,
    Prefetch,
    Q,
    QuerySet,
@@ -417,7 +415,7 @@ class SchemaView(SpectacularAPIView):

    def get(self, request, *args, **kwargs):
        spectacular_settings.TITLE = "Prowler API"
-        spectacular_settings.VERSION = "1.26.0"
+        spectacular_settings.VERSION = "1.25.0"
        spectacular_settings.DESCRIPTION = (
            "Prowler API specification.\n\nThis file is auto-generated."
        )
@@ -7580,53 +7578,6 @@ class FindingGroupViewSet(BaseRLSViewSet):
            .order_by(*ordering)
        )

-    def _orphan_findings_queryset(self, filtered_queryset, finding_ids=None):
-        """Findings in the filtered set with no ResourceFindingMapping entries."""
-        orphan_qs = filtered_queryset.filter(
-            ~Exists(ResourceFindingMapping.objects.filter(finding_id=OuterRef("pk")))
-        )
-        if finding_ids is not None:
-            orphan_qs = orphan_qs.filter(id__in=finding_ids)
-        return orphan_qs
-
-    def _has_orphan_findings(self, filtered_queryset) -> bool:
-        """Return True if any finding in the filtered set has no resource mapping."""
-        return self._orphan_findings_queryset(filtered_queryset).exists()
-
-    def _orphan_aggregation_values(self, orphan_queryset):
-        """Raw rows for orphan findings; resource payload synthesized from metadata.
-
-        check_metadata is stored with lowercase keys (see
-        `prowler.lib.outputs.finding.Finding.get_metadata`) and
-        `Finding.resource_groups` is already denormalized at ingest time.
-        """
-        return orphan_queryset.annotate(
-            _provider_type=F("scan__provider__provider"),
-            _provider_uid=F("scan__provider__uid"),
-            _provider_alias=F("scan__provider__alias"),
-            _svc=KeyTextTransform("servicename", "check_metadata"),
-            _region=KeyTextTransform("region", "check_metadata"),
-            _rtype=KeyTextTransform("resourcetype", "check_metadata"),
-            _rgroup=F("resource_groups"),
-        ).values(
-            "id",
-            "uid",
-            "status",
-            "severity",
-            "delta",
-            "muted",
-            "muted_reason",
-            "first_seen_at",
-            "inserted_at",
-            "_provider_type",
-            "_provider_uid",
-            "_provider_alias",
-            "_svc",
-            "_region",
-            "_rtype",
-            "_rgroup",
-        )
-
    def _post_process_resources(self, resource_data):
        """Convert resource aggregation rows to API output."""
        results = []
@@ -7648,13 +7599,9 @@ class FindingGroupViewSet(BaseRLSViewSet):
            else:
                delta = None

-            resource_id = row["resource_id"]
-            finding_id = str(row["finding_id"]) if row.get("finding_id") else None
-
            results.append(
                {
-                    "row_id": resource_id,
-                    "resource_id": resource_id,
+                    "resource_id": row["resource_id"],
                    "resource_uid": row["resource_uid"],
                    "resource_name": row["resource_name"],
                    "resource_service": row["resource_service"],
@@ -7673,46 +7620,9 @@ class FindingGroupViewSet(BaseRLSViewSet):
                    "muted": bool(row.get("muted", False)),
                    "muted_reason": row.get("muted_reason"),
                    "resource_group": row.get("resource_group", ""),
-                    "finding_id": finding_id,
-                }
-            )
-
-        return results
-
-    def _post_process_orphans(self, orphan_rows):
-        """Convert orphan finding rows into the same API shape as mapping rows."""
-        results = []
-        for row in orphan_rows:
-            status_val = row["status"]
-            status = status_val if status_val in ("FAIL", "PASS") else "MANUAL"
-
-            muted = bool(row["muted"])
-            delta_val = row.get("delta")
-            delta = delta_val if delta_val in ("new", "changed") and not muted else None
-
-            finding_id = str(row["id"])
-
-            results.append(
-                {
-                    "row_id": finding_id,
-                    "resource_id": None,
-                    "resource_uid": row["uid"],
-                    "resource_name": row["uid"],
-                    "resource_service": row["_svc"] or "",
-                    "resource_region": row["_region"] or "",
-                    "resource_type": row["_rtype"] or "",
-                    "provider_type": row["_provider_type"],
-                    "provider_uid": row["_provider_uid"],
-                    "provider_alias": row["_provider_alias"],
-                    "status": status,
-                    "severity": row["severity"],
-                    "delta": delta,
-                    "first_seen_at": row["first_seen_at"],
-                    "last_seen_at": row["inserted_at"],
-                    "muted": muted,
-                    "muted_reason": row.get("muted_reason"),
-                    "resource_group": row["_rgroup"] or "",
-                    "finding_id": finding_id,
+                    "finding_id": (
+                        str(row["finding_id"]) if row.get("finding_id") else None
+                    ),
                }
            )

@@ -7821,64 +7731,41 @@ class FindingGroupViewSet(BaseRLSViewSet):
    def _paginated_resource_response(
        self, request, filtered_queryset, resource_ids, tenant_id
    ):
-        """Paginate and return resources, appending orphan findings when present.
+        """Paginate and return resources.

-        Hot path (no orphans, or resource filter applied): resources come from
-        ResourceFindingMapping aggregation. Untouched pre-existing behaviour.
-
-        Orphan fallback: findings without a mapping (e.g. IaC) are appended
-        after mapping rows as synthesised resource-like rows so they remain
-        visible in the UI without paying the aggregation cost on the hot path.
+        Without sort: paginate lightweight resource IDs first, aggregate only the page.
+        With sort: build a lightweight ordering subquery (resource_id + sort keys),
+        paginate that, then aggregate full details only for the page.
        """
        sort_param = request.query_params.get("sort")
-        ordering = None
+
        if sort_param:
-            validated = self._validate_sort_fields(sort_param, self._RESOURCE_SORT_MAP)
-            ordering = validated if validated else None
+            ordering = self._validate_sort_fields(sort_param, self._RESOURCE_SORT_MAP)
+            if ordering:
+                if "resource_id" not in {field.lstrip("-") for field in ordering}:
+                    ordering.append("resource_id")

-        # Resource filters can only match findings with resources; skip orphan
-        # detection entirely when they are present.
-        if resource_ids is not None:
-            return self._mapping_paginated_response(
-                request, filtered_queryset, resource_ids, tenant_id, ordering
-            )
+                # Phase 1: lightweight aggregation with only sort keys, paginate
+                ordering_qs = self._build_resource_ordering_queryset(
+                    filtered_queryset,
+                    resource_ids=resource_ids,
+                    tenant_id=tenant_id,
+                    ordering=ordering,
+                )
+                page = self.paginate_queryset(ordering_qs)
+                if page is not None:
+                    page_ids = [row["resource_id"] for row in page]
+                    resource_data = self._build_resource_aggregation(
+                        filtered_queryset, resource_ids=page_ids, tenant_id=tenant_id
+                    )
+                    # Re-sort to match the page ordering
+                    id_order = {rid: idx for idx, rid in enumerate(page_ids)}
+                    results = self._post_process_resources(resource_data)
+                    results.sort(key=lambda r: id_order.get(r["resource_id"], 0))
+                    serializer = FindingGroupResourceSerializer(results, many=True)
+                    return self.get_paginated_response(serializer.data)

-        has_mappings = self._build_resource_mapping_queryset(
-            filtered_queryset, resource_ids=None, tenant_id=tenant_id
-        ).exists()
-
-        if has_mappings:
-            # Normal or mixed group: serve only resource-mapped rows.
-            # TODO: Orphan findings in mixed groups are intentionally excluded
-            # until the ephemeral resources strategy is decided. When resolved,
-            # route mixed groups to _combined_paginated_response instead.
-            return self._mapping_paginated_response(
-                request, filtered_queryset, resource_ids, tenant_id, ordering
-            )
-
-        # Pure orphan group (e.g. IaC): synthesize resource-like rows.
-        return self._combined_paginated_response(
-            request, filtered_queryset, tenant_id, ordering
-        )
-
-    def _mapping_paginated_response(
-        self, request, filtered_queryset, resource_ids, tenant_id, ordering
-    ):
-        """Mapping-only paginated response (original fast path)."""
-        if ordering:
-            if "resource_id" not in {field.lstrip("-") for field in ordering}:
-                ordering.append("resource_id")
-
-            # Phase 1: lightweight aggregation with only sort keys, paginate
-            ordering_qs = self._build_resource_ordering_queryset(
-                filtered_queryset,
-                resource_ids=resource_ids,
-                tenant_id=tenant_id,
-                ordering=ordering,
-            )
-            page = self.paginate_queryset(ordering_qs)
-            if page is not None:
-                page_ids = [row["resource_id"] for row in page]
+                page_ids = [row["resource_id"] for row in ordering_qs]
                resource_data = self._build_resource_aggregation(
                    filtered_queryset, resource_ids=page_ids, tenant_id=tenant_id
                )
@@ -7886,18 +7773,10 @@ class FindingGroupViewSet(BaseRLSViewSet):
                results = self._post_process_resources(resource_data)
                results.sort(key=lambda r: id_order.get(r["resource_id"], 0))
                serializer = FindingGroupResourceSerializer(results, many=True)
-                return self.get_paginated_response(serializer.data)
-
-            page_ids = [row["resource_id"] for row in ordering_qs]
-            resource_data = self._build_resource_aggregation(
-                filtered_queryset, resource_ids=page_ids, tenant_id=tenant_id
-            )
-            id_order = {rid: idx for idx, rid in enumerate(page_ids)}
-            results = self._post_process_resources(resource_data)
-            results.sort(key=lambda r: id_order.get(r["resource_id"], 0))
-            serializer = FindingGroupResourceSerializer(results, many=True)
-            return Response(serializer.data)
+                return Response(serializer.data)

+        # No sort (or only empty sort fragments): paginate lightweight resource IDs
+        # first, aggregate only the page.
        mapping_qs = self._build_resource_mapping_queryset(
            filtered_queryset, resource_ids=resource_ids, tenant_id=tenant_id
        )
@@ -7925,95 +7804,6 @@ class FindingGroupViewSet(BaseRLSViewSet):
        serializer = FindingGroupResourceSerializer(results, many=True)
        return Response(serializer.data)

-    def _combined_paginated_response(
-        self, request, filtered_queryset, tenant_id, ordering
-    ):
-        """Mapping rows + orphan findings appended at end.
-
-        Orphans sit after mapping rows regardless of sort. This keeps the
-        mapping-only code path intact for checks that have no orphans (the
-        common case) and avoids paying UNION/coalesce costs there.
-        """
-        mapping_qs = self._build_resource_mapping_queryset(
-            filtered_queryset, resource_ids=None, tenant_id=tenant_id
-        )
-        mapping_count = mapping_qs.values("resource_id").distinct().count()
-
-        orphan_ids = list(
-            self._orphan_findings_queryset(filtered_queryset)
-            .order_by("id")
-            .values_list("id", flat=True)
-        )
-        orphan_count = len(orphan_ids)
-        total = mapping_count + orphan_count
-
-        # Paginate a simple [0..total) index sequence so DRF produces proper
-        # links/meta; then slice mapping / orphan sources accordingly.
-        page = self.paginate_queryset(range(total))
-        page_indices = list(page) if page is not None else list(range(total))
-
-        mapping_indices = [i for i in page_indices if i < mapping_count]
-        orphan_positions = [
-            i - mapping_count for i in page_indices if i >= mapping_count
-        ]
-
-        mapping_results = []
-        if mapping_indices:
-            start = mapping_indices[0]
-            stop = mapping_indices[-1] + 1
-            if ordering:
-                ordering_fields = list(ordering)
-                if "resource_id" not in {
-                    field.lstrip("-") for field in ordering_fields
-                }:
-                    ordering_fields.append("resource_id")
-                ordered_qs = self._build_resource_ordering_queryset(
-                    filtered_queryset,
-                    resource_ids=None,
-                    tenant_id=tenant_id,
-                    ordering=ordering_fields,
-                )
-                slice_rids = [row["resource_id"] for row in ordered_qs[start:stop]]
-            else:
-                slice_rids = list(
-                    mapping_qs.values_list("resource_id", flat=True)
-                    .distinct()
-                    .order_by("resource_id")[start:stop]
-                )
-            if slice_rids:
-                resource_data = self._build_resource_aggregation(
-                    filtered_queryset,
-                    resource_ids=slice_rids,
-                    tenant_id=tenant_id,
-                )
-                rows_by_rid = {row["resource_id"]: row for row in resource_data}
-                ordered_rows = [
-                    rows_by_rid[rid] for rid in slice_rids if rid in rows_by_rid
-                ]
-                mapping_results = self._post_process_resources(ordered_rows)
-
-        orphan_results = []
-        if orphan_positions:
-            slice_fids = [orphan_ids[pos] for pos in orphan_positions]
-            raw_rows = list(
-                self._orphan_aggregation_values(
-                    self._orphan_findings_queryset(
-                        filtered_queryset, finding_ids=slice_fids
-                    )
-                )
-            )
-            rows_by_fid = {row["id"]: row for row in raw_rows}
-            ordered_rows = [
-                rows_by_fid[fid] for fid in slice_fids if fid in rows_by_fid
-            ]
-            orphan_results = self._post_process_orphans(ordered_rows)
-
-        results = mapping_results + orphan_results
-        serializer = FindingGroupResourceSerializer(results, many=True)
-        if page is not None:
-            return self.get_paginated_response(serializer.data)
-        return Response(serializer.data)
-
    def list(self, request, *args, **kwargs):
        """
        List finding groups with aggregation and filtering.
@@ -248,9 +248,7 @@ def _fetch_findings_batch(
    with rls_transaction(tenant_id, using=READ_REPLICA_ALIAS):
        # Use `all_objects` to get `Findings` even on soft-deleted `Providers`
        # But even the provider is already validated as active in this context
-        qs = FindingModel.all_objects.filter(
-            tenant_id=tenant_id, scan_id=scan_id
-        ).order_by("id")
+        qs = FindingModel.all_objects.filter(scan_id=scan_id).order_by("id")

        if after_id is not None:
            qs = qs.filter(id__gt=after_id)
@@ -121,8 +121,8 @@ To update the environment file:
 Edit the `.env` file and change version values:

 ```env
-PROWLER_UI_VERSION="5.24.0"
-PROWLER_API_VERSION="5.24.0"
+PROWLER_UI_VERSION="5.23.0"
+PROWLER_API_VERSION="5.23.0"
 ```

 <Note>
@@ -2,16 +2,6 @@

 All notable changes to the **Prowler SDK** are documented in this file.

-## [5.24.1] (Prowler UNRELEASED)
-
-### 🐞 Fixed
-
- Cloudflare account-scoped API tokens failing connection test in the App with `CloudflareUserTokenRequiredError` [(#10723)](https://github.com/prowler-cloud/prowler/pull/10723)
- `prowler image --registry` failing with `ImageNoImagesProvidedError` due to registry arguments not being forwarded to `ImageProvider` in `init_global_provider` [(#10470)](https://github.com/prowler-cloud/prowler/pull/10470)
- Google Workspace Calendar checks false FAIL on unconfigured settings with secure Google defaults [(#10726)](https://github.com/prowler-cloud/prowler/pull/10726)
-
---
-
 ## [5.24.0] (Prowler v5.24.0)

 ### 🚀 Added
@@ -36,9 +26,7 @@ All notable changes to the **Prowler SDK** are documented in this file.

 ### 🐞 Fixed

- `prowler image --registry-list` crashes with `AttributeError` because `ImageProvider.__init__` returns early before registering the global provider [(#10691)](https://github.com/prowler-cloud/prowler/pull/10691)
 - Vercel firewall config handling for team-scoped projects and current API response shapes [(#10695)](https://github.com/prowler-cloud/prowler/pull/10695)
- Google Workspace Drive checks false FAIL on unconfigured settings with secure Google defaults [(#10727)](https://github.com/prowler-cloud/prowler/pull/10727)

 ---

@@ -89,6 +77,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - Oracle Cloud `kms_key_rotation_enabled` now checks current key version age to avoid false positives on vaults without auto-rotation support [(#10450)](https://github.com/prowler-cloud/prowler/pull/10450)
 - OCI filestorage, blockstorage, KMS, and compute services now honor `--region` for scanning outside the tenancy home region [(#10472)](https://github.com/prowler-cloud/prowler/pull/10472)
 - OCI provider now supports multi-region filtering via `--region` [(#10473)](https://github.com/prowler-cloud/prowler/pull/10473)
+- `prowler image --registry` failing with `ImageNoImagesProvidedError` due to registry arguments not being forwarded to `ImageProvider` in `init_global_provider` [(#10470)](https://github.com/prowler-cloud/prowler/pull/10470)
 - OCI multi-region support for identity client configuration in blockstorage, identity, and filestorage services [(#10520)](https://github.com/prowler-cloud/prowler/pull/10520)
 - Google Workspace Calendar checks now filter for customer-level policies only, skipping OU and group overrides that could produce incorrect audit results [(#10658)](https://github.com/prowler-cloud/prowler/pull/10658)

@@ -293,10 +293,6 @@ def prowler():
    if not args.only_logs:
        global_provider.print_credentials()

-    # --registry-list: listing already printed during provider init, exit
-    if getattr(global_provider, "_listing_only", False):
-        sys.exit()
-
    # Skip service and check loading for external-tool providers
    if provider not in EXTERNAL_TOOL_PROVIDERS:
        # Import custom checks from folder
@@ -38,7 +38,7 @@ class _MutableTimestamp:

 timestamp = _MutableTimestamp(datetime.today())
 timestamp_utc = _MutableTimestamp(datetime.now(timezone.utc))
-prowler_version = "5.25.0"
+prowler_version = "5.24.0"
 html_logo_url = "https://github.com/prowler-cloud/prowler/"
 square_logo_img = "https://raw.githubusercontent.com/prowler-cloud/prowler/dc7d2d5aeb92fdf12e8604f42ef6472cd3e8e889/docs/img/prowler-logo-black.png"
 aws_logo = "https://user-images.githubusercontent.com/38561120/235953920-3e3fba08-0795-41dc-b480-9bea57db9f2e.png"
@@ -332,16 +332,19 @@ class CloudflareProvider(Provider):
            return
        except PermissionDeniedError as error:
            error_str = str(error)
+            # Check for user-level authentication required (code 9109)
+            if "9109" in error_str:
+                logger.error(f"CloudflareUserTokenRequiredError: {error}")
+                raise CloudflareUserTokenRequiredError(
+                    file=os.path.basename(__file__),
+                )
            # Check for invalid API key or email (code 9103) - comes as 403
            if "9103" in error_str or "Unknown X-Auth-Key" in error_str:
                logger.error(f"CloudflareInvalidAPIKeyError: {error}")
                raise CloudflareInvalidAPIKeyError(
                    file=os.path.basename(__file__),
                )
-            # For permission errors (including 9109 account-scoped tokens),
-            # try accounts.list() as fallback before failing.
-            # Error 9109 means the token is account-scoped, not user-level,
-            # which is valid for scanning — only fail if accounts.list() also fails.
+            # For other permission errors, try accounts.list() as fallback
            logger.warning(
                f"Unable to retrieve Cloudflare user info: {error}. "
                "Trying accounts.list() as fallback."
@@ -35,20 +35,21 @@ class calendar_external_invitations_warning(Check):
                    f"External invitation warnings for Google Calendar are enabled "
                    f"in domain {calendar_client.provider.identity.domain}."
                )
-            elif warning_enabled is None:
-                report.status = "PASS"
-                report.status_extended = (
-                    f"External invitation warnings for Google Calendar use Google's "
-                    f"secure default configuration (enabled) "
-                    f"in domain {calendar_client.provider.identity.domain}."
-                )
            else:
                report.status = "FAIL"
-                report.status_extended = (
-                    f"External invitation warnings for Google Calendar are disabled "
-                    f"in domain {calendar_client.provider.identity.domain}. "
-                    f"Users should be warned when inviting guests outside the organization."
-                )
+                if warning_enabled is None:
+                    report.status_extended = (
+                        f"External invitation warnings for Google Calendar are not "
+                        f"explicitly configured in domain "
+                        f"{calendar_client.provider.identity.domain}. "
+                        f"Users should be warned when inviting guests outside the organization."
+                    )
+                else:
+                    report.status_extended = (
+                        f"External invitation warnings for Google Calendar are disabled "
+                        f"in domain {calendar_client.provider.identity.domain}. "
+                        f"Users should be warned when inviting guests outside the organization."
+                    )

            findings.append(report)

@@ -36,20 +36,20 @@ class calendar_external_sharing_primary_calendar(Check):
                    f"{calendar_client.provider.identity.domain} is restricted to "
                    f"free/busy information only."
                )
-            elif sharing is None:
-                report.status = "PASS"
-                report.status_extended = (
-                    f"Primary calendar external sharing uses Google's secure default "
-                    f"configuration (free/busy only) "
-                    f"in domain {calendar_client.provider.identity.domain}."
-                )
            else:
                report.status = "FAIL"
-                report.status_extended = (
-                    f"Primary calendar external sharing in domain "
-                    f"{calendar_client.provider.identity.domain} is set to {sharing}. "
-                    f"External sharing should be restricted to free/busy information only."
-                )
+                if sharing is None:
+                    report.status_extended = (
+                        f"Primary calendar external sharing is not explicitly configured "
+                        f"in domain {calendar_client.provider.identity.domain}. "
+                        f"External sharing should be restricted to free/busy information only."
+                    )
+                else:
+                    report.status_extended = (
+                        f"Primary calendar external sharing in domain "
+                        f"{calendar_client.provider.identity.domain} is set to {sharing}. "
+                        f"External sharing should be restricted to free/busy information only."
+                    )

            findings.append(report)

@@ -33,20 +33,21 @@ class drive_external_sharing_warn_users(Check):
                    f"External sharing warnings for Drive and Docs are enabled "
                    f"in domain {drive_client.provider.identity.domain}."
                )
-            elif warning_enabled is None:
-                report.status = "PASS"
-                report.status_extended = (
-                    f"External sharing warnings for Drive and Docs use Google's "
-                    f"secure default configuration (enabled) "
-                    f"in domain {drive_client.provider.identity.domain}."
-                )
            else:
                report.status = "FAIL"
-                report.status_extended = (
-                    f"External sharing warnings for Drive and Docs are disabled "
-                    f"in domain {drive_client.provider.identity.domain}. "
-                    f"Users should be warned when sharing files outside the organization."
-                )
+                if warning_enabled is None:
+                    report.status_extended = (
+                        f"External sharing warnings for Drive and Docs are not "
+                        f"explicitly configured in domain "
+                        f"{drive_client.provider.identity.domain}. "
+                        f"Users should be warned when sharing files outside the organization."
+                    )
+                else:
+                    report.status_extended = (
+                        f"External sharing warnings for Drive and Docs are disabled "
+                        f"in domain {drive_client.provider.identity.domain}. "
+                        f"Users should be warned when sharing files outside the organization."
+                    )

            findings.append(report)

@@ -35,21 +35,22 @@ class drive_shared_drive_creation_allowed(Check):
                    f"Users in domain {drive_client.provider.identity.domain} "
                    f"are allowed to create new shared drives."
                )
-            elif allow_creation is None:
-                report.status = "PASS"
-                report.status_extended = (
-                    f"Shared drive creation uses Google's secure default "
-                    f"configuration (allowed) "
-                    f"in domain {drive_client.provider.identity.domain}."
-                )
            else:
                report.status = "FAIL"
-                report.status_extended = (
-                    f"Users in domain {drive_client.provider.identity.domain} "
-                    f"are prevented from creating new shared drives. "
-                    f"Users should be allowed to create new shared drives to avoid "
-                    f"data loss when accounts are deleted."
-                )
+                if allow_creation is None:
+                    report.status_extended = (
+                        f"Shared drive creation is not explicitly configured in "
+                        f"domain {drive_client.provider.identity.domain}. "
+                        f"Users should be allowed to create new shared drives to avoid "
+                        f"data loss when accounts are deleted."
+                    )
+                else:
+                    report.status_extended = (
+                        f"Users in domain {drive_client.provider.identity.domain} "
+                        f"are prevented from creating new shared drives. "
+                        f"Users should be allowed to create new shared drives to avoid "
+                        f"data loss when accounts are deleted."
+                    )

            findings.append(report)

@@ -35,21 +35,21 @@ class drive_shared_drive_disable_download_print_copy(Check):
                    f"{drive_client.provider.identity.domain} is restricted to "
                    f"{allowed}."
                )
-            elif allowed is None:
-                report.status = "PASS"
-                report.status_extended = (
-                    f"Download, print, and copy restrictions for shared drives use "
-                    f"Google's secure default configuration (disabled for viewers "
-                    f"and commenters) "
-                    f"in domain {drive_client.provider.identity.domain}."
-                )
            else:
                report.status = "FAIL"
-                report.status_extended = (
-                    f"Download, print, and copy in shared drives in domain "
-                    f"{drive_client.provider.identity.domain} is set to {allowed}. "
-                    f"These actions should be restricted to editors or managers only."
-                )
+                if allowed is None:
+                    report.status_extended = (
+                        f"Download, print, and copy restrictions for shared drive "
+                        f"viewers and commenters are not explicitly configured in "
+                        f"domain {drive_client.provider.identity.domain}. "
+                        f"These actions should be restricted to editors or managers only."
+                    )
+                else:
+                    report.status_extended = (
+                        f"Download, print, and copy in shared drives in domain "
+                        f"{drive_client.provider.identity.domain} is set to {allowed}. "
+                        f"These actions should be restricted to editors or managers only."
+                    )

            findings.append(report)

@@ -36,20 +36,21 @@ class drive_warn_sharing_with_allowlisted_domains(Check):
                    f"Users are warned when sharing files with allowlisted "
                    f"domains in domain {drive_client.provider.identity.domain}."
                )
-            elif warn_enabled is None:
-                report.status = "PASS"
-                report.status_extended = (
-                    f"Warning when sharing with allowlisted domains uses Google's "
-                    f"secure default configuration (enabled) "
-                    f"in domain {drive_client.provider.identity.domain}."
-                )
            else:
                report.status = "FAIL"
-                report.status_extended = (
-                    f"Warning when sharing with allowlisted domains is disabled "
-                    f"in domain {drive_client.provider.identity.domain}. "
-                    f"Users should be warned when sharing files with users in allowlisted domains."
-                )
+                if warn_enabled is None:
+                    report.status_extended = (
+                        f"Warning when sharing with allowlisted domains is not "
+                        f"explicitly configured in domain "
+                        f"{drive_client.provider.identity.domain}. "
+                        f"Users should be warned when sharing files with users in allowlisted domains."
+                    )
+                else:
+                    report.status_extended = (
+                        f"Warning when sharing with allowlisted domains is disabled "
+                        f"in domain {drive_client.provider.identity.domain}. "
+                        f"Users should be warned when sharing files with users in allowlisted domains."
+                    )

            findings.append(report)

@@ -163,51 +163,43 @@ class ImageProvider(Provider):
        # Registry scan mode: enumerate images from registry
        if self.registry:
            self._enumerate_registry()
+            if self._listing_only:
+                return

-        # Safe defaults for listing-only mode (overwritten below in scan mode)
-        self._audit_config = {}
-        self._fixer_config = {}
-        self._mutelist = None
-        self.audit_metadata = None
+        for image in self.images:
+            self._validate_image_name(image)

-        # Skip scan setup for listing-only mode
-        if not self._listing_only:
-            for image in self.images:
-                self._validate_image_name(image)
-
-            if not self.images:
-                raise ImageNoImagesProvidedError(
-                    file=__file__,
-                    message="No images provided for scanning.",
-                )
-
-            # Audit Config
-            if config_content:
-                self._audit_config = config_content
-            else:
-                if not config_path:
-                    config_path = default_config_file_path
-                self._audit_config = load_and_validate_config_file(
-                    self._type, config_path
-                )
-
-            # Fixer Config
-            self._fixer_config = fixer_config if fixer_config is not None else {}
-
-            # Mutelist (not needed for Image provider since Trivy has its own logic)
-            self._mutelist = None
-
-            self.audit_metadata = Audit_Metadata(
-                provider=self._type,
-                account_id=self.audited_account,
-                account_name="image",
-                region=self.region,
-                services_scanned=0,
-                expected_checks=[],
-                completed_checks=0,
-                audit_progress=0,
+        if not self.images:
+            raise ImageNoImagesProvidedError(
+                file=__file__,
+                message="No images provided for scanning.",
            )

+        # Audit Config
+        if config_content:
+            self._audit_config = config_content
+        else:
+            if not config_path:
+                config_path = default_config_file_path
+            self._audit_config = load_and_validate_config_file(self._type, config_path)
+
+        # Fixer Config
+        self._fixer_config = fixer_config if fixer_config is not None else {}
+
+        # Mutelist (not needed for Image provider since Trivy has its own logic)
+        self._mutelist = None
+
+        self.audit_metadata = Audit_Metadata(
+            provider=self._type,
+            account_id=self.audited_account,
+            account_name="image",
+            region=self.region,
+            services_scanned=0,
+            expected_checks=[],
+            completed_checks=0,
+            audit_progress=0,
+        )
+
        Provider.set_global_provider(self)

    def _load_images_from_file(self, file_path: str) -> None:
@@ -95,7 +95,7 @@ maintainers = [{name = "Prowler Engineering", email = "engineering@prowler.com"}
 name = "prowler"
 readme = "README.md"
 requires-python = ">=3.10,<3.13"
-version = "5.25.0"
+version = "5.24.0"

 [project.scripts]
 prowler = "prowler.__main__:prowler"
@@ -73,8 +73,8 @@ class TestCalendarExternalInvitationsWarning:
            assert findings[0].status == "FAIL"
            assert "disabled" in findings[0].status_extended

-    def test_pass_using_default(self):
-        """Test PASS when no explicit policy is set (None) — Google default is secure (enabled)"""
+    def test_fail_no_policy_set(self):
+        """Test FAIL when no explicit policy is set (None) but fetch succeeded"""
        mock_provider = set_mocked_googleworkspace_provider()

        with (
@@ -100,8 +100,8 @@ class TestCalendarExternalInvitationsWarning:
            findings = check.execute()

            assert len(findings) == 1
-            assert findings[0].status == "PASS"
-            assert "secure default" in findings[0].status_extended
+            assert findings[0].status == "FAIL"
+            assert "not explicitly configured" in findings[0].status_extended

    def test_no_findings_when_fetch_failed(self):
        """Test no findings returned when the API fetch failed"""
@@ -104,8 +104,8 @@ class TestCalendarExternalSharingPrimaryCalendar:
            assert findings[0].status == "FAIL"
            assert "EXTERNAL_ALL_INFO_READ_WRITE" in findings[0].status_extended

-    def test_pass_using_default(self):
-        """Test PASS when no explicit policy is set (None) — Google default is secure (free/busy only)"""
+    def test_fail_no_policy_set(self):
+        """Test FAIL when no explicit policy is set (None) but fetch succeeded"""
        mock_provider = set_mocked_googleworkspace_provider()

        with (
@@ -131,8 +131,8 @@ class TestCalendarExternalSharingPrimaryCalendar:
            findings = check.execute()

            assert len(findings) == 1
-            assert findings[0].status == "PASS"
-            assert "secure default" in findings[0].status_extended
+            assert findings[0].status == "FAIL"
+            assert "not explicitly configured" in findings[0].status_extended

    def test_no_findings_when_fetch_failed(self):
        """Test no findings returned when the API fetch failed"""
@@ -67,8 +67,8 @@ class TestDriveExternalSharingWarnUsers:
            assert findings[0].status == "FAIL"
            assert "disabled" in findings[0].status_extended

-    def test_pass_using_default(self):
-        """Test PASS when no explicit policy is set (None) — Google default is secure"""
+    def test_fail_no_policy_set(self):
+        """Test FAIL when no explicit policy is set (None) but fetch succeeded"""
        mock_provider = set_mocked_googleworkspace_provider()

        with (
@@ -92,8 +92,8 @@ class TestDriveExternalSharingWarnUsers:
            findings = check.execute()

            assert len(findings) == 1
-            assert findings[0].status == "PASS"
-            assert "secure default" in findings[0].status_extended
+            assert findings[0].status == "FAIL"
+            assert "not explicitly configured" in findings[0].status_extended

    def test_no_findings_when_fetch_failed(self):
        """Test no findings returned when the API fetch failed"""
@@ -69,8 +69,8 @@ class TestDriveSharedDriveCreationAllowed:
            assert findings[0].status == "FAIL"
            assert "prevented" in findings[0].status_extended

-    def test_pass_using_default(self):
-        """Test PASS when no explicit policy is set (None) — Google default is secure"""
+    def test_fail_no_policy_set(self):
+        """Test FAIL when no explicit policy is set (None) but fetch succeeded"""
        mock_provider = set_mocked_googleworkspace_provider()

        with (
@@ -94,8 +94,8 @@ class TestDriveSharedDriveCreationAllowed:
            findings = check.execute()

            assert len(findings) == 1
-            assert findings[0].status == "PASS"
-            assert "secure default" in findings[0].status_extended
+            assert findings[0].status == "FAIL"
+            assert "not explicitly configured" in findings[0].status_extended

    def test_no_findings_when_fetch_failed(self):
        """Test no findings returned when the API fetch failed"""
@@ -101,8 +101,8 @@ class TestDriveSharedDriveDisableDownloadPrintCopy:
            assert findings[0].status == "FAIL"
            assert "ALL" in findings[0].status_extended

-    def test_pass_using_default(self):
-        """Test PASS when no explicit policy is set (None) — Google default is secure"""
+    def test_fail_no_policy_set(self):
+        """Test FAIL when no explicit policy is set (None) but fetch succeeded"""
        mock_provider = set_mocked_googleworkspace_provider()

        with (
@@ -128,8 +128,8 @@ class TestDriveSharedDriveDisableDownloadPrintCopy:
            findings = check.execute()

            assert len(findings) == 1
-            assert findings[0].status == "PASS"
-            assert "secure default" in findings[0].status_extended
+            assert findings[0].status == "FAIL"
+            assert "not explicitly configured" in findings[0].status_extended

    def test_no_findings_when_fetch_failed(self):
        """Test no findings returned when the API fetch failed"""
@@ -71,8 +71,8 @@ class TestDriveWarnSharingWithAllowlistedDomains:
            assert findings[0].status == "FAIL"
            assert "disabled" in findings[0].status_extended

-    def test_pass_using_default(self):
-        """Test PASS when no explicit policy is set (None) — Google default is secure"""
+    def test_fail_no_policy_set(self):
+        """Test FAIL when no explicit policy is set (None) but fetch succeeded"""
        mock_provider = set_mocked_googleworkspace_provider()

        with (
@@ -98,8 +98,8 @@ class TestDriveWarnSharingWithAllowlistedDomains:
            findings = check.execute()

            assert len(findings) == 1
-            assert findings[0].status == "PASS"
-            assert "secure default" in findings[0].status_extended
+            assert findings[0].status == "FAIL"
+            assert "not explicitly configured" in findings[0].status_extended

    def test_no_findings_when_fetch_failed(self):
        """Test no findings returned when the API fetch failed"""
@@ -1185,58 +1185,3 @@ class TestInitGlobalProviderRegistryEnumeration:
            # The "other/lib" repo should be filtered out by --image-filter
            assert not any("other/lib" in img for img in provider.images)
            assert len(provider.images) == 3
-
-
-class TestRegistryListMode:
-    """Regression test: `prowler image --registry <url> --registry-list` crashes.
-
-    When --registry-list is passed, ImageProvider._enumerate_registry sets
-    _listing_only = True and __init__ returns early — before calling
-    Provider.set_global_provider(self). The caller in __main__.py then calls
-    global_provider.print_credentials() on a None reference, raising
-    AttributeError: 'NoneType' object has no attribute 'print_credentials'.
-    """
-
-    @patch("prowler.providers.image.image_provider.create_registry_adapter")
-    @patch("prowler.providers.common.provider.load_and_validate_config_file")
-    def test_registry_list_does_not_crash(self, mock_load_config, mock_adapter_factory):
-        """Reproduce the --registry-list crash by running the same sequence
-        as __main__.py: init_global_provider, get_global_provider,
-        then print_credentials."""
-        mock_load_config.return_value = {}
-
-        adapter = MagicMock()
-        adapter.list_repositories.return_value = ["myorg/app"]
-        adapter.list_tags.return_value = ["v1.0", "latest"]
-        mock_adapter_factory.return_value = adapter
-
-        arguments = Namespace(
-            provider="image",
-            config_file=None,
-            fixer_config=None,
-            images=None,
-            image_list_file=None,
-            scanners=["vuln"],
-            image_config_scanners=None,
-            trivy_severity=None,
-            ignore_unfixed=False,
-            timeout="5m",
-            registry="myregistry.io",
-            image_filter=None,
-            tag_filter=None,
-            max_images=0,
-            registry_insecure=False,
-            registry_list_images=True,
-        )
-
-        # Reproduce the exact crash sequence from __main__.py lines 289-294:
-        #   Provider.init_global_provider(args)
-        #   global_provider = Provider.get_global_provider()
-        #   global_provider.print_credentials()
-        with mock.patch.object(Provider, "_global", None):
-            Provider.init_global_provider(arguments)
-            global_provider = Provider.get_global_provider()
-
-            # This is the line that crashes: global_provider is None so
-            # .print_credentials() raises AttributeError.
-            global_provider.print_credentials()