fix(api): restore the API version on the release branch (#12324)

Co-authored-by: Alan Buscaglia <gentlemanprogramming@gmail.com>

.env

@@ -158,7 +158,7 @@ SENTRY_RELEASE=local
 # REO_DEV_CLIENT_ID=
 
 #### Prowler release version ####
-NEXT_PUBLIC_PROWLER_RELEASE_VERSION=v5.42.1
+NEXT_PUBLIC_PROWLER_RELEASE_VERSION=v5.37.1
 
 # Social login credentials
 SOCIAL_GOOGLE_OAUTH_CALLBACK_URL="${AUTH_URL}/api/auth/callback/google"

.github/CODEOWNERS

@@ -1,23 +1,23 @@
 # SDK
-/* @prowler-cloud/engineering
-/prowler/ @prowler-cloud/engineering
-/tests/ @prowler-cloud/engineering
-/dashboard/ @prowler-cloud/engineering
-/docs/ @prowler-cloud/engineering
-/examples/ @prowler-cloud/engineering
-/util/ @prowler-cloud/engineering
-/contrib/ @prowler-cloud/engineering
-/permissions/ @prowler-cloud/engineering
-/codecov.yml @prowler-cloud/engineering
+/* @prowler-cloud/detection-remediation
+/prowler/ @prowler-cloud/detection-remediation
+/tests/ @prowler-cloud/detection-remediation
+/dashboard/ @prowler-cloud/detection-remediation
+/docs/ @prowler-cloud/detection-remediation
+/examples/ @prowler-cloud/detection-remediation
+/util/ @prowler-cloud/detection-remediation
+/contrib/ @prowler-cloud/detection-remediation
+/permissions/ @prowler-cloud/detection-remediation
+/codecov.yml @prowler-cloud/detection-remediation @prowler-cloud/api
 
 # API
-/api/ @prowler-cloud/engineering
+/api/ @prowler-cloud/api
 
 # UI
-/ui/ @prowler-cloud/engineering
+/ui/ @prowler-cloud/ui
 
 # AI
-/mcp_server/ @prowler-cloud/engineering
+/mcp_server/ @prowler-cloud/detection-remediation
 
 # Platform
 /.github/ @prowler-cloud/platform

.github/actionlint.yaml

@@ -1,6 +0,0 @@
-# Generated by gh-aw and marked DO NOT EDIT. It uses concurrency options newer than
-# actionlint knows, so the findings are about actionlint's schema, not our workflows.
-paths:
-  .github/workflows/**/*.lock.yml:
-    ignore:
-      - '.*'

.github/actions/grype-scan/action.yml

@@ -1,179 +0,0 @@
-name: 'Container Security Scan with Grype'
-description: 'Scans container images for vulnerabilities using Grype and reports results'
-author: 'Prowler'
-
-inputs:
-  image-name:
-    description: 'Container image name to scan'
-    required: true
-  image-tag:
-    description: 'Container image tag to scan'
-    required: true
-    default: ${{ github.sha }}
-  fail-on-severity:
-    description: 'Fail the build on findings at this severity or above: critical, high, or none'
-    required: false
-    default: 'high'
-  upload-sarif:
-    description: 'Upload results to GitHub Security tab'
-    required: false
-    default: 'true'
-  create-pr-comment:
-    description: 'Create a comment on the PR with scan results'
-    required: false
-    default: 'true'
-  artifact-retention-days:
-    description: 'Days to retain the Grype report artifact'
-    required: false
-    default: '2'
-
-outputs:
-  critical-count:
-    description: 'Number of critical vulnerabilities found'
-    value: ${{ steps.security-check.outputs.critical }}
-  high-count:
-    description: 'Number of high vulnerabilities found'
-    value: ${{ steps.security-check.outputs.high }}
-  total-count:
-    description: 'Total number of vulnerabilities found'
-    value: ${{ steps.security-check.outputs.total }}
-
-runs:
-  using: 'composite'
-  steps:
-    - name: Run Grype vulnerability scan (JSON)
-      uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0
-      with:
-        image: ${{ inputs.image-name }}:${{ inputs.image-tag }}
-        output-format: 'json'
-        output-file: 'grype-report.json'
-        fail-build: 'false'
-        by-cve: 'true' # Report CVE ids rather than GHSA, so findings line up with Trivy's
-        only-fixed: 'true' # A finding with no available fix is not actionable, so it must not gate
-        cache-db: 'true'
-        grype-version: 'v0.116.1'
-
-    - name: Run Grype vulnerability scan (SARIF)
-      if: inputs.upload-sarif == 'true' && github.event_name == 'push'
-      uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0
-      with:
-        image: ${{ inputs.image-name }}:${{ inputs.image-tag }}
-        output-format: 'sarif'
-        output-file: 'grype-results.sarif'
-        fail-build: 'false'
-        severity-cutoff: 'high'
-        by-cve: 'true'
-        only-fixed: 'true' # A finding with no available fix is not actionable, so it must not gate
-        cache-db: 'true'
-        grype-version: 'v0.116.1'
-
-    - name: Upload Grype results to GitHub Security tab
-      if: inputs.upload-sarif == 'true' && github.event_name == 'push'
-      uses: github/codeql-action/upload-sarif@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.30.5
-      with:
-        sarif_file: 'grype-results.sarif'
-        category: 'grype-container'
-
-    - name: Upload Grype report artifact
-      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-      if: always()
-      with:
-        name: grype-scan-report-${{ inputs.image-name }}-${{ inputs.image-tag }}
-        path: grype-report.json
-        retention-days: ${{ inputs.artifact-retention-days }}
-
-    - name: Generate security summary
-      id: security-check
-      shell: bash
-      run: |
-        CRITICAL=$(jq '[.matches[]? | select(.vulnerability.severity=="Critical")] | length' grype-report.json)
-        HIGH=$(jq '[.matches[]? | select(.vulnerability.severity=="High")] | length' grype-report.json)
-        TOTAL=$(jq '[.matches[]?] | length' grype-report.json)
-
-        echo "critical=$CRITICAL" >> $GITHUB_OUTPUT
-        echo "high=$HIGH" >> $GITHUB_OUTPUT
-        echo "total=$TOTAL" >> $GITHUB_OUTPUT
-
-        echo "### 🔎 Container Security Scan (Grype)" >> $GITHUB_STEP_SUMMARY
-        echo "" >> $GITHUB_STEP_SUMMARY
-        echo "**Image:** \`${INPUTS_IMAGE_NAME}:${INPUTS_IMAGE_TAG}\`" >> $GITHUB_STEP_SUMMARY
-        echo "" >> $GITHUB_STEP_SUMMARY
-        echo "- 🔴 Critical: $CRITICAL" >> $GITHUB_STEP_SUMMARY
-        echo "- 🟠 High: $HIGH" >> $GITHUB_STEP_SUMMARY
-        echo "- **Total**: $TOTAL" >> $GITHUB_STEP_SUMMARY
-        echo "" >> $GITHUB_STEP_SUMMARY
-        echo "Reported alongside Trivy, not instead of it. Counts differ by design." >> $GITHUB_STEP_SUMMARY
-      env:
-        INPUTS_IMAGE_NAME: ${{ inputs.image-name }}
-        INPUTS_IMAGE_TAG: ${{ inputs.image-tag }}
-
-    # Before the gate, so the comment is there to explain a failure rather than absent because of it
-    - name: Comment scan results on PR
-      if: >-
-        inputs.create-pr-comment == 'true'
-        && github.event_name == 'pull_request'
-        && github.event.pull_request.head.repo.full_name == github.repository
-      uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-      env:
-        IMAGE_NAME: ${{ inputs.image-name }}
-        GITHUB_SHA: ${{ inputs.image-tag }}
-        CUTOFF: ${{ inputs.fail-on-severity }}
-      with:
-        script: |
-          const comment = require('./.github/scripts/grype-pr-comment.js');
-
-          // Unique identifier to find our comment
-          const marker = `<!-- grype-scan-comment:${process.env.IMAGE_NAME} -->`;
-          const body = marker + '\n' + comment;
-
-          const { data: comments } = await github.rest.issues.listComments({
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            issue_number: context.issue.number,
-          });
-
-          const existingComment = comments.find(c => c.body?.includes(marker));
-
-          if (existingComment) {
-            await github.rest.issues.updateComment({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              comment_id: existingComment.id,
-              body: body
-            });
-            console.log('✅ Updated existing Grype scan comment');
-          } else {
-            await github.rest.issues.createComment({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-              body: body
-            });
-            console.log('✅ Created new Grype scan comment');
-          }
-
-    - name: Check for blocking vulnerabilities
-      if: inputs.fail-on-severity != 'none'
-      shell: bash
-      run: |
-        if [ "$CUTOFF" = "critical" ]; then
-          BLOCKING=$CRITICAL
-          SEVERITIES='["Critical"]'
-        else
-          BLOCKING=$((CRITICAL + HIGH))
-          SEVERITIES='["Critical","High"]'
-        fi
-
-        if [ "$BLOCKING" -gt 0 ]; then
-          echo "::error::Found $BLOCKING vulnerabilities at severity ${CUTOFF} or above ($CRITICAL critical, $HIGH high)"
-          echo "::warning::Update the package, or add it to .grype.yaml with a reason if nothing can be done"
-          jq -r --argjson severities "$SEVERITIES" \
-            '.matches[] | select(.vulnerability.severity | IN($severities[]))
-             | "  \(.vulnerability.severity)\t\(.vulnerability.id)\t\(.artifact.name) \(.artifact.version)"' \
-            grype-report.json | sort -u
-          exit 1
-        fi
-      env:
-        CUTOFF: ${{ inputs.fail-on-severity }}
-        CRITICAL: ${{ steps.security-check.outputs.critical }}
-        HIGH: ${{ steps.security-check.outputs.high }}

.github/actions/setup-python-uv/action.yml

@@ -46,17 +46,6 @@ runs:
       env:
         GITHUB_TOKEN: ${{ github.token }}
       run: |
-        if grep -q "prowler-cloud/prowler" uv.lock; then
-          :
-        else
-          status=$?
-          if [ "$status" -ne 1 ]; then
-            echo "::error::grep failed reading uv.lock (exit code $status)."
-            exit "$status"
-          fi
-          echo "No prowler-cloud/prowler entry in uv.lock, nothing to update."
-          exit 0
-        fi
         LATEST_COMMIT=$(curl -sf --retry 3 --retry-all-errors --retry-delay 2 --retry-max-time 60 \
           -H "Authorization: Bearer ${GITHUB_TOKEN}" \
           -H "Accept: application/vnd.github+json" \
@@ -77,17 +66,6 @@ runs:
       env:
         GITHUB_TOKEN: ${{ github.token }}
       run: |
-        if grep -q "prowler-cloud/prowler" uv.lock; then
-          :
-        else
-          status=$?
-          if [ "$status" -ne 1 ]; then
-            echo "::error::grep failed reading uv.lock (exit code $status)."
-            exit "$status"
-          fi
-          echo "No prowler-cloud/prowler entry in uv.lock, nothing to update."
-          exit 0
-        fi
         LATEST_COMMIT=$(curl -sf --retry 3 --retry-all-errors --retry-delay 2 --retry-max-time 60 \
           -H "Authorization: Bearer ${GITHUB_TOKEN}" \
           -H "Accept: application/vnd.github+json" \

.github/actions/trivy-scan/action.yml

@@ -14,10 +14,10 @@ inputs:
     description: 'Severities to scan for (comma-separated)'
     required: false
     default: 'CRITICAL,HIGH,MEDIUM,LOW'
-  fail-on-severity:
-    description: 'Fail the build on findings at this severity or above: critical, high, or none'
+  fail-on-critical:
+    description: 'Fail the build if critical vulnerabilities are found'
     required: false
-    default: 'high'
+    default: 'false'
   upload-sarif:
     description: 'Upload results to GitHub Security tab'
     required: false
@@ -62,12 +62,8 @@ runs:
         severity: ${{ inputs.severity }}
         exit-code: '0'
         scanners: 'vuln'
-        ignore-unfixed: 'true' # A finding with no available fix is not actionable, so it must not gate
         timeout: '5m'
-        version: 'v0.74.0'
-      # Not trivyignores: that input drops the .yaml extension Trivy parses by.
-      env:
-        TRIVY_IGNOREFILE: '.trivyignore.yaml'
+        version: 'v0.71.2'
 
     - name: Run Trivy vulnerability scan (SARIF)
       if: inputs.upload-sarif == 'true' && github.event_name == 'push'
@@ -79,12 +75,8 @@ runs:
         severity: 'CRITICAL,HIGH'
         exit-code: '0'
         scanners: 'vuln'
-        ignore-unfixed: 'true' # A finding with no available fix is not actionable, so it must not gate
         timeout: '5m'
-        version: 'v0.74.0'
-      # Not trivyignores: that input drops the .yaml extension Trivy parses by.
-      env:
-        TRIVY_IGNOREFILE: '.trivyignore.yaml'
+        version: 'v0.71.2'
 
     - name: Upload Trivy results to GitHub Security tab
       if: inputs.upload-sarif == 'true' && github.event_name == 'push'
@@ -171,28 +163,13 @@ runs:
             console.log('✅ Created new Trivy scan comment');
           }
 
-    - name: Check for blocking vulnerabilities
-      if: inputs.fail-on-severity != 'none'
+    - name: Check for critical vulnerabilities
+      if: inputs.fail-on-critical == 'true' && steps.security-check.outputs.critical != '0'
       shell: bash
       run: |
-        if [ "$CUTOFF" = "critical" ]; then
-          BLOCKING=$CRITICAL
-          SEVERITIES='["CRITICAL"]'
-        else
-          BLOCKING=$((CRITICAL + HIGH))
-          SEVERITIES='["CRITICAL","HIGH"]'
-        fi
+        echo "::error::Found ${STEPS_SECURITY_CHECK_OUTPUTS_CRITICAL} critical vulnerabilities"
+        echo "::warning::Please update packages or use a different base image"
+        exit 1
 
-        if [ "$BLOCKING" -gt 0 ]; then
-          echo "::error::Found $BLOCKING vulnerabilities at severity ${CUTOFF} or above ($CRITICAL critical, $HIGH high)"
-          echo "::warning::Update the package, or add it to .trivyignore.yaml with a reason if nothing can be done"
-          jq -r --argjson severities "$SEVERITIES" \
-            '.Results[]?.Vulnerabilities[]? | select(.Severity | IN($severities[]))
-             | "  \(.Severity)\t\(.VulnerabilityID)\t\(.PkgName) \(.InstalledVersion)"' \
-            trivy-report.json | sort -u
-          exit 1
-        fi
       env:
-        CUTOFF: ${{ inputs.fail-on-severity }}
-        CRITICAL: ${{ steps.security-check.outputs.critical }}
-        HIGH: ${{ steps.security-check.outputs.high }}
+        STEPS_SECURITY_CHECK_OUTPUTS_CRITICAL: ${{ steps.security-check.outputs.critical }}

.github/agents/issue-triage.md

@@ -199,7 +199,7 @@ You MUST structure your response using this EXACT format. Do NOT include anythin
 
 ### For Check Logic Bug
 
-```markdown
+```
 ### AI Assessment [Experimental]: Check Logic Bug
 
 **Component**: {component from issue template}
@@ -297,7 +297,7 @@ Write tests FIRST (TDD). The skills contain all testing conventions and patterns
 
 ### For Bug (non-check)
 
-```markdown
+```
 ### AI Assessment [Experimental]: Bug
 
 **Component**: {CLI/SDK | API | UI | Dashboard | MCP Server | Other}
@@ -378,7 +378,7 @@ Write tests FIRST (TDD). The skills contain all testing conventions and patterns
 
 ### For Already Fixed
 
-```markdown
+```
 ### AI Assessment [Experimental]: Already Fixed
 
 **Component**: {component}
@@ -401,7 +401,7 @@ Upgrade to the latest version. Close the issue as resolved.
 
 ### For Feature Request
 
-```markdown
+```
 ### AI Assessment [Experimental]: Feature Request
 
 **Component**: {component}
@@ -419,7 +419,7 @@ Upgrade to the latest version. Close the issue as resolved.
 
 ### For Not a Bug
 
-```markdown
+```
 ### AI Assessment [Experimental]: Not a Bug
 
 **Component**: {component}
@@ -440,7 +440,7 @@ Upgrade to the latest version. Close the issue as resolved.
 
 ### For Needs More Information
 
-```markdown
+```
 ### AI Assessment [Experimental]: Needs More Information
 
 **Component**: {component or "Unknown"}

.github/labeler.yml

@@ -52,16 +52,6 @@ provider/alibabacloud:
       - any-glob-to-any-file: "prowler/providers/alibabacloud/**"
       - any-glob-to-any-file: "tests/providers/alibabacloud/**"
 
-provider/huaweicloud:
-  - changed-files:
-      - any-glob-to-any-file: "prowler/providers/huaweicloud/**"
-      - any-glob-to-any-file: "tests/providers/huaweicloud/**"
-
-provider/image:
-  - changed-files:
-      - any-glob-to-any-file: "prowler/providers/image/**"
-      - any-glob-to-any-file: "tests/providers/image/**"
-
 provider/cloudflare:
   - changed-files:
       - any-glob-to-any-file: "prowler/providers/cloudflare/**"
@@ -92,11 +82,6 @@ provider/linode:
       - any-glob-to-any-file: "prowler/providers/linode/**"
       - any-glob-to-any-file: "tests/providers/linode/**"
 
-provider/stackit:
-  - changed-files:
-      - any-glob-to-any-file: "prowler/providers/stackit/**"
-      - any-glob-to-any-file: "tests/providers/stackit/**"
-
 github_actions:
   - changed-files:
       - any-glob-to-any-file: ".github/workflows/*"

.github/scripts/grype-pr-comment.js

@@ -1,100 +0,0 @@
-const fs = require('fs');
-
-// Configuration from environment variables
-const REPORT_FILE = process.env.GRYPE_REPORT_FILE || 'grype-report.json';
-const IMAGE_NAME = process.env.IMAGE_NAME || 'container-image';
-const GITHUB_SHA = process.env.GITHUB_SHA || 'unknown';
-const GITHUB_REPOSITORY = process.env.GITHUB_REPOSITORY || '';
-const GITHUB_RUN_ID = process.env.GITHUB_RUN_ID || '';
-const CUTOFF = process.env.CUTOFF || 'high';
-
-// A cutoff of 'critical' blocks only on critical; anything else blocks on high and above
-const blocking = CUTOFF === 'critical' ? ['Critical'] : ['Critical', 'High'];
-
-const report = JSON.parse(fs.readFileSync(REPORT_FILE, 'utf-8'));
-const matches = Array.isArray(report.matches) ? report.matches : [];
-const ignored = Array.isArray(report.ignoredMatches) ? report.ignoredMatches : [];
-
-const counts = { Critical: 0, High: 0, Medium: 0, Low: 0, Negligible: 0, Unknown: 0 };
-const blockers = new Map();
-
-for (const match of matches) {
-    const severity = match.vulnerability.severity;
-    if (counts[severity] !== undefined) {
-        counts[severity]++;
-    }
-    if (blocking.includes(severity)) {
-        const artifact = match.artifact;
-        const fixedIn = (match.vulnerability.fix && match.vulnerability.fix.versions || []).join(', ');
-        // Same CVE can match several install paths of one package; collapse them
-        blockers.set(`${match.vulnerability.id}|${artifact.name}`, {
-            id: match.vulnerability.id,
-            severity,
-            name: artifact.name,
-            version: artifact.version,
-            fixedIn
-        });
-    }
-}
-
-const ignoredBlocking = ignored.filter(m => blocking.includes(m.vulnerability.severity)).length;
-const shortSha = GITHUB_SHA.substring(0, 7);
-const timestamp = new Date().toISOString().replace('T', ' ').substring(0, 19) + ' UTC';
-
-const severityConfig = {
-    Critical: { icon: '🔴', label: 'Critical' },
-    High: { icon: '🟠', label: 'High' },
-    Medium: { icon: '🟡', label: 'Medium' },
-    Low: { icon: '🔵', label: 'Low' }
-};
-
-let comment = '## 🔎 Container Security Scan (Grype)\n\n';
-comment += `**Image:** \`${IMAGE_NAME}:${shortSha}\`\n`;
-comment += `**Last scan:** ${timestamp}\n\n`;
-
-if (blockers.size === 0) {
-    comment += '### ✅ Nothing Blocking\n\n';
-    comment += `No findings at **${blocking.join(' or ').toLowerCase()}** severity.\n`;
-} else {
-    comment += `### ⚠️ ${blockers.size} Finding(s) Blocking This PR\n\n`;
-    comment += '| Severity | CVE | Package | Installed | Fixed in |\n';
-    comment += '|---|---|---|---|---|\n';
-
-    const order = { Critical: 0, High: 1 };
-    const rows = [...blockers.values()].sort((a, b) =>
-        (order[a.severity] - order[b.severity]) || a.name.localeCompare(b.name));
-
-    for (const row of rows) {
-        const config = severityConfig[row.severity];
-        comment += `| ${config.icon} ${config.label} | \`${row.id}\` | \`${row.name}\` | ${row.version} | ${row.fixedIn || '—'} |\n`;
-    }
-
-    comment += '\n**What to do:**\n';
-    comment += '- Upgrade the package to the version in the "Fixed in" column.\n';
-    comment += '- If it is pinned by another dependency, or the fix is otherwise out of reach, add it to `.grype.yaml` **with the reason**.\n';
-    comment += '- Findings with no published fix never appear here: the scan runs with `only-fixed`, so it reports only what can actually be acted on.\n';
-}
-
-const otherCounts = Object.entries(counts)
-    .filter(([severity, count]) => !blocking.includes(severity) && count > 0)
-    .map(([severity, count]) => `${severity.toLowerCase()}: ${count}`);
-
-if (otherCounts.length > 0) {
-    comment += `\nNot blocking at this cutoff — ${otherCounts.join(', ')}.\n`;
-}
-
-if (ignoredBlocking > 0) {
-    comment += `\n${ignoredBlocking} finding(s) excluded by \`.grype.yaml\`, each with a documented reason.\n`;
-}
-
-comment += '\n---\n';
-comment += '📋 **Resources:**\n';
-
-if (GITHUB_REPOSITORY && GITHUB_RUN_ID) {
-    comment += `- [Download full report](https://github.com/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}) (see artifacts)\n`;
-}
-
-comment += '- [View in Security tab](https://github.com/' + (GITHUB_REPOSITORY || 'repository') + '/security/code-scanning)\n';
-comment += '- Scanned with [Grype](https://github.com/anchore/grype), alongside Trivy\n';
-
-module.exports = comment;

.github/scripts/slack-messages/README.md

@@ -8,11 +8,11 @@ These JSON templates are used with the `slackapi/slack-github-action` using the
 
 ### Available Templates
 
-#### Container Releases
+**Container Releases**
 - `container-release-started.json`: Simple one-line notification when container push starts
 - `container-release-completed.json`: Simple one-line notification when container release completes
 
-#### Deployments
+**Deployments**
 - `deployment-started.json`: Deployment start notification with Block Kit formatting
 - `deployment-completed.json`: Deployment completion notification (updates the start message)
 
@@ -416,17 +416,17 @@ For deployments that start with one message and update it with the final status:
 ### Container Release (Simple One-Line)
 
 **Start message:**
-```text
+```
 API container release 4.5.0 push started... View run
 ```
 
 **Completion message (success):**
-```text
+```
 [✓] API container release 4.5.0 push completed successfully! View run
 ```
 
 **Completion message (failure):**
-```text
+```
 [✗] API container release 4.5.0 push failed View run
 ```
 

.github/workflows/api-container-build-push.yml

@@ -42,7 +42,6 @@ jobs:
     timeout-minutes: 5
     outputs:
       short-sha: ${{ steps.set-short-sha.outputs.short-sha }}
-      created: ${{ steps.set-short-sha.outputs.created }}
     permissions:
       contents: read
     steps:
@@ -53,9 +52,7 @@ jobs:
 
       - name: Calculate short SHA
         id: set-short-sha
-        run: |
-          echo "short-sha=${GITHUB_SHA::7}" >> "${GITHUB_OUTPUT}"
-          echo "created=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "${GITHUB_OUTPUT}"
+        run: echo "short-sha=${GITHUB_SHA::7}" >> $GITHUB_OUTPUT
 
   notify-release-started:
     if: github.repository == 'prowler-cloud/prowler' && (github.event_name == 'release' || github.event_name == 'workflow_dispatch')
@@ -162,20 +159,9 @@ jobs:
         with:
           context: ${{ env.WORKING_DIRECTORY }}
           push: true
-          sbom: true
-          # max, not the default min: min records little beyond the build ref.
-          provenance: mode=max
           platforms: ${{ matrix.platform }}
           tags: |
             ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ needs.setup.outputs.short-sha }}-${{ matrix.arch }}
-          labels: |
-            org.opencontainers.image.title=Prowler Local Server API
-            org.opencontainers.image.description=API for Prowler Local Server (Django/DRF)
-            org.opencontainers.image.vendor=ProwlerPro, Inc.
-            org.opencontainers.image.source=https://github.com/${{ github.repository }}
-            org.opencontainers.image.revision=${{ github.sha }}
-            org.opencontainers.image.created=${{ needs.setup.outputs.created }}
-            ${{ (github.event_name == 'release' || github.event_name == 'workflow_dispatch') && format('org.opencontainers.image.version={0}', env.RELEASE_TAG) || '' }}
           cache-from: type=gha,scope=${{ matrix.arch }}
           cache-to: type=gha,mode=${{ github.event_name == 'pull_request' && 'min' || 'max' }},scope=${{ matrix.arch }}
 
@@ -193,12 +179,12 @@ jobs:
         with:
           egress-policy: block
           allowed-endpoints: >
-            auth.docker.io:443
             github.com:443
+            release-assets.githubusercontent.com:443
+            registry-1.docker.io:443
+            auth.docker.io:443
             production.cloudflare.docker.com:443
             production.cloudfront.docker.com:443
-            registry-1.docker.io:443
-            release-assets.githubusercontent.com:443
       - name: Login to DockerHub
         uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
@@ -210,9 +196,9 @@ jobs:
         run: |
           docker buildx imagetools create \
             -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ env.LATEST_TAG }} \
-            -t "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}" \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64" \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64"
+            -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA} \
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64 \
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64
         env:
           NEEDS_SETUP_OUTPUTS_SHORT_SHA: ${{ needs.setup.outputs.short-sha }}
 
@@ -220,10 +206,10 @@ jobs:
         if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
         run: |
           docker buildx imagetools create \
-            -t "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${RELEASE_TAG}" \
+            -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${RELEASE_TAG} \
             -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ env.STABLE_TAG }} \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64" \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64"
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64 \
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64
         env:
           NEEDS_SETUP_OUTPUTS_SHORT_SHA: ${{ needs.setup.outputs.short-sha }}
 
@@ -263,9 +249,9 @@ jobs:
         id: outcome
         run: |
           if [[ "${NEEDS_CONTAINER_BUILD_PUSH_RESULT}" == "success" && "${NEEDS_CREATE_MANIFEST_RESULT}" == "success" ]]; then
-            echo "outcome=success" >> "$GITHUB_OUTPUT"
+            echo "outcome=success" >> $GITHUB_OUTPUT
           else
-            echo "outcome=failure" >> "$GITHUB_OUTPUT"
+            echo "outcome=failure" >> $GITHUB_OUTPUT
           fi
         env:
           NEEDS_CONTAINER_BUILD_PUSH_RESULT: ${{ needs.container-build-push.result }}

.github/workflows/api-container-checks.yml

@@ -81,10 +81,6 @@ jobs:
             auth.docker.io:443
             production.cloudflare.docker.com:443
             production.cloudfront.docker.com:443
-            raw.githubusercontent.com:443
-            objects.githubusercontent.com:443
-            grype.anchore.io:443
-            get.anchore.io:443
             debian.map.fastlydns.net:80
             release-assets.githubusercontent.com:443
             objects.githubusercontent.com:443
@@ -111,11 +107,7 @@ jobs:
         with:
           files: |
             api/**
-            .trivyignore.yaml
             .github/actions/trivy-scan/**
-            .github/actions/grype-scan/**
-            .grype.yaml
-            .github/scripts/grype-pr-comment.js
           files_ignore: |
             api/docs/**
             api/README.md
@@ -153,13 +145,5 @@ jobs:
         with:
           image-name: ${{ env.IMAGE_NAME }}
           image-tag: ${{ github.sha }}
-          fail-on-severity: 'high'
-          severity: 'CRITICAL,HIGH'
-
-      - name: Scan container with Grype
-        if: steps.check-changes.outputs.any_changed == 'true'
-        uses: ./.github/actions/grype-scan
-        with:
-          image-name: ${{ env.IMAGE_NAME }}
-          image-tag: ${{ github.sha }}
-          fail-on-severity: 'high'
+          fail-on-critical: 'true'
+          severity: 'CRITICAL'

.github/workflows/backport.yml

@@ -39,7 +39,7 @@ jobs:
 
       - name: Check labels
         id: label_check
-        uses: agilepathway/label-checker@c324842522fbd012e4f590afe3b4e591301322ed # v1.6.66
+        uses: agilepathway/label-checker@c3d16ad512e7cea5961df85ff2486bb774caf3c5 # v1.6.65
         with:
           allow_failure: true
           prefix_mode: true

.github/workflows/ci-actionlint.yml

@@ -1,63 +0,0 @@
-name: 'CI: Actionlint'
-
-on:
-  push:
-    branches:
-      - 'master'
-  pull_request:
-    branches:
-      - 'master'
-  schedule:
-    - cron: '45 06 * * *'
-  workflow_dispatch:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-permissions: {}
-
-jobs:
-  actionlint:
-    if: github.repository == 'prowler-cloud/prowler'
-    name: GitHub Actions Schema Check
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: read
-
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: block
-          allowed-endpoints: >
-            github.com:443
-            api.github.com:443
-            auth.docker.io:443
-            registry-1.docker.io:443
-            production.cloudflare.docker.com:443
-            production.cloudfront.docker.com:443
-
-      - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-        with:
-          # zizmor: ignore[artipacked]
-          persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
-
-      # Always runs so it always reports; the lint is skipped when nothing changed.
-      - name: Check for workflow changes
-        id: check-changes
-        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
-        with:
-          files: .github/**
-
-      # SC2129 is style only: it suggests grouping consecutive redirects.
-      - name: Run actionlint
-        if: steps.check-changes.outputs.any_changed == 'true'
-        env:
-          SHELLCHECK_OPTS: '-e SC2129'
-        run: |
-          docker run --rm -v "$PWD:/repo" --workdir /repo -e SHELLCHECK_OPTS \
-            rhysd/actionlint:1.7.12@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667 \
-            -color

.github/workflows/comment-label-update.yml

@@ -32,7 +32,7 @@ jobs:
           ISSUE_NUMBER: ${{ github.event.issue.number }}
         run: |
           echo "Removing 'status/awaiting-response' label from #$ISSUE_NUMBER"
-          gh api "/repos/${{ github.repository }}/issues/$ISSUE_NUMBER/labels/status%2Fawaiting-response" \
+          gh api /repos/${{ github.repository }}/issues/$ISSUE_NUMBER/labels/status%2Fawaiting-response \
             -X DELETE
 
       - name: Add 'status/waiting-for-revision' label
@@ -41,6 +41,6 @@ jobs:
           ISSUE_NUMBER: ${{ github.event.issue.number }}
         run: |
           echo "Adding 'status/waiting-for-revision' label to #$ISSUE_NUMBER"
-          gh api "/repos/${{ github.repository }}/issues/$ISSUE_NUMBER/labels" \
+          gh api /repos/${{ github.repository }}/issues/$ISSUE_NUMBER/labels \
             -X POST \
             -f labels[]='status/waiting-for-revision'

.github/workflows/compile-changelogs.yml

@@ -61,7 +61,6 @@ jobs:
             api.github.com:443
             github.com:443
             objects.githubusercontent.com:443
-            release-assets.githubusercontent.com:443
             pypi.org:443
             files.pythonhosted.org:443
 

.github/workflows/dockerhub-descriptions.yml

@@ -1,92 +0,0 @@
-name: 'Tools: Sync Docker Hub Descriptions'
-
-on:
-  push:
-    branches:
-      - 'master'
-    paths:
-      - 'docs/dockerhub/README.md'
-      - '.github/workflows/dockerhub-descriptions.yml'
-  workflow_dispatch:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: false
-
-env:
-  OVERVIEW_FILE: docs/dockerhub/README.md
-
-permissions: {}
-
-jobs:
-  prowlercloud:
-    if: github.repository == 'prowler-cloud/prowler' && github.ref == 'refs/heads/master'
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: read
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - repository: prowlercloud/prowler
-            short_description: 'Prowler CLI: the Open Cloud Security tool for AWS, Azure, Google Cloud, Kubernetes, M365 and GitHub'
-          - repository: prowlercloud/prowler-api
-            short_description: 'Prowler Local Server - API: the JSON API and Task Runner components of Prowler'
-          - repository: prowlercloud/prowler-ui
-            short_description: 'Prowler Local Server - UI: the web interface to run Prowler scans and explore findings'
-          - repository: prowlercloud/prowler-mcp
-            short_description: 'Prowler MCP: the interface for agents, including IDE plugins and agent integrations'
-
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: block
-          allowed-endpoints: >
-            github.com:443
-            hub.docker.com:443
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
-      - name: Update Docker Hub description for ${{ matrix.repository }}
-        uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-          repository: ${{ matrix.repository }}
-          short-description: ${{ matrix.short_description }}
-          readme-filepath: ${{ env.OVERVIEW_FILE }}
-
-  toniblyx:
-    if: github.repository == 'prowler-cloud/prowler' && github.ref == 'refs/heads/master'
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: read
-
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: block
-          allowed-endpoints: >
-            github.com:443
-            hub.docker.com:443
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
-      - name: Update Docker Hub description for toniblyx/prowler
-        uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0
-        with:
-          username: ${{ secrets.TONIBLYX_DOCKERHUB_USERNAME }}
-          password: ${{ secrets.TONIBLYX_DOCKERHUB_PASSWORD }}
-          repository: toniblyx/prowler
-          short-description: 'Prowler CLI (legacy repository, mirrors prowlercloud/prowler)'
-          readme-filepath: ${{ env.OVERVIEW_FILE }}

.github/workflows/helm-chart-release.yml

@@ -50,7 +50,7 @@ jobs:
           GITHUB_EVENT_RELEASE_TAG_NAME: ${{ github.event.release.tag_name }}
 
       - name: Login to GHCR
-        run: echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io -u "${GITHUB_ACTOR}" --password-stdin
+        run: echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io -u ${GITHUB_ACTOR} --password-stdin
 
       - name: Update chart dependencies
         run: helm dependency update ${{ env.CHART_PATH }}

.github/workflows/labeler.yml

@@ -85,10 +85,10 @@ jobs:
 
           # Check if author is in the org members list
           if printf '%s\n' "${ORG_MEMBERS[@]}" | grep -q "^${AUTHOR}$"; then
-            echo "is_member=true" >> "$GITHUB_OUTPUT"
+            echo "is_member=true" >> $GITHUB_OUTPUT
             echo "$AUTHOR is an organization member"
           else
-            echo "is_member=false" >> "$GITHUB_OUTPUT"
+            echo "is_member=false" >> $GITHUB_OUTPUT
             echo "$AUTHOR is not an organization member"
           fi
 

.github/workflows/markdown-lint.yml

@@ -55,10 +55,6 @@ jobs:
         # Pin must match .pre-commit-config.yaml so prek and CI behave identically.
         # pnpm dlx doesn't accept --ignore-scripts as a flag; the env var
         # disables postinstall scripts on transitives the same way.
-        #
-        # Files come from `git ls-files` because markdownlint doesn't traverse
-        # dot-directories, so `.github/**/*.md` went unlinted.
-        # `.markdownlintignore` still applies to the listed paths.
         env:
           pnpm_config_ignore_scripts: 'true'
-        run: git ls-files -z '*.md' | xargs -0 -r pnpm dlx markdownlint-cli@0.45.0 --
+        run: pnpm dlx markdownlint-cli@0.45.0 '**/*.md'

.github/workflows/mcp-container-build-push.yml

@@ -41,7 +41,6 @@ jobs:
     timeout-minutes: 5
     outputs:
       short-sha: ${{ steps.set-short-sha.outputs.short-sha }}
-      created: ${{ steps.set-short-sha.outputs.created }}
     permissions:
       contents: read
     steps:
@@ -52,9 +51,7 @@ jobs:
 
       - name: Calculate short SHA
         id: set-short-sha
-        run: |
-          echo "short-sha=${GITHUB_SHA::7}" >> "${GITHUB_OUTPUT}"
-          echo "created=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "${GITHUB_OUTPUT}"
+        run: echo "short-sha=${GITHUB_SHA::7}" >> $GITHUB_OUTPUT
 
   notify-release-started:
     if: github.repository == 'prowler-cloud/prowler' && (github.event_name == 'release' || github.event_name == 'workflow_dispatch')
@@ -113,17 +110,15 @@ jobs:
         with:
           egress-policy: block
           allowed-endpoints: >
-            auth.docker.io:443
-            dl-cdn.alpinelinux.org:443
-            dualstack.j.sni.global.fastly.net:443
-            files.pythonhosted.org:443
-            ghcr.io:443
             github.com:443
-            pkg-containers.githubusercontent.com:443
+            registry-1.docker.io:443
+            auth.docker.io:443
             production.cloudflare.docker.com:443
             production.cloudfront.docker.com:443
+            ghcr.io:443
+            pkg-containers.githubusercontent.com:443
+            files.pythonhosted.org:443
             pypi.org:443
-            registry-1.docker.io:443
 
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -146,20 +141,17 @@ jobs:
         with:
           context: ${{ env.WORKING_DIRECTORY }}
           push: true
-          sbom: true
-          # max, not the default min: min records little beyond the build ref.
-          provenance: mode=max
           platforms: ${{ matrix.platform }}
           tags: |
             ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ needs.setup.outputs.short-sha }}-${{ matrix.arch }}
           labels: |
-            org.opencontainers.image.title=Prowler MCP
+            org.opencontainers.image.title=Prowler MCP Server
             org.opencontainers.image.description=Model Context Protocol server for Prowler
             org.opencontainers.image.vendor=ProwlerPro, Inc.
             org.opencontainers.image.source=https://github.com/${{ github.repository }}
             org.opencontainers.image.revision=${{ github.sha }}
-            org.opencontainers.image.created=${{ needs.setup.outputs.created }}
-            ${{ (github.event_name == 'release' || github.event_name == 'workflow_dispatch') && format('org.opencontainers.image.version={0}', env.RELEASE_TAG) || '' }}
+            org.opencontainers.image.created=${{ github.event_name == 'release' && github.event.release.published_at || github.event.head_commit.timestamp }}
+            ${{ github.event_name == 'release' && format('org.opencontainers.image.version={0}', env.RELEASE_TAG) || '' }}
           cache-from: type=gha,scope=${{ matrix.arch }}
           cache-to: type=gha,mode=${{ github.event_name == 'pull_request' && 'min' || 'max' }},scope=${{ matrix.arch }}
 
@@ -177,11 +169,11 @@ jobs:
         with:
           egress-policy: block
           allowed-endpoints: >
+            registry-1.docker.io:443
             auth.docker.io:443
-            github.com:443
             production.cloudflare.docker.com:443
             production.cloudfront.docker.com:443
-            registry-1.docker.io:443
+            github.com:443
             release-assets.githubusercontent.com:443
 
       - name: Login to DockerHub
@@ -195,9 +187,9 @@ jobs:
         run: |
           docker buildx imagetools create \
             -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ env.LATEST_TAG }} \
-            -t "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}" \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64" \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64"
+            -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA} \
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64 \
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64
         env:
           NEEDS_SETUP_OUTPUTS_SHORT_SHA: ${{ needs.setup.outputs.short-sha }}
 
@@ -205,10 +197,10 @@ jobs:
         if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
         run: |
           docker buildx imagetools create \
-            -t "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${RELEASE_TAG}" \
+            -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${RELEASE_TAG} \
             -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ env.STABLE_TAG }} \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64" \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64"
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64 \
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64
         env:
           NEEDS_SETUP_OUTPUTS_SHORT_SHA: ${{ needs.setup.outputs.short-sha }}
 
@@ -248,9 +240,9 @@ jobs:
         id: outcome
         run: |
           if [[ "${NEEDS_CONTAINER_BUILD_PUSH_RESULT}" == "success" && "${NEEDS_CREATE_MANIFEST_RESULT}" == "success" ]]; then
-            echo "outcome=success" >> "$GITHUB_OUTPUT"
+            echo "outcome=success" >> $GITHUB_OUTPUT
           else
-            echo "outcome=failure" >> "$GITHUB_OUTPUT"
+            echo "outcome=failure" >> $GITHUB_OUTPUT
           fi
         env:
           NEEDS_CONTAINER_BUILD_PUSH_RESULT: ${{ needs.container-build-push.result }}

.github/workflows/mcp-container-checks.yml

@@ -81,17 +81,12 @@ jobs:
             pkg-containers.githubusercontent.com:443
             files.pythonhosted.org:443
             pypi.org:443
-            dl-cdn.alpinelinux.org:443
-            dualstack.j.sni.global.fastly.net:443
             api.github.com:443
             mirror.gcr.io:443
             check.trivy.dev:443
             get.trivy.dev:443
             release-assets.githubusercontent.com:443
             objects.githubusercontent.com:443
-            raw.githubusercontent.com:443
-            grype.anchore.io:443
-            get.anchore.io:443
 
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -105,11 +100,7 @@ jobs:
         with:
           files: |
             mcp_server/**
-            .trivyignore.yaml
             .github/actions/trivy-scan/**
-            .github/actions/grype-scan/**
-            .grype.yaml
-            .github/scripts/grype-pr-comment.js
           files_ignore: |
             mcp_server/README.md
             mcp_server/CHANGELOG.md
@@ -136,13 +127,5 @@ jobs:
         with:
           image-name: ${{ env.IMAGE_NAME }}
           image-tag: ${{ github.sha }}
-          fail-on-severity: 'high'
-          severity: 'CRITICAL,HIGH'
-
-      - name: Scan MCP container with Grype
-        if: steps.check-changes.outputs.any_changed == 'true'
-        uses: ./.github/actions/grype-scan
-        with:
-          image-name: ${{ env.IMAGE_NAME }}
-          image-tag: ${{ github.sha }}
-          fail-on-severity: 'high'
+          fail-on-critical: 'true'
+          severity: 'CRITICAL'

.github/workflows/mcp-pypi-release.yml

@@ -113,7 +113,7 @@ jobs:
 
       - name: Publish prowler-mcp package to PyPI
         if: steps.pypi-check.outputs.skip != 'true'
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
         with:
           packages-dir: ${{ env.WORKING_DIRECTORY }}/dist/
           print-hash: true

.github/workflows/mcp-tests.yml

@@ -1,99 +0,0 @@
-name: 'MCP: Tests'
-
-on:
-  push:
-    branches:
-      - 'master'
-      - 'v5.*'
-  pull_request:
-    branches:
-      - 'master'
-      - 'v5.*'
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-env:
-  MCP_WORKING_DIR: ./mcp_server
-
-permissions: {}
-
-jobs:
-  mcp-tests:
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    permissions:
-      contents: read
-    strategy:
-      matrix:
-        # requires-python is >=3.12 while the shipped image is 3.13; testing both
-        # is what keeps that floor honest.
-        python-version:
-          - '3.12'
-          - '3.13'
-    defaults:
-      run:
-        working-directory: ./mcp_server
-
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: block
-          # hub.prowler.com and raw.githubusercontent.com are deliberately absent:
-          # the suite mocks every outbound call, so a real one must fail the job.
-          # The sentry.io entry is not the test suite: the Codecov uploader sends
-          # its own telemetry there, so api-tests.yml and sdk-tests.yml allow it too.
-          allowed-endpoints: >
-            github.com:443
-            pypi.org:443
-            files.pythonhosted.org:443
-            cli.codecov.io:443
-            keybase.io:443
-            ingest.codecov.io:443
-            o26192.ingest.us.sentry.io:443
-            storage.googleapis.com:443
-            api.github.com:443
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          # zizmor: ignore[artipacked]
-          persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
-
-      - name: Check for MCP server changes
-        id: check-changes
-        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
-        with:
-          files: |
-            mcp_server/**
-            .github/workflows/mcp-tests.yml
-            codecov.yml
-          files_ignore: |
-            mcp_server/README.md
-            mcp_server/CHANGELOG.md
-            mcp_server/changelog.d/**
-            mcp_server/AGENTS.md
-            mcp_server/Dockerfile
-            mcp_server/.dockerignore
-            mcp_server/entrypoint.sh
-
-      - name: Setup Python with uv
-        if: steps.check-changes.outputs.any_changed == 'true'
-        uses: ./.github/actions/setup-python-uv
-        with:
-          python-version: ${{ matrix.python-version }}
-          working-directory: ./mcp_server
-
-      - name: Run tests with pytest
-        if: steps.check-changes.outputs.any_changed == 'true'
-        run: uv run pytest --cov=./prowler_mcp_server --cov-report=xml tests
-
-      - name: Upload coverage reports to Codecov
-        if: steps.check-changes.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-        with:
-          flags: mcp

.github/workflows/pr-check-changelog.yml

@@ -35,7 +35,6 @@ jobs:
             api.github.com:443
             github.com:443
             objects.githubusercontent.com:443
-            release-assets.githubusercontent.com:443
             pypi.org:443
             files.pythonhosted.org:443
 
@@ -130,6 +129,7 @@ jobs:
           handwritten_changelogs=""
 
           all_changed=$(echo "${STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES}" | tr ' ' '\n')
+          added=$(echo "${STEPS_CHANGED_FILES_OUTPUTS_ADDED_FILES}" | tr ' ' '\n')
           added_or_renamed=$(printf '%s\n%s' "${STEPS_CHANGED_FILES_OUTPUTS_ADDED_FILES}" "${STEPS_CHANGED_FILES_OUTPUTS_RENAMED_FILES}" | tr ' ' '\n')
           added_modified_or_renamed=$(printf '%s\n%s\n%s' "${STEPS_CHANGED_FILES_OUTPUTS_ADDED_FILES}" "${STEPS_CHANGED_FILES_OUTPUTS_MODIFIED_FILES}" "${STEPS_CHANGED_FILES_OUTPUTS_RENAMED_FILES}" | tr ' ' '\n')
 

.github/workflows/pr-check-compliance-mapping.yml

@@ -111,7 +111,7 @@ jobs:
             done
 
             if [ -n "$found_in" ]; then
-              found_in="${found_in%, }"
+              found_in=$(echo "$found_in" | sed 's/, $//')
               MAPPED="${MAPPED}- \`${check_id}\` (\`${provider}\`): ${found_in}"$'\n'
             else
               UNMAPPED="${UNMAPPED}- \`${check_id}\` (\`${provider}\`)"$'\n'

.github/workflows/pr-conflict-checker.yml

@@ -74,15 +74,15 @@ jobs:
           done <<< "$STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES"
 
           if [ "$HAS_CONFLICTS" = true ]; then
-            echo "has_conflicts=true" >> "$GITHUB_OUTPUT"
+            echo "has_conflicts=true" >> $GITHUB_OUTPUT
             {
               echo "conflict_files<<EOF"
               echo "$CONFLICT_FILES"
               echo "EOF"
-            } >> "$GITHUB_OUTPUT"
+            } >> $GITHUB_OUTPUT
             echo "Conflict markers detected"
           else
-            echo "has_conflicts=false" >> "$GITHUB_OUTPUT"
+            echo "has_conflicts=false" >> $GITHUB_OUTPUT
             echo "No conflict markers found in changed files"
           fi
         env:

.github/workflows/pr-merged.yml

@@ -36,7 +36,7 @@ jobs:
         id: vars
         run: |
           SHORT_SHA="${GITHUB_EVENT_PULL_REQUEST_MERGE_COMMIT_SHA}"
-          echo "short_sha=${SHORT_SHA::7}" >> "$GITHUB_OUTPUT"
+          echo "short_sha=${SHORT_SHA::7}" >> $GITHUB_OUTPUT
         env:
           GITHUB_EVENT_PULL_REQUEST_MERGE_COMMIT_SHA: ${{ github.event.pull_request.merge_commit_sha }}
 
@@ -46,7 +46,6 @@ jobs:
           token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }}
           repository: ${{ secrets.CLOUD_DISPATCH }}
           event-type: prowler-pull-request-merged
-          # repository_dispatch caps client_payload at 10 properties; this is exactly at the cap.
           client-payload: |
             {
               "PROWLER_COMMIT_SHA": "${{ github.event.pull_request.merge_commit_sha }}",
@@ -55,8 +54,8 @@ jobs:
               "PROWLER_PR_TITLE": ${{ toJson(github.event.pull_request.title) }},
               "PROWLER_PR_LABELS": ${{ toJson(github.event.pull_request.labels.*.name) }},
               "PROWLER_PR_BODY": ${{ toJson(github.event.pull_request.body) }},
+              "PROWLER_PR_URL": ${{ toJson(github.event.pull_request.html_url) }},
               "PROWLER_PR_MERGED_BY": "${{ github.event.pull_request.merged_by.login }}",
-              "PROWLER_PR_STACK_NUMBER": "${{ github.event.pull_request.stack.number }}",
-              "PROWLER_PR_STACK_POSITION": "${{ github.event.pull_request.stack.position }}",
-              "PROWLER_PR_STACK_SIZE": "${{ github.event.pull_request.stack.size }}"
+              "PROWLER_PR_BASE_BRANCH": ${{ toJson(github.event.pull_request.base.ref) }},
+              "PROWLER_PR_HEAD_BRANCH": ${{ toJson(github.event.pull_request.head.ref) }}
             }

.github/workflows/prepare-release.yml

@@ -77,7 +77,7 @@ jobs:
 
           echo "Prowler version: $PROWLER_VERSION"
           echo "Branch name: $BRANCH_NAME"
-          echo "Is minor release: $([ "$PATCH_VERSION" -eq 0 ] && echo 'true' || echo 'false')"
+          echo "Is minor release: $([ $PATCH_VERSION -eq 0 ] && echo 'true' || echo 'false')"
         else
           echo "Invalid version syntax: '$PROWLER_VERSION' (must be N.N.N)" >&2
           exit 1
@@ -107,8 +107,7 @@ jobs:
           if [ -f "$changelog_file" ]; then
             # Extract version that matches this Prowler release
             # Format: ## [version] (Prowler X.Y.Z) or ## [vversion] (Prowler vX.Y.Z)
-            local version
-            version=$(grep '^## \[' "$changelog_file" | grep "(Prowler v\?${prowler_version})" | head -1 | sed 's/^## \[\(.*\)\].*/\1/' | sed 's/^v//' | tr -d '[:space:]')
+            local version=$(grep '^## \[' "$changelog_file" | grep "(Prowler v\?${prowler_version})" | head -1 | sed 's/^## \[\(.*\)\].*/\1/' | sed 's/^v//' | tr -d '[:space:]')
             echo "$version"
           else
             echo ""
@@ -179,55 +178,55 @@ jobs:
 
         # Determine if components have changes for this specific release
         if [ -n "$SDK_VERSION" ]; then
-          echo "HAS_SDK_CHANGES=true" >> "$GITHUB_ENV"
+          echo "HAS_SDK_CHANGES=true" >> $GITHUB_ENV
           HAS_SDK_CHANGES="true"
           echo "✓ SDK changes detected - version: $SDK_VERSION"
           extract_changelog "prowler/CHANGELOG.md" "$SDK_VERSION" "prowler_changelog.md"
         else
-          echo "HAS_SDK_CHANGES=false" >> "$GITHUB_ENV"
+          echo "HAS_SDK_CHANGES=false" >> $GITHUB_ENV
           HAS_SDK_CHANGES="false"
           echo "ℹ No SDK changes for this release"
           touch "prowler_changelog.md"
         fi
 
         if [ -n "$API_VERSION" ]; then
-          echo "HAS_API_CHANGES=true" >> "$GITHUB_ENV"
+          echo "HAS_API_CHANGES=true" >> $GITHUB_ENV
           HAS_API_CHANGES="true"
           echo "✓ API changes detected - version: $API_VERSION"
           extract_changelog "api/CHANGELOG.md" "$API_VERSION" "api_changelog.md"
         else
-          echo "HAS_API_CHANGES=false" >> "$GITHUB_ENV"
+          echo "HAS_API_CHANGES=false" >> $GITHUB_ENV
           HAS_API_CHANGES="false"
           echo "ℹ No API changes for this release"
           touch "api_changelog.md"
         fi
 
         if [ -n "$UI_VERSION" ]; then
-          echo "HAS_UI_CHANGES=true" >> "$GITHUB_ENV"
+          echo "HAS_UI_CHANGES=true" >> $GITHUB_ENV
           HAS_UI_CHANGES="true"
           echo "✓ UI changes detected - version: $UI_VERSION"
           extract_changelog "ui/CHANGELOG.md" "$UI_VERSION" "ui_changelog.md"
         else
-          echo "HAS_UI_CHANGES=false" >> "$GITHUB_ENV"
+          echo "HAS_UI_CHANGES=false" >> $GITHUB_ENV
           HAS_UI_CHANGES="false"
           echo "ℹ No UI changes for this release"
           touch "ui_changelog.md"
         fi
 
         if [ -n "$MCP_VERSION" ]; then
-          echo "HAS_MCP_CHANGES=true" >> "$GITHUB_ENV"
+          echo "HAS_MCP_CHANGES=true" >> $GITHUB_ENV
           HAS_MCP_CHANGES="true"
           echo "✓ MCP changes detected - version: $MCP_VERSION"
           extract_changelog "mcp_server/CHANGELOG.md" "$MCP_VERSION" "mcp_changelog.md"
         else
-          echo "HAS_MCP_CHANGES=false" >> "$GITHUB_ENV"
+          echo "HAS_MCP_CHANGES=false" >> $GITHUB_ENV
           HAS_MCP_CHANGES="false"
           echo "ℹ No MCP changes for this release"
           touch "mcp_changelog.md"
         fi
 
         # Combine changelogs in order: UI, API, SDK, MCP
-        : > combined_changelog.md
+        > combined_changelog.md
 
         if [ "$HAS_UI_CHANGES" = "true" ] && [ -s "ui_changelog.md" ]; then
           echo "## UI" >> combined_changelog.md

.github/workflows/sdk-container-build-push.yml

@@ -54,7 +54,6 @@ jobs:
     timeout-minutes: 5
     outputs:
       prowler_version: ${{ steps.get-prowler-version.outputs.prowler_version }}
-      created: ${{ steps.get-prowler-version.outputs.created }}
       latest_tag: ${{ steps.get-prowler-version.outputs.latest_tag }}
       stable_tag: ${{ steps.get-prowler-version.outputs.stable_tag }}
     permissions:
@@ -65,9 +64,9 @@ jobs:
         with:
           egress-policy: block
           allowed-endpoints: >
-            files.pythonhosted.org:443
             github.com:443
             pypi.org:443
+            files.pythonhosted.org:443
 
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -87,7 +86,6 @@ jobs:
           fi
           echo "latest_tag=latest" >> "${GITHUB_OUTPUT}"
           echo "stable_tag=stable" >> "${GITHUB_OUTPUT}"
-          echo "created=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "${GITHUB_OUTPUT}"
 
   notify-release-started:
     if: github.repository == 'prowler-cloud/prowler' && (github.event_name == 'release' || github.event_name == 'workflow_dispatch')
@@ -148,24 +146,24 @@ jobs:
         with:
           egress-policy: block
           allowed-endpoints: >
-            _http._tcp.deb.debian.org:443
-            aka.ms:443
             api.ecr-public.us-east-1.amazonaws.com:443
-            auth.docker.io:443
-            cdn.powershellgallery.com:443
-            debian.map.fastlydns.net:80
-            files.pythonhosted.org:443
-            github.com:443
-            powershellinfraartifacts-gkhedzdeaghdezhr.z01.azurefd.net:443
-            production.cloudflare.docker.com:443
-            production.cloudfront.docker.com:443
             public.ecr.aws:443
-            pypi.org:443
-            registry-1.docker.io:443
-            release-assets.githubusercontent.com:443
             sts.amazonaws.com:443
             sts.us-east-1.amazonaws.com:443
+            registry-1.docker.io:443
+            production.cloudflare.docker.com:443
+            production.cloudfront.docker.com:443
+            auth.docker.io:443
+            debian.map.fastlydns.net:80
+            github.com:443
+            release-assets.githubusercontent.com:443
+            pypi.org:443
+            files.pythonhosted.org:443
             www.powershellgallery.com:443
+            aka.ms:443
+            cdn.powershellgallery.com:443
+            _http._tcp.deb.debian.org:443
+            powershellinfraartifacts-gkhedzdeaghdezhr.z01.azurefd.net:443
 
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -200,20 +198,9 @@ jobs:
           context: .
           file: ${{ env.DOCKERFILE_PATH }}
           push: true
-          sbom: true
-          # max, not the default min: min records little beyond the build ref.
-          provenance: mode=max
           platforms: ${{ matrix.platform }}
           tags: |
             ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ needs.setup.outputs.latest_tag }}-${{ matrix.arch }}
-          labels: |
-            org.opencontainers.image.title=Prowler CLI
-            org.opencontainers.image.description=Open Source security tool for cloud security assessments, audits, incident response, continuous monitoring, hardening and forensics readiness
-            org.opencontainers.image.vendor=ProwlerPro, Inc.
-            org.opencontainers.image.source=https://github.com/${{ github.repository }}
-            org.opencontainers.image.revision=${{ github.sha }}
-            org.opencontainers.image.created=${{ needs.setup.outputs.created }}
-            org.opencontainers.image.version=${{ needs.setup.outputs.prowler_version }}
           cache-from: type=gha,scope=${{ matrix.arch }}
           cache-to: type=gha,mode=${{ github.event_name == 'pull_request' && 'min' || 'max' }},scope=${{ matrix.arch }}
 
@@ -232,14 +219,14 @@ jobs:
         with:
           egress-policy: block
           allowed-endpoints: >
-            api.ecr-public.us-east-1.amazonaws.com:443
+            registry-1.docker.io:443
             auth.docker.io:443
-            github.com:443
+            public.ecr.aws:443
             production.cloudflare.docker.com:443
             production.cloudfront.docker.com:443
-            public.ecr.aws:443
-            registry-1.docker.io:443
+            github.com:443
             release-assets.githubusercontent.com:443
+            api.ecr-public.us-east-1.amazonaws.com:443
             sts.amazonaws.com:443
             sts.us-east-1.amazonaws.com:443
 
@@ -265,10 +252,10 @@ jobs:
         if: github.event_name == 'push'
         run: |
           docker buildx imagetools create \
-            -t "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG}" \
-            -t "${{ secrets.PUBLIC_ECR_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG}" \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG}-amd64" \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG}-arm64"
+            -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG} \
+            -t ${{ secrets.PUBLIC_ECR_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG} \
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG}-amd64 \
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG}-arm64
         env:
           NEEDS_SETUP_OUTPUTS_LATEST_TAG: ${{ needs.setup.outputs.latest_tag }}
 
@@ -276,12 +263,12 @@ jobs:
         if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
         run: |
           docker buildx imagetools create \
-            -t "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_PROWLER_VERSION}" \
-            -t "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_STABLE_TAG}" \
-            -t "${{ secrets.PUBLIC_ECR_REPOSITORY }}/${{ env.IMAGE_NAME }}:${NEEDS_SETUP_OUTPUTS_PROWLER_VERSION}" \
-            -t "${{ secrets.PUBLIC_ECR_REPOSITORY }}/${{ env.IMAGE_NAME }}:${NEEDS_SETUP_OUTPUTS_STABLE_TAG}" \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG}-amd64" \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG}-arm64"
+            -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_PROWLER_VERSION} \
+            -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_STABLE_TAG} \
+            -t ${{ secrets.PUBLIC_ECR_REPOSITORY }}/${{ env.IMAGE_NAME }}:${NEEDS_SETUP_OUTPUTS_PROWLER_VERSION} \
+            -t ${{ secrets.PUBLIC_ECR_REPOSITORY }}/${{ env.IMAGE_NAME }}:${NEEDS_SETUP_OUTPUTS_STABLE_TAG} \
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG}-amd64 \
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG}-arm64
         env:
           NEEDS_SETUP_OUTPUTS_PROWLER_VERSION: ${{ needs.setup.outputs.prowler_version }}
           NEEDS_SETUP_OUTPUTS_STABLE_TAG: ${{ needs.setup.outputs.stable_tag }}
@@ -306,7 +293,7 @@ jobs:
         if: needs.setup.outputs.latest_tag == 'latest' && (github.event_name == 'release' || github.event_name == 'workflow_dispatch')
         run: |
           docker buildx imagetools create \
-            -t "${{ env.TONIBLYX_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_PROWLER_VERSION}" \
+            -t ${{ env.TONIBLYX_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_PROWLER_VERSION} \
             -t ${{ env.TONIBLYX_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:stable \
             ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:stable
         env:
@@ -356,9 +343,9 @@ jobs:
         id: outcome
         run: |
           if [[ "${NEEDS_CONTAINER_BUILD_PUSH_RESULT}" == "success" && "${NEEDS_CREATE_MANIFEST_RESULT}" == "success" ]]; then
-            echo "outcome=success" >> "$GITHUB_OUTPUT"
+            echo "outcome=success" >> $GITHUB_OUTPUT
           else
-            echo "outcome=failure" >> "$GITHUB_OUTPUT"
+            echo "outcome=failure" >> $GITHUB_OUTPUT
           fi
         env:
           NEEDS_CONTAINER_BUILD_PUSH_RESULT: ${{ needs.container-build-push.result }}

.github/workflows/sdk-container-checks.yml

@@ -10,7 +10,6 @@ on:
       - 'Dockerfile*'
       - 'pyproject.toml'
       - 'uv.lock'
-      - '.trivyignore.yaml'
       - '.github/workflows/sdk-container-checks.yml'
   pull_request:
     branches:
@@ -84,10 +83,6 @@ jobs:
             api.github.com:443
             mirror.gcr.io:443
             check.trivy.dev:443
-            raw.githubusercontent.com:443
-            objects.githubusercontent.com:443
-            grype.anchore.io:443
-            get.anchore.io:443
             debian.map.fastlydns.net:80
             release-assets.githubusercontent.com:443
             objects.githubusercontent.com:443
@@ -117,12 +112,8 @@ jobs:
             Dockerfile*
             pyproject.toml
             uv.lock
-            .trivyignore.yaml
             .github/workflows/sdk-container-checks.yml
             .github/actions/trivy-scan/**
-            .github/actions/grype-scan/**
-            .grype.yaml
-            .github/scripts/grype-pr-comment.js
           files_ignore: |
             prowler/CHANGELOG.md
             prowler/changelog.d/**
@@ -149,13 +140,5 @@ jobs:
         with:
           image-name: ${{ env.IMAGE_NAME }}
           image-tag: ${{ github.sha }}
-          fail-on-severity: 'high'
-          severity: 'CRITICAL,HIGH'
-
-      - name: Scan SDK container with Grype
-        if: steps.check-changes.outputs.any_changed == 'true'
-        uses: ./.github/actions/grype-scan
-        with:
-          image-name: ${{ env.IMAGE_NAME }}
-          image-tag: ${{ github.sha }}
-          fail-on-severity: 'high'
+          fail-on-critical: 'true'
+          severity: 'CRITICAL'

.github/workflows/sdk-package-checks.yml

@@ -1,196 +0,0 @@
-name: 'SDK: Package Checks'
-
-# Rehearses the PyPI release on every packaging change and once a week, from the
-# consumer's side. Two incidents this guards against:
-#
-# - 5.38.0 shipped an unsatisfiable Requires-Dist (cryptography==50.0.0 while
-#   alibabacloud-tea-openapi and pyopenssl cap it below 49). A [tool.uv] override hid
-#   the conflict inside the repo; pip could not install the wheel and silently
-#   resolved `pip install prowler` to 5.37.1 for a week.
-# - 5.39.0 never published: an unpinned build backend started emitting core metadata
-#   2.5 and the twine bundled in the publish action rejected it.
-#
-# Both were only detectable at release time because nothing built and installed the
-# artifact earlier. The weekly run also catches releases yanked from PyPI after we
-# pinned them (zstd 1.5.7.3, "buggy - not thread safe", sat in uv.lock for months).
-
-on:
-  push:
-    branches:
-      - 'master'
-      - 'v5.*'
-  pull_request:
-    branches:
-      - 'master'
-      - 'v5.*'
-  schedule:
-    # Monday 06:00 UTC. Yanks and upstream releases happen without a commit here.
-    - cron: '0 6 * * 1'
-  workflow_dispatch:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-permissions: {}
-
-env:
-  # Must equal the twine bundled in the pypa/gh-action-pypi-publish pin used by
-  # sdk-pypi-release.yml (requirements/runtime.txt in that repo at the pinned tag).
-  # A metadata check that passes here must pass there.
-  TWINE_VERSION: '7.0.0'
-
-jobs:
-  changes:
-    if: github.repository == 'prowler-cloud/prowler'
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    permissions:
-      contents: read
-    outputs:
-      # Scheduled and manual runs always execute; pushes and PRs only when a packaging
-      # input changed. Jobs skipped this way still report success to branch protection.
-      run: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || steps.filter.outputs.any_changed == 'true' }}
-
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: block
-          allowed-endpoints: >
-            github.com:443
-            api.github.com:443
-
-      - name: Checkout repository
-        if: github.event_name == 'push' || github.event_name == 'pull_request'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          # zizmor: ignore[artipacked]
-          persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
-
-      - name: Detect packaging changes
-        if: github.event_name == 'push' || github.event_name == 'pull_request'
-        id: filter
-        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
-        with:
-          files: |
-            pyproject.toml
-            uv.lock
-            README.md
-            util/replicate_pypi_package.py
-            util/check_yanked_pins.py
-            api/pyproject.toml
-            api/uv.lock
-            mcp_server/pyproject.toml
-            mcp_server/uv.lock
-            .github/workflows/sdk-package-checks.yml
-            .github/workflows/sdk-pypi-release.yml
-            .github/actions/setup-python-uv/**
-
-  install-from-wheel:
-    needs: changes
-    if: needs.changes.outputs.run == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    permissions:
-      contents: read
-    strategy:
-      fail-fast: false
-      matrix:
-        python-version:
-          - '3.10'
-          - '3.11'
-          - '3.12'
-          - '3.13'
-        package:
-          - 'prowler'
-        include:
-          # prowler-cloud is the same tree renamed by util/replicate_pypi_package.py;
-          # one Python is enough to prove the rename and its build still work.
-          - python-version: '3.12'
-            package: 'prowler-cloud'
-
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: block
-          allowed-endpoints: >
-            github.com:443
-            api.github.com:443
-            release-assets.githubusercontent.com:443
-            pypi.org:443
-            files.pythonhosted.org:443
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
-      - name: Setup Python with uv
-        uses: ./.github/actions/setup-python-uv
-        with:
-          python-version: ${{ matrix.python-version }}
-          install-dependencies: 'false'
-
-      - name: Rename package to prowler-cloud
-        if: matrix.package == 'prowler-cloud'
-        run: |
-          pip install --no-cache-dir toml
-          python util/replicate_pypi_package.py
-
-      - name: Build sdist and wheel
-        run: uv build
-
-      - name: Check metadata with the release workflow's twine
-        run: uvx --from "twine==${TWINE_VERSION}" twine check --strict dist/*
-
-      - name: Install the wheel with pip into a clean virtualenv
-        # Plain pip, --isolated, from outside the repo: consumers never see [tool.uv]
-        # override-dependencies or constraint-dependencies, so neither does this step.
-        run: |
-          python -m venv "${RUNNER_TEMP}/consumer"
-          "${RUNNER_TEMP}/consumer/bin/python" -m pip install --quiet --upgrade pip
-          cd "${RUNNER_TEMP}"
-          "${RUNNER_TEMP}/consumer/bin/python" -m pip install --isolated --no-cache-dir "${GITHUB_WORKSPACE}"/dist/*.whl
-
-      - name: Smoke test the installed CLI
-        run: |
-          cd "${RUNNER_TEMP}"
-          "${RUNNER_TEMP}/consumer/bin/prowler" --version
-          # Loads every AWS check module from the installed wheel: catches files missing
-          # from the package. grep fails the step if the summary line never appears.
-          "${RUNNER_TEMP}/consumer/bin/prowler" aws --list-checks | grep 'available checks'
-
-  pinned-releases-not-yanked:
-    needs: changes
-    if: needs.changes.outputs.run == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: read
-
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: block
-          allowed-endpoints: >
-            github.com:443
-            api.github.com:443
-            release-assets.githubusercontent.com:443
-            pypi.org:443
-            files.pythonhosted.org:443
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
-      - name: Set up Python
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
-        with:
-          python-version: '3.12'
-
-      - name: Check every pinned and locked release against PyPI
-        run: python util/check_yanked_pins.py . api mcp_server

.github/workflows/sdk-pypi-release.yml

@@ -84,18 +84,8 @@ jobs:
       - name: Build Prowler package
         run: uv build
 
-      - name: Verify the wheel installs with pip
-        # Same check as "SDK: Package Checks", repeated on the exact artifact about to be
-        # published. Plain pip, --isolated, from outside the repo: an unsatisfiable
-        # Requires-Dist fails here instead of on users' machines (5.38.0 shipped one).
-        run: |
-          python -m venv "${RUNNER_TEMP}/consumer"
-          "${RUNNER_TEMP}/consumer/bin/python" -m pip install --quiet --upgrade pip
-          cd "${RUNNER_TEMP}"
-          "${RUNNER_TEMP}/consumer/bin/python" -m pip install --isolated --no-cache-dir --dry-run "${GITHUB_WORKSPACE}"/dist/*.whl
-
       - name: Publish Prowler package to PyPI
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
         with:
           print-hash: true
 
@@ -138,17 +128,7 @@ jobs:
       - name: Build prowler-cloud package
         run: uv build
 
-      - name: Verify the wheel installs with pip
-        # Same check as "SDK: Package Checks", repeated on the exact artifact about to be
-        # published. Plain pip, --isolated, from outside the repo: an unsatisfiable
-        # Requires-Dist fails here instead of on users' machines (5.38.0 shipped one).
-        run: |
-          python -m venv "${RUNNER_TEMP}/consumer"
-          "${RUNNER_TEMP}/consumer/bin/python" -m pip install --quiet --upgrade pip
-          cd "${RUNNER_TEMP}"
-          "${RUNNER_TEMP}/consumer/bin/python" -m pip install --isolated --no-cache-dir --dry-run "${GITHUB_WORKSPACE}"/dist/*.whl
-
       - name: Publish prowler-cloud package to PyPI
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
         with:
           print-hash: true

.github/workflows/sdk-refresh-aws-services-regions.yml

@@ -44,10 +44,7 @@ jobs:
           cache: 'pip'
 
       - name: Install dependencies
-        # Pinned to the versions in pyproject.toml: the ISO partitions region
-        # data comes from the endpoints.json bundled with botocore, so the
-        # botocore version is itself a data source and must be deterministic
-        run: pip install boto3==1.40.61 botocore==1.40.61
+        run: pip install boto3
 
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1

.github/workflows/sdk-tests.yml

@@ -216,8 +216,7 @@ jobs:
           elif [ -z "${STEPS_AWS_SERVICES_OUTPUTS_SERVICE_PATHS}" ]; then
             echo "No AWS service paths detected; skipping AWS tests."
           else
-            read -ra service_paths <<< "${STEPS_AWS_SERVICES_OUTPUTS_SERVICE_PATHS}"
-            uv run pytest -n auto --cov=./prowler/providers/aws --cov-report=xml:aws_coverage.xml "${service_paths[@]}"
+            uv run pytest -n auto --cov=./prowler/providers/aws --cov-report=xml:aws_coverage.xml ${STEPS_AWS_SERVICES_OUTPUTS_SERVICE_PATHS}
           fi
         env:
           STEPS_AWS_SERVICES_OUTPUTS_RUN_ALL: ${{ steps.aws-services.outputs.run_all }}

.github/workflows/test-impact-analysis.yml

@@ -57,7 +57,6 @@ jobs:
           egress-policy: block
           allowed-endpoints: >
             github.com:443
-            release-assets.githubusercontent.com:443
             pypi.org:443
             files.pythonhosted.org:443
 
@@ -85,8 +84,7 @@ jobs:
           echo "Changed files:"
           echo "${STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES}" | tr ' ' '\n'
           echo ""
-          read -ra changed <<< "${STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES}"
-          python .github/scripts/test-impact.py "${changed[@]}"
+          python .github/scripts/test-impact.py ${STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES}
         env:
           STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }}
 
@@ -94,21 +92,21 @@ jobs:
         id: set-flags
         run: |
           if [[ -n "${STEPS_IMPACT_OUTPUTS_SDK_TESTS}" ]]; then
-            echo "has-sdk-tests=true" >> "$GITHUB_OUTPUT"
+            echo "has-sdk-tests=true" >> $GITHUB_OUTPUT
           else
-            echo "has-sdk-tests=false" >> "$GITHUB_OUTPUT"
+            echo "has-sdk-tests=false" >> $GITHUB_OUTPUT
           fi
 
           if [[ -n "${STEPS_IMPACT_OUTPUTS_API_TESTS}" ]]; then
-            echo "has-api-tests=true" >> "$GITHUB_OUTPUT"
+            echo "has-api-tests=true" >> $GITHUB_OUTPUT
           else
-            echo "has-api-tests=false" >> "$GITHUB_OUTPUT"
+            echo "has-api-tests=false" >> $GITHUB_OUTPUT
           fi
 
           if [[ -n "${STEPS_IMPACT_OUTPUTS_UI_E2E}" ]]; then
-            echo "has-ui-e2e=true" >> "$GITHUB_OUTPUT"
+            echo "has-ui-e2e=true" >> $GITHUB_OUTPUT
           else
-            echo "has-ui-e2e=false" >> "$GITHUB_OUTPUT"
+            echo "has-ui-e2e=false" >> $GITHUB_OUTPUT
           fi
         env:
           STEPS_IMPACT_OUTPUTS_SDK_TESTS: ${{ steps.impact.outputs.sdk-tests }}
@@ -117,22 +115,22 @@ jobs:
 
       - name: Summary
         run: |
-          echo "## Test Impact Analysis" >> "$GITHUB_STEP_SUMMARY"
-          echo "" >> "$GITHUB_STEP_SUMMARY"
+          echo "## Test Impact Analysis" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
 
           if [[ "${STEPS_IMPACT_OUTPUTS_RUN_ALL}" == "true" ]]; then
-            echo "🚨 **Critical path changed - running ALL tests**" >> "$GITHUB_STEP_SUMMARY"
+            echo "🚨 **Critical path changed - running ALL tests**" >> $GITHUB_STEP_SUMMARY
           else
-            echo "### Affected Modules" >> "$GITHUB_STEP_SUMMARY"
-            echo "\`${STEPS_IMPACT_OUTPUTS_MODULES}\`" >> "$GITHUB_STEP_SUMMARY"
-            echo "" >> "$GITHUB_STEP_SUMMARY"
+            echo "### Affected Modules" >> $GITHUB_STEP_SUMMARY
+            echo "\`${STEPS_IMPACT_OUTPUTS_MODULES}\`" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
 
-            echo "### Tests to Run" >> "$GITHUB_STEP_SUMMARY"
-            echo "| Category | Paths |" >> "$GITHUB_STEP_SUMMARY"
-            echo "|----------|-------|" >> "$GITHUB_STEP_SUMMARY"
-            echo "| SDK Tests | \`${STEPS_IMPACT_OUTPUTS_SDK_TESTS:-none}\` |" >> "$GITHUB_STEP_SUMMARY"
-            echo "| API Tests | \`${STEPS_IMPACT_OUTPUTS_API_TESTS:-none}\` |" >> "$GITHUB_STEP_SUMMARY"
-            echo "| UI E2E | \`${STEPS_IMPACT_OUTPUTS_UI_E2E:-none}\` |" >> "$GITHUB_STEP_SUMMARY"
+            echo "### Tests to Run" >> $GITHUB_STEP_SUMMARY
+            echo "| Category | Paths |" >> $GITHUB_STEP_SUMMARY
+            echo "|----------|-------|" >> $GITHUB_STEP_SUMMARY
+            echo "| SDK Tests | \`${STEPS_IMPACT_OUTPUTS_SDK_TESTS:-none}\` |" >> $GITHUB_STEP_SUMMARY
+            echo "| API Tests | \`${STEPS_IMPACT_OUTPUTS_API_TESTS:-none}\` |" >> $GITHUB_STEP_SUMMARY
+            echo "| UI E2E | \`${STEPS_IMPACT_OUTPUTS_UI_E2E:-none}\` |" >> $GITHUB_STEP_SUMMARY
           fi
 
         env:

.github/workflows/ui-container-build-push.yml

@@ -41,20 +41,17 @@ jobs:
     timeout-minutes: 5
     outputs:
       short-sha: ${{ steps.set-short-sha.outputs.short-sha }}
-      created: ${{ steps.set-short-sha.outputs.created }}
     permissions:
       contents: read
     steps:
-      - name: Harden Runner
+      - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
-          egress-policy: block
+          egress-policy: audit
 
       - name: Calculate short SHA
         id: set-short-sha
-        run: |
-          echo "short-sha=${GITHUB_SHA::7}" >> "${GITHUB_OUTPUT}"
-          echo "created=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "${GITHUB_OUTPUT}"
+        run: echo "short-sha=${GITHUB_SHA::7}" >> $GITHUB_OUTPUT
 
   notify-release-started:
     if: github.repository == 'prowler-cloud/prowler' && (github.event_name == 'release' || github.event_name == 'workflow_dispatch')
@@ -114,15 +111,15 @@ jobs:
         with:
           egress-policy: block
           allowed-endpoints: >
+            registry-1.docker.io:443
+            production.cloudflare.docker.com:443
+            production.cloudfront.docker.com:443
             auth.docker.io:443
+            registry.npmjs.org:443
             dl-cdn.alpinelinux.org:443
             fonts.googleapis.com:443
             fonts.gstatic.com:443
             github.com:443
-            production.cloudflare.docker.com:443
-            production.cloudfront.docker.com:443
-            registry-1.docker.io:443
-            registry.npmjs.org:443
 
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -147,20 +144,9 @@ jobs:
           build-args: |
             NEXT_PUBLIC_PROWLER_RELEASE_VERSION=${{ (github.event_name == 'release' || github.event_name == 'workflow_dispatch') && format('v{0}', env.RELEASE_TAG) || needs.setup.outputs.short-sha }}
           push: true
-          sbom: true
-          # max, not the default min: min records little beyond the build ref.
-          provenance: mode=max
           platforms: ${{ matrix.platform }}
           tags: |
             ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ needs.setup.outputs.short-sha }}-${{ matrix.arch }}
-          labels: |
-            org.opencontainers.image.title=Prowler Local Server UI
-            org.opencontainers.image.description=Web UI for Prowler Local Server (Next.js)
-            org.opencontainers.image.vendor=ProwlerPro, Inc.
-            org.opencontainers.image.source=https://github.com/${{ github.repository }}
-            org.opencontainers.image.revision=${{ github.sha }}
-            org.opencontainers.image.created=${{ needs.setup.outputs.created }}
-            ${{ (github.event_name == 'release' || github.event_name == 'workflow_dispatch') && format('org.opencontainers.image.version={0}', env.RELEASE_TAG) || '' }}
           cache-from: type=gha,scope=${{ matrix.arch }}
           cache-to: type=gha,mode=${{ github.event_name == 'pull_request' && 'min' || 'max' }},scope=${{ matrix.arch }}
 
@@ -178,12 +164,12 @@ jobs:
         with:
           egress-policy: block
           allowed-endpoints: >
-            auth.docker.io:443
             github.com:443
+            release-assets.githubusercontent.com:443
+            registry-1.docker.io:443
+            auth.docker.io:443
             production.cloudflare.docker.com:443
             production.cloudfront.docker.com:443
-            registry-1.docker.io:443
-            release-assets.githubusercontent.com:443
 
       - name: Login to DockerHub
         uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
@@ -196,9 +182,9 @@ jobs:
         run: |
           docker buildx imagetools create \
             -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ env.LATEST_TAG }} \
-            -t "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}" \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64" \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64"
+            -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA} \
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64 \
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64
         env:
           NEEDS_SETUP_OUTPUTS_SHORT_SHA: ${{ needs.setup.outputs.short-sha }}
 
@@ -206,10 +192,10 @@ jobs:
         if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
         run: |
           docker buildx imagetools create \
-            -t "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${RELEASE_TAG}" \
+            -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${RELEASE_TAG} \
             -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ env.STABLE_TAG }} \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64" \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64"
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64 \
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64
         env:
           NEEDS_SETUP_OUTPUTS_SHORT_SHA: ${{ needs.setup.outputs.short-sha }}
 
@@ -249,9 +235,9 @@ jobs:
         id: outcome
         run: |
           if [[ "${NEEDS_CONTAINER_BUILD_PUSH_RESULT}" == "success" && "${NEEDS_CREATE_MANIFEST_RESULT}" == "success" ]]; then
-            echo "outcome=success" >> "$GITHUB_OUTPUT"
+            echo "outcome=success" >> $GITHUB_OUTPUT
           else
-            echo "outcome=failure" >> "$GITHUB_OUTPUT"
+            echo "outcome=failure" >> $GITHUB_OUTPUT
           fi
         env:
           NEEDS_CONTAINER_BUILD_PUSH_RESULT: ${{ needs.container-build-push.result }}

.github/workflows/ui-container-checks.yml

@@ -88,9 +88,6 @@ jobs:
             get.trivy.dev:443
             release-assets.githubusercontent.com:443
             objects.githubusercontent.com:443
-            raw.githubusercontent.com:443
-            grype.anchore.io:443
-            get.anchore.io:443
 
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -104,11 +101,7 @@ jobs:
         with:
           files: |
             ui/**
-            .trivyignore.yaml
             .github/actions/trivy-scan/**
-            .github/actions/grype-scan/**
-            .grype.yaml
-            .github/scripts/grype-pr-comment.js
           files_ignore: |
             ui/CHANGELOG.md
             ui/changelog.d/**
@@ -139,13 +132,5 @@ jobs:
         with:
           image-name: ${{ env.IMAGE_NAME }}
           image-tag: ${{ github.sha }}
-          fail-on-severity: 'high'
-          severity: 'CRITICAL,HIGH'
-
-      - name: Scan UI container with Grype
-        if: steps.check-changes.outputs.any_changed == 'true'
-        uses: ./.github/actions/grype-scan
-        with:
-          image-name: ${{ env.IMAGE_NAME }}
-          image-tag: ${{ github.sha }}
-          fail-on-severity: 'high'
+          fail-on-critical: 'true'
+          severity: 'CRITICAL'

.github/workflows/ui-e2e-tests-v2.yml

@@ -108,14 +108,14 @@ jobs:
 
       - name: Show test scope
         run: |
-          echo "## E2E Test Scope" >> "$GITHUB_STEP_SUMMARY"
+          echo "## E2E Test Scope" >> $GITHUB_STEP_SUMMARY
           if [[ "${RUN_ALL_TESTS}" == "true" ]]; then
-            echo "Running **ALL** E2E tests (critical path changed)" >> "$GITHUB_STEP_SUMMARY"
+            echo "Running **ALL** E2E tests (critical path changed)" >> $GITHUB_STEP_SUMMARY
           else
-            echo "Running tests matching: \`${E2E_TEST_PATHS}\`" >> "$GITHUB_STEP_SUMMARY"
+            echo "Running tests matching: \`${E2E_TEST_PATHS}\`" >> $GITHUB_STEP_SUMMARY
           fi
           echo ""
-          echo "Affected modules: \`${NEEDS_IMPACT_ANALYSIS_OUTPUTS_MODULES}\`" >> "$GITHUB_STEP_SUMMARY"
+          echo "Affected modules: \`${NEEDS_IMPACT_ANALYSIS_OUTPUTS_MODULES}\`" >> $GITHUB_STEP_SUMMARY
         env:
           NEEDS_IMPACT_ANALYSIS_OUTPUTS_MODULES: ${{ needs.impact-analysis.outputs.modules }}
 
@@ -233,7 +233,7 @@ jobs:
           yq -i '.services.worker.networks = ["kind","default"]' docker-compose.yml
 
       - name: Fix API data directory permissions
-        run: docker run --rm -v "$(pwd)/_data/api:/data" alpine chown -R 1000:1000 /data
+        run: docker run --rm -v $(pwd)/_data/api:/data alpine chown -R 1000:1000 /data
 
       - name: Add AWS credentials for testing
         run: |
@@ -267,7 +267,7 @@ jobs:
           timeout=150
           elapsed=0
           while [ $elapsed -lt $timeout ]; do
-            if curl -s "${UI_API_BASE_URL}/docs" >/dev/null 2>&1; then
+            if curl -s ${UI_API_BASE_URL}/docs >/dev/null 2>&1; then
               echo "Prowler API is ready!"
               exit 0
             fi
@@ -301,7 +301,7 @@ jobs:
           run_install: false
 
       - name: Get pnpm store directory
-        run: echo "STORE_PATH=$(pnpm store path --silent)" >> "$GITHUB_ENV"
+        run: echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
 
       - name: Setup pnpm and Next.js cache
         uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
@@ -387,8 +387,7 @@ jobs:
             fi
             TEST_PATHS=$(echo "$VALID_PATHS" | tr '\n' ' ')
             echo "Resolved test paths: $TEST_PATHS"
-            read -ra test_paths <<< "$TEST_PATHS"
-            pnpm exec playwright test "${test_paths[@]}"
+            pnpm exec playwright test $TEST_PATHS
           fi
 
       - name: Upload test reports
@@ -445,12 +444,12 @@ jobs:
 
       - name: No E2E tests needed
         run: |
-          echo "## E2E Tests Skipped" >> "$GITHUB_STEP_SUMMARY"
-          echo "" >> "$GITHUB_STEP_SUMMARY"
-          echo "No UI E2E tests needed for this change." >> "$GITHUB_STEP_SUMMARY"
-          echo "" >> "$GITHUB_STEP_SUMMARY"
-          echo "Affected modules: \`${NEEDS_IMPACT_ANALYSIS_OUTPUTS_MODULES}\`" >> "$GITHUB_STEP_SUMMARY"
-          echo "" >> "$GITHUB_STEP_SUMMARY"
-          echo "To run all tests, modify a file in a critical path (e.g., \`ui/lib/**\`)." >> "$GITHUB_STEP_SUMMARY"
+          echo "## E2E Tests Skipped" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "No UI E2E tests needed for this change." >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "Affected modules: \`${NEEDS_IMPACT_ANALYSIS_OUTPUTS_MODULES}\`" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "To run all tests, modify a file in a critical path (e.g., \`ui/lib/**\`)." >> $GITHUB_STEP_SUMMARY
         env:
           NEEDS_IMPACT_ANALYSIS_OUTPUTS_MODULES: ${{ needs.impact-analysis.outputs.modules }}

.github/workflows/ui-tests.yml

@@ -113,7 +113,7 @@ jobs:
       - name: Get pnpm store directory
         if: steps.check-changes.outputs.any_changed == 'true'
         shell: bash
-        run: echo "STORE_PATH=$(pnpm store path --silent)" >> "$GITHUB_ENV"
+        run: echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
 
       - name: Setup pnpm and Next.js cache
         if: steps.check-changes.outputs.any_changed == 'true'
@@ -157,8 +157,7 @@ jobs:
           echo "${STEPS_CHANGED_SOURCE_OUTPUTS_ALL_CHANGED_FILES}"
           # Convert space-separated to vitest related format (remove ui/ prefix for relative paths)
           CHANGED_FILES=$(echo "${STEPS_CHANGED_SOURCE_OUTPUTS_ALL_CHANGED_FILES}" | tr ' ' '\n' | sed 's|^ui/||' | tr '\n' ' ')
-          read -ra changed <<< "$CHANGED_FILES"
-          pnpm exec vitest related "${changed[@]}" --run --project unit
+          pnpm exec vitest related $CHANGED_FILES --run --project unit
         env:
           STEPS_CHANGED_SOURCE_OUTPUTS_ALL_CHANGED_FILES: ${{ steps.changed-source.outputs.all_changed_files }}
 

.grype.yaml

@@ -1,128 +0,0 @@
-# Findings excluded from the Grype gate, each with a reason.
-# Anything not listed here blocks the pull request at critical or high severity.
-# Pairs are explicit: a new CVE against an already-listed package still blocks.
-#
-# Every entry below has a published fix we cannot take. Findings with no fix at all are
-# not listed: the scan runs with only-fixed, so they never reach the gate.
-
-ignore:
-
-  # Modules compiled into the Trivy binary we ship.
-  # Only a Trivy rebuild by its vendor can change these; the version is pinned in our Dockerfile.
-  # CVE-2026-71556 is the same temporary exception documented in .trivyignore.yaml:
-  # Trivy 0.73.0 still embeds go-git 5.19.1, while the 5.19.2 fix is merged only on
-  # Trivy main. Remove this entry with the Trivy exception by 2026-09-15.
-  # https://github.com/aquasecurity/trivy/blob/v0.73.0/go.mod#L46
-  # https://github.com/aquasecurity/trivy/commit/a2edba9a03987ba0d2ebc8212c1a9a1e6979497b
-  - vulnerability: CVE-2026-71556
-    package:
-      name: github.com/go-git/go-git/v5
-  # CVE-2026-84304 is the same temporary exception documented in .trivyignore.yaml:
-  # Trivy 0.74.0 still embeds grpc 1.82.1, while the 1.83.1 fix is not in any release.
-  # Prowler only runs `trivy image` / `trivy fs`, never client/server mode, so no gRPC
-  # endpoint exists in the image. Pinned to the embedded version so the rule stops
-  # matching on its own once Trivy bumps grpc. Remove with the Trivy exception by 2026-10-15.
-  # https://github.com/aquasecurity/trivy/pull/11176
-  - vulnerability: CVE-2026-84304
-    package:
-      name: google.golang.org/grpc
-      version: v1.82.1
-  # CVE-2026-84445 is the same temporary exception documented in .trivyignore.yaml:
-  # Trivy 0.74.0 still embeds grpc 1.82.1, while the 1.82.2 / 1.83.2 fix is not in any
-  # release. The panic needs a gRPC server built with `xds.NewGRPCServer()`; Prowler only
-  # runs `trivy image` / `trivy fs`, so the image serves no gRPC at all. Pinned to the
-  # embedded version so the rule stops matching on its own once Trivy bumps grpc. Remove
-  # with the Trivy exception by 2026-10-15.
-  # https://github.com/advisories/GHSA-2v4p-qf9q-27wj
-  - vulnerability: CVE-2026-84445
-    package:
-      name: google.golang.org/grpc
-      version: v1.82.1
-  # CVE-2026-56855 / CVE-2026-78662 are the same temporary exception documented in
-  # .trivyignore.yaml: Trivy 0.74.0 still embeds golang.org/x/crypto v0.55.0, while the
-  # 0.56.0 fix (published 2026-09-02) hasn't reached any Trivy release, or even Trivy
-  # main, yet. Pinned to the embedded version so the rule stops matching on its own once
-  # Trivy bumps it. Remove with the Trivy exception by 2026-10-15.
-  - vulnerability: CVE-2026-56855
-    package:
-      name: golang.org/x/crypto
-      version: v0.55.0
-  - vulnerability: CVE-2026-78662
-    package:
-      name: golang.org/x/crypto
-      version: v0.55.0
-  - vulnerability: CVE-2026-56852
-    package:
-      name: golang.org/x/text
-  - vulnerability: GHSA-hrxh-6v49-42gf
-    package:
-      name: google.golang.org/grpc
-  - vulnerability: CVE-2026-50151
-    package:
-      name: oras.land/oras-go/v2
-
-  # Shipped inside the PowerShell tarball, in its bundled MicrosoftTeams module.
-  # Not a dependency we declare, and not one we can upgrade independently.
-  - vulnerability: CVE-2026-26127
-    package:
-      name: Microsoft.Bcl.Memory
-
-  # The .NET runtime bundled inside the PowerShell tarball the Dockerfile pins.
-  # CVE-2026-62901 is the same temporary exception documented in .trivyignore.yaml:
-  # fixed in .NET 9.0.19 / 10.0.11 (2026-08-11), but no published PowerShell release
-  # ships a patched runtime yet (7.5.9 bundles 9.0.18; 7.6.4 bundles 10.0.x < 10.0.11).
-  # pwsh runs only local M365 module cmdlets; nothing listens for inbound WebSocket
-  # connections. Remove with the Trivy exception by 2026-09-15.
-  - vulnerability: CVE-2026-62901
-    package:
-      name: Microsoft.NETCore.App.Runtime.linux-x64
-  - vulnerability: CVE-2026-62901
-    package:
-      name: Microsoft.NETCore.App.Runtime.linux-arm64
-
-
-  # The CPython interpreter, compiled into the official base image.
-  # TEMPORARY, unlike the entries above: moving to Python 3.13 clears seven of these, and
-  # that is a runtime upgrade pending its own evaluation. The remaining three need 3.15 and
-  # are unfixable either way -- the MCP image already runs 3.13.14 and still reports them.
-  - vulnerability: CVE-2026-11940
-    package:
-      name: python
-  - vulnerability: CVE-2026-11972
-    package:
-      name: python
-  - vulnerability: CVE-2026-15308
-    package:
-      name: python
-  - vulnerability: CVE-2026-3298
-    package:
-      name: python
-  - vulnerability: CVE-2026-3644
-    package:
-      name: python
-  - vulnerability: CVE-2026-4224
-    package:
-      name: python
-  - vulnerability: CVE-2026-4786
-    package:
-      name: python
-  - vulnerability: CVE-2026-6100
-    package:
-      name: python
-  - vulnerability: CVE-2026-7210
-    package:
-      name: python
-  - vulnerability: CVE-2026-9669
-    package:
-      name: python
-  # CVE-2026-82049 (tarfile data/tar filter bypass via a hard link to a symlink) has no
-  # fixed CPython release on any branch: the fix is merged on main and 3.13 only, and the
-  # 3.12 backport is still open. Grype records 3.14.0b1 as the fix, so only-fixed does not
-  # drop it, yet python:3.12.14-slim-trixie reports it too. Prowler never extracts tar
-  # archives to disk: the ECR image inspection reads members in memory with extractfile().
-  # Remove once the base image ships a 3.12 release that includes the backport.
-  # https://github.com/python/cpython/issues/157190
-  # https://github.com/python/cpython/pull/157454
-  - vulnerability: CVE-2026-82049
-    package:
-      name: python

.pre-commit-config.yaml

@@ -47,14 +47,6 @@ repos:
         priority: 20
 
   ## GITHUB ACTIONS
-  - repo: https://github.com/rhysd/actionlint
-    rev: v1.7.12
-    hooks:
-      - id: actionlint
-        # SC2129 only suggests grouping consecutive redirects; not worth restructuring for.
-        args: ['-shellcheck=-e SC2129']
-        priority: 30
-
   - repo: https://github.com/zizmorcore/zizmor-pre-commit
     rev: v1.24.1
     hooks:

.trivyignore

@@ -0,0 +1,58 @@
+# Trivy ignore file for the prowlercloud/prowler SDK and API container images.
+# Each entry below documents (a) the affected package and why it ships in the
+# image, (b) why the CVE is not exploitable in Prowler's runtime, and (c) the
+# upstream fix status. Entries carry an expiry so they auto-force re-review.
+# The `pkg:` selector on each line is documentation only. Trivy's classic
+# .trivyignore format parses the CVE ID and ignores the rest, so each entry
+# suppresses its CVE across every package in the image, not just the one named.
+# Verified against Trivy 0.65.0: an entry written `pkg:zlib1g` still suppressed
+# the finding on perl-base. Real per-package scoping needs .trivyignore.yaml
+# with purls — tracked in PROWLER-2327.
+# `exp:` IS honoured: an entry dated in the past correctly lapses.
+#
+# Keep expiries staggered, and only suppress packages the images actually install.
+#
+# Scanned by: .github/actions/trivy-scan via .github/workflows/sdk-container-checks.yml
+# and .github/workflows/api-container-checks.yml
+
+# perl-base is Debian "Essential: yes". Trivy spreads src:perl CVEs across every
+# binary package, so perl-base gets flagged for modules only perl-modules-5.40 ships.
+# Neither image installs perl-modules-5.40, and nothing in either invokes perl.
+#
+# Why these four cannot be fixed rather than accepted (reviewed 2026-07-31):
+#
+#   1. No fix exists. All four report no fixed version on perl-base 5.40.1-6.
+#      Debian's tracker marks CVE-2026-42496 "fix_deferred" and the other three
+#      "affected". Updating the base image, apt upgrade, or moving to a newer
+#      Debian release changes nothing, because Debian has not shipped a fix.
+#   2. The package cannot be removed. "Essential: yes" means removal needs
+#      dpkg --force-remove-essential, which also breaks apt for anything built
+#      downstream from these images.
+#   3. Changing base distribution was evaluated and rejected. Alpine removes
+#      perl entirely, but PowerShell publishes no linux-musl-arm64 build in any
+#      release, so M365 scanning would break on arm64 — which is what we run in
+#      production. Wolfi keeps glibc and drops perl, but pinnable versioned tags
+#      are a paid tier, so builds would not be reproducibly pinnable.
+#
+# Not-invoked claim verified by sweeping both images for: files with a perl
+# shebang, shell/python callers of perl, ELF binaries containing "perl", and
+# .pl/.pm files or perl subprocess calls anywhere in site-packages. The only
+# consumers found are dpkg/debconf/adduser/pam tooling, none of which runs at
+# runtime, plus one build-time script inside the ExchangeOnlineManagement
+# PowerShell module that is never invoked (it generates that module's manifest,
+# and lives in its netFramework/ path, while Linux loads netCore/).
+
+# Archive::Tar path traversal. Not installed: `perl -MArchive::Tar -e1` cannot locate it.
+CVE-2026-42496 pkg:perl-base exp:2027-01-31
+
+# Storable integer overflow. Not installed: `perl -MStorable -e1` cannot locate it.
+CVE-2026-57433 pkg:perl-base exp:2027-01-31
+
+# Regex heap overflow on 32-bit builds only; both published arches are 64-bit.
+CVE-2026-8376 pkg:perl-base exp:2027-01-31
+
+# Regex trie bug giving silently wrong matches above 65535 alternation branches. Now on
+# perl 5.40.1, which is in range (the 5.36-predates-it argument no longer applies), so this
+# rests on nothing invoking perl. Short expiry to force a re-look.
+# Ref: https://github.com/Perl/perl5/issues/23388
+CVE-2026-13221 pkg:perl-base exp:2026-11-30

.trivyignore.yaml

@@ -1,208 +0,0 @@
-# Trivy suppressions for the prowlercloud/prowler SDK and API container images.
-#
-# This file replaces the classic .trivyignore, which parsed only the CVE id: the
-# `pkg:` selector written on each line was documentation and the entry suppressed
-# its CVE across every package in the image. The `purls` field below is honoured,
-# so each entry is scoped to the package it names. Verified against Trivy 0.71.2:
-# an entry given the wrong purl leaves the finding reported, where the classic
-# format suppressed it.
-#
-# `expired_at` forces re-review. Keep the dates staggered.
-#
-# The four entries below are currently redundant: the scan runs with ignore-unfixed,
-# and none of them has a published fix, so they never reach the gate either way. They
-# are kept because the reasoning is what justifies accepting them, and because they
-# apply again the moment any of them gains a fix we do not take.
-#
-# perl-base is Debian "Essential: yes". Trivy spreads src:perl CVEs across every
-# binary package built from that source, so perl-base is flagged for modules only
-# perl-modules-* ships. Neither image installs those, and nothing in either
-# invokes perl.
-#
-# Why these four are accepted rather than fixed (reviewed 2026-07-31):
-#
-#   1. No fix exists. All four report no fixed version on perl-base 5.40.1-6.
-#      Debian marks CVE-2026-42496 "fix_deferred" and the other three "affected".
-#      A newer base image, apt upgrade, or a newer Debian release changes nothing.
-#   2. The package cannot be removed. "Essential: yes" means removal needs
-#      dpkg --force-remove-essential, which breaks apt for anything built
-#      downstream from these images.
-#   3. Changing base distribution was evaluated and rejected. Alpine drops perl
-#      entirely, but PowerShell publishes no linux-musl-arm64 build in any
-#      release, so M365 scanning would break on arm64 -- which is what we run in
-#      production. Wolfi keeps glibc and drops perl, but pinnable versioned tags
-#      are a paid tier, so builds would not be reproducibly pinnable.
-#
-# Not-invoked claim verified by sweeping both images for files with a perl
-# shebang, shell/python callers of perl, ELF binaries containing "perl", and
-# .pl/.pm files or perl subprocess calls anywhere in site-packages. The only
-# consumers found are dpkg/debconf/adduser/pam tooling, none of which runs at
-# runtime, plus one build-time script inside the ExchangeOnlineManagement
-# PowerShell module that is never invoked.
-
-vulnerabilities:
-  # Archive::Tar path traversal. Not installed: `perl -MArchive::Tar -e1` cannot locate it.
-  - id: CVE-2026-42496
-    purls:
-      - "pkg:deb/debian/perl-base"
-    expired_at: 2027-01-31
-
-  # Storable integer overflow. Not installed: `perl -MStorable -e1` cannot locate it.
-  - id: CVE-2026-57433
-    purls:
-      - "pkg:deb/debian/perl-base"
-    expired_at: 2027-01-31
-
-  # Regex heap overflow on 32-bit builds only; both published arches are 64-bit.
-  - id: CVE-2026-8376
-    purls:
-      - "pkg:deb/debian/perl-base"
-    expired_at: 2027-01-31
-
-  # Regex trie bug giving silently wrong matches above 65535 alternation branches.
-  # perl 5.40.1 is in range, so this rests on nothing invoking perl. Short expiry
-  # to force a re-look. Ref: https://github.com/Perl/perl5/issues/23388
-  - id: CVE-2026-13221
-    purls:
-      - "pkg:deb/debian/perl-base"
-    expired_at: 2026-11-30
-
-  # Declared in the SPDX manifest that ships inside PowerShell's MicrosoftTeams module
-  # (Modules/MicrosoftTeams/7.9.0/_manifest/spdx_2.2/manifest.spdx.json). Trivy reads that
-  # SBOM and reports what it declares, which is not the same as what the image contains:
-  # there is no Node runtime and no node_modules anywhere in the image, and the .NET
-  # assemblies target net472, a Windows-only framework. Nothing here is reachable, and none
-  # of it is a dependency we declare -- only Microsoft can change the module's contents.
-  - id: CVE-2020-0606
-    purls:
-      - "pkg:nuget/Microsoft.WindowsDesktop.App.Ref"
-    expired_at: 2027-01-31
-  - id: CVE-2019-0820
-    purls:
-      - "pkg:nuget/System.Text.RegularExpressions"
-    expired_at: 2027-01-31
-  - id: CVE-2026-47302
-    purls:
-      - "pkg:nuget/System.Security.Cryptography.Xml"
-    expired_at: 2027-01-31
-  - id: CVE-2026-47304
-    purls:
-      - "pkg:nuget/System.Security.Cryptography.Xml"
-    expired_at: 2027-01-31
-  - id: CVE-2026-50525
-    purls:
-      - "pkg:nuget/System.Security.Cryptography.Xml"
-    expired_at: 2027-01-31
-  - id: CVE-2026-50527
-    purls:
-      - "pkg:nuget/System.Security.Cryptography.Xml"
-    expired_at: 2027-01-31
-  - id: CVE-2026-50648
-    purls:
-      - "pkg:nuget/System.Security.Cryptography.Xml"
-    expired_at: 2027-01-31
-  - id: CVE-2026-13676
-    purls:
-      - "pkg:npm/fast-uri"
-    expired_at: 2027-01-31
-  - id: CVE-2026-16221
-    purls:
-      - "pkg:npm/fast-uri"
-    expired_at: 2027-01-31
-  - id: CVE-2026-18446
-    purls:
-      - "pkg:npm/fast-uri"
-    expired_at: 2027-01-31
-  - id: CVE-2026-75899
-    purls:
-      - "pkg:npm/fast-uri"
-    expired_at: 2027-01-31
-  - id: CVE-2026-75975
-    purls:
-      - "pkg:npm/fast-uri"
-    expired_at: 2027-01-31
-  - id: CVE-2026-76172
-    purls:
-      - "pkg:npm/fast-uri"
-    expired_at: 2027-01-31
-  - id: CVE-2026-75931
-    purls:
-      - "pkg:npm/fast-uri"
-    expired_at: 2027-01-31
-  - id: CVE-2026-69192
-    purls:
-      - "pkg:npm/ip-address"
-    expired_at: 2027-01-31
-
-  # CVE-2026-84304 is a DoS in grpc-go <= 1.83.0: a peer fragments a gRPC stream into
-  # millions of tiny HTTP/2 DATA frames until the receiver runs out of heap. Fixed in
-  # 1.83.1 (published 2026-09-01). Trivy 0.74.0, the latest published release and the
-  # version the images ship, pins 1.82.1 as an indirect dependency:
-  # https://github.com/aquasecurity/trivy/blob/v0.74.0/go.mod
-  # Upstream bump still open: https://github.com/aquasecurity/trivy/pull/11176
-  # Trivy only speaks gRPC in client/server mode (`trivy server`, `--server`). Prowler
-  # invokes it exclusively as `trivy image` and `trivy fs` on a local path, so no gRPC
-  # listener or connection ever exists in the image and the affected path is not
-  # reachable. Remove this temporary suppression as soon as a Trivy release pins
-  # grpc >= 1.83.1.
-  - id: CVE-2026-84304
-    purls:
-      - "pkg:golang/google.golang.org/grpc"
-    expired_at: 2026-10-15
-
-  # CVE-2026-84445 is a DoS in grpc-go servers built with `xds.NewGRPCServer()`: a request
-  # carrying neither `:authority` nor `Host` reaches the xDS routing interceptor, which
-  # indexes an empty slice of authorities and panics. The per-RPC goroutine does not
-  # recover, so the whole server process dies. Fixed in 1.82.2 and 1.83.2 (published
-  # 2026-09-08). Trivy 0.74.0, the latest published release and the version the images
-  # ship, pins 1.82.1 as an indirect dependency:
-  # https://github.com/aquasecurity/trivy/blob/v0.74.0/go.mod
-  # Trivy main already carries 1.83.2, but no published release includes it yet.
-  # The reachability argument is the one made for CVE-2026-84304 above, only narrower:
-  # this panic needs an xDS-managed gRPC server. Prowler invokes Trivy exclusively as
-  # `trivy image` and `trivy fs` on a local path, never `trivy server`, so the image runs
-  # no gRPC server at all, xDS or otherwise. Remove this temporary suppression as soon as
-  # a Trivy release pins grpc >= 1.83.2.
-  # https://github.com/advisories/GHSA-2v4p-qf9q-27wj
-  - id: CVE-2026-84445
-    purls:
-      - "pkg:golang/google.golang.org/grpc@v1.82.1"
-    expired_at: 2026-10-15
-
-  # CVE-2026-56855 and CVE-2026-78662 are DoS deadlocks in x/crypto/ssh: a malicious peer
-  # can flood or misuse channel messages (RFC 4254) to block the whole connection.
-  # Fixed in golang.org/x/crypto v0.56.0 (published 2026-09-02). Trivy 0.74.0, the latest
-  # published release and the version the images ship, still pins v0.55.0, and Trivy main
-  # has not bumped it either:
-  # https://github.com/aquasecurity/trivy/blob/v0.74.0/go.mod
-  # x/crypto/ssh is pulled in transitively through go-git's ssh transport, the same
-  # dependency chain as the CVE-2026-71556 entry above. Prowler invokes Trivy only with
-  # `fs` on an existing local path or with `image`; it never asks Trivy to clone over SSH
-  # or to run `trivy server`, so no SSH connection -- as client or server -- ever exists in
-  # the image and the affected code path is not reachable. Remove this temporary
-  # suppression as soon as a fixed Trivy release is available.
-  - id: CVE-2026-56855
-    purls:
-      - "pkg:golang/golang.org/x/crypto@v0.55.0"
-    expired_at: 2026-10-15
-  - id: CVE-2026-78662
-    purls:
-      - "pkg:golang/golang.org/x/crypto@v0.55.0"
-    expired_at: 2026-10-15
-
-  - id: CVE-2026-56852
-    purls:
-      - "pkg:golang/golang.org/x/text"
-    expired_at: 2026-12-31
-  - id: GHSA-hrxh-6v49-42gf
-    purls:
-      - "pkg:golang/google.golang.org/grpc"
-    expired_at: 2026-12-31
-  - id: CVE-2026-50151
-    purls:
-      - "pkg:golang/oras.land/oras-go/v2"
-    expired_at: 2026-12-31
-  - id: CVE-2026-50163
-    purls:
-      - "pkg:golang/oras.land/oras-go/v2"
-    expired_at: 2026-12-31

Dockerfile

@@ -3,44 +3,21 @@ FROM python:3.12.13-slim-trixie@sha256:57cd7c3a7a273101a6485ba99423ee56815788280
 LABEL maintainer="https://github.com/prowler-cloud/prowler"
 LABEL org.opencontainers.image.source="https://github.com/prowler-cloud/prowler"
 
-ARG POWERSHELL_VERSION=7.5.11
+ARG POWERSHELL_VERSION=7.5.9
 ENV POWERSHELL_VERSION=${POWERSHELL_VERSION}
 # Opt out of PowerShell telemetry (Application Insights -> dc.services.visualstudio.com)
 ENV POWERSHELL_TELEMETRY_OPTOUT=1
 
-ARG TRIVY_VERSION=0.74.0
+ARG TRIVY_VERSION=0.72.0
 ENV TRIVY_VERSION=${TRIVY_VERSION}
 
 ARG ZIZMOR_VERSION=1.24.1
 ENV ZIZMOR_VERSION=${ZIZMOR_VERSION}
 
-# Pinned here, not fetched with the artefact: a compromised release ships its own checksum.
-ARG TRIVY_SHA256_AMD64=2ae6fe3ee734b7fdf11335663e18c75ea12dccc76062f09f164a3b0f8be4371a
-ARG TRIVY_SHA256_ARM64=b94ce1976bbf3c15b514b605ee88be7c6d94a29be2302847ff01cb794d47aad5
-ARG POWERSHELL_SHA256_AMD64=82a8b13d92b0f3ae48e56cf2f3f7961679371736ca90145ca71617c2913ba9d8
-ARG POWERSHELL_SHA256_ARM64=830ebda118c731ece3fa7e6b7e8573a21346387cbbca5b2f5e3b9bfe24f96672
-ARG ZIZMOR_SHA256_AMD64=a8000f3c683319a523d3b20df0e75457ba591f049cfcbfa98966631b56733c03
-ARG ZIZMOR_SHA256_ARM64=d66e37ef8a375fb07939c630ebf9709a6e0f20242bdc3faf672a7ed97e0b768d
-
-# High CVEs fixed in Debian trixie but not yet in the pinned base image:
-#   openssl/libssl3t64/openssl-provider-legacy 3.5.7-1~deb13u2  CVE-2026-14456,
-#   -14457, -18798, -54874, -63072, -63073, -63074, -63075, -63076, -75803
-#   libsqlite3-0 3.46.1-7+deb13u2  CVE-2026-11822, -11824
-#   gzip 1.13-1+deb13u1  CVE-2026-41992
-#   perl-base 5.40.1-6+deb13u1  CVE-2026-42497, -48962, -57432
-#   libssh2-1t64 1.11.1-1+deb13u2  CVE-2026-58050
-#   libpcre2-8-0 10.46-1~deb13u2  CVE-2026-86145, -89161
-# Taken as a targeted --only-upgrade rather than by moving the digest: the newest
-# published python:3.12-slim-trixie carries the same vulnerable versions. The three
-# openssl packages are flagged separately, so all are named.
-# Drop each one once the base image ships its fixed version.
 # hadolint ignore=DL3008
 RUN apt-get update && apt-get install -y --no-install-recommends \
     wget libicu76 libunwind8 libssl3 libcurl4 ca-certificates apt-transport-https gnupg \
     build-essential pkg-config libzstd-dev zlib1g-dev \
-    && apt-get install -y --no-install-recommends --only-upgrade \
-       util-linux libssl3t64 openssl openssl-provider-legacy \
-       libsqlite3-0 gzip perl-base libssh2-1t64 libpcre2-8-0 \
     && rm -rf /var/lib/apt/lists/*
 
 # Install PowerShell
@@ -52,9 +29,6 @@ RUN ARCH=$(uname -m) && \
     else \
         echo "Unsupported architecture: $ARCH" && exit 1 ; \
     fi && \
-    if [ "$ARCH" = "x86_64" ]; then EXPECT="$POWERSHELL_SHA256_AMD64" ; else EXPECT="$POWERSHELL_SHA256_ARM64" ; fi && \
-    echo "$EXPECT  /tmp/powershell.tar.gz" > /tmp/powershell.sha256 && \
-    sha256sum -c /tmp/powershell.sha256 && rm /tmp/powershell.sha256 && \
     mkdir -p /opt/microsoft/powershell/7 && \
     tar zxf /tmp/powershell.tar.gz -C /opt/microsoft/powershell/7 && \
     chmod +x /opt/microsoft/powershell/7/pwsh && \
@@ -71,9 +45,6 @@ RUN ARCH=$(uname -m) && \
         echo "Unsupported architecture for Trivy: $ARCH" && exit 1 ; \
     fi && \
     wget --progress=dot:giga "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_${TRIVY_ARCH}.tar.gz" -O /tmp/trivy.tar.gz && \
-    if [ "$ARCH" = "x86_64" ]; then EXPECT="$TRIVY_SHA256_AMD64" ; else EXPECT="$TRIVY_SHA256_ARM64" ; fi && \
-    echo "$EXPECT  /tmp/trivy.tar.gz" > /tmp/trivy.sha256 && \
-    sha256sum -c /tmp/trivy.sha256 && rm /tmp/trivy.sha256 && \
     tar zxf /tmp/trivy.tar.gz -C /tmp && \
     mv /tmp/trivy /usr/local/bin/trivy && \
     chmod +x /usr/local/bin/trivy && \
@@ -92,9 +63,6 @@ RUN ARCH=$(uname -m) && \
         echo "Unsupported architecture for zizmor: $ARCH" && exit 1 ; \
     fi && \
     wget --progress=dot:giga "https://github.com/zizmorcore/zizmor/releases/download/v${ZIZMOR_VERSION}/zizmor-${ZIZMOR_ARCH}.tar.gz" -O /tmp/zizmor.tar.gz && \
-    if [ "$ARCH" = "x86_64" ]; then EXPECT="$ZIZMOR_SHA256_AMD64" ; else EXPECT="$ZIZMOR_SHA256_ARM64" ; fi && \
-    echo "$EXPECT  /tmp/zizmor.tar.gz" > /tmp/zizmor.sha256 && \
-    sha256sum -c /tmp/zizmor.sha256 && rm /tmp/zizmor.sha256 && \
     mkdir -p /tmp/zizmor-extract && \
     tar zxf /tmp/zizmor.tar.gz -C /tmp/zizmor-extract && \
     mv /tmp/zizmor-extract/zizmor /usr/local/bin/zizmor && \

Makefile

@@ -34,9 +34,6 @@ test:   ## Test with pytest
 	rm -rf .coverage && \
 	pytest -n auto -vvv -s --cov=./prowler --cov-report=xml tests
 
-test-mcp: ## Test MCP server with pytest (mirrors CI)
-	cd mcp_server && uv run pytest --cov=./prowler_mcp_server --cov-report=term-missing tests
-
 coverage: ## Show Test Coverage
 	coverage run --skip-covered -m pytest -v && \
 	coverage report -m && \

README.md

@@ -126,12 +126,12 @@ Every AWS provider scan will enqueue an Attack Paths ingestion job automatically
 
 | Provider | Checks | Services | [Compliance Frameworks](https://docs.prowler.com/user-guide/compliance/tutorials/compliance) | [Categories](https://docs.prowler.com/user-guide/cli/tutorials/misc#categories) | Support | Interface |
 |---|---|---|---|---|---|---|
-| AWS | 639 | 86 | 47 | 19 | Official | UI, API, CLI |
+| AWS | 621 | 86 | 47 | 19 | Official | UI, API, CLI |
 | Azure | 191 | 22 | 21 | 16 | Official | UI, API, CLI |
 | GCP | 109 | 20 | 19 | 12 | Official | UI, API, CLI |
 | Kubernetes | 92 | 7 | 8 | 11 | Official | UI, API, CLI |
 | GitHub | 24 | 3 | 2 | 5 | Official | UI, API, CLI |
-| M365 | 143 | 10 | 6 | 10 | Official | UI, API, CLI |
+| M365 | 111 | 10 | 6 | 10 | Official | UI, API, CLI |
 | OCI | 52 | 14 | 5 | 10 | Official | UI, API, CLI |
 | Alibaba Cloud | 63 | 9 | 6 | 9 | Official | UI, API, CLI |
 | Cloudflare | 29 | 3 | 2 | 5 | Official | UI, API, CLI |
@@ -139,7 +139,7 @@ Every AWS provider scan will enqueue an Attack Paths ingestion job automatically
 | MongoDB Atlas | 10 | 3 | 1 | 8 | Official | UI, API, CLI |
 | LLM | [See `promptfoo` docs.](https://www.promptfoo.dev/docs/red-team/plugins/) | N/A | N/A | N/A | Official | CLI |
 | Image | N/A | N/A | N/A | N/A | Official | UI, API, CLI |
-| Google Workspace | 65 | 11 | 4 | 6 | Official | UI, API, CLI |
+| Google Workspace | 65 | 11 | 3 | 6 | Official | UI, API, CLI |
 | OpenStack | 34 | 5 | 1 | 9 | Official | UI, API, CLI |
 | Vercel | 26 | 6 | 1 | 8 | Official | UI, API, CLI |
 | Okta | 29 | 8 | 2 | 2 | Official | UI, API, CLI |
@@ -147,7 +147,7 @@ Every AWS provider scan will enqueue an Attack Paths ingestion job automatically
 | Huawei Cloud [Contact us](https://prowler.com/contact) | 25 | 10 | 1 | 6 | Unofficial | CLI |
 | E2E Networks [Contact us](https://prowler.com/contact) | 27 | 6 | 0 | 2 | Unofficial | CLI |
 | Scaleway [Contact us](https://prowler.com/contact) | 1 | 1 | 1 | 1 | Unofficial | CLI |
-| StackIT [Contact us](https://prowler.com/contact) | 8 | 2 | 1 | 3 | Unofficial | CLI |
+| StackIT [Contact us](https://prowler.com/contact) | 7 | 2 | 1 | 3 | Unofficial | CLI |
 | NHN | 6 | 2 | 2 | 0 | Unofficial | CLI |
 
 > [!Note]

api/.env.example

@@ -59,9 +59,5 @@ DJANGO_GITHUB_OAUTH_CLIENT_ID=""
 DJANGO_GITHUB_OAUTH_CLIENT_SECRET=""
 DJANGO_GITHUB_OAUTH_CALLBACK_URL=""
 
-# Public base URL of the Prowler UI, used to link Jira issues back to findings.
-# Leave empty to omit the link.
-DJANGO_UI_BASE_URL=""
-
 # Deletion Task Batch Size
 DJANGO_DELETION_BATCH_SIZE=5000

api/CHANGELOG.md

@@ -4,95 +4,6 @@ All notable changes to the **Prowler API** are documented in this file.
 
 <!-- changelog: release notes start -->
 
-## [1.43.0] (Prowler v5.42.0)
-
-### 🔄 Changed
-
-- Speed up compliance overview ingestion by reading ThreatScore mappings from the compliance template instead of each finding, generating time-ordered `uuid7` row ids and grouping inserted rows by framework and requirement [(#12738)](https://github.com/prowler-cloud/prowler/pull/12738)
-
----
-
-## [1.42.0] (Prowler v5.41.0)
-
-### 🚀 Added
-
-- Jira issues created from Prowler Cloud now carry the `prowler`, `prowler-<provider>`, `prowler-<severity>`, `prowler-<check-id>`, and `prowler-finding-<finding-uid>` labels, a link back to the finding when `DJANGO_UI_BASE_URL` is configured, and the tenant name [(#12540)](https://github.com/prowler-cloud/prowler/pull/12540)
-
-### 🐞 Fixed
-
-- `POST /api/v1/mute-rules` now updates only each affected provider's latest completed scan and future scans, preventing historical reaggregation from flooding Celery queues [(#12681)](https://github.com/prowler-cloud/prowler/pull/12681)
-
----
-
-## [1.41.0] (Prowler v5.40.0)
-
-### 🐞 Fixed
-
-- `FINDINGS_TABLE_PARTITION_MAX_AGE_MONTHS` is now applied in months instead of days, and negative values are rejected [(#12580)](https://github.com/prowler-cloud/prowler/pull/12580)
-
-### 🔐 Security
-
-- `sqlparse` upgraded to 0.6.0, patching CVE-2026-54284, CVE-2026-59893, and CVE-2026-71491 [(#12509)](https://github.com/prowler-cloud/prowler/pull/12509)
-- `openssl`, `libssl3t64` and `openssl-provider-legacy` upgraded to 3.5.7-1~deb13u2 in the API container image, patching ten high OpenSSL CVEs [(#12549)](https://github.com/prowler-cloud/prowler/pull/12549)
-
----
-
-## [1.40.1] (Prowler v5.39.1)
-
-### 🔄 Changed
-
-- Bump alibabacloud-tea-openapi to 0.4.6, oci to 2.184.1 and pyopenssl to 26.4.0 to match the SDK; the cryptography override now names its actual blockers (azure-cli-core pins msal below 1.37, workos 8.3.0 requires cryptography 48) [(#12477)](https://github.com/prowler-cloud/prowler/pull/12477)
-
-### 🐞 Fixed
-
-- Pin zstd to 1.5.7.2; 1.5.7.3 was yanked from PyPI as not thread safe [(#12477)](https://github.com/prowler-cloud/prowler/pull/12477)
-
-### 🔐 Security
-
-- Trivy from v0.72.0 to v0.73.0 in the container image, fixing HIGH CVE-2026-46600 in the bundled `golang.org/x/net` [(#12445)](https://github.com/prowler-cloud/prowler/pull/12445)
-- Trivy v0.74.0 and Debian util-linux 2.41.5-0+deb13u1 in the API container image, patching Go standard library vulnerabilities and CVE-2026-53615 [(#12470)](https://github.com/prowler-cloud/prowler/pull/12470)
-
----
-
-## [1.40.0] (Prowler v5.39.0)
-
-### 🔄 Changed
-
-- `GET /api/v1/users/me` membership relationships identify the active tenant with `meta.active` for JWT and API key authentication [(#12388)](https://github.com/prowler-cloud/prowler/pull/12388)
-
-### 🐞 Fixed
-
-- Tenant deletion no longer leaves memberships partially removed when exclusive-user cleanup fails [(#12379)](https://github.com/prowler-cloud/prowler/pull/12379)
-- `/api/v1/accounts/saml/{organization_slug}/acs/` rejects non-POST requests before SAML response processing [(#12393)](https://github.com/prowler-cloud/prowler/pull/12393)
-- Social login derives a valid user name when identity providers omit the profile name [(#12413)](https://github.com/prowler-cloud/prowler/pull/12413)
-
----
-
-## [1.39.0] (Prowler v5.38.0)
-
-### 🚀 Added
-
-- Attack Paths adds 20 AWS privilege-escalation detection queries from pathfinding.cloud, covering service PassRole escalations (Batch, Braket, Cognito Identity, ECS, EMR, EMR Serverless, GameLift, Glue, EC2 Image Builder, Kinesis Analytics, HealthOmics, EventBridge Scheduler, SSM, Step Functions), CodeDeploy and Step Functions existing-resource abuse, role permissions-boundary removal with role assumption, and IAM Identity Center permission-set policy injection [(#12237)](https://github.com/prowler-cloud/prowler/pull/12237)
-- Attack Paths query metadata now carries an outcome (Code execution, Privilege escalation, Public exposure, or Resource inventory), exposed on the queries endpoint so the graph can show a terminal outcome node [(#12344)](https://github.com/prowler-cloud/prowler/pull/12344)
-- Container images now ship an SBOM and build provenance as OCI attestations [(#12352)](https://github.com/prowler-cloud/prowler/pull/12352)
-
-### 🔄 Changed
-
-- Pin the container vulnerability scanner to Trivy v0.72.0, matching prowler-registry and partner-portal [(#12346)](https://github.com/prowler-cloud/prowler/pull/12346)
-
-### 🐞 Fixed
-
-- Compliance report output directory failures are now logged with the exception attached and fingerprinted by `errno` in Sentry, so `ENOSPC`, `ENOENT` and `EACCES` no longer share a single issue [(#12142)](https://github.com/prowler-cloud/prowler/pull/12142)
-- Restored the SDK dependency to `@master` now that the dependency bumps have landed there, and regenerated the lock. The API image no longer builds against a temporary integration branch [(#12309)](https://github.com/prowler-cloud/prowler/pull/12309)
-
-### 🔐 Security
-
-- The API container image now verifies the checksum of every third-party binary it downloads (PowerShell, Trivy, zizmor) before installing it [(#12334)](https://github.com/prowler-cloud/prowler/pull/12334)
-- Upgrade aiohttp to 3.14.3 to pick up the fix for CVE-2026-69244 [(#12340)](https://github.com/prowler-cloud/prowler/pull/12340)
-- Upgrade cryptography to 50.0.0, closing CVE-2026-69247 and CVE-2026-69249 [(#12356)](https://github.com/prowler-cloud/prowler/pull/12356)
-
----
-
 ## [1.38.1] (Prowler v5.37.1)
 
 ### 🐞 Fixed

api/Dockerfile

@@ -2,37 +2,17 @@ FROM python:3.12.13-slim-trixie@sha256:57cd7c3a7a273101a6485ba99423ee56815788280
 
 LABEL maintainer="https://github.com/prowler-cloud/api"
 
-ARG POWERSHELL_VERSION=7.5.11
+ARG POWERSHELL_VERSION=7.5.9
 ENV POWERSHELL_VERSION=${POWERSHELL_VERSION}
 # Opt out of PowerShell telemetry (Application Insights -> dc.services.visualstudio.com)
 ENV POWERSHELL_TELEMETRY_OPTOUT=1
 
-ARG TRIVY_VERSION=0.74.0
+ARG TRIVY_VERSION=0.72.0
 ENV TRIVY_VERSION=${TRIVY_VERSION}
 
 ARG ZIZMOR_VERSION=1.24.1
 ENV ZIZMOR_VERSION=${ZIZMOR_VERSION}
 
-# Pinned here, not fetched with the artefact: a compromised release ships its own checksum.
-ARG TRIVY_SHA256_AMD64=2ae6fe3ee734b7fdf11335663e18c75ea12dccc76062f09f164a3b0f8be4371a
-ARG TRIVY_SHA256_ARM64=b94ce1976bbf3c15b514b605ee88be7c6d94a29be2302847ff01cb794d47aad5
-ARG POWERSHELL_SHA256_AMD64=82a8b13d92b0f3ae48e56cf2f3f7961679371736ca90145ca71617c2913ba9d8
-ARG POWERSHELL_SHA256_ARM64=830ebda118c731ece3fa7e6b7e8573a21346387cbbca5b2f5e3b9bfe24f96672
-ARG ZIZMOR_SHA256_AMD64=a8000f3c683319a523d3b20df0e75457ba591f049cfcbfa98966631b56733c03
-ARG ZIZMOR_SHA256_ARM64=d66e37ef8a375fb07939c630ebf9709a6e0f20242bdc3faf672a7ed97e0b768d
-
-# High CVEs fixed in Debian trixie but not yet in the pinned base image:
-#   openssl/libssl3t64/openssl-provider-legacy 3.5.7-1~deb13u2  CVE-2026-14456,
-#   -14457, -18798, -54874, -63072, -63073, -63074, -63075, -63076, -75803
-#   libsqlite3-0 3.46.1-7+deb13u2  CVE-2026-11822, -11824
-#   gzip 1.13-1+deb13u1  CVE-2026-41992
-#   perl-base 5.40.1-6+deb13u1  CVE-2026-42497, -48962, -57432
-#   libssh2-1t64 1.11.1-1+deb13u2  CVE-2026-58050
-#   libpcre2-8-0 10.46-1~deb13u2  CVE-2026-86145, -89161
-# Taken as a targeted --only-upgrade rather than by moving the digest: the newest
-# published python:3.12-slim-trixie carries the same vulnerable versions. The three
-# openssl packages are flagged separately, so all are named.
-# Drop each one once the base image ships its fixed version.
 # hadolint ignore=DL3008
 RUN apt-get update && apt-get install -y --no-install-recommends \
     wget \
@@ -48,9 +28,6 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     libtool \
     libxslt1-dev \
     python3-dev \
-    && apt-get install -y --no-install-recommends --only-upgrade \
-       util-linux libssl3t64 openssl openssl-provider-legacy \
-       libsqlite3-0 gzip perl-base libssh2-1t64 libpcre2-8-0 \
     && rm -rf /var/lib/apt/lists/*
 
 # Install PowerShell
@@ -62,9 +39,6 @@ RUN ARCH=$(uname -m) && \
     else \
         echo "Unsupported architecture: $ARCH" && exit 1 ; \
     fi && \
-    if [ "$ARCH" = "x86_64" ]; then EXPECT="$POWERSHELL_SHA256_AMD64" ; else EXPECT="$POWERSHELL_SHA256_ARM64" ; fi && \
-    echo "$EXPECT  /tmp/powershell.tar.gz" > /tmp/powershell.sha256 && \
-    sha256sum -c /tmp/powershell.sha256 && rm /tmp/powershell.sha256 && \
     mkdir -p /opt/microsoft/powershell/7 && \
     tar zxf /tmp/powershell.tar.gz -C /opt/microsoft/powershell/7 && \
     chmod +x /opt/microsoft/powershell/7/pwsh && \
@@ -81,9 +55,6 @@ RUN ARCH=$(uname -m) && \
         echo "Unsupported architecture for Trivy: $ARCH" && exit 1 ; \
     fi && \
     wget --progress=dot:giga "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_${TRIVY_ARCH}.tar.gz" -O /tmp/trivy.tar.gz && \
-    if [ "$ARCH" = "x86_64" ]; then EXPECT="$TRIVY_SHA256_AMD64" ; else EXPECT="$TRIVY_SHA256_ARM64" ; fi && \
-    echo "$EXPECT  /tmp/trivy.tar.gz" > /tmp/trivy.sha256 && \
-    sha256sum -c /tmp/trivy.sha256 && rm /tmp/trivy.sha256 && \
     tar zxf /tmp/trivy.tar.gz -C /tmp && \
     mv /tmp/trivy /usr/local/bin/trivy && \
     chmod +x /usr/local/bin/trivy && \
@@ -102,9 +73,6 @@ RUN ARCH=$(uname -m) && \
         echo "Unsupported architecture for zizmor: $ARCH" && exit 1 ; \
     fi && \
     wget --progress=dot:giga "https://github.com/zizmorcore/zizmor/releases/download/v${ZIZMOR_VERSION}/zizmor-${ZIZMOR_ARCH}.tar.gz" -O /tmp/zizmor.tar.gz && \
-    if [ "$ARCH" = "x86_64" ]; then EXPECT="$ZIZMOR_SHA256_AMD64" ; else EXPECT="$ZIZMOR_SHA256_ARM64" ; fi && \
-    echo "$EXPECT  /tmp/zizmor.tar.gz" > /tmp/zizmor.sha256 && \
-    sha256sum -c /tmp/zizmor.sha256 && rm /tmp/zizmor.sha256 && \
     mkdir -p /tmp/zizmor-extract && \
     tar zxf /tmp/zizmor.tar.gz -C /tmp/zizmor-extract && \
     mv /tmp/zizmor-extract/zizmor /usr/local/bin/zizmor && \

api/changelog.d/api-anyio-cve-2026-63374.security.md

@@ -1 +0,0 @@
-Bumped `anyio` to 4.14.2 to resolve CVE-2026-63374

api/changelog.d/api-image-debian-cves.security.md

@@ -1 +0,0 @@
-`libsqlite3-0`, `gzip`, `perl-base` and `libpcre2-8-0` upgraded in the API container image, patching high Debian CVEs

api/changelog.d/api-image-powershell-dotnet-cve.security.md

@@ -1 +0,0 @@
-PowerShell from 7.5.9 to 7.5.11 in the API container image, bundling .NET runtime 9.0.20 and patching CVE-2026-62901

api/changelog.d/lapsed-invitations-block-re-invites.fixed.md

@@ -1 +0,0 @@
-Lapsed pending invitations are reported as expired and no longer block a new invitation for the same email

api/pyproject.toml

@@ -45,7 +45,7 @@ dependencies = [
   "gunicorn==26.0.0",
   "uvloop==0.22.1",
   "lxml==6.1.0",
-  "prowler @ git+https://github.com/prowler-cloud/prowler.git@v5.42",
+  "prowler @ git+https://github.com/prowler-cloud/prowler.git@v5.37",
   "psycopg2-binary==2.9.9",
   "pytest-celery[redis] (==1.3.0)",
   "sentry-sdk[django] (==2.56.0)",
@@ -61,7 +61,7 @@ dependencies = [
   "cartography (==0.138.1)",
   "gevent (==25.9.1)",
   "werkzeug (==3.1.7)",
-  "sqlparse (==0.6.0)",
+  "sqlparse (==0.5.5)",
   "fonttools (==4.62.1)",
   "uvicorn-worker (==0.4.0)"
 ]
@@ -71,7 +71,7 @@ name = "prowler-api"
 package-mode = false
 # Needed for the SDK compatibility
 requires-python = ">=3.11,<3.13"
-version = "1.43.1"
+version = "1.38.1"
 
 # Shared ruff baseline (kept in sync with mcp_server/pyproject.toml).
 # target-version tracks this project's lowest supported Python.
@@ -92,7 +92,8 @@ extend-select = [
 
 [tool.uv]
 # Transitive pins matching master to avoid silent drift; bump deliberately.
-# workos is api-only; pyopenssl matches master (PROWLER-2310).
+# workos and pyopenssl run ahead of master: the versions master pins cap cryptography
+# below 48, so both were bumped to versions that allow it (PROWLER-2310).
 constraint-dependencies = [
   "about-time==4.2.1",
   "adal==1.2.7",
@@ -100,7 +101,7 @@ constraint-dependencies = [
   "aiobotocore==2.25.1",
   "aiofiles==24.1.0",
   "aiohappyeyeballs==2.6.1",
-  "aiohttp==3.14.3",
+  "aiohttp==3.14.0",
   "aioitertools==0.13.0",
   "aiosignal==1.4.0",
   "alibabacloud-actiontrail20200706==2.4.1",
@@ -129,7 +130,7 @@ constraint-dependencies = [
   "alibabacloud-sls20201230==5.9.0",
   "alibabacloud-sts20150401==1.1.6",
   "alibabacloud-tea==0.4.3",
-  "alibabacloud-tea-openapi==0.4.6",
+  "alibabacloud-tea-openapi==0.4.5",
   "alibabacloud-tea-util==0.3.14",
   "alibabacloud-tea-xml==0.0.3",
   "alibabacloud-vpc20160428==6.13.0",
@@ -137,7 +138,7 @@ constraint-dependencies = [
   "aliyun-log-fastpb==0.2.0",
   "amqp==5.3.1",
   "annotated-types==0.7.0",
-  "anyio==4.14.2",
+  "anyio==4.12.1",
   "applicationinsights==0.11.10",
   "apscheduler==3.11.2",
   "argcomplete==3.5.3",
@@ -211,7 +212,7 @@ constraint-dependencies = [
   "coverage==7.5.4",
   "cron-descriptor==1.4.5",
   "crowdstrike-falconpy==1.6.0",
-  "cryptography==50.0.0",
+  "cryptography==48.0.1",
   "cycler==0.12.1",
   "darabonba-core==1.0.8",
   "dash==3.1.1",
@@ -338,7 +339,7 @@ constraint-dependencies = [
   "nltk==3.9.4",
   "numpy==2.2.6",
   "oauthlib==3.3.1",
-  "oci==2.184.1",
+  "oci==2.183.0",
   "openai==1.109.1",
   "openstacksdk==4.2.0",
   "opentelemetry-api==1.39.1",
@@ -379,7 +380,7 @@ constraint-dependencies = [
   "pylint==3.2.5",
   "pymsalruntime==0.18.1",
   "pynacl==1.6.2",
-  "pyopenssl==26.4.0",
+  "pyopenssl==26.2.0",
   "pyparsing==3.3.2",
   "pyreadline3==3.5.4",
   "pysocks==1.7.1",
@@ -423,7 +424,7 @@ constraint-dependencies = [
   "six==1.17.0",
   "slack-sdk==3.39.0",
   "sniffio==1.3.1",
-  "sqlparse==0.6.0",
+  "sqlparse==0.5.5",
   "statsd==4.0.1",
   "std-uritemplate==2.0.8",
   "stevedore==5.6.0",
@@ -457,7 +458,7 @@ constraint-dependencies = [
   "zipp==3.23.0",
   "zope-event==6.1",
   "zope-interface==8.2",
-  "zstd==1.5.7.2"
+  "zstd==1.5.7.3"
 ]
 # prowler@master needs okta==3.4.2, but cartography 0.138.1 requires okta<1.0.0.
 # Attack Paths does not ingest Okta today, so override the Cartography
@@ -484,13 +485,6 @@ constraint-dependencies = [
 # that request pyjwt[crypto] and leave cryptography (needed for RS256) only transitive.
 override-dependencies = [
   "okta==3.4.2",
-  # prowler requires cryptography==50.0.0. Two api-only dependencies still cap it below
-  # 49 and cannot move yet: msal, pinned exactly by azure-cli-core (2.83.0 -> 1.35.0b1,
-  # 2.89.1 -> 1.36.0, both <49; cartography needs azure-cli-core), and workos 8.3.0
-  # (~=48.0; workos 10.1.1+ needs ~=50.0 and is a separate SDK upgrade). This api is
-  # deployed from this lock with `uv sync --locked`, so the override applies to what runs.
-  # Remove when azure-cli-core pins msal>=1.37.0 and workos is on 10.x.
-  "cryptography==50.0.0",
   "azure-mgmt-containerservice==34.1.0",
   "microsoft-kiota-abstractions==1.9.10",
   "microsoft-kiota-authentication-azure==1.9.10",

api/src/backend/api/adapters.py

@@ -12,37 +12,11 @@ from api.models import (
     UserRoleRelationship,
 )
 from api.utils import accept_invitation_for_user
-from django.core.exceptions import ValidationError
 from django.db import transaction
 from django.http import HttpResponseForbidden
 
 
 class ProwlerSocialAccountAdapter(DefaultSocialAccountAdapter):
-    @staticmethod
-    def _get_social_account_name(extra_data: dict, email: str) -> str:
-        name_field = User._meta.get_field("name")
-        for value in (
-            extra_data.get("name"),
-            extra_data.get("login"),
-            extra_data.get("username"),
-            email,
-        ):
-            if not isinstance(value, str):
-                continue
-
-            candidate = value.strip()[: name_field.max_length].rstrip()
-            if not candidate:
-                continue
-
-            try:
-                name_field.run_validators(candidate)
-            except ValidationError:
-                continue
-
-            return candidate
-
-        raise ValueError("Social account does not provide a valid user identity.")
-
     @staticmethod
     def get_user_by_email(email: str):
         try:
@@ -142,8 +116,11 @@ class ProwlerSocialAccountAdapter(DefaultSocialAccountAdapter):
 
             if provider != "saml":
                 # Handle other providers (e.g., GitHub, Google)
-                user.name = self._get_social_account_name(extra, user.email)
                 user.save(using=MainRouter.admin_db)
+                social_account_name = extra.get("name")
+                if social_account_name:
+                    user.name = social_account_name
+                    user.save(using=MainRouter.admin_db)
 
                 invitation_token = self._get_invitation_token(request)
                 if invitation_token:

api/src/backend/api/attack_paths/__init__.py

@@ -1,6 +1,5 @@
 from api.attack_paths.queries import (
     AttackPathsQueryDefinition,
-    AttackPathsQueryOutcome,
     AttackPathsQueryParameterDefinition,
     get_queries_for_provider,
     get_query_by_id,
@@ -8,7 +7,6 @@ from api.attack_paths.queries import (
 
 __all__ = [
     "AttackPathsQueryDefinition",
-    "AttackPathsQueryOutcome",
     "AttackPathsQueryParameterDefinition",
     "get_queries_for_provider",
     "get_query_by_id",

api/src/backend/api/attack_paths/queries/__init__.py

@@ -4,13 +4,11 @@ from api.attack_paths.queries.registry import (
 )
 from api.attack_paths.queries.types import (
     AttackPathsQueryDefinition,
-    AttackPathsQueryOutcome,
     AttackPathsQueryParameterDefinition,
 )
 
 __all__ = [
     "AttackPathsQueryDefinition",
-    "AttackPathsQueryOutcome",
     "AttackPathsQueryParameterDefinition",
     "get_queries_for_provider",
     "get_query_by_id",

api/src/backend/api/attack_paths/queries/types.py

@@ -1,38 +1,4 @@
 from dataclasses import dataclass, field
-from enum import Enum
-
-
-@dataclass(frozen=True)
-class AttackPathsQueryOutcomeMeta:
-    """Display metadata for an outcome kind.
-
-    `label` and `partial` are properties of the outcome *kind*, not of an
-    individual query, so they live here once and every query just references a
-    kind. `partial` marks a latent/posture outcome (e.g. inventory) that the UI
-    renders as a marker rather than a full realized outcome.
-    """
-
-    kind: str
-    label: str
-    partial: bool = False
-
-
-class AttackPathsQueryOutcome(Enum):
-    """The terminal impact an attack-path query leads to.
-
-    Set per query and exposed by the API so the UI can render the graph's
-    terminal outcome node. The taxonomy is shared with Prowler Hub's attack-path
-    diagram (whose terminal labels match these values).
-    """
-
-    CODE_EXECUTION = AttackPathsQueryOutcomeMeta("code_execution", "Code execution")
-    PRIVILEGE_ESCALATION = AttackPathsQueryOutcomeMeta(
-        "privilege_escalation", "Privilege escalation"
-    )
-    PUBLIC_EXPOSURE = AttackPathsQueryOutcomeMeta("public_exposure", "Public exposure")
-    RESOURCE_INVENTORY = AttackPathsQueryOutcomeMeta(
-        "resource_inventory", "Resource inventory", partial=True
-    )
 
 
 @dataclass
@@ -70,5 +36,4 @@ class AttackPathsQueryDefinition:
     provider: str
     cypher: str
     attribution: AttackPathsQueryAttribution | None = None
-    outcome: AttackPathsQueryOutcome | None = None
     parameters: list[AttackPathsQueryParameterDefinition] = field(default_factory=list)

api/src/backend/api/filters.py

@@ -1439,20 +1439,8 @@ class InvitationFilter(FilterSet):
     inserted_at = DateFilter(field_name="inserted_at", lookup_expr="date")
     updated_at = DateFilter(field_name="updated_at", lookup_expr="date")
     expires_at = DateFilter(field_name="expires_at", lookup_expr="date")
-    state = ChoiceFilter(choices=Invitation.State.choices, method="filter_state")
-    state__in = ChoiceInFilter(
-        choices=Invitation.State.choices, lookup_expr="in", method="filter_state_in"
-    )
-
-    def filter_state(self, queryset, name, value):
-        return self.filter_state_in(queryset, name, [value])
-
-    def filter_state_in(self, queryset, name, value):
-        lapsed = Invitation.lapsed_q()
-        query = Q(state__in=value) & ~lapsed
-        if Invitation.State.EXPIRED in value:
-            query |= lapsed
-        return queryset.filter(query)
+    state = ChoiceFilter(choices=Invitation.State.choices)
+    state__in = ChoiceInFilter(choices=Invitation.State.choices, lookup_expr="in")
 
     class Meta:
         model = Invitation

api/src/backend/api/models.py

@@ -1380,15 +1380,6 @@ class Invitation(RowLevelSecurityProtectedModel):
             self.email = self.email.strip().lower()
         super().save(*args, **kwargs)
 
-    @classmethod
-    def lapsed_q(cls):
-        """Pending invitations whose expiry date has already passed."""
-        return Q(state=cls.State.PENDING, expires_at__lte=datetime.now(UTC))
-
-    @property
-    def is_lapsed(self):
-        return self.state == self.State.PENDING and self.expires_at <= datetime.now(UTC)
-
     class Meta(RowLevelSecurityProtectedModel.Meta):
         db_table = "invitations"
 

api/src/backend/api/partitions.py

@@ -6,7 +6,6 @@ from api.rls import RowLevelSecurityConstraint
 from api.uuid_utils import datetime_to_uuid7
 from dateutil.relativedelta import relativedelta
 from django.conf import settings
-from django.core.exceptions import ImproperlyConfigured
 from psqlextra.partitioning import (
     PostgresPartitioningError,
     PostgresPartitioningManager,
@@ -154,17 +153,10 @@ class PostgresUUIDv7PartitioningStrategy(PostgresRangePartitioningStrategy):
         )
 
 
-def relative_months_or_none(value):
-    # A negative value would set the cutoff in the future and delete every
-    # partition, so it is rejected rather than silently ignored.
-    if value is not None and value < 0:
-        raise ImproperlyConfigured(
-            "FINDINGS_TABLE_PARTITION_MAX_AGE_MONTHS must not be negative; "
-            "leave it unset or use 0 to keep partitions indefinitely"
-        )
-    if not value:
+def relative_days_or_none(value):
+    if value is None:
         return None
-    return relativedelta(months=value)
+    return relativedelta(days=value)
 
 
 #
@@ -181,7 +173,7 @@ manager = PostgresPartitioningManager(
                     months=settings.FINDINGS_TABLE_PARTITION_MONTHS
                 ),
                 count=settings.FINDINGS_TABLE_PARTITION_COUNT,
-                max_age=relative_months_or_none(
+                max_age=relative_days_or_none(
                     settings.FINDINGS_TABLE_PARTITION_MAX_AGE_MONTHS
                 ),
                 name_format="%Y_%b",
@@ -197,7 +189,7 @@ manager = PostgresPartitioningManager(
                     months=settings.FINDINGS_TABLE_PARTITION_MONTHS
                 ),
                 count=settings.FINDINGS_TABLE_PARTITION_COUNT,
-                max_age=relative_months_or_none(
+                max_age=relative_days_or_none(
                     settings.FINDINGS_TABLE_PARTITION_MAX_AGE_MONTHS
                 ),
                 name_format="%Y_%b",

api/src/backend/api/specs/v1.yaml

@@ -1,7 +1,7 @@
 openapi: 3.0.3
 info:
   title: Prowler API
-  version: 1.43.1
+  version: 1.38.1
   description: |-
     Prowler API specification.
 

api/src/backend/api/tests/integration/test_authentication.py

@@ -1590,8 +1590,8 @@ class TestAPIKeyMultiTenantWorkflows:
         tenant1 = tenants_fixture[0]
         tenant2 = tenants_fixture[1]
 
-        membership1 = Membership.objects.create(user=user, tenant=tenant1)
-        membership2 = Membership.objects.create(user=user, tenant=tenant2)
+        Membership.objects.create(user=user, tenant=tenant1)
+        Membership.objects.create(user=user, tenant=tenant2)
 
         role1 = Role.objects.create(
             tenant_id=tenant1.id,
@@ -1646,27 +1646,6 @@ class TestAPIKeyMultiTenantWorkflows:
         assert me_response1.json()["data"]["id"] == str(user.id)
         assert me_response2.json()["data"]["id"] == str(user.id)
 
-        memberships1 = {
-            item["id"]: item["meta"]["active"]
-            for item in me_response1.json()["data"]["relationships"]["memberships"][
-                "data"
-            ]
-        }
-        memberships2 = {
-            item["id"]: item["meta"]["active"]
-            for item in me_response2.json()["data"]["relationships"]["memberships"][
-                "data"
-            ]
-        }
-        assert memberships1 == {
-            str(membership1.id): True,
-            str(membership2.id): False,
-        }
-        assert memberships2 == {
-            str(membership1.id): False,
-            str(membership2.id): True,
-        }
-
     def test_api_key_cannot_access_different_tenant_resources(
         self, tenants_fixture, aws_provider
     ):

api/src/backend/api/tests/test_adapters.py

@@ -111,110 +111,6 @@ def _verify_local_email(user):
     )
 
 
-def test_social_account_name_falls_back_to_login_for_blank_name():
-    adapter = ProwlerSocialAccountAdapter()
-
-    name = adapter._get_social_account_name(
-        {"name": "   ", "login": "octocat"},
-        "verified@example.com",
-    )
-
-    assert name == "octocat"
-
-
-@pytest.mark.parametrize("provider_name", [None, "", "   ", 123, ["name"]])
-def test_social_account_name_ignores_unusable_provider_names(provider_name):
-    adapter = ProwlerSocialAccountAdapter()
-
-    name = adapter._get_social_account_name(
-        {"name": provider_name, "login": "octocat"},
-        "verified@example.com",
-    )
-
-    assert name == "octocat"
-
-
-def test_social_account_name_uses_login_when_name_is_missing():
-    adapter = ProwlerSocialAccountAdapter()
-
-    name = adapter._get_social_account_name(
-        {"login": "octocat"},
-        "verified@example.com",
-    )
-
-    assert name == "octocat"
-
-
-def test_social_account_name_falls_back_to_username_then_email():
-    adapter = ProwlerSocialAccountAdapter()
-
-    username_name = adapter._get_social_account_name(
-        {"name": "ab", "login": None, "username": "  monalisa  "},
-        "verified@example.com",
-    )
-    email_name = adapter._get_social_account_name({}, "  verified@example.com  ")
-
-    assert username_name == "monalisa"
-    assert email_name == "verified@example.com"
-
-
-def test_social_account_name_trims_and_limits_provider_name():
-    adapter = ProwlerSocialAccountAdapter()
-    max_length = User._meta.get_field("name").max_length
-
-    trimmed_name = adapter._get_social_account_name(
-        {"name": "  Ada Lovelace  "},
-        "verified@example.com",
-    )
-    limited_name = adapter._get_social_account_name(
-        {"name": "a" * (max_length + 1)},
-        "verified@example.com",
-    )
-
-    assert trimmed_name == "Ada Lovelace"
-    assert limited_name == "a" * max_length
-
-
-def test_social_account_name_rejects_missing_identity():
-    adapter = ProwlerSocialAccountAdapter()
-
-    with pytest.raises(
-        ValueError,
-        match="Social account does not provide a valid user identity",
-    ):
-        adapter._get_social_account_name({}, "")
-
-
-def test_save_user_applies_normalized_social_account_name(rf):
-    adapter = ProwlerSocialAccountAdapter()
-    request = rf.post("/")
-    request.session = {}
-    sociallogin = MagicMock(spec=SocialLogin)
-    sociallogin.provider = MagicMock()
-    sociallogin.provider.id = "github"
-    sociallogin.account = MagicMock()
-    sociallogin.account.extra_data = {"name": None, "login": "  octocat  "}
-    user = User(email="verified@example.com")
-    user.save = MagicMock()
-    invitation = SimpleNamespace(tenant_id="tenant-id")
-
-    with (
-        patch("api.adapters.super") as mock_super,
-        patch("api.adapters.transaction.atomic"),
-        patch("api.adapters.write_db_alias"),
-        patch.object(adapter, "_get_invitation_token", return_value="token"),
-        patch(
-            "api.adapters.accept_invitation_for_user",
-            return_value=(invitation, True),
-        ),
-    ):
-        mock_super.return_value.save_user.return_value = user
-        saved_user = adapter.save_user(request, sociallogin)
-
-    assert saved_user.name == "octocat"
-    assert request.prowler_invitation_token == "token"
-
-
 @pytest.mark.django_db
 class TestProwlerSocialAccountAdapter:
     def test_get_user_by_email_returns_user(self, create_test_user):

api/src/backend/api/tests/test_attack_paths_queries.py

@@ -22,10 +22,7 @@ from api.attack_paths.queries.aws import (
     AWS_STS_PRIVESC_CROSS_ACCOUNT_TRUST,
     AWS_STS_PRIVESC_WILDCARD_TRUST,
 )
-from api.attack_paths.queries.types import (
-    AttackPathsQueryDefinition,
-    AttackPathsQueryOutcome,
-)
+from api.attack_paths.queries.types import AttackPathsQueryDefinition
 
 # The pathfinding.cloud privilege-escalation queries added for PROWLER-2278.
 NEW_PATHFINDING_QUERIES = [
@@ -241,50 +238,6 @@ class TestAllQueriesUniqueIds:
         assert not duplicates, f"Duplicate query IDs found: {duplicates}"
 
 
-class TestQueryOutcomes:
-    """Every query carries a valid outcome (the graph's terminal impact)."""
-
-    def test_every_query_has_an_outcome(self):
-        # Completeness guard: a new query must be given an outcome, so the UI can
-        # always render a terminal outcome node.
-        missing = [q.id for q in AWS_QUERIES if q.outcome is None]
-        assert not missing, f"Queries without an outcome: {missing}"
-
-    def test_every_outcome_is_a_valid_member(self):
-        for query in AWS_QUERIES:
-            assert isinstance(query.outcome, AttackPathsQueryOutcome)
-            assert query.outcome.value.kind
-            assert query.outcome.value.label
-
-    @pytest.mark.parametrize(
-        "query, expected",
-        [
-            (
-                AWS_STS_PRIVESC_CROSS_ACCOUNT_TRUST,
-                AttackPathsQueryOutcome.PRIVILEGE_ESCALATION,
-            ),
-            (
-                AWS_IAM_PRIVESC_DELETE_USER_PERMISSIONS_BOUNDARY,
-                AttackPathsQueryOutcome.PRIVILEGE_ESCALATION,
-            ),
-        ],
-        ids=lambda v: getattr(v, "id", getattr(v, "name", "")),
-    )
-    def test_representative_outcomes(self, query, expected):
-        assert query.outcome is expected
-
-    def test_inventory_outcome_is_partial(self):
-        assert AttackPathsQueryOutcome.RESOURCE_INVENTORY.value.partial is True
-
-    def test_realized_outcomes_are_not_partial(self):
-        for outcome in (
-            AttackPathsQueryOutcome.CODE_EXECUTION,
-            AttackPathsQueryOutcome.PRIVILEGE_ESCALATION,
-            AttackPathsQueryOutcome.PUBLIC_EXPOSURE,
-        ):
-            assert outcome.value.partial is False
-
-
 def _strip_comment_lines(cypher: str) -> str:
     """Drop `//` comment lines so keyword scans ignore prose in comments."""
     return "\n".join(

api/src/backend/api/tests/test_attack_paths_service_privesc_queries.py

@@ -1,133 +0,0 @@
-"""
-Structural validation for the pathfinding.cloud service privilege-escalation
-Attack Paths queries added in PROWLER-2279.
-
-These assert the conventions documented in
-`docs/developer-guide/attack-paths-queries.mdx`: list-typed policy properties are
-reached through `HAS_*` child-item traversals (never read as node fields),
-predicate functions unsupported on Neptune (`any`/`all`/`none`, regex `=~`) are
-absent, the finding probe is typed and filters only on `status`, and the
-`RETURN` shape preserves the `paths, dpf, dpfr` contract.
-"""
-
-import re
-
-import pytest
-from api.attack_paths.queries.aws import AWS_QUERIES
-from api.attack_paths.queries.types import AttackPathsQueryDefinition
-
-# IDs of the queries introduced for PROWLER-2279 (pathfinding.cloud coverage).
-PATHFINDING_2279_QUERY_IDS = [
-    "aws-batch-privesc-passrole-submit-job",
-    "aws-braket-privesc-passrole-create-job",
-    "aws-cognito-privesc-passrole-set-identity-pool-roles",
-    "aws-ecs-privesc-passrole-start-existing-task",
-    "aws-emr-privesc-passrole-run-job-flow",
-    "aws-emrserverless-privesc-passrole-start-job",
-    "aws-gamelift-privesc-passrole-create-fleet",
-    "aws-glue-privesc-passrole-create-session",
-    "aws-imagebuilder-privesc-passrole-create-image",
-    "aws-kinesisanalytics-privesc-passrole-create-application",
-    "aws-omics-privesc-passrole-start-run",
-    "aws-scheduler-privesc-passrole-create-schedule",
-    "aws-ssm-privesc-passrole-automation",
-    "aws-stepfunctions-privesc-passrole-create-state-machine",
-    "aws-batch-privesc-submit-existing-job",
-    "aws-codedeploy-privesc-create-deployment",
-    "aws-stepfunctions-privesc-update-state-machine",
-    "aws-iam-privesc-delete-role-boundary-assume-role",
-    "aws-sso-privesc-attach-managed-policy-permission-set",
-    "aws-sso-privesc-put-inline-policy-permission-set",
-]
-
-_BY_ID = {q.id: q for q in AWS_QUERIES}
-NEW_QUERIES = [_BY_ID[qid] for qid in PATHFINDING_2279_QUERY_IDS if qid in _BY_ID]
-
-NEPTUNE_UNSUPPORTED_PREDICATES = re.compile(r"\b(any|all|none)\s*\(", re.IGNORECASE)
-NORMALIZED_STATEMENT_FIELDS = ("action", "resource", "notaction", "notresource")
-
-
-def test_all_2279_queries_registered():
-    missing = [qid for qid in PATHFINDING_2279_QUERY_IDS if qid not in _BY_ID]
-    assert not missing, f"queries not registered in AWS_QUERIES: {missing}"
-
-
-class TestServicePrivescQuerySchema:
-    @pytest.mark.parametrize("query", NEW_QUERIES, ids=lambda q: q.id)
-    def test_is_query_definition(self, query):
-        assert isinstance(query, AttackPathsQueryDefinition)
-
-    @pytest.mark.parametrize("query", NEW_QUERIES, ids=lambda q: q.id)
-    def test_id_kebab_and_aws_prefixed(self, query):
-        assert query.id.startswith("aws-")
-        assert re.match(r"^[a-z0-9]+(-[a-z0-9]+)*$", query.id)
-
-    @pytest.mark.parametrize("query", NEW_QUERIES, ids=lambda q: q.id)
-    def test_provider_is_aws(self, query):
-        assert query.provider == "aws"
-
-    @pytest.mark.parametrize("query", NEW_QUERIES, ids=lambda q: q.id)
-    def test_has_metadata(self, query):
-        assert query.name and len(query.name) > 5
-        assert query.short_description and len(query.short_description) > 10
-        assert query.description and len(query.description) > 20
-        assert isinstance(query.parameters, list)
-
-    @pytest.mark.parametrize("query", NEW_QUERIES, ids=lambda q: q.id)
-    def test_attribution_links_pathfinding(self, query):
-        assert query.attribution is not None
-        assert "pathfinding.cloud" in query.attribution.text
-        assert query.attribution.link.startswith("https://pathfinding.cloud/paths/")
-
-
-class TestServicePrivescQueryCypher:
-    @pytest.mark.parametrize("query", NEW_QUERIES, ids=lambda q: q.id)
-    def test_anchored_and_provider_scoped(self, query):
-        assert "(aws:AWSAccount {id: $provider_uid})" in query.cypher
-
-    @pytest.mark.parametrize("query", NEW_QUERIES, ids=lambda q: q.id)
-    def test_finding_label_interpolated(self, query):
-        assert "PROWLER_FINDING_LABEL" not in query.cypher
-
-    @pytest.mark.parametrize("query", NEW_QUERIES, ids=lambda q: q.id)
-    def test_typed_status_scoped_finding_probe(self, query):
-        assert re.search(
-            r"-\[pfr:HAS_FINDING\]-\(pf:ProwlerFinding \{status: 'FAIL'\}\)",
-            query.cypher,
-        ), f"{query.id} lacks the typed, status-scoped finding probe"
-
-    @pytest.mark.parametrize("query", NEW_QUERIES, ids=lambda q: q.id)
-    def test_return_contract(self, query):
-        assert re.search(
-            r"RETURN paths, collect\(DISTINCT pf\) as dpf, "
-            r"collect\(DISTINCT pfr\) as dpfr",
-            query.cypher,
-        )
-
-    @pytest.mark.parametrize("query", NEW_QUERIES, ids=lambda q: q.id)
-    def test_no_neptune_unsupported_predicates(self, query):
-        m = NEPTUNE_UNSUPPORTED_PREDICATES.search(query.cypher)
-        assert m is None, f"{query.id} uses '{m.group().strip()}' (not Neptune-safe)"
-
-    @pytest.mark.parametrize("query", NEW_QUERIES, ids=lambda q: q.id)
-    def test_no_regex_operator(self, query):
-        assert "=~" not in query.cypher
-
-    @pytest.mark.parametrize("query", NEW_QUERIES, ids=lambda q: q.id)
-    def test_does_not_read_normalized_list_fields(self, query):
-        for field in NORMALIZED_STATEMENT_FIELDS:
-            assert not re.search(rf"\.{field}\b", query.cypher), (
-                f"{query.id} reads normalized list field '.{field}' as a property; "
-                f"traverse the HAS_{field.upper()} edge instead"
-            )
-
-    @pytest.mark.parametrize("query", NEW_QUERIES, ids=lambda q: q.id)
-    def test_read_only(self, query):
-        no_comments = "\n".join(
-            line
-            for line in query.cypher.split("\n")
-            if not line.strip().startswith("//")
-        )
-        assert not re.search(
-            r"\b(CREATE|MERGE|SET|DELETE|REMOVE|DETACH)\b", no_comments, re.IGNORECASE
-        )

api/src/backend/api/tests/test_partitions.py

@@ -1,63 +0,0 @@
-from datetime import UTC, datetime
-from itertools import islice
-
-import pytest
-from api.partitions import (
-    PostgresUUIDv7PartitioningStrategy,
-    relative_months_or_none,
-)
-from dateutil.relativedelta import relativedelta
-from django.core.exceptions import ImproperlyConfigured
-from psqlextra.partitioning import PostgresTimePartitionSize
-
-
-def build_strategy(max_age):
-    return PostgresUUIDv7PartitioningStrategy(
-        size=PostgresTimePartitionSize(months=1),
-        count=1,
-        start_date=datetime.now(UTC),
-        max_age=max_age,
-        name_format="%Y_%b",
-    )
-
-
-class TestRelativeMonthsOrNone:
-    @pytest.mark.parametrize("value", [None, 0])
-    def test_unset_or_zero_keeps_partitions_indefinitely(self, value):
-        assert relative_months_or_none(value) is None
-
-    @pytest.mark.parametrize("months", [1, 3, 12])
-    def test_value_is_interpreted_as_months(self, months):
-        assert relative_months_or_none(months) == relativedelta(months=months)
-
-    def test_value_is_not_interpreted_as_days(self):
-        assert relative_months_or_none(12) != relativedelta(days=12)
-
-    def test_negative_is_rejected(self):
-        with pytest.raises(ImproperlyConfigured):
-            relative_months_or_none(-12)
-
-
-class TestToDelete:
-    @pytest.mark.parametrize("max_age", [None, relative_months_or_none(0)])
-    def test_nothing_is_deleted_without_max_age(self, max_age):
-        strategy = build_strategy(max_age)
-
-        assert list(islice(strategy.to_delete(), 5)) == []
-
-    def test_first_deleted_partition_is_max_age_old(self):
-        months = 3
-        strategy = build_strategy(relative_months_or_none(months))
-
-        first = next(strategy.to_delete())
-
-        expected = strategy.get_start_datetime() - relativedelta(months=months)
-        assert first.name() == expected.strftime("%Y_%b").lower()
-
-    def test_deleted_partitions_go_further_back_in_time(self):
-        strategy = build_strategy(relative_months_or_none(3))
-
-        names = [p.name() for p in islice(strategy.to_delete(), 3)]
-        starts = [datetime.strptime(n, "%Y_%b") for n in names]
-
-        assert starts == sorted(starts, reverse=True)

api/src/backend/api/tests/test_sentry.py

@@ -1,10 +1,9 @@
-import errno
 import logging
 from unittest.mock import MagicMock, patch
 
 import pytest
 from config.settings import sentry as sentry_settings
-from config.settings.sentry import before_send, errno_fingerprint
+from config.settings.sentry import before_send
 
 
 def test_initialize_sentry_skips_without_dsn():
@@ -189,165 +188,3 @@ def test_before_send_passes_non_defunct_neo4j_log():
     event = MagicMock()
 
     assert before_send(event, hint) == event
-
-
-def _filesystem_hint(exception, msg="Error generating output directory"):
-    """Build the hint the logging integration sends for a filesystem failure."""
-    exc_info = (type(exception), exception, exception.__traceback__)
-    log_record = _make_log_record(msg)
-    log_record.exc_info = exc_info
-    setattr(
-        log_record,
-        sentry_settings.ERROR_CATEGORY_ATTRIBUTE,
-        sentry_settings.FILESYSTEM_ERROR_CATEGORY,
-    )
-    return {"log_record": log_record, "exc_info": exc_info}
-
-
-@pytest.mark.parametrize(
-    ("error_number", "message", "expected_suffix"),
-    [
-        (errno.ENOSPC, "No space left on device", "errno:ENOSPC"),
-        (errno.ENOENT, "No such file or directory", "errno:ENOENT"),
-        (errno.EACCES, "Permission denied", "errno:EACCES"),
-    ],
-)
-def test_before_send_fingerprints_oserror_by_errno(
-    error_number, message, expected_suffix
-):
-    """Filesystem failures raised from the same call site must not be merged."""
-    event = {}
-
-    result = before_send(event, _filesystem_hint(OSError(error_number, message)))
-
-    assert result is event
-    assert event["fingerprint"] == ["{{ default }}", expected_suffix]
-
-
-def test_before_send_fingerprints_differ_per_errno():
-    """ENOSPC and ENOENT from the same call site produce different issues."""
-    enospc_event = {}
-    enoent_event = {}
-
-    before_send(
-        enospc_event, _filesystem_hint(OSError(errno.ENOSPC, "No space left on device"))
-    )
-    before_send(
-        enoent_event,
-        _filesystem_hint(OSError(errno.ENOENT, "No such file or directory")),
-    )
-
-    assert enospc_event["fingerprint"] != enoent_event["fingerprint"]
-
-
-def test_before_send_fingerprints_wrapped_oserror():
-    """The errno is found even when the OSError is wrapped by another error."""
-    try:
-        try:
-            raise OSError(errno.ENOSPC, "No space left on device")
-        except OSError as os_error:
-            raise RuntimeError("Error generating output directory") from os_error
-    except RuntimeError as wrapper:
-        event = {}
-        before_send(event, _filesystem_hint(wrapper))
-
-    assert event["fingerprint"] == ["{{ default }}", "errno:ENOSPC"]
-
-
-def test_before_send_does_not_fingerprint_non_oserror():
-    """Non-filesystem exceptions keep Sentry's default grouping."""
-    event = {}
-
-    result = before_send(event, _filesystem_hint(ValueError("boom")))
-
-    assert result is event
-    assert "fingerprint" not in event
-
-
-def test_before_send_does_not_fingerprint_unrelated_oserror_log():
-    """Only records declaring the filesystem category opt into the errno grouping."""
-    exception = OSError(errno.ENOSPC, "No space left on device")
-    log_record = _make_log_record("Unrelated failure")
-    exc_info = (OSError, exception, None)
-    log_record.exc_info = exc_info
-    event = {}
-
-    result = before_send(event, {"log_record": log_record, "exc_info": exc_info})
-
-    assert result is event
-    assert "fingerprint" not in event
-
-
-def test_before_send_does_not_fingerprint_exception_events():
-    """Exception events without a log record keep Sentry's default grouping."""
-    event = {}
-
-    result = before_send(
-        event,
-        {"exc_info": (OSError, OSError(errno.ENOSPC, "No space left on device"), None)},
-    )
-
-    assert result is event
-    assert "fingerprint" not in event
-
-
-@pytest.mark.parametrize("fingerprint", [["scope-fingerprint"], []])
-def test_before_send_keeps_existing_fingerprint(fingerprint):
-    """A fingerprint set by a scope or an integration is never overwritten."""
-    expected_fingerprint = fingerprint.copy()
-    event = {"fingerprint": fingerprint}
-
-    before_send(
-        event, _filesystem_hint(OSError(errno.ENOSPC, "No space left on device"))
-    )
-
-    assert event["fingerprint"] == expected_fingerprint
-
-
-def test_before_send_ignores_suppressed_context():
-    """`raise ... from None` hides the context, so it must not group the event."""
-    try:
-        try:
-            raise OSError(errno.ENOSPC, "No space left on device")
-        except OSError:
-            raise RuntimeError("Error generating output directory") from None
-    except RuntimeError as wrapper:
-        event = {}
-        before_send(event, _filesystem_hint(wrapper))
-
-    assert "fingerprint" not in event
-
-
-def test_errno_fingerprint_follows_implicit_context():
-    """An implicit `raise` during handling still exposes the original errno."""
-    try:
-        try:
-            raise OSError(errno.EACCES, "Permission denied")
-        except OSError:
-            raise RuntimeError("Error generating output directory")
-    except RuntimeError as wrapper:
-        assert errno_fingerprint(wrapper) == "errno:EACCES"
-
-
-def test_before_send_does_not_fingerprint_oserror_without_errno():
-    """An OSError without errno has nothing to split the issue by."""
-    event = {}
-
-    before_send(event, _filesystem_hint(OSError("no errno here")))
-
-    assert "fingerprint" not in event
-
-
-def test_errno_fingerprint_uses_raw_number_for_unknown_errno():
-    """Unmapped errno values still split the issue instead of being dropped."""
-    assert errno_fingerprint(OSError(9999, "unknown")) == "errno:9999"
-
-
-def test_errno_fingerprint_stops_on_self_referencing_chain():
-    """A cyclic exception chain must not hang the fingerprint lookup."""
-    first = ValueError("first")
-    second = ValueError("second")
-    first.__cause__ = second
-    second.__cause__ = first
-
-    assert errno_fingerprint(first) is None

api/src/backend/api/tests/test_views.py

@@ -19,7 +19,6 @@ from allauth.account.models import EmailAddress
 from allauth.socialaccount.models import SocialAccount, SocialApp
 from api.attack_paths import (
     AttackPathsQueryDefinition,
-    AttackPathsQueryOutcome,
     AttackPathsQueryParameterDefinition,
 )
 from api.compliance import get_compliance_frameworks
@@ -78,9 +77,8 @@ from conftest import (
     today_after_n_days,
 )
 from django.conf import settings
-from django.db import close_old_connections, connection, connections
+from django.db import close_old_connections, connection
 from django.db.models import Count
-from django.db.models.signals import pre_delete
 from django.http import JsonResponse
 from django.test import RequestFactory
 from django.test.utils import CaptureQueriesContext
@@ -520,50 +518,6 @@ class TestUserViewSet:
         assert error_field in response.json()["errors"][0]["source"]["pointer"]
 
 
-@pytest.mark.requires_test_admin_alias
-@pytest.mark.django_db(transaction=True, databases=["default", "admin"])
-class TestTenantDeletionTransactions:
-    @patch("api.v1.views.delete_tenant_task.apply_async")
-    def test_delete_rolls_back_memberships_when_user_cleanup_fails(
-        self,
-        delete_tenant_mock,
-        authenticated_client,
-        tenants_fixture,
-    ):
-        assert connections["default"] is not connections["admin"]
-
-        _, tenant, _ = tenants_fixture
-        exclusive_user = User.objects.create_user(
-            name="exclusive user",
-            password=TEST_PASSWORD,
-            email="exclusive-user@example.com",
-        )
-        membership = Membership.objects.create(
-            user=exclusive_user,
-            tenant=tenant,
-            role=Membership.RoleChoices.MEMBER,
-        )
-
-        def fail_user_cleanup(*, instance, **kwargs):
-            if instance.pk == exclusive_user.pk:
-                raise RuntimeError("Simulated user cleanup failure.")
-
-        pre_delete.connect(fail_user_cleanup, sender=User)
-        try:
-            with (
-                patch.object(MainRouter, "admin_db", "admin"),
-                pytest.raises(RuntimeError, match=r"Simulated user cleanup failure\."),
-            ):
-                authenticated_client.delete(
-                    reverse("tenant-detail", kwargs={"pk": tenant.id})
-                )
-        finally:
-            pre_delete.disconnect(fail_user_cleanup, sender=User)
-
-        assert Membership.objects.using("admin").filter(pk=membership.pk).exists()
-        delete_tenant_mock.assert_not_called()
-
-
 @pytest.mark.django_db
 class TestTenantViewSet:
     @pytest.fixture
@@ -5434,72 +5388,6 @@ class TestAttackPathsScanViewSet:
         assert payload[0]["attributes"]["name"] == "RDS inventory"
         assert payload[0]["attributes"]["parameters"][0]["name"] == "ip"
 
-    def test_attack_paths_queries_expose_outcome(
-        self,
-        authenticated_client,
-        aws_provider,
-        scans_fixture,
-        create_attack_paths_scan,
-    ):
-        provider = aws_provider
-        attack_paths_scan = create_attack_paths_scan(
-            provider,
-            scan=scans_fixture[0],
-        )
-
-        definitions = [
-            AttackPathsQueryDefinition(
-                id="aws-lambda-passrole",
-                name="Lambda passrole",
-                short_description="Pass a role to a new Lambda function.",
-                description="Pass a role to a new Lambda function and run code as it.",
-                provider=provider.provider,
-                cypher="MATCH (n) RETURN n",
-                outcome=AttackPathsQueryOutcome.CODE_EXECUTION,
-            ),
-            AttackPathsQueryDefinition(
-                id="aws-rds-inventory",
-                name="RDS inventory",
-                short_description="List account RDS assets.",
-                description="List account RDS assets.",
-                provider=provider.provider,
-                cypher="MATCH (n) RETURN n",
-                outcome=AttackPathsQueryOutcome.RESOURCE_INVENTORY,
-            ),
-            AttackPathsQueryDefinition(
-                id="aws-no-outcome",
-                name="No outcome",
-                short_description="A query without an outcome.",
-                description="A query without an outcome.",
-                provider=provider.provider,
-                cypher="MATCH (n) RETURN n",
-            ),
-        ]
-
-        with patch("api.v1.views.get_queries_for_provider", return_value=definitions):
-            response = authenticated_client.get(
-                reverse(
-                    "attack-paths-scans-queries", kwargs={"pk": attack_paths_scan.id}
-                )
-            )
-
-        assert response.status_code == status.HTTP_200_OK
-        outcomes = {
-            item["id"]: item["attributes"]["outcome"]
-            for item in response.json()["data"]
-        }
-        assert outcomes["aws-lambda-passrole"] == {
-            "kind": "code_execution",
-            "label": "Code execution",
-            "partial": False,
-        }
-        assert outcomes["aws-rds-inventory"] == {
-            "kind": "resource_inventory",
-            "label": "Resource inventory",
-            "partial": True,
-        }
-        assert outcomes["aws-no-outcome"] is None
-
     def test_attack_paths_queries_returns_404_when_catalog_missing(
         self,
         authenticated_client,
@@ -8784,190 +8672,6 @@ class TestInvitationViewSet:
             user.id
         )
 
-    @staticmethod
-    def _invitation_create_payload(email, role):
-        return json.dumps(
-            {
-                "data": {
-                    "type": "invitations",
-                    "attributes": {"email": email},
-                    "relationships": {
-                        "roles": {"data": [{"type": "roles", "id": str(role.id)}]}
-                    },
-                }
-            }
-        )
-
-    @staticmethod
-    def _create_lapsed_invitation(email, tenant, inviter):
-        return Invitation.objects.create(
-            email=email,
-            state=Invitation.State.PENDING,
-            expires_at=datetime.now(UTC) - timedelta(days=1),
-            inviter=inviter,
-            tenant=tenant,
-        )
-
-    def test_invitations_create_with_lapsed_pending_invitation_for_same_email(
-        self,
-        authenticated_client,
-        create_test_user,
-        tenants_fixture,
-        invitations_fixture,
-        roles_fixture,
-    ):
-        lapsed_invitation, expired_invitation = invitations_fixture
-        lapsed_invitation.expires_at = datetime.now(UTC) - timedelta(days=1)
-        lapsed_invitation.save()
-        other_email_lapsed_invitation = self._create_lapsed_invitation(
-            "other@prowler.com", tenants_fixture[0], create_test_user
-        )
-
-        response = authenticated_client.post(
-            reverse("invitation-list"),
-            data=self._invitation_create_payload(
-                lapsed_invitation.email, roles_fixture[0]
-            ),
-            content_type="application/vnd.api+json",
-        )
-
-        assert response.status_code == status.HTTP_201_CREATED
-        new_invitation = Invitation.objects.get(id=response.json()["data"]["id"])
-        assert new_invitation.email == lapsed_invitation.email
-        assert new_invitation.state == Invitation.State.PENDING
-        lapsed_invitation.refresh_from_db()
-        assert lapsed_invitation.state == Invitation.State.EXPIRED
-        expired_invitation.refresh_from_db()
-        assert expired_invitation.state == Invitation.State.EXPIRED
-        other_email_lapsed_invitation.refresh_from_db()
-        assert other_email_lapsed_invitation.state == Invitation.State.PENDING
-
-    def test_invitations_create_with_active_pending_invitation_for_same_email(
-        self,
-        authenticated_client,
-        create_test_user,
-        tenants_fixture,
-        invitations_fixture,
-        roles_fixture,
-    ):
-        active_invitation, _ = invitations_fixture
-        self._create_lapsed_invitation(
-            active_invitation.email, tenants_fixture[0], create_test_user
-        )
-        invitation_count = Invitation.objects.count()
-
-        response = authenticated_client.post(
-            reverse("invitation-list"),
-            data=self._invitation_create_payload(
-                active_invitation.email, roles_fixture[0]
-            ),
-            content_type="application/vnd.api+json",
-        )
-
-        assert response.status_code == status.HTTP_400_BAD_REQUEST
-        assert (
-            response.json()["errors"][0]["source"]["pointer"]
-            == "/data/attributes/email"
-        )
-        assert Invitation.objects.count() == invitation_count
-        active_invitation.refresh_from_db()
-        assert active_invitation.state == Invitation.State.PENDING
-
-    def test_invitations_create_ignores_pending_invitations_from_other_tenants(
-        self, authenticated_client, create_test_user, tenants_fixture, roles_fixture
-    ):
-        email = "cross_tenant@prowler.com"
-        other_tenant = tenants_fixture[1]
-        other_tenant_lapsed_invitation = self._create_lapsed_invitation(
-            email, other_tenant, create_test_user
-        )
-        Invitation.objects.create(
-            email=email, inviter=create_test_user, tenant=other_tenant
-        )
-
-        response = authenticated_client.post(
-            reverse("invitation-list"),
-            data=self._invitation_create_payload(email, roles_fixture[0]),
-            content_type="application/vnd.api+json",
-        )
-
-        assert response.status_code == status.HTTP_201_CREATED
-        other_tenant_lapsed_invitation.refresh_from_db()
-        assert other_tenant_lapsed_invitation.state == Invitation.State.PENDING
-
-    def test_invitations_report_lapsed_pending_invitation_as_expired(
-        self,
-        authenticated_client,
-        create_test_user,
-        tenants_fixture,
-        invitations_fixture,
-    ):
-        active_invitation, expired_invitation = invitations_fixture
-        lapsed_invitation = self._create_lapsed_invitation(
-            "lapsed@prowler.com", tenants_fixture[0], create_test_user
-        )
-
-        list_response = authenticated_client.get(reverse("invitation-list"))
-        retrieve_response = authenticated_client.get(
-            reverse("invitation-detail", kwargs={"pk": lapsed_invitation.id})
-        )
-
-        assert list_response.status_code == status.HTTP_200_OK
-        assert retrieve_response.status_code == status.HTTP_200_OK
-        assert {
-            invitation["id"]: invitation["attributes"]["state"]
-            for invitation in list_response.json()["data"]
-        } == {
-            str(active_invitation.id): Invitation.State.PENDING.value,
-            str(expired_invitation.id): Invitation.State.EXPIRED.value,
-            str(lapsed_invitation.id): Invitation.State.EXPIRED.value,
-        }
-        assert (
-            retrieve_response.json()["data"]["attributes"]["state"]
-            == Invitation.State.EXPIRED.value
-        )
-
-    @pytest.mark.parametrize(
-        "filter_name, filter_value, expected_invitations",
-        [
-            ("state", "pending", {"active"}),
-            ("state", "expired", {"expired", "lapsed"}),
-            ("state", "accepted", set()),
-            ("state__in", "pending", {"active"}),
-            ("state__in", "expired", {"expired", "lapsed"}),
-            ("state__in", "pending,expired", {"active", "expired", "lapsed"}),
-            ("state__in", "accepted,revoked", set()),
-        ],
-    )
-    def test_invitations_filter_state_treats_lapsed_pending_as_expired(
-        self,
-        authenticated_client,
-        create_test_user,
-        tenants_fixture,
-        invitations_fixture,
-        filter_name,
-        filter_value,
-        expected_invitations,
-    ):
-        active_invitation, expired_invitation = invitations_fixture
-        lapsed_invitation = self._create_lapsed_invitation(
-            "lapsed@prowler.com", tenants_fixture[0], create_test_user
-        )
-        invitation_ids = {
-            "active": str(active_invitation.id),
-            "expired": str(expired_invitation.id),
-            "lapsed": str(lapsed_invitation.id),
-        }
-
-        response = authenticated_client.get(
-            reverse("invitation-list"), {f"filter[{filter_name}]": filter_value}
-        )
-
-        assert response.status_code == status.HTTP_200_OK
-        assert {invitation["id"] for invitation in response.json()["data"]} == {
-            invitation_ids[name] for name in expected_invitations
-        }
-
     @pytest.mark.parametrize(
         "email",
         [
@@ -8975,10 +8679,8 @@ class TestInvitationViewSet:
             "invalid_email@",
             # There is a pending invitation with this email
             "testing@prowler.com",
-            "TESTING@prowler.com",
             # User is already a member of the tenant
             TEST_USER,
-            TEST_USER.upper(),
         ],
     )
     def test_invitations_create_invalid_email(
@@ -9233,56 +8935,6 @@ class TestInvitationViewSet:
             == "This invitation cannot be revoked."
         )
 
-    def test_invitations_delete_lapsed_invitation(
-        self, authenticated_client, invitations_fixture
-    ):
-        invitation, *_ = invitations_fixture
-        invitation.expires_at = datetime.now(UTC) - timedelta(days=1)
-        invitation.save()
-
-        response = authenticated_client.delete(
-            reverse("invitation-detail", kwargs={"pk": str(invitation.id)})
-        )
-
-        assert response.status_code == status.HTTP_400_BAD_REQUEST
-        assert (
-            response.json()["errors"][0]["detail"]
-            == "This invitation cannot be revoked."
-        )
-        invitation.refresh_from_db()
-        assert invitation.state == Invitation.State.PENDING
-
-    def test_invitations_partial_update_lapsed_invitation(
-        self, authenticated_client, invitations_fixture
-    ):
-        invitation, *_ = invitations_fixture
-        invitation.expires_at = datetime.now(UTC) - timedelta(days=1)
-        invitation.save()
-        data = {
-            "data": {
-                "id": str(invitation.id),
-                "type": "invitations",
-                "attributes": {
-                    "email": invitation.email,
-                    "expires_at": self.TOMORROW_ISO,
-                },
-            }
-        }
-
-        response = authenticated_client.patch(
-            reverse("invitation-detail", kwargs={"pk": str(invitation.id)}),
-            data=json.dumps(data),
-            content_type="application/vnd.api+json",
-        )
-
-        assert response.status_code == status.HTTP_400_BAD_REQUEST
-        assert (
-            response.json()["errors"][0]["detail"]
-            == "This invitation cannot be updated."
-        )
-        invitation.refresh_from_db()
-        assert invitation.is_lapsed
-
     def test_invitations_accept_invitation_new_user(self, client, invitations_fixture):
         invitation, *_ = invitations_fixture
 
@@ -14909,37 +14561,6 @@ class TestSAMLConfigurationViewSet:
         assert not SAMLConfiguration.objects.filter(id=config.id).exists()
 
 
-@pytest.mark.django_db
-class TestSAMLACSView:
-    def test_get_is_not_allowed(self, client, saml_setup):
-        response = client.get(
-            reverse(
-                "saml_acs",
-                kwargs={"organization_slug": saml_setup["domain"]},
-            )
-        )
-
-        assert response.status_code == status.HTTP_405_METHOD_NOT_ALLOWED
-        assert response.headers["Allow"] == "POST"
-        assert "saml-acs-session" not in response.cookies
-
-    def test_post_is_forwarded_to_allauth(self, client, saml_setup):
-        response = client.post(
-            reverse(
-                "saml_acs",
-                kwargs={"organization_slug": saml_setup["domain"]},
-            ),
-            data={"SAMLResponse": "test-saml-response"},
-        )
-
-        assert response.status_code == status.HTTP_302_FOUND
-        assert response.url == reverse(
-            "saml_finish_acs",
-            kwargs={"organization_slug": saml_setup["domain"]},
-        )
-        assert "saml-acs-session" in response.cookies
-
-
 @pytest.mark.django_db
 class TestTenantFinishACSView:
     def test_dispatch_skips_if_user_not_authenticated(self, monkeypatch):
@@ -18569,14 +18190,19 @@ class TestMuteRuleViewSet:
         assert len(data) == 2
         assert data[0]["id"] == str(mute_rules_fixture[first_index].id)
 
-    @patch("api.v1.views.mute_findings_in_latest_scans_task.apply_async")
+    @patch("api.v1.views.chain")
+    @patch("api.v1.views.reaggregate_all_finding_group_summaries_task.si")
+    @patch("api.v1.views.mute_historical_findings_task.si")
     @patch("api.v1.views.transaction.on_commit", side_effect=lambda fn: fn())
     def test_mute_rules_create_valid(
         self,
         _mock_on_commit,
-        mock_mute_task,
+        mock_mute_signature,
+        mock_reaggregate_signature,
+        mock_chain,
         authenticated_client,
         findings_fixture,
+        create_test_user,
     ):
         """Test creating a valid mute rule."""
         finding_ids = [str(findings_fixture[0].id)]
@@ -18603,20 +18229,24 @@ class TestMuteRuleViewSet:
         assert response_data["attributes"]["name"] == "New Mute Rule"
         assert response_data["attributes"]["reason"] == "Security exception approved"
 
+        # Verify the finding was immediately muted
+        from api.models import Finding
+
         finding = Finding.objects.get(id=findings_fixture[0].id)
-        assert finding.muted is False
-        assert finding.muted_at is None
-        assert finding.muted_reason is None
+        assert finding.muted is True
+        assert finding.muted_at is not None
+        assert finding.muted_reason == "Security exception approved"
 
-        mock_mute_task.assert_called_once_with(
-            kwargs={
-                "tenant_id": str(finding.tenant_id),
-                "mute_rule_id": response_data["id"],
-                "provider_ids": [str(finding.scan.provider_id)],
-            }
+        # Verify background task chain was called: mute → reaggregate all
+        mock_mute_signature.assert_called_once()
+        mock_reaggregate_signature.assert_called_once()
+        mock_chain.assert_called_once_with(
+            mock_mute_signature.return_value,
+            mock_reaggregate_signature.return_value,
         )
+        mock_chain.return_value.apply_async.assert_called_once()
 
-    @patch("api.v1.views.mute_findings_in_latest_scans_task.apply_async")
+    @patch("tasks.tasks.mute_historical_findings_task.apply_async")
     def test_mute_rules_create_converts_finding_ids_to_uids(
         self,
         mock_task,
@@ -18652,7 +18282,7 @@ class TestMuteRuleViewSet:
         ]
         assert set(mute_rule.finding_uids) == set(expected_uids)
 
-    @patch("api.v1.views.mute_findings_in_latest_scans_task.apply_async")
+    @patch("tasks.tasks.mute_historical_findings_task.apply_async")
     def test_mute_rules_deduplicates_uids(
         self,
         mock_task,
@@ -18719,10 +18349,10 @@ class TestMuteRuleViewSet:
 
         finding1.refresh_from_db()
         finding2.refresh_from_db()
-        assert finding1.muted is False
-        assert finding2.muted is False
+        assert finding1.muted is True
+        assert finding2.muted is True
 
-    @patch("api.v1.views.mute_findings_in_latest_scans_task.apply_async")
+    @patch("tasks.tasks.mute_historical_findings_task.apply_async")
     def test_mute_rules_create_overlap_detection_active(
         self,
         mock_task,
@@ -18755,7 +18385,7 @@ class TestMuteRuleViewSet:
             "already muted" in error_detail.lower() or "overlap" in error_detail.lower()
         )
 
-    @patch("api.v1.views.mute_findings_in_latest_scans_task.apply_async")
+    @patch("tasks.tasks.mute_historical_findings_task.apply_async")
     def test_mute_rules_create_no_overlap_with_inactive(
         self,
         mock_task,
@@ -18811,7 +18441,7 @@ class TestMuteRuleViewSet:
             == "/data/attributes/finding_ids"
         )
 
-    @patch("api.v1.views.mute_findings_in_latest_scans_task.apply_async")
+    @patch("tasks.tasks.mute_historical_findings_task.apply_async")
     def test_mute_rules_create_invalid_finding_ids(
         self, mock_task, authenticated_client
     ):

api/src/backend/api/v1/serializers.py

@@ -329,15 +329,6 @@ class TokenSwitchTenantSerializer(BaseSerializerV1):
 # Users
 
 
-class ActiveMembershipRelatedField(SerializerMethodResourceRelatedField):
-    def to_representation(self, value):
-        representation = super().to_representation(value)
-        representation["meta"] = {
-            "active": str(value.tenant_id) == str(self.context["request"].tenant_id),
-        }
-        return representation
-
-
 class UserSerializer(BaseModelSerializerV1):
     """
     Serializer for the User model.
@@ -399,12 +390,6 @@ class UserSerializer(BaseModelSerializerV1):
         )
 
 
-class UserMeSerializer(UserSerializer):
-    memberships = ActiveMembershipRelatedField(
-        many=True, read_only=True, source="memberships", method_name="get_memberships"
-    )
-
-
 class UserIncludeSerializer(UserSerializer):
     class Meta:
         model = User
@@ -1330,28 +1315,6 @@ class AttackPathsQuerySerializer(BaseSerializerV1):
     attribution = AttackPathsQueryAttributionSerializer(allow_null=True, required=False)
     provider = serializers.CharField()
     parameters = AttackPathsQueryParameterSerializer(many=True)
-    # The terminal impact the query leads to (e.g. {"kind": "code_execution",
-    # "label": "Code execution"}), or null if the query has none. The UI renders
-    # this as the graph's terminal outcome node.
-    outcome = serializers.SerializerMethodField()
-
-    @extend_schema_field(
-        {
-            "type": "object",
-            "nullable": True,
-            "properties": {
-                "kind": {"type": "string"},
-                "label": {"type": "string"},
-                "partial": {"type": "boolean"},
-            },
-        }
-    )
-    def get_outcome(self, definition):
-        outcome = getattr(definition, "outcome", None)
-        if outcome is None:
-            return None
-        meta = outcome.value
-        return {"kind": meta.kind, "label": meta.label, "partial": meta.partial}
 
     class JSONAPIMeta:
         resource_name = "attack-paths-queries"
@@ -2149,12 +2112,6 @@ class InvitationSerializer(RLSSerializer):
         if tenant_id is not None:
             self.fields["roles"].queryset = Role.objects.filter(tenant_id=tenant_id)
 
-    def to_representation(self, instance):
-        data = super().to_representation(instance)
-        if instance.is_lapsed:
-            data["state"] = Invitation.State.EXPIRED.value
-        return data
-
     class Meta:
         model = Invitation
         fields = [
@@ -2181,7 +2138,6 @@ class InvitationBaseWriteSerializer(BaseWriteSerializer):
             self.fields["roles"].queryset = Role.objects.filter(tenant_id=tenant_id)
 
     def validate_email(self, value):
-        value = value.strip().lower()
         user = User.objects.filter(email=value).first()
         tenant_id = self.context["tenant_id"]
         if user and Membership.objects.filter(user=user, tenant=tenant_id).exists():
@@ -2189,13 +2145,9 @@ class InvitationBaseWriteSerializer(BaseWriteSerializer):
                 "The user may already be a member of the tenant or there was an issue with the "
                 "email provided."
             )
-        pending_invitations = Invitation.objects.filter(
-            tenant_id=tenant_id, email=value, state=Invitation.State.PENDING
-        )
-        pending_invitations.filter(Invitation.lapsed_q()).update(
-            state=Invitation.State.EXPIRED
-        )
-        if pending_invitations.filter(expires_at__gt=datetime.now(UTC)).exists():
+        if Invitation.objects.filter(
+            email=value, state=Invitation.State.PENDING
+        ).exists():
             raise ValidationError(
                 "Unable to process your request. Please check the information provided and "
                 "try again."

api/src/backend/api/v1/urls.py

@@ -46,7 +46,6 @@ from api.v1.views import (
 from django.http import JsonResponse
 from django.urls import include, path
 from django.views.decorators.csrf import csrf_exempt
-from django.views.decorators.http import require_POST
 from drf_spectacular.views import SpectacularRedocView
 from rest_framework_nested import routers
 
@@ -195,7 +194,7 @@ urlpatterns = [
     ),
     path(
         "accounts/saml/<organization_slug>/acs/",
-        require_POST(ACSView.as_view()),
+        ACSView.as_view(),
         name="saml_acs",
     ),
     path(

api/src/backend/api/v1/views.py

@@ -238,12 +238,12 @@ from api.v1.serializers import (
     TokenSocialLoginSerializer,
     TokenSwitchTenantSerializer,
     UserCreateSerializer,
-    UserMeSerializer,
     UserRoleRelationshipSerializer,
     UserSerializer,
     UserUpdateSerializer,
 )
 from botocore.exceptions import ClientError, NoCredentialsError, ParamValidationError
+from celery import chain
 from celery.result import AsyncResult
 from config.custom_logging import BackendLogger
 from config.env import env
@@ -341,7 +341,8 @@ from tasks.tasks import (
     enqueue_scan_execution_on_commit,
     get_active_provider_scan,
     jira_integration_task,
-    mute_findings_in_latest_scans_task,
+    mute_historical_findings_task,
+    reaggregate_all_finding_group_summaries_task,
     refresh_lighthouse_provider_models_task,
 )
 
@@ -1112,8 +1113,6 @@ class UserViewSet(BaseUserViewset):
             return UserCreateSerializer
         elif self.action == "partial_update":
             return UserUpdateSerializer
-        elif self.action == "me":
-            return UserMeSerializer
         else:
             return UserSerializer
 
@@ -1131,7 +1130,7 @@ class UserViewSet(BaseUserViewset):
     @action(detail=False, methods=["get"], url_name="me")
     def me(self, request):
         user = self.request.user
-        serializer = self.get_serializer(user)
+        serializer = UserSerializer(user, context=self.get_serializer_context())
         return Response(
             data=serializer.data,
             status=status.HTTP_200_OK,
@@ -1443,7 +1442,7 @@ class TenantViewSet(BaseTenantViewset):
         if not membership or membership.role != Membership.RoleChoices.OWNER:
             raise PermissionDenied("Only owners can delete a tenant.")
 
-        with transaction.atomic(using=MainRouter.admin_db):
+        with transaction.atomic():
             # Collect user IDs from this tenant's memberships before deleting them
             tenant_user_ids = set(
                 Membership.objects.using(MainRouter.admin_db)
@@ -4471,7 +4470,7 @@ class InvitationViewSet(BaseRLSViewSet):
 
     def partial_update(self, request, *args, **kwargs):
         instance = self.get_object()
-        if instance.state != Invitation.State.PENDING or instance.is_lapsed:
+        if instance.state != Invitation.State.PENDING:
             raise ValidationError(detail="This invitation cannot be updated.")
         serializer = self.get_serializer(
             instance,
@@ -4485,7 +4484,7 @@ class InvitationViewSet(BaseRLSViewSet):
 
     def destroy(self, request, *args, **kwargs):
         instance = self.get_object()
-        if instance.state != Invitation.State.PENDING or instance.is_lapsed:
+        if instance.state != Invitation.State.PENDING:
             raise ValidationError(detail="This invitation cannot be revoked.")
         instance.state = Invitation.State.REVOKED
         instance.save()
@@ -7549,28 +7548,35 @@ class MuteRuleViewSet(BaseRLSViewSet):
         serializer = self.get_serializer(data=request.data)
         serializer.is_valid(raise_exception=True)
 
-        tenant_id = str(request.tenant_id)
-        finding_ids = serializer.validated_data["finding_ids"]
-        provider_ids = list(
-            dict.fromkeys(
-                Finding.all_objects.filter(
-                    id__in=finding_ids, tenant_id=tenant_id
-                ).values_list("scan__provider_id", flat=True)
-            )
-        )
-
+        # Create the mute rule
         mute_rule = serializer.save()
 
-        transaction.on_commit(
-            lambda: mute_findings_in_latest_scans_task.apply_async(
-                kwargs={
-                    "tenant_id": tenant_id,
-                    "mute_rule_id": str(mute_rule.id),
-                    "provider_ids": [str(provider_id) for provider_id in provider_ids],
-                }
-            )
+        tenant_id = str(request.tenant_id)
+        finding_ids = request.data.get("finding_ids", [])
+
+        # Immediately mute the selected findings
+        Finding.all_objects.filter(
+            id__in=finding_ids, tenant_id=tenant_id, muted=False
+        ).update(
+            muted=True,
+            muted_at=mute_rule.inserted_at,
+            muted_reason=mute_rule.reason,
         )
 
+        # Launch background task for historical muting + reaggregation
+        transaction.on_commit(
+            lambda: chain(
+                mute_historical_findings_task.si(
+                    tenant_id=tenant_id,
+                    mute_rule_id=str(mute_rule.id),
+                ),
+                reaggregate_all_finding_group_summaries_task.si(
+                    tenant_id=tenant_id,
+                ),
+            ).apply_async()
+        )
+
+        # Return the created mute rule
         serializer = self.get_serializer(mute_rule)
         return Response(
             data=serializer.data,

api/src/backend/config/django/base.py

@@ -303,11 +303,6 @@ SECURE_REFERRER_POLICY = "strict-origin-when-cross-origin"
 
 DJANGO_DELETION_BATCH_SIZE = env.int("DJANGO_DELETION_BATCH_SIZE", 5000)
 
-# Public base URL of the Prowler UI (for example https://cloud.prowler.com). Used to
-# build links back to findings in outbound integrations such as Jira. Empty by
-# default, so self-hosted deployments emit no links unless they configure it.
-UI_BASE_URL = env.str("DJANGO_UI_BASE_URL", "").rstrip("/")
-
 # SAML requirement
 CSRF_COOKIE_SECURE = True
 SESSION_COOKIE_SECURE = True

api/src/backend/config/settings/sentry.py

@@ -1,20 +1,6 @@
-from errno import errorcode
-
 import sentry_sdk
 from config.env import env
 
-# How many links of the __cause__/__context__ chain are inspected when looking
-# for the OSError that actually caused the event.
-MAX_EXCEPTION_CHAIN_DEPTH = 10
-
-# LogRecord attribute describing what kind of failure the record reports, set by
-# the caller through `logger.exception(..., extra={"error_category": ...})`.
-ERROR_CATEGORY_ATTRIBUTE = "error_category"
-
-# Category of records whose events are grouped by the errno of the underlying
-# OSError. Only records that declare it opt into the errno fingerprint.
-FILESYSTEM_ERROR_CATEGORY = "filesystem"
-
 IGNORED_EXCEPTIONS = [
     # Provider is not connected due to credentials errors
     "is not connected",
@@ -94,38 +80,6 @@ IGNORED_EXCEPTIONS = [
 ]
 
 
-def errno_fingerprint(exception):
-    """
-    Return an errno-based fingerprint suffix for OSError-like exceptions.
-
-    Filesystem failures such as ENOSPC (disk full), ENOENT (missing mount point)
-    or EACCES (wrong permissions) are all OSError raised from the same call
-    site, so Sentry's default grouping merges them into a single issue even
-    when the exception is attached to the event. Appending the errno keeps the
-    default grouping and splits the issue per failure cause.
-
-    Only the part of the chain Sentry itself displays is inspected: a
-    `raise ... from None` sets __suppress_context__, so the implicit
-    __context__ is dropped from the event and must not group it either.
-
-    Returns None when no OSError with an errno is found in the exception chain.
-    """
-    seen = set()
-    for _ in range(MAX_EXCEPTION_CHAIN_DEPTH):
-        if exception is None or id(exception) in seen:
-            break
-        seen.add(id(exception))
-        if isinstance(exception, OSError) and exception.errno is not None:
-            return f"errno:{errorcode.get(exception.errno, exception.errno)}"
-        if exception.__cause__ is not None:
-            exception = exception.__cause__
-        elif exception.__suppress_context__:
-            break
-        else:
-            exception = exception.__context__
-    return None
-
-
 def before_send(event, hint):
     """
     before_send handles the Sentry events in order to send them or not
@@ -161,28 +115,10 @@ def before_send(event, hint):
 
     # Ignore exceptions with the ignored_exceptions
     if "exc_info" in hint and hint["exc_info"]:
-        exception = hint["exc_info"][1]
-        exc_value = str(exception)
+        exc_value = str(hint["exc_info"][1])
         if any(ignored in exc_value for ignored in IGNORED_EXCEPTIONS):
             return None  # Explicitly return None to drop the event
 
-    # Split filesystem issues per errno instead of grouping every failure raised
-    # from the same call site under a single issue. Only records that declare
-    # themselves as filesystem failures opt in, and a fingerprint already set by
-    # a scope or an integration always wins.
-    log_record = hint.get("log_record")
-    exc_info = hint.get("exc_info")
-    if (
-        log_record is not None
-        and exc_info
-        and getattr(log_record, ERROR_CATEGORY_ATTRIBUTE, None)
-        == FILESYSTEM_ERROR_CATEGORY
-        and "fingerprint" not in event
-    ):
-        fingerprint_suffix = errno_fingerprint(exc_info[1])
-        if fingerprint_suffix:
-            event["fingerprint"] = ["{{ default }}", fingerprint_suffix]
-
     return event
 
 

api/src/backend/tasks/jobs/integrations.py

@@ -2,16 +2,13 @@ import os
 import time
 from datetime import UTC, datetime
 from glob import glob
-from urllib.parse import quote
 
 from api.db_router import READ_REPLICA_ALIAS, MainRouter
 from api.db_utils import REPLICA_MAX_ATTEMPTS, REPLICA_RETRY_BASE_DELAY, rls_transaction
 from api.models import Finding, Integration, Provider
-from api.rls import Tenant
 from api.utils import initialize_prowler_integration, initialize_prowler_provider
 from celery.utils.log import get_task_logger
 from config.django.base import DJANGO_FINDINGS_BATCH_SIZE
-from django.conf import settings
 from django.db import OperationalError
 from prowler.lib.outputs.asff.asff import ASFF
 from prowler.lib.outputs.compliance.generic.generic import GenericCompliance
@@ -19,7 +16,6 @@ from prowler.lib.outputs.csv.csv import CSV
 from prowler.lib.outputs.finding import Finding as FindingOutput
 from prowler.lib.outputs.html.html import HTML
 from prowler.lib.outputs.jira.exceptions.exceptions import JiraBaseException
-from prowler.lib.outputs.jira.jira import Jira
 from prowler.lib.outputs.ocsf.ocsf import OCSF
 from prowler.providers.aws.aws_provider import AwsProvider
 from prowler.providers.aws.lib.s3.s3 import S3
@@ -481,55 +477,6 @@ def upload_security_hub_integration(
         return False
 
 
-JIRA_LABEL_PREFIX = "prowler"
-
-
-def build_jira_finding_url(finding_uid: str) -> str:
-    """Build the Prowler UI link for a finding, or "" when no UI base URL is set.
-
-    The link filters by the finding ``uid`` rather than the per-scan record id so
-    it keeps resolving after the finding is seen again in later scans.
-    """
-    base_url = getattr(settings, "UI_BASE_URL", "")
-    if not base_url or not finding_uid:
-        return ""
-    return f"{base_url}/findings?filter[uid]={quote(finding_uid, safe='')}"
-
-
-def build_jira_issue_labels(
-    finding_uid: str, provider: str, severity: str, check_id: str
-) -> list[str]:
-    """Build the deterministic label set written to every Jira issue.
-
-    Labels are prefixed to avoid colliding with customer labels and sanitized so
-    Jira never rejects them; the finding-uid label is what lets a ticket be traced
-    back (or JQL-filtered) to its finding.
-    """
-    raw_labels = [
-        JIRA_LABEL_PREFIX,
-        f"{JIRA_LABEL_PREFIX}-{provider}" if provider else "",
-        f"{JIRA_LABEL_PREFIX}-{severity}" if severity else "",
-        f"{JIRA_LABEL_PREFIX}-{check_id}" if check_id else "",
-        Jira.build_finding_label(finding_uid),
-    ]
-    return Jira.sanitize_labels(raw_labels)
-
-
-def get_tenant_name(tenant_id: str) -> str:
-    """Return the tenant name for the Jira issue "Tenant Info" row, or "" if unknown.
-
-    The name is informational only, so a lookup failure must never block the send.
-    """
-    try:
-        return (
-            Tenant.objects.filter(id=tenant_id).values_list("name", flat=True).first()
-            or ""
-        )
-    except Exception:
-        logger.warning("Could not resolve tenant name for %s", tenant_id)
-        return ""
-
-
 def send_findings_to_jira(
     tenant_id: str,
     integration_id: str,
@@ -540,7 +487,6 @@ def send_findings_to_jira(
     with rls_transaction(tenant_id):
         integration = Integration.objects.get(id=integration_id)
         jira_integration = initialize_prowler_integration(integration)
-        tenant_info = get_tenant_name(tenant_id)
 
     num_tickets_created = 0
     error_messages = []
@@ -573,15 +519,6 @@ def send_findings_to_jira(
             recommendation = remediation.get("recommendation", {})
             remediation_code = remediation.get("code", {})
 
-            provider_type = finding_instance.scan.provider.provider
-            issue_labels = build_jira_issue_labels(
-                finding_uid=finding_instance.uid,
-                provider=provider_type,
-                severity=finding_instance.severity,
-                check_id=finding_instance.check_id,
-            )
-            finding_url = build_jira_finding_url(finding_instance.uid)
-
             try:
                 # Send the individual finding to Jira
                 result = jira_integration.send_finding(
@@ -590,7 +527,7 @@ def send_findings_to_jira(
                     severity=finding_instance.severity,
                     status=finding_instance.status,
                     status_extended=finding_instance.status_extended or "",
-                    provider=provider_type,
+                    provider=finding_instance.scan.provider.provider,
                     region=region,
                     resource_uid=resource_uid,
                     resource_name=resource_name,
@@ -605,9 +542,6 @@ def send_findings_to_jira(
                     compliance=finding_instance.compliance or {},
                     project_key=project_key,
                     issue_type=issue_type,
-                    issue_labels=issue_labels,
-                    finding_url=finding_url,
-                    tenant_info=tenant_info,
                 )
             except JiraBaseException as error:
                 error_message = error.message or JIRA_GENERIC_SEND_ERROR
@@ -623,11 +557,6 @@ def send_findings_to_jira(
 
             if result:
                 num_tickets_created += 1
-                logger.info(
-                    "Finding %s sent to Jira as %s",
-                    finding_id,
-                    result.get("key") if isinstance(result, dict) else result,
-                )
             else:
                 error_message = JIRA_GENERIC_SEND_ERROR
                 logger.error(error_message)

api/src/backend/tasks/jobs/muting.py

@@ -1,104 +1,63 @@
-from collections.abc import Iterable
-
 from api.db_utils import rls_transaction
-from api.models import Finding, MuteRule, Scan, StateChoices
+from api.models import Finding, MuteRule
 from celery.utils.log import get_task_logger
+from config.django.base import DJANGO_FINDINGS_BATCH_SIZE
+from tasks.utils import batched
 
 logger = get_task_logger(__name__)
 
 
-def _mute_findings_for_rule(
-    *,
-    tenant_id: str,
-    scan_id: str,
-    finding_uids: Iterable[str],
-    muted_at,
-    muted_reason: str,
-) -> int:
-    finding_uids = list(finding_uids)
-    if not finding_uids:
-        return 0
+def mute_historical_findings(tenant_id: str, mute_rule_id: str):
+    """
+    Mute historical findings that match the given mute rule.
 
-    return Finding.all_objects.filter(
-        tenant_id=tenant_id,
-        scan_id=scan_id,
-        uid__in=finding_uids,
-        muted=False,
-    ).update(
-        muted=True,
-        muted_at=muted_at,
-        muted_reason=muted_reason,
-    )
+    This function processes findings in batches, updating their muted status
+    and adding the mute reason.
 
+    Args:
+        tenant_id (str): The tenant ID for RLS context
+        mute_rule_id (str): The ID of the mute rule to apply
 
-def mute_findings_in_latest_scans(
-    tenant_id: str, mute_rule_id: str, provider_ids: list[str]
-) -> dict:
-    """Apply a mute rule to the latest completed scan of each provider."""
-    provider_ids = list(dict.fromkeys(provider_ids))
+    Returns:
+        dict: Summary of the muting operation with findings_muted count
+    """
+    findings_muted_count = 0
 
+    # Get the list of UIDs to mute and the reason
     with rls_transaction(tenant_id):
         mute_rule = MuteRule.objects.get(id=mute_rule_id, tenant_id=tenant_id)
-        latest_scans = list(
-            Scan.objects.filter(
-                tenant_id=tenant_id,
-                provider_id__in=provider_ids,
-                state=StateChoices.COMPLETED,
-                completed_at__isnull=False,
-            )
-            .order_by("provider_id", "-completed_at", "-inserted_at", "-id")
-            .distinct("provider_id")
-            .values_list("id", flat=True)
-        )
-
-        changed_scan_ids = []
-        findings_muted = 0
-        for scan_id in latest_scans:
-            updated = _mute_findings_for_rule(
-                tenant_id=tenant_id,
-                scan_id=str(scan_id),
-                finding_uids=mute_rule.finding_uids,
-                muted_at=mute_rule.inserted_at,
-                muted_reason=mute_rule.reason,
-            )
-            if updated:
-                findings_muted += updated
-                changed_scan_ids.append(str(scan_id))
-
-    logger.info(
-        "Muted %d findings in %d latest scans for rule %s",
-        findings_muted,
-        len(changed_scan_ids),
-        mute_rule_id,
-    )
-    return {
-        "findings_muted": findings_muted,
-        "rule_id": mute_rule_id,
-        "scan_ids": changed_scan_ids,
-    }
-
-
-def reconcile_scan_mute_rules(tenant_id: str, scan_id: str) -> dict:
-    """Apply the current enabled mute rules to one completed scan."""
-    findings_muted = 0
+        finding_uids = mute_rule.finding_uids
+        mute_reason = mute_rule.reason
+        muted_at = mute_rule.inserted_at
 
+    # Query findings that match the UIDs and are not already muted
     with rls_transaction(tenant_id):
-        mute_rules = MuteRule.objects.filter(tenant_id=tenant_id, enabled=True).values(
-            "finding_uids", "reason", "inserted_at"
+        findings_to_mute = Finding.objects.filter(
+            tenant_id=tenant_id, uid__in=finding_uids, muted=False
+        )
+        total_findings = findings_to_mute.count()
+
+        logger.info(
+            f"Processing {total_findings} findings for mute rule {mute_rule_id}"
         )
 
-        for mute_rule in mute_rules:
-            findings_muted += _mute_findings_for_rule(
-                tenant_id=tenant_id,
-                scan_id=scan_id,
-                finding_uids=mute_rule["finding_uids"],
-                muted_at=mute_rule["inserted_at"],
-                muted_reason=mute_rule["reason"],
-            )
+        if total_findings > 0:
+            for batch, is_last in batched(
+                findings_to_mute.iterator(), DJANGO_FINDINGS_BATCH_SIZE
+            ):
+                batch_ids = [f.id for f in batch]
+                updated_count = Finding.all_objects.filter(
+                    id__in=batch_ids, tenant_id=tenant_id
+                ).update(
+                    muted=True,
+                    muted_at=muted_at,
+                    muted_reason=mute_reason,
+                )
+                findings_muted_count += updated_count
 
-    logger.info(
-        "Reconciled mute rules for scan %s; muted %d findings",
-        scan_id,
-        findings_muted,
-    )
-    return {"findings_muted": findings_muted, "scan_id": str(scan_id)}
+    logger.info(f"Muted {findings_muted_count} findings for rule {mute_rule_id}")
+
+    return {
+        "findings_muted": findings_muted_count,
+        "rule_id": mute_rule_id,
+    }

api/src/backend/tasks/jobs/report.py

@@ -13,7 +13,6 @@ from api.db_utils import rls_transaction
 from api.models import Provider, Scan, ScanSummary, StateChoices, ThreatScoreSnapshot
 from celery.utils.log import get_task_logger
 from config.django.base import DJANGO_TMP_OUTPUT_DIRECTORY
-from config.settings.sentry import ERROR_CATEGORY_ATTRIBUTE, FILESYSTEM_ERROR_CATEGORY
 from prowler.lib.check.compliance_models import (
     Compliance,
     get_bulk_compliance_frameworks_universal,
@@ -961,15 +960,7 @@ def generate_compliance_reports(
             first_output_path = next(iter(output_paths.values()))
             out_dir = str(Path(first_output_path).parent.parent)
     except Exception as e:
-        # logger.exception attaches the exception (and its traceback) to the
-        # Sentry event and the filesystem category opts that event into the
-        # errno fingerprint, so ENOSPC, ENOENT and EACCES raised from this same
-        # call site land on separate issues.
-        logger.exception(
-            "Error generating output directory: %s",
-            e,
-            extra={ERROR_CATEGORY_ATTRIBUTE: FILESYSTEM_ERROR_CATEGORY},
-        )
+        logger.error("Error generating output directory: %s", e)
         error_dict = {"error": str(e), "upload": False, "path": ""}
         if generate_threatscore:
             results["threatscore"] = error_dict.copy()

api/src/backend/tasks/jobs/scan.py

@@ -5,6 +5,7 @@ import json
 import random
 import re
 import time
+import uuid
 from collections import defaultdict
 from collections.abc import Callable, Iterable
 from datetime import UTC, datetime
@@ -72,7 +73,6 @@ from tasks.jobs.queries import (
     COMPLIANCE_UPSERT_TENANT_SUMMARY_SQL,
 )
 from tasks.utils import CustomEncoder, batched
-from uuid6 import uuid7
 
 logger = get_task_logger(__name__)
 
@@ -1756,27 +1756,32 @@ def aggregate_findings(tenant_id: str, scan_id: str):
 
 
 def _aggregate_findings_by_region(
-    tenant_id: str,
-    scan_id: str,
-    normalized_threatscore_id: str,
-    threatscore_requirements_by_check: dict[str, list[str]],
+    tenant_id: str, scan_id: str, modeled_threatscore_compliance_id: str
 ) -> tuple[dict, dict]:
     """
     Aggregate findings by region using streaming, column-scoped ORM reads.
 
     Reads only the consumed columns as tuples via ``values_list`` and streams
     them with ``.iterator()``, using the denormalized ``resource_regions`` array
-    instead of ``prefetch_related("resources")``. ThreatScore requirement ids
-    are resolved per ``check_id`` from ``threatscore_requirements_by_check``.
+    instead of ``prefetch_related("resources")``. ``resource_regions`` mirrors the
+    regions of a finding's related resources, so it yields the same per-region
+    tally without joining the resource table.
+
+    Args:
+        tenant_id: Tenant UUID
+        scan_id: Scan UUID
+        modeled_threatscore_compliance_id: ID for ThreatScore compliance framework
 
     Returns:
         tuple: (check_status_by_region, findings_count_by_compliance)
             - check_status_by_region: {region: {check_id: status}}
-            - findings_count_by_compliance: {region: {normalized_threatscore_id: {requirement_id: {total, pass}}}}
+            - findings_count_by_compliance: {region: {normalized_id: {requirement_id: {total, pass}}}}
     """
     check_status_by_region: dict = {}
     findings_count_by_compliance: dict = {}
 
+    normalized_id = re.sub(r"[^a-z0-9]", "", modeled_threatscore_compliance_id.lower())
+
     with rls_transaction(tenant_id, using=READ_REPLICA_ALIAS):
         findings = (
             Finding.all_objects.filter(
@@ -1785,12 +1790,14 @@ def _aggregate_findings_by_region(
                 muted=False,
                 status__in=["PASS", "FAIL"],
             )
-            .values_list("check_id", "status", "resource_regions")
+            .values_list("check_id", "status", "resource_regions", "compliance")
             .iterator(chunk_size=DJANGO_FINDINGS_BATCH_SIZE)
         )
 
-        for check_id, status, resource_regions in findings:
-            threatscore_requirements = threatscore_requirements_by_check.get(check_id)
+        for check_id, status, resource_regions, compliance in findings:
+            threatscore_requirements = (compliance or {}).get(
+                modeled_threatscore_compliance_id
+            )
 
             for region in resource_regions or ():
                 # Priority: FAIL > any other status
@@ -1802,7 +1809,7 @@ def _aggregate_findings_by_region(
                 if threatscore_requirements:
                     compliance_key = findings_count_by_compliance.setdefault(
                         region, {}
-                    ).setdefault(normalized_threatscore_id, {})
+                    ).setdefault(normalized_id, {})
 
                     for requirement_id in threatscore_requirements:
                         requirement_stats = compliance_key.setdefault(
@@ -1841,28 +1848,15 @@ def create_compliance_requirements(tenant_id: str, scan_id: str):
         compliance_template = PROWLER_COMPLIANCE_OVERVIEW_TEMPLATE[
             provider_instance.provider
         ]
-        normalized_threatscore_id = _normalized_compliance_key(
-            "ProwlerThreatScore", "1.0"
-        )
+        modeled_threatscore_compliance_id = "ProwlerThreatScore-1.0"
 
         requirement_lookup: dict[str, list[tuple[str, str]]] = {}
-        threatscore_requirements_by_check: dict[str, list[str]] = {}
         for compliance_id, compliance in compliance_template.items():
-            is_threatscore = (
-                _normalized_compliance_key(
-                    compliance["framework"], compliance["version"]
-                )
-                == normalized_threatscore_id
-            )
             for requirement_id, requirement in compliance["requirements"].items():
                 for check_id in requirement["checks"].keys():
                     requirement_lookup.setdefault(check_id, []).append(
                         (compliance_id, requirement_id)
                     )
-                    if is_threatscore:
-                        threatscore_requirements_by_check.setdefault(
-                            check_id, []
-                        ).append(requirement_id)
 
         regions = []
         requirements_created = 0
@@ -1875,10 +1869,7 @@ def create_compliance_requirements(tenant_id: str, scan_id: str):
             # Aggregate findings by region using SQL for optimal performance
             check_status_by_region, findings_count_by_compliance = (
                 _aggregate_findings_by_region(
-                    tenant_id,
-                    scan_id,
-                    normalized_threatscore_id,
-                    threatscore_requirements_by_check,
+                    tenant_id, scan_id, modeled_threatscore_compliance_id
                 )
             )
 
@@ -1943,35 +1934,23 @@ def create_compliance_requirements(tenant_id: str, scan_id: str):
             # Yield rows lazily (consumed batch-by-batch by COPY) so peak memory
             # stays bounded; tally requirement_statuses in the same pass. The
             # ORM fallback re-iterates from scratch, so the tally resets first.
-            # Region is the innermost loop so consecutive rows share the leading
-            # columns of the table's secondary indexes.
             def _iter_compliance_requirement_rows():
                 requirement_statuses.clear()
-                for (
-                    compliance_id,
-                    framework,
-                    version,
-                    modeled_compliance_id,
-                    requirements,
-                ) in compliance_plan:
-                    stats_by_region = [
-                        (
-                            region,
-                            region_requirement_stats.get(region, {}).get(
-                                compliance_id, {}
-                            ),
-                            findings_count_by_compliance.get(region, {}).get(
-                                modeled_compliance_id, {}
-                            ),
+                for region in regions:
+                    region_stats = region_requirement_stats.get(region, {})
+                    region_findings = findings_count_by_compliance.get(region, {})
+                    for (
+                        compliance_id,
+                        framework,
+                        version,
+                        modeled_compliance_id,
+                        requirements,
+                    ) in compliance_plan:
+                        compliance_stats = region_stats.get(compliance_id, {})
+                        compliance_findings = region_findings.get(
+                            modeled_compliance_id, {}
                         )
-                        for region in regions
-                    ]
-                    for requirement_id, description, total_checks in requirements:
-                        for (
-                            region,
-                            compliance_stats,
-                            compliance_findings,
-                        ) in stats_by_region:
+                        for requirement_id, description, total_checks in requirements:
                             stats = compliance_stats.get(requirement_id)
                             if stats:
                                 passed_checks = stats["passed_checks"]
@@ -2002,7 +1981,7 @@ def create_compliance_requirements(tenant_id: str, scan_id: str):
                                 requirement_statuses[key]["pass_count"] += 1
 
                             yield {
-                                "id": uuid7(),
+                                "id": uuid.uuid4(),
                                 "tenant_id": tenant_id_str,
                                 "inserted_at": utc_datetime_now,
                                 "compliance_id": compliance_id,

api/src/backend/tasks/tasks.py

@@ -73,10 +73,7 @@ from tasks.jobs.lighthouse_providers import (
     check_lighthouse_provider_connection,
     refresh_lighthouse_provider_models,
 )
-from tasks.jobs.muting import (
-    mute_findings_in_latest_scans,
-    reconcile_scan_mute_rules,
-)
+from tasks.jobs.muting import mute_historical_findings
 from tasks.jobs.orphan_recovery import reconcile_orphans
 from tasks.jobs.report import (
     STALE_TMP_OUTPUT_MAX_AGE_HOURS,
@@ -529,7 +526,6 @@ def perform_scan_task(
             provider_id=provider_id,
             checks_to_execute=checks_to_execute,
         )
-        reconcile_scan_mute_rules(tenant_id, scan_id)
         _perform_scan_complete_tasks(tenant_id, scan_id, provider_id)
         return result
     finally:
@@ -639,7 +635,6 @@ def perform_scheduled_scan_task(self, tenant_id: str, provider_id: str):
             scan_id=str(scan_instance.id),
             provider_id=provider_id,
         )
-        reconcile_scan_mute_rules(tenant_id, str(scan_instance.id))
         _perform_scan_complete_tasks(tenant_id, str(scan_instance.id), provider_id)
         return result
     finally:
@@ -1193,48 +1188,85 @@ def aggregate_finding_group_summaries_task(tenant_id: str, scan_id: str):
     return aggregate_finding_group_summaries(tenant_id=tenant_id, scan_id=scan_id)
 
 
-def _dispatch_scan_summary_reaggregation(tenant_id: str, scan_ids: list[str]) -> None:
-    if not scan_ids:
-        return
-
-    logger.info(
-        "Reaggregating overview/finding summaries for %d latest scans",
-        len(scan_ids),
-    )
-    group(
-        chain(
-            perform_scan_summary_task.si(tenant_id=tenant_id, scan_id=scan_id),
-            group(
-                aggregate_daily_severity_task.si(tenant_id=tenant_id, scan_id=scan_id),
-                aggregate_finding_group_summaries_task.si(
-                    tenant_id=tenant_id, scan_id=scan_id
-                ),
-                aggregate_scan_resource_group_summaries_task.si(
-                    tenant_id=tenant_id, scan_id=scan_id
-                ),
-                aggregate_scan_category_summaries_task.si(
-                    tenant_id=tenant_id, scan_id=scan_id
-                ),
-                aggregate_attack_surface_task.si(tenant_id=tenant_id, scan_id=scan_id),
-            ),
-        )
-        for scan_id in scan_ids
-    ).apply_async()
-
-
-@shared_task(base=RLSTask, name="findings-mute-latest-scans", queue="overview")
+@shared_task(
+    base=RLSTask, name="reaggregate-all-finding-group-summaries", queue="overview"
+)
 @set_tenant(keep_tenant=True)
-def mute_findings_in_latest_scans_task(
-    tenant_id: str, mute_rule_id: str, provider_ids: list[str]
-):
-    """Apply a mute rule to current scans and rebuild only changed summaries."""
-    result = mute_findings_in_latest_scans(
-        tenant_id=tenant_id,
-        mute_rule_id=mute_rule_id,
-        provider_ids=provider_ids,
+def reaggregate_all_finding_group_summaries_task(tenant_id: str):
+    """Reaggregate every pre-aggregated summary table for this tenant.
+
+    Mirrors the unbounded scope of `mute_historical_findings_task`: that task
+    rewrites every Finding row whose UID matches a mute rule, with no time
+    limit. To keep the pre-aggregated tables consistent with that update,
+    this task re-runs the same per-scan aggregation pipeline that scan
+    completion runs on the latest completed scan of every (provider, day)
+    pair, rebuilding the tables that power the read endpoints:
+
+      - `ScanSummary` and `DailySeveritySummary` -> `/overviews/findings`,
+        `/overviews/findings-severity`, `/overviews/services`.
+      - `FindingGroupDailySummary` -> `/finding-groups` and
+        `/finding-groups/latest`.
+      - `ScanGroupSummary` -> `/overviews/resource-groups` (resource
+        inventory).
+      - `ScanCategorySummary` -> `/overviews/categories`.
+      - `AttackSurfaceOverview` -> `/overviews/attack-surfaces`.
+
+    Per-scan pipelines are dispatched in parallel via a Celery group so
+    wallclock scales with the worker pool.
+    """
+    completed_scans = list(
+        Scan.objects.filter(
+            tenant_id=tenant_id,
+            state=StateChoices.COMPLETED,
+            completed_at__isnull=False,
+        )
+        .order_by("-completed_at")
+        .values("id", "completed_at", "provider_id")
     )
-    _dispatch_scan_summary_reaggregation(tenant_id, result["scan_ids"])
-    return result
+
+    # Keep the latest scan per (provider, day) pair so the daily summary row
+    # the aggregator writes is the most recent snapshot of that day for that
+    # provider. Iterating from most recent to oldest means the first scan we
+    # see for a given key wins.
+    latest_scans: dict[tuple, str] = {}
+    for scan in completed_scans:
+        key = (scan["provider_id"], scan["completed_at"].date())
+        if key not in latest_scans:
+            latest_scans[key] = str(scan["id"])
+
+    scan_ids = list(latest_scans.values())
+    if scan_ids:
+        logger.info(
+            "Reaggregating overview/finding summaries for %d scans (provider x day)",
+            len(scan_ids),
+        )
+        # DailySeveritySummary reads from ScanSummary, so ScanSummary must be
+        # recomputed first; the other aggregators read Finding directly and
+        # can run in parallel with the severity step.
+        group(
+            chain(
+                perform_scan_summary_task.si(tenant_id=tenant_id, scan_id=scan_id),
+                group(
+                    aggregate_daily_severity_task.si(
+                        tenant_id=tenant_id, scan_id=scan_id
+                    ),
+                    aggregate_finding_group_summaries_task.si(
+                        tenant_id=tenant_id, scan_id=scan_id
+                    ),
+                    aggregate_scan_resource_group_summaries_task.si(
+                        tenant_id=tenant_id, scan_id=scan_id
+                    ),
+                    aggregate_scan_category_summaries_task.si(
+                        tenant_id=tenant_id, scan_id=scan_id
+                    ),
+                    aggregate_attack_surface_task.si(
+                        tenant_id=tenant_id, scan_id=scan_id
+                    ),
+                ),
+            )
+            for scan_id in scan_ids
+        ).apply_async()
+    return {"scans_reaggregated": len(scan_ids)}
 
 
 @shared_task(base=RLSTask, name="lighthouse-connection-check")
@@ -1435,3 +1467,25 @@ def generate_compliance_reports_task(tenant_id: str, scan_id: str, provider_id:
         generate_csa=True,
         generate_cis=True,
     )
+
+
+@shared_task(name="findings-mute-historical")
+def mute_historical_findings_task(tenant_id: str, mute_rule_id: str):
+    """
+    Background task to mute all historical findings matching a mute rule.
+
+    This task processes findings in batches to avoid memory issues with large datasets.
+    It updates the Finding.muted, Finding.muted_at, and Finding.muted_reason fields
+    for all findings whose UID is in the mute rule's finding_uids list.
+
+    Args:
+        tenant_id (str): The tenant ID for RLS context.
+        mute_rule_id (str): The primary key of the MuteRule to apply.
+
+    Returns:
+        dict: A dictionary containing:
+            - 'findings_muted' (int): Total number of findings muted.
+            - 'rule_id' (str): The mute rule ID.
+            - 'status' (str): Final status ('completed').
+    """
+    return mute_historical_findings(tenant_id, mute_rule_id)

api/src/backend/tasks/tests/test_integrations.py

@@ -6,20 +6,15 @@ from api.db_router import READ_REPLICA_ALIAS, MainRouter
 from api.models import Integration
 from api.utils import prowler_integration_connection_test
 from django.db import OperationalError
-from django.test import override_settings
 from prowler.lib.outputs.jira.exceptions.exceptions import (
     JiraRefreshTokenError,
     JiraRequiredCustomFieldsError,
 )
-from prowler.lib.outputs.jira.jira import Jira
 from prowler.providers.aws.lib.security_hub.security_hub import SecurityHubConnection
 from prowler.providers.common.models import Connection
 from tasks.jobs.integrations import (
-    build_jira_finding_url,
-    build_jira_issue_labels,
     get_s3_client_from_integration,
     get_security_hub_client_from_integration,
-    get_tenant_name,
     send_findings_to_jira,
     upload_s3_integration,
     upload_security_hub_integration,
@@ -1701,7 +1696,6 @@ class TestJiraIntegration:
 
         finding1 = MagicMock()
         finding1.id = "finding-1"
-        finding1.uid = "prowler-aws-check_001-123456789012-us-east-1-my bucket"
         finding1.check_id = "check_001"
         finding1.severity = "high"
         finding1.status = "FAIL"
@@ -1730,7 +1724,6 @@ class TestJiraIntegration:
 
         finding2 = MagicMock()
         finding2.id = "finding-2"
-        finding2.uid = "prowler-azure-check_002-sub/resource"
         finding2.check_id = "check_002"
         finding2.severity = "medium"
         finding2.status = "PASS"
@@ -1755,13 +1748,9 @@ class TestJiraIntegration:
         ]
 
         # Call the function
-        with (
-            override_settings(UI_BASE_URL="https://cloud.example.com"),
-            patch("tasks.jobs.integrations.get_tenant_name", return_value="Acme"),
-        ):
-            result = send_findings_to_jira(
-                tenant_id, integration_id, project_key, issue_type, finding_ids
-            )
+        result = send_findings_to_jira(
+            tenant_id, integration_id, project_key, issue_type, finding_ids
+        )
 
         # Assertions
         assert result == {"created_count": 2, "failed_count": 0}
@@ -1784,36 +1773,12 @@ class TestJiraIntegration:
         assert first_call.kwargs["provider"] == "aws"
         assert first_call.kwargs["project_key"] == project_key
         assert first_call.kwargs["issue_type"] == issue_type
-        # Finding reference: labels, link back and tenant info
-        assert first_call.kwargs["issue_labels"] == [
-            "prowler",
-            "prowler-aws",
-            "prowler-high",
-            "prowler-check_001",
-            "prowler-finding-prowler-aws-check_001-123456789012-us-east-1-my_bucket",
-        ]
-        assert first_call.kwargs["finding_url"] == (
-            "https://cloud.example.com/findings?filter[uid]="
-            "prowler-aws-check_001-123456789012-us-east-1-my%20bucket"
-        )
-        assert first_call.kwargs["tenant_info"] == "Acme"
 
         # Verify second call
         second_call = mock_jira_integration.send_finding.call_args_list[1]
         assert second_call.kwargs["check_id"] == "check_002"
         assert second_call.kwargs["severity"] == "medium"
         assert second_call.kwargs["status"] == "PASS"
-        assert second_call.kwargs["issue_labels"] == [
-            "prowler",
-            "prowler-azure",
-            "prowler-medium",
-            "prowler-check_002",
-            "prowler-finding-prowler-azure-check_002-sub/resource",
-        ]
-        assert second_call.kwargs["finding_url"] == (
-            "https://cloud.example.com/findings?filter[uid]="
-            "prowler-azure-check_002-sub%2Fresource"
-        )
 
     @patch("tasks.jobs.integrations.rls_transaction")
     @patch("tasks.jobs.integrations.Finding")
@@ -2235,101 +2200,3 @@ class TestJiraIntegration:
         assert call_kwargs["remediation_code_cli"] == ""
         assert call_kwargs["remediation_code_other"] == ""
         assert call_kwargs["compliance"] == {}
-
-
-class TestJiraFindingReference:
-    """Helpers that give Jira issues a stable reference back to the finding."""
-
-    def test_build_jira_issue_labels(self):
-        assert build_jira_issue_labels(
-            finding_uid="prowler-aws-check-123-eu-west-1-hub/unknown",
-            provider="aws",
-            severity="critical",
-            check_id="iam_root_mfa",
-        ) == [
-            "prowler",
-            "prowler-aws",
-            "prowler-critical",
-            "prowler-iam_root_mfa",
-            "prowler-finding-prowler-aws-check-123-eu-west-1-hub/unknown",
-        ]
-
-    def test_build_jira_issue_labels_skips_empty_parts(self):
-        assert build_jira_issue_labels(
-            finding_uid="", provider="", severity="", check_id=""
-        ) == ["prowler"]
-
-    def test_build_jira_issue_labels_sanitizes_metadata(self):
-        assert build_jira_issue_labels(
-            finding_uid=" uid\x00 with spaces ",
-            provider="aws cloud",
-            severity="high severity",
-            check_id="check id",
-        ) == [
-            "prowler",
-            "prowler-aws_cloud",
-            "prowler-high_severity",
-            "prowler-check_id",
-            "prowler-finding-uid_with_spaces",
-        ]
-
-    def test_build_jira_issue_labels_preserves_maximum_length_uid(self):
-        finding_uid = "u" * (Jira.LABEL_MAX_LENGTH - len(Jira.FINDING_LABEL_PREFIX) - 1)
-        finding_label = build_jira_issue_labels(
-            finding_uid=finding_uid,
-            provider="gcp",
-            severity="low",
-            check_id="check",
-        )[-1]
-
-        assert finding_label == f"{Jira.FINDING_LABEL_PREFIX}-{finding_uid}"
-        assert len(finding_label) == Jira.LABEL_MAX_LENGTH
-
-    def test_build_jira_issue_labels_distinguishes_long_uids(self):
-        common_prefix = "u" * 300
-        first_uid = f"{common_prefix}-first"
-        second_uid = f"{common_prefix}-second"
-
-        first_label = build_jira_issue_labels(
-            finding_uid=first_uid,
-            provider="gcp",
-            severity="low",
-            check_id="check",
-        )[-1]
-        second_label = build_jira_issue_labels(
-            finding_uid=second_uid,
-            provider="gcp",
-            severity="low",
-            check_id="check",
-        )[-1]
-
-        assert first_label == Jira.build_finding_label(first_uid)
-        assert second_label == Jira.build_finding_label(second_uid)
-        assert first_label != second_label
-        assert len(first_label) == Jira.LABEL_MAX_LENGTH
-        assert len(second_label) == Jira.LABEL_MAX_LENGTH
-
-    @override_settings(UI_BASE_URL="")
-    def test_build_jira_finding_url_without_base_url(self):
-        assert build_jira_finding_url("prowler-aws-check-1") == ""
-
-    @override_settings(UI_BASE_URL="https://cloud.example.com")
-    def test_build_jira_finding_url_with_base_url(self):
-        assert build_jira_finding_url("prowler-aws-check-1") == (
-            "https://cloud.example.com/findings?filter[uid]=prowler-aws-check-1"
-        )
-        # uid characters that would break the query string are encoded
-        assert build_jira_finding_url("a/b c&d") == (
-            "https://cloud.example.com/findings?filter[uid]=a%2Fb%20c%26d"
-        )
-        assert build_jira_finding_url("") == ""
-
-    @pytest.mark.django_db
-    def test_get_tenant_name(self, tenants_fixture):
-        tenant = tenants_fixture[0]
-        assert get_tenant_name(str(tenant.id)) == tenant.name
-
-    @pytest.mark.django_db
-    def test_get_tenant_name_unknown_or_invalid(self):
-        assert get_tenant_name("00000000-0000-0000-0000-000000000000") == ""
-        assert get_tenant_name("not-a-uuid") == ""

api/src/backend/tasks/tests/test_muting.py

@@ -1,205 +1,531 @@
-from datetime import UTC, datetime, timedelta
+from datetime import UTC, datetime
 from uuid import uuid4
 
 import pytest
-from api.models import Finding, MuteRule, Scan, StateChoices
+from api.models import Finding, MuteRule
+from django.core.exceptions import ObjectDoesNotExist
 from prowler.lib.check.models import Severity
 from prowler.lib.outputs.finding import Status
-from tasks.jobs.muting import (
-    mute_findings_in_latest_scans,
-    reconcile_scan_mute_rules,
-)
-
-
-def _create_finding(scan: Scan, uid: str) -> Finding:
-    return Finding.objects.create(
-        tenant_id=scan.tenant_id,
-        uid=uid,
-        scan=scan,
-        status=Status.FAIL,
-        status_extended="Test finding",
-        impact=Severity.high,
-        severity=Severity.high,
-        raw_result={},
-        check_id="test_check",
-        check_metadata={"CheckId": "test_check"},
-        muted=False,
-    )
-
-
-def _create_mute_rule(tenant_id, user, finding_uids, *, enabled=True) -> MuteRule:
-    return MuteRule.objects.create(
-        tenant_id=tenant_id,
-        name=f"Mute rule {uuid4()}",
-        reason="Approved exception",
-        enabled=enabled,
-        created_by=user,
-        finding_uids=finding_uids,
-    )
+from tasks.jobs.muting import mute_historical_findings
 
 
 @pytest.mark.django_db
-class TestMuteFindingsInLatestScans:
-    def test_mutes_latest_scan_and_leaves_older_scan_unchanged(
-        self, scans_fixture, create_test_user
-    ):
-        latest_scan = scans_fixture[0]
-        older_scan = Scan.objects.create(
-            tenant_id=latest_scan.tenant_id,
-            provider=latest_scan.provider,
-            name="Older scan",
-            trigger=Scan.TriggerChoices.MANUAL,
-            state=StateChoices.COMPLETED,
-            started_at=datetime.now(UTC) - timedelta(days=1),
-            completed_at=datetime.now(UTC) - timedelta(days=1),
-        )
-        uid = "latest-scan-only"
-        older_finding = _create_finding(older_scan, uid)
-        latest_finding = _create_finding(latest_scan, uid)
-        mute_rule = _create_mute_rule(latest_scan.tenant_id, create_test_user, [uid])
+class TestMuteHistoricalFindings:
+    """
+    Test suite for the mute_historical_findings function.
 
-        result = mute_findings_in_latest_scans(
-            str(latest_scan.tenant_id),
-            str(mute_rule.id),
-            [str(latest_scan.provider_id)],
-        )
+    This class tests the batch processing of findings to update their muted status
+    based on MuteRule criteria.
+    """
 
-        older_finding.refresh_from_db()
-        latest_finding.refresh_from_db()
-        assert older_finding.muted is False
-        assert latest_finding.muted is True
-        assert latest_finding.muted_at == mute_rule.inserted_at
-        assert latest_finding.muted_reason == mute_rule.reason
-        assert result == {
-            "findings_muted": 1,
-            "rule_id": str(mute_rule.id),
-            "scan_ids": [str(latest_scan.id)],
-        }
+    @pytest.fixture(scope="function")
+    def test_user(self, create_test_user):
+        """Create a test user for mute rule creation."""
+        return create_test_user
 
-    def test_mutes_one_latest_scan_per_provider(self, scans_fixture, create_test_user):
-        first_scan, second_scan, _ = scans_fixture
-        uid = "shared-selected-uid"
-        first_finding = _create_finding(first_scan, uid)
-        second_finding = _create_finding(second_scan, uid)
-        mute_rule = _create_mute_rule(first_scan.tenant_id, create_test_user, [uid])
-
-        result = mute_findings_in_latest_scans(
-            str(first_scan.tenant_id),
-            str(mute_rule.id),
-            [str(first_scan.provider_id), str(second_scan.provider_id)],
-        )
-
-        first_finding.refresh_from_db()
-        second_finding.refresh_from_db()
-        assert first_finding.muted is True
-        assert second_finding.muted is True
-        assert result["findings_muted"] == 2
-        assert set(result["scan_ids"]) == {str(first_scan.id), str(second_scan.id)}
-
-    def test_provider_without_completed_scan_does_nothing(
-        self, tenants_fixture, provider_factory, create_test_user
-    ):
+    @pytest.fixture(scope="function")
+    def mute_rule_with_findings(self, tenants_fixture, findings_fixture, test_user):
+        """
+        Create a mute rule that targets the first finding in the fixture.
+        """
         tenant = tenants_fixture[0]
-        provider = provider_factory()
-        mute_rule = _create_mute_rule(
-            tenant.id, create_test_user, ["future-scan-finding"]
+        finding = findings_fixture[0]
+
+        mute_rule = MuteRule.objects.create(
+            tenant_id=tenant.id,
+            name="Test Mute Rule",
+            reason="Testing mute functionality",
+            enabled=True,
+            created_by=test_user,
+            finding_uids=[finding.uid],
         )
 
-        result = mute_findings_in_latest_scans(
-            str(tenant.id), str(mute_rule.id), [str(provider.id)]
-        )
+        return mute_rule
 
-        assert result == {
-            "findings_muted": 0,
-            "rule_id": str(mute_rule.id),
-            "scan_ids": [],
-        }
-
-    def test_retry_does_not_report_changed_scans_twice(
-        self, scans_fixture, create_test_user
-    ):
+    @pytest.fixture(scope="function")
+    def mute_rule_multiple_findings(self, scans_fixture, test_user):
+        """
+        Create multiple unmuted findings and a mute rule targeting all of them.
+        """
         scan = scans_fixture[0]
-        finding = _create_finding(scan, "idempotent-mute")
-        mute_rule = _create_mute_rule(scan.tenant_id, create_test_user, [finding.uid])
-        args = (
-            str(scan.tenant_id),
-            str(mute_rule.id),
-            [str(scan.provider_id)],
+        tenant_id = scan.tenant_id
+
+        # Create 5 unmuted findings
+        finding_uids = []
+        for i in range(5):
+            finding = Finding.objects.create(
+                tenant_id=tenant_id,
+                uid=f"test_finding_uid_mute_{i}",
+                scan=scan,
+                status=Status.FAIL,
+                status_extended=f"Test status {i}",
+                impact=Severity.high,
+                severity=Severity.high,
+                raw_result={
+                    "status": Status.FAIL,
+                    "impact": Severity.high,
+                    "severity": Severity.high,
+                },
+                check_id=f"test_check_id_{i}",
+                check_metadata={
+                    "CheckId": f"test_check_id_{i}",
+                    "Description": f"Test description {i}",
+                },
+                muted=False,
+            )
+            finding_uids.append(finding.uid)
+
+        # Create mute rule targeting all findings
+        mute_rule = MuteRule.objects.create(
+            tenant_id=tenant_id,
+            name="Test Multiple Findings Mute Rule",
+            reason="Testing batch muting",
+            enabled=True,
+            created_by=test_user,
+            finding_uids=finding_uids,
         )
 
-        first_result = mute_findings_in_latest_scans(*args)
-        second_result = mute_findings_in_latest_scans(*args)
+        return mute_rule, finding_uids
 
-        assert first_result["scan_ids"] == [str(scan.id)]
-        assert second_result["findings_muted"] == 0
-        assert second_result["scan_ids"] == []
+    @pytest.fixture(scope="function")
+    def mute_rule_already_muted(self, findings_fixture, test_user):
+        """
+        Create a mute rule that targets an already-muted finding.
+        """
+        tenant_id = findings_fixture[1].tenant_id
+        already_muted_finding = findings_fixture[1]
 
-    def test_does_not_cross_tenant_boundary(
-        self, tenants_fixture, provider_factory, create_test_user
-    ):
-        tenant = tenants_fixture[0]
-        other_tenant = tenants_fixture[2]
-        other_provider = provider_factory(tenant=other_tenant)
-        other_scan = Scan.objects.create(
-            tenant_id=other_tenant.id,
-            provider=other_provider,
-            name="Other tenant scan",
-            trigger=Scan.TriggerChoices.MANUAL,
-            state=StateChoices.COMPLETED,
-            started_at=datetime.now(UTC),
-            completed_at=datetime.now(UTC),
-        )
-        other_finding = _create_finding(other_scan, "tenant-isolated-uid")
-        mute_rule = _create_mute_rule(tenant.id, create_test_user, [other_finding.uid])
-
-        result = mute_findings_in_latest_scans(
-            str(tenant.id), str(mute_rule.id), [str(other_provider.id)]
+        mute_rule = MuteRule.objects.create(
+            tenant_id=tenant_id,
+            name="Test Already Muted Rule",
+            reason="Testing already muted findings",
+            enabled=True,
+            created_by=test_user,
+            finding_uids=[already_muted_finding.uid],
         )
 
-        other_finding.refresh_from_db()
-        assert other_finding.muted is False
-        assert result["scan_ids"] == []
+        return mute_rule
 
-    def test_nonexistent_rule_raises(self, tenants_fixture):
-        with pytest.raises(MuteRule.DoesNotExist):
-            mute_findings_in_latest_scans(str(tenants_fixture[0].id), str(uuid4()), [])
-
-
-@pytest.mark.django_db
-class TestReconcileScanMuteRules:
-    def test_applies_only_enabled_rules_to_requested_scan(
-        self, scans_fixture, create_test_user
-    ):
+    @pytest.fixture(scope="function")
+    def mute_rule_mixed_findings(self, scans_fixture, test_user):
+        """
+        Create a mute rule with a mix of muted and unmuted findings.
+        """
         scan = scans_fixture[0]
-        active_finding = _create_finding(scan, "active-rule-uid")
-        disabled_finding = _create_finding(scan, "disabled-rule-uid")
-        active_rule = _create_mute_rule(
-            scan.tenant_id, create_test_user, [active_finding.uid]
-        )
-        _create_mute_rule(
-            scan.tenant_id,
-            create_test_user,
-            [disabled_finding.uid],
-            enabled=False,
-        )
-        older_scan = Scan.objects.create(
-            tenant_id=scan.tenant_id,
-            provider=scan.provider,
-            name="Older matching scan",
-            trigger=Scan.TriggerChoices.MANUAL,
-            state=StateChoices.COMPLETED,
-            started_at=datetime.now(UTC) - timedelta(days=1),
-            completed_at=datetime.now(UTC) - timedelta(days=1),
-        )
-        older_finding = _create_finding(older_scan, active_finding.uid)
+        tenant_id = scan.tenant_id
 
-        result = reconcile_scan_mute_rules(str(scan.tenant_id), str(scan.id))
+        # Create 3 unmuted findings
+        unmuted_uids = []
+        for i in range(3):
+            finding = Finding.objects.create(
+                tenant_id=tenant_id,
+                uid=f"unmuted_finding_{i}",
+                scan=scan,
+                status=Status.FAIL,
+                status_extended=f"Unmuted status {i}",
+                impact=Severity.medium,
+                severity=Severity.medium,
+                raw_result={
+                    "status": Status.FAIL,
+                    "impact": Severity.medium,
+                    "severity": Severity.medium,
+                },
+                check_id=f"unmuted_check_{i}",
+                check_metadata={
+                    "CheckId": f"unmuted_check_{i}",
+                    "Description": f"Unmuted description {i}",
+                },
+                muted=False,
+            )
+            unmuted_uids.append(finding.uid)
 
-        active_finding.refresh_from_db()
-        disabled_finding.refresh_from_db()
-        older_finding.refresh_from_db()
-        assert active_finding.muted is True
-        assert active_finding.muted_at == active_rule.inserted_at
-        assert disabled_finding.muted is False
-        assert older_finding.muted is False
-        assert result == {"findings_muted": 1, "scan_id": str(scan.id)}
+        # Create 2 already muted findings
+        muted_uids = []
+        for i in range(2):
+            finding = Finding.objects.create(
+                tenant_id=tenant_id,
+                uid=f"muted_finding_{i}",
+                scan=scan,
+                status=Status.FAIL,
+                status_extended=f"Muted status {i}",
+                impact=Severity.low,
+                severity=Severity.low,
+                raw_result={
+                    "status": Status.FAIL,
+                    "impact": Severity.low,
+                    "severity": Severity.low,
+                },
+                check_id=f"muted_check_{i}",
+                check_metadata={
+                    "CheckId": f"muted_check_{i}",
+                    "Description": f"Muted description {i}",
+                },
+                muted=True,
+                muted_at=datetime.now(UTC),
+                muted_reason="Already muted",
+            )
+            muted_uids.append(finding.uid)
+
+        # Create mute rule targeting all findings
+        all_uids = unmuted_uids + muted_uids
+        mute_rule = MuteRule.objects.create(
+            tenant_id=tenant_id,
+            name="Test Mixed Findings Rule",
+            reason="Testing mixed muted/unmuted findings",
+            enabled=True,
+            created_by=test_user,
+            finding_uids=all_uids,
+        )
+
+        return mute_rule, unmuted_uids, muted_uids
+
+    @pytest.fixture(scope="function")
+    def mute_rule_batch_test(self, scans_fixture, test_user):
+        """
+        Create enough findings to test batch processing (>1000 for default batch size).
+        """
+        scan = scans_fixture[0]
+        tenant_id = scan.tenant_id
+
+        # Create 1500 findings to exceed default batch size of 1000
+        finding_uids = []
+        for i in range(1500):
+            finding = Finding.objects.create(
+                tenant_id=tenant_id,
+                uid=f"batch_test_finding_{i}",
+                scan=scan,
+                status=Status.FAIL,
+                status_extended=f"Batch test status {i}",
+                impact=Severity.critical,
+                severity=Severity.critical,
+                raw_result={
+                    "status": Status.FAIL,
+                    "impact": Severity.critical,
+                    "severity": Severity.critical,
+                },
+                check_id=f"batch_test_check_{i}",
+                check_metadata={
+                    "CheckId": f"batch_test_check_{i}",
+                    "Description": f"Batch test description {i}",
+                },
+                muted=False,
+            )
+            finding_uids.append(finding.uid)
+
+        # Create mute rule targeting all findings
+        mute_rule = MuteRule.objects.create(
+            tenant_id=tenant_id,
+            name="Test Batch Processing Rule",
+            reason="Testing batch processing functionality",
+            enabled=True,
+            created_by=test_user,
+            finding_uids=finding_uids,
+        )
+
+        return mute_rule, finding_uids
+
+    def test_mute_historical_findings_single_finding(
+        self, mute_rule_with_findings, findings_fixture
+    ):
+        """
+        Test muting a single historical finding.
+        """
+        mute_rule = mute_rule_with_findings
+        tenant_id = str(mute_rule.tenant_id)
+        finding = findings_fixture[0]
+
+        # Ensure the finding is not muted before execution
+        finding.refresh_from_db()
+        assert finding.muted is False
+        assert finding.muted_at is None
+        assert finding.muted_reason is None
+
+        # Execute the muting function
+        result = mute_historical_findings(tenant_id, str(mute_rule.id))
+
+        # Verify return value
+        assert result["findings_muted"] == 1
+        assert result["rule_id"] == str(mute_rule.id)
+
+        # Verify the finding was muted
+        finding.refresh_from_db()
+        assert finding.muted is True
+        assert finding.muted_at == mute_rule.inserted_at
+        assert finding.muted_reason == mute_rule.reason
+
+    def test_mute_historical_findings_multiple_findings(
+        self, mute_rule_multiple_findings
+    ):
+        """
+        Test muting multiple historical findings.
+        """
+        mute_rule, finding_uids = mute_rule_multiple_findings
+        tenant_id = str(mute_rule.tenant_id)
+
+        # Verify all findings are unmuted
+        findings = Finding.objects.filter(tenant_id=tenant_id, uid__in=finding_uids)
+        assert findings.count() == 5
+        for finding in findings:
+            assert finding.muted is False
+
+        # Execute the muting function
+        result = mute_historical_findings(tenant_id, str(mute_rule.id))
+
+        # Verify return value
+        assert result["findings_muted"] == 5
+        assert result["rule_id"] == str(mute_rule.id)
+
+        # Verify all findings were muted
+        findings = Finding.objects.filter(tenant_id=tenant_id, uid__in=finding_uids)
+        for finding in findings:
+            assert finding.muted is True
+            assert finding.muted_at == mute_rule.inserted_at
+            assert finding.muted_reason == mute_rule.reason
+
+    def test_mute_historical_findings_already_muted(
+        self, mute_rule_already_muted, findings_fixture
+    ):
+        """
+        Test that already-muted findings are not counted or updated.
+        """
+        mute_rule = mute_rule_already_muted
+        tenant_id = str(mute_rule.tenant_id)
+        finding = findings_fixture[1]
+
+        # Verify the finding is already muted
+        finding.refresh_from_db()
+        assert finding.muted is True
+        original_muted_at = finding.muted_at
+        original_muted_reason = finding.muted_reason
+
+        # Execute the muting function
+        result = mute_historical_findings(tenant_id, str(mute_rule.id))
+
+        # Verify no findings were muted
+        assert result["findings_muted"] == 0
+        assert result["rule_id"] == str(mute_rule.id)
+
+        # Verify the finding's mute status did not change
+        finding.refresh_from_db()
+        assert finding.muted is True
+        assert finding.muted_at == original_muted_at
+        assert finding.muted_reason == original_muted_reason
+
+    def test_mute_historical_findings_mixed_status(self, mute_rule_mixed_findings):
+        """
+        Test muting when some findings are already muted and others are not.
+        """
+        mute_rule, unmuted_uids, muted_uids = mute_rule_mixed_findings
+        tenant_id = str(mute_rule.tenant_id)
+
+        # Execute the muting function
+        result = mute_historical_findings(tenant_id, str(mute_rule.id))
+
+        # Verify only unmuted findings were counted
+        assert result["findings_muted"] == 3
+        assert result["rule_id"] == str(mute_rule.id)
+
+        # Verify unmuted findings are now muted
+        unmuted_findings = Finding.objects.filter(
+            tenant_id=tenant_id, uid__in=unmuted_uids
+        )
+        for finding in unmuted_findings:
+            assert finding.muted is True
+            assert finding.muted_at == mute_rule.inserted_at
+            assert finding.muted_reason == mute_rule.reason
+
+        # Verify already-muted findings remained unchanged
+        already_muted_findings = Finding.objects.filter(
+            tenant_id=tenant_id, uid__in=muted_uids
+        )
+        for finding in already_muted_findings:
+            assert finding.muted is True
+            assert finding.muted_reason == "Already muted"
+
+    def test_mute_historical_findings_nonexistent_rule(self, tenants_fixture):
+        """
+        Test that a nonexistent mute rule raises ObjectDoesNotExist.
+        """
+        tenant_id = str(tenants_fixture[0].id)
+        nonexistent_rule_id = str(uuid4())
+
+        with pytest.raises(ObjectDoesNotExist):
+            mute_historical_findings(tenant_id, nonexistent_rule_id)
+
+    def test_mute_historical_findings_no_matching_findings(
+        self, tenants_fixture, test_user
+    ):
+        """
+        Test muting when no findings match the rule's UIDs.
+        """
+        tenant_id = str(tenants_fixture[0].id)
+
+        # Create a mute rule with non-existent finding UIDs
+        mute_rule = MuteRule.objects.create(
+            tenant_id=tenant_id,
+            name="Test No Match Rule",
+            reason="Testing no matching findings",
+            enabled=True,
+            created_by=test_user,
+            finding_uids=[
+                "nonexistent_uid_1",
+                "nonexistent_uid_2",
+                "nonexistent_uid_3",
+            ],
+        )
+
+        # Execute the muting function
+        result = mute_historical_findings(tenant_id, str(mute_rule.id))
+
+        # Verify no findings were muted
+        assert result["findings_muted"] == 0
+        assert result["rule_id"] == str(mute_rule.id)
+
+    def test_mute_historical_findings_batch_processing(self, mute_rule_batch_test):
+        """
+        Test that large numbers of findings are processed in batches correctly.
+        """
+        mute_rule, finding_uids = mute_rule_batch_test
+        tenant_id = str(mute_rule.tenant_id)
+
+        # Verify all findings exist and are unmuted
+        findings = Finding.objects.filter(tenant_id=tenant_id, uid__in=finding_uids)
+        assert findings.count() == 1500
+        for finding in findings:
+            assert finding.muted is False
+
+        # Execute the muting function
+        result = mute_historical_findings(tenant_id, str(mute_rule.id))
+
+        # Verify return value
+        assert result["findings_muted"] == 1500
+        assert result["rule_id"] == str(mute_rule.id)
+
+        # Verify all findings were muted
+        findings = Finding.objects.filter(tenant_id=tenant_id, uid__in=finding_uids)
+        for finding in findings:
+            assert finding.muted is True
+            assert finding.muted_at == mute_rule.inserted_at
+            assert finding.muted_reason == mute_rule.reason
+
+    def test_mute_historical_findings_preserves_muted_at_timestamp(
+        self, mute_rule_with_findings, findings_fixture
+    ):
+        """
+        Test that muted_at is set to the rule's inserted_at, not the current time.
+        """
+        mute_rule = mute_rule_with_findings
+        tenant_id = str(mute_rule.tenant_id)
+        finding = findings_fixture[0]
+
+        # Execute the muting function
+        result = mute_historical_findings(tenant_id, str(mute_rule.id))
+
+        # Verify the finding was muted
+        assert result["findings_muted"] == 1
+
+        # Verify muted_at matches the rule's inserted_at timestamp
+        finding.refresh_from_db()
+        assert finding.muted_at == mute_rule.inserted_at
+        assert finding.muted_at is not None
+
+    def test_mute_historical_findings_partial_match(self, scans_fixture, test_user):
+        """
+        Test muting when only some of the rule's UIDs exist as findings.
+        """
+        scan = scans_fixture[0]
+        tenant_id = str(scan.tenant_id)
+
+        # Create 3 findings
+        existing_uids = []
+        for i in range(3):
+            finding = Finding.objects.create(
+                tenant_id=tenant_id,
+                uid=f"partial_match_finding_{i}",
+                scan=scan,
+                status=Status.FAIL,
+                status_extended=f"Partial match status {i}",
+                impact=Severity.high,
+                severity=Severity.high,
+                raw_result={
+                    "status": Status.FAIL,
+                    "impact": Severity.high,
+                    "severity": Severity.high,
+                },
+                check_id=f"partial_match_check_{i}",
+                check_metadata={
+                    "CheckId": f"partial_match_check_{i}",
+                    "Description": f"Partial match description {i}",
+                },
+                muted=False,
+            )
+            existing_uids.append(finding.uid)
+
+        # Create a mute rule with both existing and non-existing UIDs
+        all_uids = existing_uids + [
+            "nonexistent_uid_1",
+            "nonexistent_uid_2",
+        ]
+        mute_rule = MuteRule.objects.create(
+            tenant_id=tenant_id,
+            name="Test Partial Match Rule",
+            reason="Testing partial matching",
+            enabled=True,
+            created_by=test_user,
+            finding_uids=all_uids,
+        )
+
+        # Execute the muting function
+        result = mute_historical_findings(tenant_id, str(mute_rule.id))
+
+        # Verify only existing findings were muted
+        assert result["findings_muted"] == 3
+        assert result["rule_id"] == str(mute_rule.id)
+
+        # Verify the existing findings were muted
+        findings = Finding.objects.filter(tenant_id=tenant_id, uid__in=existing_uids)
+        assert findings.count() == 3
+        for finding in findings:
+            assert finding.muted is True
+            assert finding.muted_at == mute_rule.inserted_at
+            assert finding.muted_reason == mute_rule.reason
+
+    def test_mute_historical_findings_empty_uids(self, tenants_fixture, test_user):
+        """
+        Test muting when the rule has an empty finding_uids array.
+        """
+        tenant_id = str(tenants_fixture[0].id)
+
+        # Create a mute rule with empty finding_uids
+        mute_rule = MuteRule.objects.create(
+            tenant_id=tenant_id,
+            name="Test Empty UIDs Rule",
+            reason="Testing empty UIDs",
+            enabled=True,
+            created_by=test_user,
+            finding_uids=[],
+        )
+
+        # Execute the muting function
+        result = mute_historical_findings(tenant_id, str(mute_rule.id))
+
+        # Verify no findings were muted
+        assert result["findings_muted"] == 0
+        assert result["rule_id"] == str(mute_rule.id)
+
+    def test_mute_historical_findings_return_format(self, mute_rule_with_findings):
+        """
+        Test that the return value has the correct format and fields.
+        """
+        mute_rule = mute_rule_with_findings
+        tenant_id = str(mute_rule.tenant_id)
+
+        result = mute_historical_findings(tenant_id, str(mute_rule.id))
+
+        # Verify return value structure
+        assert isinstance(result, dict)
+        assert "findings_muted" in result
+        assert "rule_id" in result
+        assert isinstance(result["findings_muted"], int)
+        assert isinstance(result["rule_id"], str)
+        assert result["rule_id"] == str(mute_rule.id)

api/src/backend/tasks/tests/test_reports.py

@@ -1,5 +1,3 @@
-import errno
-import logging
 import os
 import time
 import uuid
@@ -16,11 +14,6 @@ from api.models import (
     StateChoices,
     StatusChoices,
 )
-from config.settings.sentry import (
-    ERROR_CATEGORY_ATTRIBUTE,
-    FILESYSTEM_ERROR_CATEGORY,
-    before_send,
-)
 from prowler.lib.check.models import Severity
 from reportlab.lib import colors
 from tasks.jobs.report import (
@@ -1683,78 +1676,6 @@ class TestGenerateComplianceReportsCIS:
         assert result["cis"]["upload"] is False
         assert result["cis"]["error"] == "dir boom"
 
-    @patch("tasks.jobs.report._aggregate_requirement_statistics_from_database")
-    @patch("tasks.jobs.report._generate_compliance_output_directory")
-    @patch("tasks.jobs.report.Compliance.get_bulk")
-    def test_output_directory_failures_are_grouped_per_errno(
-        self,
-        mock_get_bulk,
-        mock_generate_output_dir,
-        mock_stats,
-        monkeypatch,
-        caplog,
-        tenants_fixture,
-        scans_fixture,
-        aws_provider,
-    ):
-        """A full disk and a missing mount point must not share a Sentry issue.
-
-        Both are OSError raised from the same ``os.makedirs`` call, so they only
-        stay apart if the exception reaches ``before_send``, which fingerprints
-        it by errno.
-        """
-        tenant = tenants_fixture[0]
-        scan = scans_fixture[0]
-        provider = aws_provider
-
-        self._force_scan_has_findings(monkeypatch)
-        mock_stats.return_value = {}
-        mock_get_bulk.return_value = {"cis_5.0_aws": Mock()}
-
-        fingerprints = []
-        for error_number, message in (
-            (errno.ENOSPC, "No space left on device: '/tmp/prowler_api_output'"),
-            (errno.ENOENT, "No such file or directory: '/mnt/output'"),
-        ):
-            mock_generate_output_dir.side_effect = OSError(error_number, message)
-            caplog.clear()
-
-            with caplog.at_level(logging.ERROR, logger="tasks.jobs.report"):
-                generate_compliance_reports(
-                    tenant_id=str(tenant.id),
-                    scan_id=str(scan.id),
-                    provider_id=str(provider.id),
-                    generate_threatscore=False,
-                    generate_ens=False,
-                    generate_nis2=False,
-                    generate_csa=False,
-                    generate_cis=True,
-                )
-
-            record = next(
-                record
-                for record in caplog.records
-                if "Error generating output directory" in record.getMessage()
-            )
-            # Without exc_info the Sentry event carries no exception at all and
-            # nothing can tell the two failures apart.
-            assert record.exc_info is not None
-            # The category is what scopes the errno fingerprint to this record.
-            assert (
-                getattr(record, ERROR_CATEGORY_ATTRIBUTE, None)
-                == FILESYSTEM_ERROR_CATEGORY
-            )
-
-            # Same hint the Sentry logging integration builds for this record.
-            event = {}
-            before_send(event, {"log_record": record, "exc_info": record.exc_info})
-            fingerprints.append(event["fingerprint"])
-
-        assert fingerprints == [
-            ["{{ default }}", "errno:ENOSPC"],
-            ["{{ default }}", "errno:ENOENT"],
-        ]
-
 
 class TestPickLatestCisVariant:
     """Unit tests for `_pick_latest_cis_variant` helper."""

api/src/backend/tasks/tests/test_scan.py

@@ -1,5 +1,6 @@
 import csv
 import json
+import re
 import uuid
 from collections.abc import MutableMapping
 from contextlib import contextmanager
@@ -9,7 +10,6 @@ from unittest.mock import MagicMock, patch
 
 import pytest
 from api.db_router import MainRouter
-from api.db_utils import rls_transaction
 from api.exceptions import ProviderConnectionError, ProviderDeletedException
 from api.models import (
     Finding,
@@ -2795,167 +2795,6 @@ class TestCreateComplianceRequirements:
 
         assert count_after_first > 0
         assert count_after_second == count_after_first
-        with rls_transaction(tenant_id):
-            row_versions = {
-                row_id.version
-                for row_id in ComplianceRequirementOverview.objects.filter(
-                    scan_id=scan_id
-                ).values_list("id", flat=True)
-            }
-        assert row_versions == {7}
-
-    def test_create_compliance_requirements_threatscore_counts_from_template(
-        self,
-        tenants_fixture,
-        scans_fixture,
-        aws_provider,
-        findings_fixture,
-    ):
-        """ThreatScore finding counts are derived from the template mapping,
-        not from each finding's stored ``compliance`` payload."""
-        from api.models import ComplianceRequirementOverview
-
-        with patch(
-            "tasks.jobs.scan.PROWLER_COMPLIANCE_OVERVIEW_TEMPLATE"
-        ) as mock_compliance_template:
-            tenant_id = str(tenants_fixture[0].id)
-            scan_id = str(scans_fixture[0].id)
-
-            mock_compliance_template.__getitem__.return_value = {
-                "prowler_threatscore_aws": {
-                    "framework": "ProwlerThreatScore",
-                    "version": "1.0",
-                    "requirements": {
-                        "1.1.1": {
-                            "description": "ThreatScore requirement",
-                            "checks": {"test_check_id": None},
-                        },
-                        "1.1.2": {
-                            "description": "Unrelated requirement",
-                            "checks": {"other_check_id": None},
-                        },
-                    },
-                },
-                "other_framework": {
-                    "framework": "Other",
-                    "version": "2.0",
-                    "requirements": {
-                        "a": {
-                            "description": "Same check, other framework",
-                            "checks": {"test_check_id": None},
-                        },
-                    },
-                },
-            }
-
-            create_compliance_requirements(tenant_id, scan_id)
-
-        with rls_transaction(tenant_id):
-            counted = sum(
-                len(finding.resource_regions or [])
-                for finding in Finding.all_objects.filter(
-                    scan_id=scan_id,
-                    muted=False,
-                    status__in=["PASS", "FAIL"],
-                    check_id="test_check_id",
-                )
-            )
-            rows = list(
-                ComplianceRequirementOverview.objects.filter(
-                    scan_id=scan_id
-                ).values_list("compliance_id", "requirement_id", "total_findings")
-            )
-        assert counted > 0
-        assert (
-            sum(
-                total
-                for compliance_id, requirement_id, total in rows
-                if (compliance_id, requirement_id)
-                == ("prowler_threatscore_aws", "1.1.1")
-            )
-            == counted
-        )
-        assert all(
-            total == 0
-            for compliance_id, requirement_id, total in rows
-            if (compliance_id, requirement_id) == ("prowler_threatscore_aws", "1.1.2")
-        )
-        assert all(
-            total == 0
-            for compliance_id, _, total in rows
-            if compliance_id == "other_framework"
-        )
-
-    def test_create_compliance_requirements_rows_across_regions_and_frameworks(
-        self,
-        tenants_fixture,
-        scans_fixture,
-        aws_provider,
-    ):
-        from api.models import ComplianceRequirementOverview
-
-        tenant_id = str(tenants_fixture[0].id)
-        scan_id = str(scans_fixture[0].id)
-        check_status_by_region = {
-            "us-east-1": {"check_a": "FAIL", "check_b": "PASS"},
-            "eu-west-1": {"check_a": "PASS"},
-        }
-        template = {
-            "fw_one": {
-                "framework": "One",
-                "version": "1",
-                "requirements": {
-                    "r1": {"description": "a", "checks": {"check_a": None}},
-                    "r2": {
-                        "description": "a+b",
-                        "checks": {"check_a": None, "check_b": None},
-                    },
-                },
-            },
-            "fw_two": {
-                "framework": "Two",
-                "version": "2",
-                "requirements": {
-                    "m1": {"description": "manual", "checks": {}},
-                },
-            },
-        }
-
-        with (
-            patch(
-                "tasks.jobs.scan.PROWLER_COMPLIANCE_OVERVIEW_TEMPLATE"
-            ) as mock_compliance_template,
-            patch(
-                "tasks.jobs.scan._aggregate_findings_by_region",
-                return_value=(check_status_by_region, {}),
-            ),
-        ):
-            mock_compliance_template.__getitem__.return_value = template
-            result = create_compliance_requirements(tenant_id, scan_id)
-
-        assert result["requirements_created"] == 6
-        with rls_transaction(tenant_id):
-            rows = set(
-                ComplianceRequirementOverview.objects.filter(
-                    scan_id=scan_id
-                ).values_list(
-                    "compliance_id",
-                    "requirement_id",
-                    "region",
-                    "requirement_status",
-                    "passed_checks",
-                    "failed_checks",
-                    "total_checks",
-                )
-            )
-        assert rows == {
-            ("fw_one", "r1", "us-east-1", "FAIL", 0, 1, 1),
-            ("fw_one", "r1", "eu-west-1", "PASS", 1, 0, 1),
-            ("fw_one", "r2", "us-east-1", "FAIL", 1, 1, 2),
-            ("fw_one", "r2", "eu-west-1", "PASS", 1, 0, 2),
-            ("fw_two", "m1", "us-east-1", "MANUAL", 0, 0, 0),
-            ("fw_two", "m1", "eu-west-1", "MANUAL", 0, 0, 0),
-        }
 
     def test_create_compliance_requirements_kubernetes_provider(
         self,
@@ -4884,11 +4723,17 @@ class TestAggregateFindingsByRegion:
         """Test function returns correct data structure."""
         tenant_id = str(uuid.uuid4())
         scan_id = str(uuid.uuid4())
-        normalized_id = "prowlerthreatscore10"
+        modeled_threatscore_compliance_id = "ProwlerThreatScore-1.0"
 
-        # (check_id, status, resource_regions) tuples
-        finding_rows = [("check1", "FAIL", ["us-east-1"])]
-        threatscore_by_check = {"check1": ["req1", "req2"]}
+        # (check_id, status, resource_regions, compliance) tuples
+        finding_rows = [
+            (
+                "check1",
+                "FAIL",
+                ["us-east-1"],
+                {modeled_threatscore_compliance_id: ["req1", "req2"]},
+            )
+        ]
 
         mock_queryset = MagicMock()
         mock_queryset.values_list.return_value = mock_queryset
@@ -4902,16 +4747,13 @@ class TestAggregateFindingsByRegion:
 
         check_status_by_region, findings_count_by_compliance = (
             _aggregate_findings_by_region(
-                tenant_id,
-                scan_id,
-                normalized_id,
-                threatscore_by_check,
+                tenant_id, scan_id, modeled_threatscore_compliance_id
             )
         )
 
         # Streaming query contract: column-scoped values_list + iterator
         mock_queryset.values_list.assert_called_once_with(
-            "check_id", "status", "resource_regions"
+            "check_id", "status", "resource_regions", "compliance"
         )
         mock_queryset.iterator.assert_called_once()
 
@@ -4932,14 +4774,13 @@ class TestAggregateFindingsByRegion:
         """Test that FAIL status takes priority over other statuses."""
         tenant_id = str(uuid.uuid4())
         scan_id = str(uuid.uuid4())
-        normalized_id = "prowlerthreatscore10"
+        modeled_threatscore_compliance_id = "ProwlerThreatScore-1.0"
 
         # Same check/region: PASS first, then FAIL — FAIL must win
         finding_rows = [
-            ("check1", "PASS", ["us-east-1"]),
-            ("check1", "FAIL", ["us-east-1"]),
+            ("check1", "PASS", ["us-east-1"], {}),
+            ("check1", "FAIL", ["us-east-1"], {}),
         ]
-        threatscore_by_check = {}
 
         mock_queryset = MagicMock()
         mock_queryset.values_list.return_value = mock_queryset
@@ -4952,15 +4793,12 @@ class TestAggregateFindingsByRegion:
         mock_findings_filter.return_value = mock_queryset
 
         check_status_by_region, _ = _aggregate_findings_by_region(
-            tenant_id,
-            scan_id,
-            normalized_id,
-            threatscore_by_check,
+            tenant_id, scan_id, modeled_threatscore_compliance_id
         )
 
         # Streaming query contract: column-scoped values_list + iterator
         mock_queryset.values_list.assert_called_once_with(
-            "check_id", "status", "resource_regions"
+            "check_id", "status", "resource_regions", "compliance"
         )
         mock_queryset.iterator.assert_called_once()
 
@@ -4975,9 +4813,8 @@ class TestAggregateFindingsByRegion:
         """Test that muted findings are filtered out (muted=False in query)."""
         tenant_id = str(uuid.uuid4())
         scan_id = str(uuid.uuid4())
-        normalized_id = "prowlerthreatscore10"
+        modeled_threatscore_compliance_id = "ProwlerThreatScore-1.0"
 
-        threatscore_by_check = {}
         mock_queryset = MagicMock()
         mock_queryset.values_list.return_value = mock_queryset
         mock_queryset.iterator.return_value = []
@@ -4989,15 +4826,12 @@ class TestAggregateFindingsByRegion:
         mock_findings_filter.return_value = mock_queryset
 
         _aggregate_findings_by_region(
-            tenant_id,
-            scan_id,
-            normalized_id,
-            threatscore_by_check,
+            tenant_id, scan_id, modeled_threatscore_compliance_id
         )
 
         # Streaming query contract: column-scoped values_list + iterator
         mock_queryset.values_list.assert_called_once_with(
-            "check_id", "status", "resource_regions"
+            "check_id", "status", "resource_regions", "compliance"
         )
         mock_queryset.iterator.assert_called_once()
 
@@ -5017,14 +4851,23 @@ class TestAggregateFindingsByRegion:
         """Test that ThreatScore compliance counts are processed correctly."""
         tenant_id = str(uuid.uuid4())
         scan_id = str(uuid.uuid4())
-        normalized_id = "prowlerthreatscore10"
+        modeled_threatscore_compliance_id = "ProwlerThreatScore-1.0"
 
         # PASS and FAIL findings mapped to the same ThreatScore requirement
         finding_rows = [
-            ("check1", "PASS", ["us-east-1"]),
-            ("check2", "FAIL", ["us-east-1"]),
+            (
+                "check1",
+                "PASS",
+                ["us-east-1"],
+                {modeled_threatscore_compliance_id: ["req1"]},
+            ),
+            (
+                "check2",
+                "FAIL",
+                ["us-east-1"],
+                {modeled_threatscore_compliance_id: ["req1"]},
+            ),
         ]
-        threatscore_by_check = {"check1": ["req1"], "check2": ["req1"]}
 
         mock_queryset = MagicMock()
         mock_queryset.values_list.return_value = mock_queryset
@@ -5037,19 +4880,19 @@ class TestAggregateFindingsByRegion:
         mock_findings_filter.return_value = mock_queryset
 
         _, findings_count_by_compliance = _aggregate_findings_by_region(
-            tenant_id,
-            scan_id,
-            normalized_id,
-            threatscore_by_check,
+            tenant_id, scan_id, modeled_threatscore_compliance_id
         )
 
         # Streaming query contract: column-scoped values_list + iterator
         mock_queryset.values_list.assert_called_once_with(
-            "check_id", "status", "resource_regions"
+            "check_id", "status", "resource_regions", "compliance"
         )
         mock_queryset.iterator.assert_called_once()
 
         # Verify compliance counts
+        normalized_id = re.sub(
+            r"[^a-z0-9]", "", modeled_threatscore_compliance_id.lower()
+        )
         assert "us-east-1" in findings_count_by_compliance
         assert normalized_id in findings_count_by_compliance["us-east-1"]
         assert "req1" in findings_count_by_compliance["us-east-1"][normalized_id]
@@ -5066,14 +4909,13 @@ class TestAggregateFindingsByRegion:
         """Test aggregation across multiple regions."""
         tenant_id = str(uuid.uuid4())
         scan_id = str(uuid.uuid4())
-        normalized_id = "prowlerthreatscore10"
+        modeled_threatscore_compliance_id = "ProwlerThreatScore-1.0"
 
         # One finding per region
         finding_rows = [
-            ("check1", "FAIL", ["us-east-1"]),
-            ("check1", "PASS", ["us-west-2"]),
+            ("check1", "FAIL", ["us-east-1"], {}),
+            ("check1", "PASS", ["us-west-2"], {}),
         ]
-        threatscore_by_check = {}
 
         mock_queryset = MagicMock()
         mock_queryset.values_list.return_value = mock_queryset
@@ -5086,15 +4928,12 @@ class TestAggregateFindingsByRegion:
         mock_findings_filter.return_value = mock_queryset
 
         check_status_by_region, _ = _aggregate_findings_by_region(
-            tenant_id,
-            scan_id,
-            normalized_id,
-            threatscore_by_check,
+            tenant_id, scan_id, modeled_threatscore_compliance_id
         )
 
         # Streaming query contract: column-scoped values_list + iterator
         mock_queryset.values_list.assert_called_once_with(
-            "check_id", "status", "resource_regions"
+            "check_id", "status", "resource_regions", "compliance"
         )
         mock_queryset.iterator.assert_called_once()
 
@@ -5112,10 +4951,16 @@ class TestAggregateFindingsByRegion:
         """A finding with multiple resource_regions is tallied in every region."""
         tenant_id = str(uuid.uuid4())
         scan_id = str(uuid.uuid4())
-        normalized_id = "prowlerthreatscore10"
+        modeled_threatscore_compliance_id = "ProwlerThreatScore-1.0"
 
-        finding_rows = [("check1", "FAIL", ["us-east-1", "eu-west-1"])]
-        threatscore_by_check = {"check1": ["req1"]}
+        finding_rows = [
+            (
+                "check1",
+                "FAIL",
+                ["us-east-1", "eu-west-1"],
+                {modeled_threatscore_compliance_id: ["req1"]},
+            )
+        ]
 
         mock_queryset = MagicMock()
         mock_queryset.values_list.return_value = mock_queryset
@@ -5129,19 +4974,19 @@ class TestAggregateFindingsByRegion:
 
         check_status_by_region, findings_count_by_compliance = (
             _aggregate_findings_by_region(
-                tenant_id,
-                scan_id,
-                normalized_id,
-                threatscore_by_check,
+                tenant_id, scan_id, modeled_threatscore_compliance_id
             )
         )
 
         # Streaming query contract: column-scoped values_list + iterator
         mock_queryset.values_list.assert_called_once_with(
-            "check_id", "status", "resource_regions"
+            "check_id", "status", "resource_regions", "compliance"
         )
         mock_queryset.iterator.assert_called_once()
 
+        normalized_id = re.sub(
+            r"[^a-z0-9]", "", modeled_threatscore_compliance_id.lower()
+        )
         for region in ("us-east-1", "eu-west-1"):
             assert check_status_by_region[region]["check1"] == "FAIL"
             req_stats = findings_count_by_compliance[region][normalized_id]["req1"]
@@ -5155,13 +5000,12 @@ class TestAggregateFindingsByRegion:
         """A finding with no denormalized regions contributes nothing."""
         tenant_id = str(uuid.uuid4())
         scan_id = str(uuid.uuid4())
-        normalized_id = "prowlerthreatscore10"
+        modeled_threatscore_compliance_id = "ProwlerThreatScore-1.0"
 
         finding_rows = [
-            ("check1", "FAIL", []),
-            ("check2", "PASS", None),
+            ("check1", "FAIL", [], {modeled_threatscore_compliance_id: ["req1"]}),
+            ("check2", "PASS", None, {}),
         ]
-        threatscore_by_check = {"check1": ["req1"]}
 
         mock_queryset = MagicMock()
         mock_queryset.values_list.return_value = mock_queryset
@@ -5175,16 +5019,13 @@ class TestAggregateFindingsByRegion:
 
         check_status_by_region, findings_count_by_compliance = (
             _aggregate_findings_by_region(
-                tenant_id,
-                scan_id,
-                normalized_id,
-                threatscore_by_check,
+                tenant_id, scan_id, modeled_threatscore_compliance_id
             )
         )
 
         # Streaming query contract: column-scoped values_list + iterator
         mock_queryset.values_list.assert_called_once_with(
-            "check_id", "status", "resource_regions"
+            "check_id", "status", "resource_regions", "compliance"
         )
         mock_queryset.iterator.assert_called_once()
 
@@ -5199,9 +5040,8 @@ class TestAggregateFindingsByRegion:
         """Test with no findings - should return empty dicts."""
         tenant_id = str(uuid.uuid4())
         scan_id = str(uuid.uuid4())
-        normalized_id = "prowlerthreatscore10"
+        modeled_threatscore_compliance_id = "ProwlerThreatScore-1.0"
 
-        threatscore_by_check = {}
         mock_queryset = MagicMock()
         mock_queryset.values_list.return_value = mock_queryset
         mock_queryset.iterator.return_value = []
@@ -5214,16 +5054,13 @@ class TestAggregateFindingsByRegion:
 
         check_status_by_region, findings_count_by_compliance = (
             _aggregate_findings_by_region(
-                tenant_id,
-                scan_id,
-                normalized_id,
-                threatscore_by_check,
+                tenant_id, scan_id, modeled_threatscore_compliance_id
             )
         )
 
         # Streaming query contract: column-scoped values_list + iterator
         mock_queryset.values_list.assert_called_once_with(
-            "check_id", "status", "resource_regions"
+            "check_id", "status", "resource_regions", "compliance"
         )
         mock_queryset.iterator.assert_called_once()
 

api/src/backend/tasks/tests/test_tasks.py

@@ -1,6 +1,6 @@
 import uuid
 from contextlib import contextmanager
-from datetime import UTC, datetime
+from datetime import UTC, datetime, timedelta
 from unittest.mock import MagicMock, patch
 
 import httpx
@@ -33,10 +33,10 @@ from tasks.tasks import (
     check_integrations_task,
     check_lighthouse_provider_connection_task,
     generate_outputs_task,
-    mute_findings_in_latest_scans_task,
     perform_attack_paths_scan_task,
     perform_scan_task,
     perform_scheduled_scan_task,
+    reaggregate_all_finding_group_summaries_task,
     refresh_lighthouse_provider_models_task,
     s3_integration_task,
     security_hub_integration_task,
@@ -2959,7 +2959,6 @@ class TestPerformScheduledScanTask:
         with (
             patch("tasks.tasks.perform_prowler_scan", side_effect=_complete_scan),
             patch("tasks.tasks._perform_scan_complete_tasks"),
-            patch("tasks.tasks.reconcile_scan_mute_rules") as mock_reconcile,
             self._override_task_request(perform_scheduled_scan_task, id=task_id),
         ):
             perform_scheduled_scan_task.run(
@@ -2983,13 +2982,6 @@ class TestPerformScheduledScanTask:
             ).count()
             == 1
         )
-        completed_scan = Scan.objects.get(
-            tenant_id=tenant.id,
-            provider=provider,
-            trigger=Scan.TriggerChoices.SCHEDULED,
-            state=StateChoices.COMPLETED,
-        )
-        mock_reconcile.assert_called_once_with(str(tenant.id), str(completed_scan.id))
         assert (
             Scan.objects.filter(
                 tenant_id=tenant.id,
@@ -3184,10 +3176,7 @@ class TestPerformScanTask:
             task=queued_task,
         )
 
-        events = []
-
         def _complete_scan(tenant_id, scan_id, provider_id, checks_to_execute=None):
-            events.append("scan")
             scan_instance = Scan.objects.get(id=scan_id)
             scan_instance.state = StateChoices.COMPLETED
             scan_instance.save()
@@ -3195,14 +3184,7 @@ class TestPerformScanTask:
 
         with (
             patch("tasks.tasks.perform_prowler_scan", side_effect=_complete_scan),
-            patch(
-                "tasks.tasks.reconcile_scan_mute_rules",
-                side_effect=lambda *_args: events.append("reconcile"),
-            ),
-            patch(
-                "tasks.tasks._perform_scan_complete_tasks",
-                side_effect=lambda *_args: events.append("summaries"),
-            ),
+            patch("tasks.tasks._perform_scan_complete_tasks"),
             patch("tasks.tasks.perform_scan_task.apply_async") as mock_apply_async,
         ):
             with django_capture_on_commit_callbacks(execute=True):
@@ -3214,7 +3196,6 @@ class TestPerformScanTask:
 
         queued_task_result.refresh_from_db()
         assert result == {"status": "ok"}
-        assert events == ["scan", "reconcile", "summaries"]
         assert queued_task_result.status == states.PENDING
         mock_apply_async.assert_called_once_with(
             kwargs={
@@ -3260,7 +3241,10 @@ class TestPerformScanTask:
 
 
 @pytest.mark.django_db
-class TestMuteFindingsInLatestScansTask:
+class TestReaggregateAllFindingGroupSummaries:
+    def setup_method(self):
+        self.tenant_id = str(uuid.uuid4())
+
     @patch("tasks.tasks.chain")
     @patch("tasks.tasks.group")
     @patch("tasks.tasks.aggregate_attack_surface_task")
@@ -3269,10 +3253,10 @@ class TestMuteFindingsInLatestScansTask:
     @patch("tasks.tasks.aggregate_finding_group_summaries_task")
     @patch("tasks.tasks.aggregate_daily_severity_task")
     @patch("tasks.tasks.perform_scan_summary_task")
-    @patch("tasks.tasks.mute_findings_in_latest_scans")
-    def test_reaggregates_only_changed_scans(
+    @patch("tasks.tasks.Scan.objects.filter")
+    def test_dispatches_subtasks_for_each_provider_per_day(
         self,
-        mock_mute_findings,
+        mock_scan_filter,
         mock_scan_summary_task,
         mock_daily_severity_task,
         mock_finding_group_task,
@@ -3281,36 +3265,49 @@ class TestMuteFindingsInLatestScansTask:
         mock_attack_surface_task,
         mock_group,
         mock_chain,
-        tenants_fixture,
     ):
-        tenant_id = str(tenants_fixture[0].id)
-        mute_rule_id = str(uuid.uuid4())
-        provider_ids = [str(uuid.uuid4()), str(uuid.uuid4())]
-        scan_ids = [str(uuid.uuid4()), str(uuid.uuid4())]
-        result = {
-            "findings_muted": 2,
-            "rule_id": mute_rule_id,
-            "scan_ids": scan_ids,
-        }
-        mock_mute_findings.return_value = result
+        provider_id_1 = uuid.uuid4()
+        provider_id_2 = uuid.uuid4()
+        scan_id_today_p1 = uuid.uuid4()
+        scan_id_yesterday_p1 = uuid.uuid4()
+        scan_id_today_p2 = uuid.uuid4()
+        today = datetime.now(tz=UTC)
+        yesterday = today - timedelta(days=1)
+
         mock_outer_group_result = MagicMock()
+        # The first `group()` call wraps the inner parallel step; subsequent
+        # calls wrap the outer per-scan generator.
         mock_group.side_effect = lambda *args, **kwargs: (
             list(args[0]) if args and hasattr(args[0], "__iter__") else None,
             mock_outer_group_result,
         )[1]
 
-        task_result = mute_findings_in_latest_scans_task(
-            tenant_id=tenant_id,
-            mute_rule_id=mute_rule_id,
-            provider_ids=provider_ids,
-        )
+        mock_scan_filter.return_value.order_by.return_value.values.return_value = [
+            {
+                "id": scan_id_today_p1,
+                "completed_at": today,
+                "provider_id": provider_id_1,
+            },
+            {
+                "id": scan_id_today_p2,
+                "completed_at": today,
+                "provider_id": provider_id_2,
+            },
+            {
+                "id": scan_id_yesterday_p1,
+                "completed_at": yesterday,
+                "provider_id": provider_id_1,
+            },
+        ]
 
-        assert task_result == result
-        mock_mute_findings.assert_called_once_with(
-            tenant_id=tenant_id,
-            mute_rule_id=mute_rule_id,
-            provider_ids=provider_ids,
-        )
+        result = reaggregate_all_finding_group_summaries_task(tenant_id=self.tenant_id)
+
+        assert result == {"scans_reaggregated": 3}
+        expected_scan_ids = {
+            str(scan_id_today_p1),
+            str(scan_id_today_p2),
+            str(scan_id_yesterday_p1),
+        }
         for task_mock in (
             mock_scan_summary_task,
             mock_daily_severity_task,
@@ -3319,35 +3316,93 @@ class TestMuteFindingsInLatestScansTask:
             mock_category_task,
             mock_attack_surface_task,
         ):
-            assert task_mock.si.call_count == 2
-            assert {
+            assert task_mock.si.call_count == 3
+            dispatched = {
                 call.kwargs["scan_id"] for call in task_mock.si.call_args_list
-            } == set(scan_ids)
-        assert mock_chain.call_count == 2
+            }
+            assert dispatched == expected_scan_ids
+            for call in task_mock.si.call_args_list:
+                assert call.kwargs["tenant_id"] == self.tenant_id
+        assert mock_chain.call_count == 3
         mock_outer_group_result.apply_async.assert_called_once()
 
     @patch("tasks.tasks.chain")
     @patch("tasks.tasks.group")
-    @patch("tasks.tasks.mute_findings_in_latest_scans")
-    def test_skips_reaggregation_when_no_scan_changed(
-        self, mock_mute_findings, mock_group, mock_chain, tenants_fixture
+    @patch("tasks.tasks.aggregate_attack_surface_task")
+    @patch("tasks.tasks.aggregate_scan_category_summaries_task")
+    @patch("tasks.tasks.aggregate_scan_resource_group_summaries_task")
+    @patch("tasks.tasks.aggregate_finding_group_summaries_task")
+    @patch("tasks.tasks.aggregate_daily_severity_task")
+    @patch("tasks.tasks.perform_scan_summary_task")
+    @patch("tasks.tasks.Scan.objects.filter")
+    def test_dedupes_scans_to_latest_per_provider_per_day(
+        self,
+        mock_scan_filter,
+        mock_scan_summary_task,
+        mock_daily_severity_task,
+        mock_finding_group_task,
+        mock_resource_group_task,
+        mock_category_task,
+        mock_attack_surface_task,
+        mock_group,
+        mock_chain,
     ):
-        tenant_id = str(tenants_fixture[0].id)
-        mute_rule_id = str(uuid.uuid4())
-        result = {
-            "findings_muted": 0,
-            "rule_id": mute_rule_id,
-            "scan_ids": [],
-        }
-        mock_mute_findings.return_value = result
+        """When several scans run on the same day for the same provider, only
+        the latest one is dispatched (matching the daily summary unique key)."""
+        provider_id = uuid.uuid4()
+        latest_scan_today = uuid.uuid4()
+        earlier_scan_today = uuid.uuid4()
+        today_late = datetime.now(tz=UTC)
+        today_early = today_late - timedelta(hours=4)
 
-        task_result = mute_findings_in_latest_scans_task(
-            tenant_id=tenant_id,
-            mute_rule_id=mute_rule_id,
-            provider_ids=[],
-        )
+        mock_outer_group_result = MagicMock()
+        mock_group.side_effect = lambda *args, **kwargs: (
+            list(args[0]) if args and hasattr(args[0], "__iter__") else None,
+            mock_outer_group_result,
+        )[1]
 
-        assert task_result == result
+        # Returned ordered by `-completed_at`, so the most recent comes first.
+        mock_scan_filter.return_value.order_by.return_value.values.return_value = [
+            {
+                "id": latest_scan_today,
+                "completed_at": today_late,
+                "provider_id": provider_id,
+            },
+            {
+                "id": earlier_scan_today,
+                "completed_at": today_early,
+                "provider_id": provider_id,
+            },
+        ]
+
+        result = reaggregate_all_finding_group_summaries_task(tenant_id=self.tenant_id)
+
+        assert result == {"scans_reaggregated": 1}
+        for task_mock in (
+            mock_scan_summary_task,
+            mock_daily_severity_task,
+            mock_finding_group_task,
+            mock_resource_group_task,
+            mock_category_task,
+            mock_attack_surface_task,
+        ):
+            task_mock.si.assert_called_once_with(
+                tenant_id=self.tenant_id, scan_id=str(latest_scan_today)
+            )
+        mock_chain.assert_called_once()
+        mock_outer_group_result.apply_async.assert_called_once()
+
+    @patch("tasks.tasks.chain")
+    @patch("tasks.tasks.group")
+    @patch("tasks.tasks.Scan.objects.filter")
+    def test_no_completed_scans_skips_dispatch(
+        self, mock_scan_filter, mock_group, mock_chain
+    ):
+        mock_scan_filter.return_value.order_by.return_value.values.return_value = []
+
+        result = reaggregate_all_finding_group_summaries_task(tenant_id=self.tenant_id)
+
+        assert result == {"scans_reaggregated": 0}
         mock_group.assert_not_called()
         mock_chain.assert_not_called()
 

api/uv.lock

@@ -16,7 +16,7 @@ constraints = [
     { name = "aiobotocore", specifier = "==2.25.1" },
     { name = "aiofiles", specifier = "==24.1.0" },
     { name = "aiohappyeyeballs", specifier = "==2.6.1" },
-    { name = "aiohttp", specifier = "==3.14.3" },
+    { name = "aiohttp", specifier = "==3.14.0" },
     { name = "aioitertools", specifier = "==0.13.0" },
     { name = "aiosignal", specifier = "==1.4.0" },
     { name = "alibabacloud-actiontrail20200706", specifier = "==2.4.1" },
@@ -45,7 +45,7 @@ constraints = [
     { name = "alibabacloud-sls20201230", specifier = "==5.9.0" },
     { name = "alibabacloud-sts20150401", specifier = "==1.1.6" },
     { name = "alibabacloud-tea", specifier = "==0.4.3" },
-    { name = "alibabacloud-tea-openapi", specifier = "==0.4.6" },
+    { name = "alibabacloud-tea-openapi", specifier = "==0.4.5" },
     { name = "alibabacloud-tea-util", specifier = "==0.3.14" },
     { name = "alibabacloud-tea-xml", specifier = "==0.0.3" },
     { name = "alibabacloud-vpc20160428", specifier = "==6.13.0" },
@@ -53,7 +53,7 @@ constraints = [
     { name = "aliyun-log-fastpb", specifier = "==0.2.0" },
     { name = "amqp", specifier = "==5.3.1" },
     { name = "annotated-types", specifier = "==0.7.0" },
-    { name = "anyio", specifier = "==4.14.2" },
+    { name = "anyio", specifier = "==4.12.1" },
     { name = "applicationinsights", specifier = "==0.11.10" },
     { name = "apscheduler", specifier = "==3.11.2" },
     { name = "argcomplete", specifier = "==3.5.3" },
@@ -127,7 +127,7 @@ constraints = [
     { name = "coverage", specifier = "==7.5.4" },
     { name = "cron-descriptor", specifier = "==1.4.5" },
     { name = "crowdstrike-falconpy", specifier = "==1.6.0" },
-    { name = "cryptography", specifier = "==50.0.0" },
+    { name = "cryptography", specifier = "==48.0.1" },
     { name = "cycler", specifier = "==0.12.1" },
     { name = "darabonba-core", specifier = "==1.0.8" },
     { name = "dash", specifier = "==3.1.1" },
@@ -254,7 +254,7 @@ constraints = [
     { name = "nltk", specifier = "==3.9.4" },
     { name = "numpy", specifier = "==2.2.6" },
     { name = "oauthlib", specifier = "==3.3.1" },
-    { name = "oci", specifier = "==2.184.1" },
+    { name = "oci", specifier = "==2.183.0" },
     { name = "openai", specifier = "==1.109.1" },
     { name = "openstacksdk", specifier = "==4.2.0" },
     { name = "opentelemetry-api", specifier = "==1.39.1" },
@@ -295,7 +295,7 @@ constraints = [
     { name = "pylint", specifier = "==3.2.5" },
     { name = "pymsalruntime", specifier = "==0.18.1" },
     { name = "pynacl", specifier = "==1.6.2" },
-    { name = "pyopenssl", specifier = "==26.4.0" },
+    { name = "pyopenssl", specifier = "==26.2.0" },
     { name = "pyparsing", specifier = "==3.3.2" },
     { name = "pyreadline3", specifier = "==3.5.4" },
     { name = "pysocks", specifier = "==1.7.1" },
@@ -339,7 +339,7 @@ constraints = [
     { name = "six", specifier = "==1.17.0" },
     { name = "slack-sdk", specifier = "==3.39.0" },
     { name = "sniffio", specifier = "==1.3.1" },
-    { name = "sqlparse", specifier = "==0.6.0" },
+    { name = "sqlparse", specifier = "==0.5.5" },
     { name = "statsd", specifier = "==4.0.1" },
     { name = "std-uritemplate", specifier = "==2.0.8" },
     { name = "stevedore", specifier = "==5.6.0" },
@@ -373,11 +373,10 @@ constraints = [
     { name = "zipp", specifier = "==3.23.0" },
     { name = "zope-event", specifier = "==6.1" },
     { name = "zope-interface", specifier = "==8.2" },
-    { name = "zstd", specifier = "==1.5.7.2" },
+    { name = "zstd", specifier = "==1.5.7.3" },
 ]
 overrides = [
     { name = "azure-mgmt-containerservice", specifier = "==34.1.0" },
-    { name = "cryptography", specifier = "==50.0.0" },
     { name = "dulwich", specifier = "==1.2.5" },
     { name = "microsoft-kiota-abstractions", specifier = "==1.9.10" },
     { name = "microsoft-kiota-authentication-azure", specifier = "==1.9.10" },
@@ -479,7 +478,7 @@ wheels = [
 
 [[package]]
 name = "aiohttp"
-version = "3.14.3"
+version = "3.14.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "aiohappyeyeballs" },
@@ -491,44 +490,44 @@ dependencies = [
     { name = "typing-extensions" },
     { name = "yarl" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/58/d9/22ce5786ac0c1653ae8b6c23bded02c1686d11f0dbb45b31ce128e0df985/aiohttp-3.14.3.tar.gz", hash = "sha256:9491196535a88924a60afd5b5f434b5b203b6cc616250878dbdb223a8f7844bc", size = 7971213, upload-time = "2026-07-23T01:57:27.037Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/ee/ab/93ce242f899b68c51b0578c027aafa791ab3614cb9345fa5d37b5f5c8e3e/aiohttp-3.14.0.tar.gz", hash = "sha256:2882de819734c715fd1b9c11c97e09fa020d14438203d1d354d8ed1702791c9b", size = 7940674, upload-time = "2026-06-01T19:41:02.763Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/f8/5c/b3e4ff8ad43a8afef9602c5e90285936da1beaea8b029016b793891f03c3/aiohttp-3.14.3-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:e568e14940c09955aa51f4e645b6daa18a581c5dcfcd73744dcc86a856e3ced3", size = 764250, upload-time = "2026-07-23T01:52:48.525Z" },
-    { url = "https://files.pythonhosted.org/packages/0e/da/f1b384465e51449d844056b75070461da03a9a23e6c1747003695bf4172a/aiohttp-3.14.3-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:54cfcdee2770dac994417cbb0ee1f3eb0e7cb6b30c79bf44f2c02ff79ec5124a", size = 516281, upload-time = "2026-07-23T01:52:51.047Z" },
-    { url = "https://files.pythonhosted.org/packages/b9/3f/01264f820ee2e3712a827892b1cd6ff80f3300c1fcbffbb45714a915d47a/aiohttp-3.14.3-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:21c016079415ed3fd676963e9793700a566d85dbbd6bfc564b9b2d209147dcc8", size = 514742, upload-time = "2026-07-23T01:52:53.779Z" },
-    { url = "https://files.pythonhosted.org/packages/9e/8d/a71c6f2db52ac1ed142b133f7feddaa6b70539c3f4de24d7e226c95b794c/aiohttp-3.14.3-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:d6088ec9894113802bddb3c09e974929aed2c7b3a8c456219b8aab4481f1a239", size = 1780613, upload-time = "2026-07-23T01:52:56.948Z" },
-    { url = "https://files.pythonhosted.org/packages/a5/11/3dd9b3fb3a170f6ec9011b5291d876a6fab4086714c9e158600edf01b4fd/aiohttp-3.14.3-cp311-cp311-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:16ea7e24c309fb7c0bbd505d149abe4fe4dccfb8db911db7dbec0921bc889a6f", size = 1737688, upload-time = "2026-07-23T01:52:59.294Z" },
-    { url = "https://files.pythonhosted.org/packages/6d/3e/834c26918be7d88068822b40e0db30fca50b5f4fe79104aa16a93f1d74e6/aiohttp-3.14.3-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:56f355e79f71aef2a85c80305cc915f894b170dba76de5fe84f6351939b83c06", size = 1845742, upload-time = "2026-07-23T01:53:01.641Z" },
-    { url = "https://files.pythonhosted.org/packages/cc/c9/49ab8572df7d66bc13d11e31f781292badb04180dd87ba98733066c6aed7/aiohttp-3.14.3-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:18c441d0a8fca6de8d1f546849b9f0ab20d435993e2c5b59562b2fae6be2f929", size = 1928412, upload-time = "2026-07-23T01:53:04.018Z" },
-    { url = "https://files.pythonhosted.org/packages/a5/b9/2b8f0c0ce09c87a1daf80fd483431b56b1435d3f62789bc86f572e1245de/aiohttp-3.14.3-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:53e7b4ce82b54a8bcc71b3b67a5cbd177ca1d7f592cbc92cd38b7349f73482db", size = 1786220, upload-time = "2026-07-23T01:53:06.481Z" },
-    { url = "https://files.pythonhosted.org/packages/85/00/9c45f81de11710460edfa1dc81317b6e882703b160926c879a9d20da9fcc/aiohttp-3.14.3-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:f55119f7bf25f49ed210f6096090715da24f2943c62102448915fde3c62877ce", size = 1637231, upload-time = "2026-07-23T01:53:10.258Z" },
-    { url = "https://files.pythonhosted.org/packages/19/ce/967d628e910756f3539c6107cb7844a1b69440dcb3029a5ee7871b09ab63/aiohttp-3.14.3-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:9aa6e61fdf20105c4144e755bd586008ff450791d67b1c8146fdc15959c4d51c", size = 1753161, upload-time = "2026-07-23T01:53:13.817Z" },
-    { url = "https://files.pythonhosted.org/packages/11/b2/0c3d4114f0aee4f580f5b3b4eb71b24d7a23b834ea506a4dfebe76513f35/aiohttp-3.14.3-cp311-cp311-musllinux_1_2_armv7l.whl", hash = "sha256:ccd4893707b3e2a13e39c90d43cf80edf2e4d0457935bcc103bf2346214c3f15", size = 1756356, upload-time = "2026-07-23T01:53:16.211Z" },
-    { url = "https://files.pythonhosted.org/packages/63/5d/99e7d91c82f1399d1ae2a854e080bd1493fbc31e5e959dbc4ec33dac3bec/aiohttp-3.14.3-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:b2466434105a4e03113c36ec775cc2ebe6676b62eae326fa670bb607ef788c1c", size = 1819846, upload-time = "2026-07-23T01:53:18.289Z" },
-    { url = "https://files.pythonhosted.org/packages/ad/05/d5e1cb6480eeffd3f901d40a2c5e2d1e7effdc797837da3b490272699f13/aiohttp-3.14.3-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:ba59d59aba08ac02fc03b0c8983ccd5ee39a199d0552ce9e6d2b4845b34d59ae", size = 1628531, upload-time = "2026-07-23T01:53:23.86Z" },
-    { url = "https://files.pythonhosted.org/packages/c9/90/b934682bcaefae18a9e04f3dff5b68522ba810906358ae5029b68110ea3b/aiohttp-3.14.3-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:ed099d105449c4f9e84f24af203cd131349d4761d8813fa7e02c32e7128cd910", size = 1832712, upload-time = "2026-07-23T01:53:27.551Z" },
-    { url = "https://files.pythonhosted.org/packages/21/df/6061679faaf81fac746e7307c7adb71e858071a5d34c27583afefc64f543/aiohttp-3.14.3-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:152516815ef926786a0b6ae2b8f1fd2e0c71582dee0b435636865316fd4891b7", size = 1775014, upload-time = "2026-07-23T01:53:30.223Z" },
-    { url = "https://files.pythonhosted.org/packages/8a/1d/f854878bbc69b88faefe924b619a34a6f59ec05fd387c77690667eaa75eb/aiohttp-3.14.3-cp311-cp311-win32.whl", hash = "sha256:a4af35c443e0b1a1bd6a8af3f3485d7fda15c142751a00f3ff8090f0b93346fa", size = 456006, upload-time = "2026-07-23T01:53:34.97Z" },
-    { url = "https://files.pythonhosted.org/packages/73/0c/2af9d1674baccd1dbd47282a93d660a22e57ef6167c856deb24b4214fbab/aiohttp-3.14.3-cp311-cp311-win_amd64.whl", hash = "sha256:e1e74298bab6ee0d6e749ed4fd1901c7e604bdda32c03d787a2cc71c46d0433d", size = 481069, upload-time = "2026-07-23T01:53:39.673Z" },
-    { url = "https://files.pythonhosted.org/packages/8e/76/88401ff3fc95e85c5fc38d588f36f55e61ecb64343b2bc8d69326f453cc0/aiohttp-3.14.3-cp311-cp311-win_arm64.whl", hash = "sha256:03cd2bde3d7f085b64e549c985f4bb928cad7e8ecf5323bfca320db548d81b39", size = 453021, upload-time = "2026-07-23T01:53:43.749Z" },
-    { url = "https://files.pythonhosted.org/packages/18/d4/eb96299230e20acf2efae207cb8d69051f1f68e357e5ea5e479bf6fb097a/aiohttp-3.14.3-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:39aded8c7f3b935b54aab1d8d73c70ec0ee2d3ec3b943e0e86611bc150ba47f5", size = 754690, upload-time = "2026-07-23T01:53:47.332Z" },
-    { url = "https://files.pythonhosted.org/packages/88/11/e7a70a209eb9a067c0d3212b518a0134e3484f5178c7533878b6b514d469/aiohttp-3.14.3-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:5bcb6ff3fdab1258a192679ff1a05d44f59626430aa05cd1a9d2447423599228", size = 509484, upload-time = "2026-07-23T01:53:51.159Z" },
-    { url = "https://files.pythonhosted.org/packages/30/07/4bbc222cc8dbe31d4c3e8a5baad2286e4d42026ac0c570027b89afce6344/aiohttp-3.14.3-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:617105e2c3018ee38d0c8ce5ee3c84f621a6d8b9f723202aacaff28449ca91ee", size = 511949, upload-time = "2026-07-23T01:53:55.083Z" },
-    { url = "https://files.pythonhosted.org/packages/54/b9/42e74c46b7b7c794b995bbc1f573fb48950c38b19d8600c62a6804ee2d67/aiohttp-3.14.3-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f631fe87a6f30df5fbe6d79640b25e4cffb38c31c7fb6f10871517b84b0f8c1a", size = 1765282, upload-time = "2026-07-23T01:53:59.662Z" },
-    { url = "https://files.pythonhosted.org/packages/6b/ed/62bc4d74363ad346d518e0720363a949f63e2e23439a79eb5813d4d29bb3/aiohttp-3.14.3-cp312-cp312-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:a94dbaae5ae27bd849c93570669bff91e0510f33a80805738e3de72a7be0447b", size = 1741511, upload-time = "2026-07-23T01:54:04.063Z" },
-    { url = "https://files.pythonhosted.org/packages/d0/9f/181e8a8bc79e47d13c7fc4540bd7a3b729d9505609c61f392a8dd2fbfe55/aiohttp-3.14.3-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:8f2f1c4c032c7cedd7d8da6f54c97b70266c6570c3108d3fdffee7188bb70529", size = 1810680, upload-time = "2026-07-23T01:54:09.882Z" },
-    { url = "https://files.pythonhosted.org/packages/5c/9a/dec94d6ad694552fe3424e3f1928d7a606a5d9d9433a04e7ecdd9d38ae7f/aiohttp-3.14.3-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:ea05e1f97ceea523942d9b2a7d7c0359d781d683d6b043f5943a602b14da4787", size = 1905646, upload-time = "2026-07-23T01:54:13.475Z" },
-    { url = "https://files.pythonhosted.org/packages/52/b7/7cd31f29d6055bd711ae6e669367fba6f5ae9de463910a793e30556a8db7/aiohttp-3.14.3-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:543906c127fb1d929b95076db19b83fa2d46751006ff1e23b093aa5ac4d8db42", size = 1792122, upload-time = "2026-07-23T01:54:15.752Z" },
-    { url = "https://files.pythonhosted.org/packages/66/73/10b1ef93afa61f4963c746257b70ced619cf31a4798671de5fdb2608501d/aiohttp-3.14.3-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:0a5ff2dfbb9ce645fa5b8ef3e02c6c0b9cc3f6030ff863d0c51fffc50cb5541b", size = 1591127, upload-time = "2026-07-23T01:54:19.489Z" },
-    { url = "https://files.pythonhosted.org/packages/49/ed/3b203fa6de1b338c14acdc06bf6ca9b043b7944f005966958c2ced932cde/aiohttp-3.14.3-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:041badb8f84396357c4d3ad26de6afd7a32b112f43d3c63045c0c8278cfd2043", size = 1725210, upload-time = "2026-07-23T01:54:24.129Z" },
-    { url = "https://files.pythonhosted.org/packages/28/b7/1c2aab8c706436dcc28598452488ac9cd7c409da815237c28c27d58993e6/aiohttp-3.14.3-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:530125ee1163c4219af35dc3aa1206e541e7b31b6efc1a3f93b70a136f65d427", size = 1764848, upload-time = "2026-07-23T01:54:27.973Z" },
-    { url = "https://files.pythonhosted.org/packages/54/50/94c28f08b131c4bf10984ea2c7a536c9920608bb2d6e7f95642c30cc87b7/aiohttp-3.14.3-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:c8653fd547c93a61aadc612007790f5555cdd18946fa48cf45e26d8ea4ea473d", size = 1777102, upload-time = "2026-07-23T01:54:31.775Z" },
-    { url = "https://files.pythonhosted.org/packages/13/d4/e7d09ba7d345fb2d74440fd2fa033c5e079fac05552927705986f41a364f/aiohttp-3.14.3-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:89176250f686cb9853c0fb7ead90e639e915b84a6f43eedc2a4e7ec21f1037f0", size = 1580205, upload-time = "2026-07-23T01:54:34.518Z" },
-    { url = "https://files.pythonhosted.org/packages/a3/84/072a91d68e1e1eb587985b54baab94221277f877e8ef274fc213a0ceae28/aiohttp-3.14.3-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:3a26434dafe408229ff3403458ca58de24fb51936504decac49ce6755f77e59d", size = 1797219, upload-time = "2026-07-23T01:54:36.995Z" },
-    { url = "https://files.pythonhosted.org/packages/e0/eb/aad34e897e668424d6e995da5dff8a4a09af93363d3392488772957a63aa/aiohttp-3.14.3-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:d1558173930a5a8d3069cee5c92fc91c87c4dbcb099debbb3622053717145a19", size = 1768629, upload-time = "2026-07-23T01:54:40.103Z" },
-    { url = "https://files.pythonhosted.org/packages/b6/2b/6bb88ddba0fecd9122aa3ebcad25996cf6c083a4a7040dbb3a4f97972af6/aiohttp-3.14.3-cp312-cp312-win32.whl", hash = "sha256:16100ad3ab8d649fdfbee87602d9d2dcdca9df0b9eda8a1b5fdc0d41f96da559", size = 451481, upload-time = "2026-07-23T01:54:42.547Z" },
-    { url = "https://files.pythonhosted.org/packages/76/9b/f2f8f108da17ecef2cc3efc424e8b7ad3782b1a8360f7b8eae8ced84f6ea/aiohttp-3.14.3-cp312-cp312-win_amd64.whl", hash = "sha256:33a2d7c28d33797a2e99923dffa63f83d908a19b6bf26cfe80fa790aa5e1a75a", size = 476845, upload-time = "2026-07-23T01:54:44.853Z" },
-    { url = "https://files.pythonhosted.org/packages/3e/44/28dac80a8941b604f4da10ce21097614ca1bf905ce93dca28d8d7de9c1e7/aiohttp-3.14.3-cp312-cp312-win_arm64.whl", hash = "sha256:362a3fd481769cac1a824514bcd86fda51c65e8fe6e051099e008fddde6db17c", size = 448050, upload-time = "2026-07-23T01:54:47.087Z" },
+    { url = "https://files.pythonhosted.org/packages/67/47/7727bfe8db93f8835a001bd4359d8480cc68d1259b8bce334668f8be97bd/aiohttp-3.14.0-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:54bf3522d6f7351e55f89a62d5c2bf138ad557b031670266c5df604ae88e0b5a", size = 759147, upload-time = "2026-06-01T19:37:12.918Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/f2/cd3fedff6fade73d71df9ec908c210cec518ef90fd00289250684b90aecf/aiohttp-3.14.0-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:0746d9fb0ac4fdef643a84494efe3f06d50335dd8c7a530228b86448aae0a803", size = 513705, upload-time = "2026-06-01T19:37:14.633Z" },
+    { url = "https://files.pythonhosted.org/packages/5a/fe/49746b6b610144a06323bebd8e1211a390310d8c69b98dd6d52df341bc3e/aiohttp-3.14.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:9f3a96b6d39a4872222beee72e1df41d2ff886ae96152cf3e757ef8c5673ef0e", size = 509627, upload-time = "2026-06-01T19:37:16.385Z" },
+    { url = "https://files.pythonhosted.org/packages/4c/3f/28f2f6cf3d5c0e7b01b27140d0e7873fd11fb341169ad3ce78ad04aba628/aiohttp-3.14.0-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:d336820adbb914debbc90a1d8c1bfc4bea55996aecf64866a989d35d1f9fd903", size = 1769293, upload-time = "2026-06-01T19:37:18.067Z" },
+    { url = "https://files.pythonhosted.org/packages/97/6f/2e5f1b525d5474b12b3c60abf733a755845f3bceff21542081ada515f837/aiohttp-3.14.0-cp311-cp311-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:71b2604c9bfc1b115547d63a094d5244b3f02799833513a99a68aaa7b167c4cb", size = 1732363, upload-time = "2026-06-01T19:37:20.138Z" },
+    { url = "https://files.pythonhosted.org/packages/a8/ce/596120faa85ca7b19cd061e3f2f3be23aa8f11a0aedf9191db9e0da1bd76/aiohttp-3.14.0-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:610d68800435903e303ca0542b9d3e4eb72a12ff33a6d471a070c1d81eebd3c2", size = 1840375, upload-time = "2026-06-01T19:37:22.104Z" },
+    { url = "https://files.pythonhosted.org/packages/72/3c/a7ffe05a757a4a7867643da69357ec41f506879fbd1b231d2ed90af246b2/aiohttp-3.14.0-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:514db9a79337068981ee2137310283a07b4b885c584991097a91a4da419bcb81", size = 1921484, upload-time = "2026-06-01T19:37:24.068Z" },
+    { url = "https://files.pythonhosted.org/packages/93/fa/2c861170bbd4a491de93a69e081db1d971092569e0d593a98ef62c384dc1/aiohttp-3.14.0-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:c452d17eeb95d563fc8b936f3050301dbd1d268126c4632d8b70ede9696202ee", size = 1774153, upload-time = "2026-06-01T19:37:26.256Z" },
+    { url = "https://files.pythonhosted.org/packages/9d/da/1d2f5a165f47ec9b1f69d37b8b977fdc4d501aa72ffb7930db27bb9e49ea/aiohttp-3.14.0-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:ed94a81506e3d1bdbad5108f497a58f2a2354aedb4ca314d5326f07d1fd1ac2d", size = 1632569, upload-time = "2026-06-01T19:37:28.192Z" },
+    { url = "https://files.pythonhosted.org/packages/46/1d/7a6e295c4257252f70f69e90864fdad74b6a1293054fb3f9e65a15de6d63/aiohttp-3.14.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:1394dce36e0f0d260ac0b555a654de19cb989f3c1b8bdd24f505314dfea18a00", size = 1740325, upload-time = "2026-06-01T19:37:30.08Z" },
+    { url = "https://files.pythonhosted.org/packages/f1/7e/e1899b1ca3ec62f1eab2a5cbde14039b97493f7f53eb88d9b668562ffa8d/aiohttp-3.14.0-cp311-cp311-musllinux_1_2_armv7l.whl", hash = "sha256:d1467d1e7b48a73ca7237e0ee4335f3d02b923dbc27b82fd254bc301c97d4026", size = 1748691, upload-time = "2026-06-01T19:37:32.211Z" },
+    { url = "https://files.pythonhosted.org/packages/ec/54/4e6b61c1fe7d3433f82bcc6bd7e4d7c683a742a10c9b12a025fd3695c047/aiohttp-3.14.0-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:6a5f3532125233c261cf61f32df4059cfcf482eb793c7d3db8452e3142028b86", size = 1814477, upload-time = "2026-06-01T19:37:34.173Z" },
+    { url = "https://files.pythonhosted.org/packages/9c/38/86fd51be2e08d8e45c83d879d255f10391903cd9fe2a16512f7591a15873/aiohttp-3.14.0-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:3ea81eb518a2ecb319d8ec6d1424a37c773f6634bd87d6985eb606b2faac419f", size = 1623393, upload-time = "2026-06-01T19:37:36.281Z" },
+    { url = "https://files.pythonhosted.org/packages/78/49/466e947a42a88ee23c486d036e7e5d1b097f1bafd8084ad9c9a0a92f0f43/aiohttp-3.14.0-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:32e735c3182de7b64f6941a4ede48b38c7f47d9437bd615dd30b5bda8fa1bc93", size = 1824097, upload-time = "2026-06-01T19:37:38.421Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/89/35f3410bc284682338a1be6b6ea0c5abfa05f063942cfaa9256608440434/aiohttp-3.14.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:c21ca9a1c63d4509158f478aeb9d02914dcc52adc68d1bc9dee2452284ee5996", size = 1764790, upload-time = "2026-06-01T19:37:40.755Z" },
+    { url = "https://files.pythonhosted.org/packages/42/80/2d4291bd5724d3d17e5951aff5a3e02281483fb47295f0788276ee66cd73/aiohttp-3.14.0-cp311-cp311-win32.whl", hash = "sha256:19ca5fc84130675ba11c6ca5c7da5cb65f7bf8a32cdd2b616bf49cd334688aae", size = 454176, upload-time = "2026-06-01T19:37:42.837Z" },
+    { url = "https://files.pythonhosted.org/packages/59/ed/41d0ad4f6ececffc32bdf1f7b494e5498f7ca5c849ea2e3cc9bbd1668251/aiohttp-3.14.0-cp311-cp311-win_amd64.whl", hash = "sha256:d488e6e9d3bb8ba5ae7066d5be885ae9670eba021b8c6ccb9a3a568e6b19d6e5", size = 479334, upload-time = "2026-06-01T19:37:44.776Z" },
+    { url = "https://files.pythonhosted.org/packages/d1/86/c0b5e305c770053f8c3d069bb52b8196917ba91949d1962d52eb307fb0d2/aiohttp-3.14.0-cp311-cp311-win_arm64.whl", hash = "sha256:8b93618102caf12801638a01a2b478a55410ddd71bd41cfaf6f707953a49ac43", size = 450262, upload-time = "2026-06-01T19:37:46.461Z" },
+    { url = "https://files.pythonhosted.org/packages/89/97/2b6889bfb6b6847520d50d95eb8c4307a45e28aaca39faf4a9454b3d1b2f/aiohttp-3.14.0-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:b29518c9c2ec7e373e68259206a137c7f4f5439c58baaec4b5ab3ab799850a4e", size = 750194, upload-time = "2026-06-01T19:37:48.164Z" },
+    { url = "https://files.pythonhosted.org/packages/21/e2/62634b7fff918ed98c3c6b2f0e70d520f7f28846cb412d451b04354c6459/aiohttp-3.14.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:dbec68ce61b64cb73cab4d33df9433427b1713c8bcccb181dce695c1b6f8e87c", size = 506966, upload-time = "2026-06-01T19:37:50.014Z" },
+    { url = "https://files.pythonhosted.org/packages/dd/fb/5ce075150828c797a5106f1c2fb26034e709d4289b9d2bf8b07f1e59fac6/aiohttp-3.14.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:3cdf534aa455593e589302990c5097aa5c92c06c4262a20da22934f9186a5fff", size = 507527, upload-time = "2026-06-01T19:37:51.96Z" },
+    { url = "https://files.pythonhosted.org/packages/01/d5/405a0ae4e6b081754a3609c1c97c63a950e000a2def16046f1e736933a0e/aiohttp-3.14.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:cb6c657104393b5fbff01a5f59b2023db74058a8077d94475d6c25d03882a108", size = 1762420, upload-time = "2026-06-01T19:37:53.839Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/1d/e05a7c896b15a6bc6fb8fc5319eb437861c2c49c34559ef928add6590315/aiohttp-3.14.0-cp312-cp312-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:46fbbec4e4fab7428d4396a3823f9320e4560aa3113b89eeebce712c27c9ed5a", size = 1733672, upload-time = "2026-06-01T19:37:55.791Z" },
+    { url = "https://files.pythonhosted.org/packages/cc/22/a72f7c459e195fa41bf4f7abd1f925b91fe91f8097e51c654229ba144a33/aiohttp-3.14.0-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:2c2c7e05dd5335b298085abf45ddf98673934c3ee1c083d0b9ea13d4186ad500", size = 1805064, upload-time = "2026-06-01T19:37:57.931Z" },
+    { url = "https://files.pythonhosted.org/packages/80/50/e85bdaba0be59ca4838005ebfef4048fcdd5f35a02b07057a9a123394440/aiohttp-3.14.0-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:3c7139100fbaae76515b73051d8f0aa3a3ff02e415eec8a8eee8e2223d9ba955", size = 1902125, upload-time = "2026-06-01T19:38:00.225Z" },
+    { url = "https://files.pythonhosted.org/packages/19/d8/51de5c6b971c27bb1ef620293b8d1ca611ec78736b34b3f6ccf68e4c8785/aiohttp-3.14.0-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:78d6f9286a629ce52728430afe18f8ed2b6c39a1fddb3802d7244b9983910ad2", size = 1783112, upload-time = "2026-06-01T19:38:02.641Z" },
+    { url = "https://files.pythonhosted.org/packages/73/ae/b4402bfde77e43dfb1b6ccff83c7b7ab63ed06b50c4754f0c5423fb374fe/aiohttp-3.14.0-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:cc3c3e12cdaeb92d7dcf13db00e9f6b1956b910e47256e696df1cfa946d02159", size = 1586356, upload-time = "2026-06-01T19:38:04.637Z" },
+    { url = "https://files.pythonhosted.org/packages/bc/05/750a3265ca4dc54a460bd0cb1121a8f2ce9171fce4a135fb47ea7fd594d2/aiohttp-3.14.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:4d6a998191f5ebe3b8c28463ff72bc030250008b3193c402464efadd08b5ca02", size = 1723119, upload-time = "2026-06-01T19:38:06.713Z" },
+    { url = "https://files.pythonhosted.org/packages/37/01/8c0812c50b3b1b1c37b323bf170d6be8847a8f234060485b7d1e71953f60/aiohttp-3.14.0-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:0fc2b75ae8d169d853be2862d960be8550da6c5c65711d5476407eb3fdb006bd", size = 1757216, upload-time = "2026-06-01T19:38:08.736Z" },
+    { url = "https://files.pythonhosted.org/packages/47/2a/50fb98028a26887cbe48dcc1df92a90825615bc73b5584301304090cded8/aiohttp-3.14.0-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:16eee56bcc72d04600bc56c1759982c2385ec0b41d3fd3521f836bf64a0957ef", size = 1770500, upload-time = "2026-06-01T19:38:11.111Z" },
+    { url = "https://files.pythonhosted.org/packages/bd/32/0ffd598a2fa2b9a423daf242e700cfdabda35d6e602394ad9ae58972c1c7/aiohttp-3.14.0-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:5a2e7ca615c3ddc15b82687e05a624e5f5cba3f1d6c20cb81172d70ea498451e", size = 1576224, upload-time = "2026-06-01T19:38:13.391Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/f9/b9fc381dd9b66afb33f2634c40e229d106467be0afcabe79648631ab6712/aiohttp-3.14.0-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:f0b7b8bbbec3ce9467ee0ebe334622fd90624f593edd3136c567811453fc4fae", size = 1794252, upload-time = "2026-06-01T19:38:15.498Z" },
+    { url = "https://files.pythonhosted.org/packages/a8/fb/05d9214c975f23225a8cd5c439325e338c7c377b315480ef3871db51f54e/aiohttp-3.14.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:5ba10966d4f03dd96a14365be4b8e37c327c76f11c3ca867116966cdd9f98066", size = 1760193, upload-time = "2026-06-01T19:38:17.624Z" },
+    { url = "https://files.pythonhosted.org/packages/d9/4b/02992fc4fb9e1b6673ee3f888a8e587a6447afda1f6f4aca776c148c2876/aiohttp-3.14.0-cp312-cp312-win32.whl", hash = "sha256:101df7779c80c0636014a6b2c6642acd3efb5b355d48347c9d7dfb720aee9430", size = 448650, upload-time = "2026-06-01T19:38:19.545Z" },
+    { url = "https://files.pythonhosted.org/packages/39/e9/246532214c3abda518477cbaaf16d420295ad8effa5233844cbb38f299ab/aiohttp-3.14.0-cp312-cp312-win_amd64.whl", hash = "sha256:b0a5747586d4467efd1f932710b269131c9717a872dce082cd92a00c1c13123a", size = 476145, upload-time = "2026-06-01T19:38:21.505Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/c3/63f8c20090048915711598b0adf475b149216d736157961de06480a45b15/aiohttp-3.14.0-cp312-cp312-win_arm64.whl", hash = "sha256:5f1c5be60add78fabb4aacd13c5a348ae79d2fcbfc7fa78da8f1eb192273b370", size = 444250, upload-time = "2026-06-01T19:38:24.027Z" },
 ]
 
 [[package]]
@@ -860,7 +859,7 @@ sdist = { url = "https://files.pythonhosted.org/packages/9a/7d/b22cb9a0d4f396ee0
 
 [[package]]
 name = "alibabacloud-tea-openapi"
-version = "0.4.6"
+version = "0.4.5"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "alibabacloud-credentials" },
@@ -869,9 +868,9 @@ dependencies = [
     { name = "cryptography" },
     { name = "darabonba-core" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/ab/34/1918a2d780676494365c7f945bfab397ecddb988054d78025bd26f438977/alibabacloud_tea_openapi-0.4.6.tar.gz", hash = "sha256:dafc32401712f5b21c12dc3d05ba887a91ad156d9b49a7662279f9fd90526fb2", size = 26742, upload-time = "2026-08-17T08:34:11.55Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/3b/73/fb0c4d44759791ecdf269fc715c1e810fa1aba3981bfaaf8a01f61899296/alibabacloud_tea_openapi-0.4.5.tar.gz", hash = "sha256:75fa1f4360a46e41f5bf5f8d4917e52efb6f64885839bc1328c35590670c97b9", size = 26616, upload-time = "2026-07-14T13:15:39.364Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/35/00/2f534f5884e5f299d9cb3a1e8be2def8071bc6a6e2a192ba4ff2a8cd5e02/alibabacloud_tea_openapi-0.4.6-py3-none-any.whl", hash = "sha256:c9e1727b9fb2936f487d050fc3590c99f9f2065256dc3a927e5b61f414674ed6", size = 33448, upload-time = "2026-08-17T08:34:10.472Z" },
+    { url = "https://files.pythonhosted.org/packages/8d/ec/6b368a10e9c2e8b1b394c69b96ac213ae66e8c4895e0baa1ffaf7178fd32/alibabacloud_tea_openapi-0.4.5-py3-none-any.whl", hash = "sha256:338979095c7beda80a5b413c31262892cafdc12069dde4ce4fc2e4f7ce0fc609", size = 33333, upload-time = "2026-07-14T13:15:38.365Z" },
 ]
 
 [[package]]
@@ -969,15 +968,15 @@ wheels = [
 
 [[package]]
 name = "anyio"
-version = "4.14.2"
+version = "4.12.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "idna" },
     { name = "typing-extensions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/61/cc/a381afa6efea9f496eff839d4a6a1aed3bfafc7b3ab4b0d1b243a12573dd/anyio-4.14.2.tar.gz", hash = "sha256:cfa139f3ed1a23ee8f88a145ddb5ac7605b8bbfd8592baacd7ce3d8bb4313c7f", size = 260176, upload-time = "2026-07-12T20:29:07.082Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/96/f0/5eb65b2bb0d09ac6776f2eb54adee6abe8228ea05b20a5ad0e4945de8aac/anyio-4.12.1.tar.gz", hash = "sha256:41cfcc3a4c85d3f05c932da7c26d0201ac36f72abd4435ba90d0464a3ffed703", size = 228685, upload-time = "2026-01-06T11:45:21.246Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/da/35/f2287558c17e29fafc8ef3daf819bb9834061cfa43bff8014f7df7f63bdc/anyio-4.14.2-py3-none-any.whl", hash = "sha256:9f505dda5ac9f0c8309b5e8bd445a8c2bf7246f3ce950121e45ea15bc41d1494", size = 125813, upload-time = "2026-07-12T20:29:05.763Z" },
+    { url = "https://files.pythonhosted.org/packages/38/0e/27be9fdef66e72d64c0cdc3cc2823101b80585f8119b5c112c2e8f5f7dab/anyio-4.12.1-py3-none-any.whl", hash = "sha256:d405828884fc140aa80a3c667b8beed277f1dfedec42ba031bd6ac3db606ab6c", size = 113592, upload-time = "2026-01-06T11:45:19.497Z" },
 ]
 
 [[package]]
@@ -2150,45 +2149,47 @@ wheels = [
 
 [[package]]
 name = "cryptography"
-version = "50.0.0"
+version = "48.0.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "cffi", marker = "platform_python_implementation != 'PyPy'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/de/41/6cbdcf9142d00fe82836fbb51e503e58088575cf7a0fe1dbff6695bf0840/cryptography-50.0.0.tar.gz", hash = "sha256:eeac2acb5a20ed25e0ad6d1df9891a520b78b404266b6d11778f25d5d691a6c9", size = 880201, upload-time = "2026-07-31T14:25:10.11Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/12/45/870e7f4bef50e5f53b9f51d4428aee5290eedf58ba443f16b1ebb7ab8e66/cryptography-48.0.1.tar.gz", hash = "sha256:266f4ee051abb2f725b74ef8072b521ce1feacf685a3364fa6a6b45548db791a", size = 832989, upload-time = "2026-06-09T22:32:31.8Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/c5/5c/59086b4aac5e879d38ddbcf74e4be7ade89cebc3eb199a55da998c3bb46a/cryptography-50.0.0-cp311-abi3-macosx_11_0_arm64.whl", hash = "sha256:031e2d5dd4bb9caa3ca9c82e5a197fd8ae680232cee62603d1a813f3f07e3d03", size = 4001252, upload-time = "2026-07-31T14:23:33.331Z" },
-    { url = "https://files.pythonhosted.org/packages/57/ef/8f2df13c7216bcad3e1c74e07f6e193d93e998e114f524a53877c9af27ad/cryptography-50.0.0-cp311-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:fd9192b7b70c573d7f214eb1ae35e00d359f6f5e4b27c7e21e30de1fc6204645", size = 4719554, upload-time = "2026-07-31T14:23:35.611Z" },
-    { url = "https://files.pythonhosted.org/packages/d9/41/029086c34d91052fc3b88bcc8056f709a7c915c7a23b235a54eb800b1c97/cryptography-50.0.0-cp311-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:06a32a980526a6ab9a4b9bf8f7385800791e2bb960903cb6b530e4817509a3b7", size = 4702130, upload-time = "2026-07-31T14:23:37.635Z" },
-    { url = "https://files.pythonhosted.org/packages/7d/ff/b6ce0954962e7f7b969f850a883744197bb3910bdfd7b6da162eab7d9f68/cryptography-50.0.0-cp311-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:a1b30560f2acc95aa8b2e06e716a13dbfc97314747b80d9707e307f77b40d6b3", size = 4725244, upload-time = "2026-07-31T14:23:39.471Z" },
-    { url = "https://files.pythonhosted.org/packages/06/1e/63a1027cb7fec360a182208e1b7767d5aa1fe57be3d6aa856e69a321edc0/cryptography-50.0.0-cp311-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:8d89f3976b10b4ce31118de72329025f70d2c6ead14a8217c5514dd2c6d5a78f", size = 5342265, upload-time = "2026-07-31T14:23:41.286Z" },
-    { url = "https://files.pythonhosted.org/packages/6b/72/a1116d683a6d7ece94590013882515de087edf9ef0e6292aae615a44df73/cryptography-50.0.0-cp311-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:b42a28c1844fd9de8f3f7d540e36b66f3a9c83fceac7170ebc7a6a19edd9dcae", size = 4734609, upload-time = "2026-07-31T14:23:43.139Z" },
-    { url = "https://files.pythonhosted.org/packages/15/37/36a9c479bbe49acea2636c7fd3360d20f7b7e079c300352011c44850b181/cryptography-50.0.0-cp311-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:900131fafd8aead39ac7dd3a7e833be754c17a95cfd91221636949fe4eb0aa8a", size = 4356517, upload-time = "2026-07-31T14:23:44.939Z" },
-    { url = "https://files.pythonhosted.org/packages/32/98/8a151d64367204cbc63ec65d37502f1d9c53cf4bfc6ec3c532614dbec60d/cryptography-50.0.0-cp311-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:07949c449a1abcf60d1ee6e88956d89404c7df3c8258f46589e912988e551987", size = 4724529, upload-time = "2026-07-31T14:23:46.93Z" },
-    { url = "https://files.pythonhosted.org/packages/22/f6/ec13b470172126464a86bf54d2294a46d29837fc51ba3e45d4047946fb5e/cryptography-50.0.0-cp311-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:f89831ef99dd7dd169ab06d63a831adb9e20a87aac6d380266bbda5823349169", size = 5299852, upload-time = "2026-07-31T14:23:48.851Z" },
-    { url = "https://files.pythonhosted.org/packages/da/3a/f05e32c99d440c9bb891ea0e36c9091891e36be5a9a87ab2ee6ea20729f6/cryptography-50.0.0-cp311-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:82148ec5bddac30b51a5b3c1945075f896fa022cb93f8e4a01e9f6ee95292c5f", size = 4734462, upload-time = "2026-07-31T14:23:50.861Z" },
-    { url = "https://files.pythonhosted.org/packages/ca/dc/bd72b26be8953f80625f63151efd38eee71c76ca6cf591c08ff34615a79e/cryptography-50.0.0-cp311-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:1489e263a8048bb8b6a8bac662eb2d402ea5d2b7b4699b72f385f1e2772db105", size = 4852708, upload-time = "2026-07-31T14:23:52.715Z" },
-    { url = "https://files.pythonhosted.org/packages/27/20/c930314a2ab476d15dec966ec87e2e9637bb02b06106b12c0396c57bb603/cryptography-50.0.0-cp311-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:7cec5b856506da6defb290f30c9ee687d5f5e8cb0bd3f6459dde43b0b4fa40ef", size = 5004179, upload-time = "2026-07-31T14:23:54.887Z" },
-    { url = "https://files.pythonhosted.org/packages/32/2e/c9db68a0c4bfa28e310707527c0ee3a2bd254104d2e02e68f368e197aa4c/cryptography-50.0.0-cp311-abi3-win_amd64.whl", hash = "sha256:bd1c592e4d5974f0d08d4888e432157adba757c66da0246918e43677fafa2d30", size = 3840395, upload-time = "2026-07-31T14:23:56.677Z" },
-    { url = "https://files.pythonhosted.org/packages/03/37/73d005be173aff344af30e9fd2a576575cb2391a7101d9cd3842e1fa8cce/cryptography-50.0.0-cp39-abi3-macosx_11_0_arm64.whl", hash = "sha256:ccdc4a71a4dabae05de219404f9f4abc38e3b58422177ff93d0da05967dafa07", size = 4036009, upload-time = "2026-07-31T14:24:24.122Z" },
-    { url = "https://files.pythonhosted.org/packages/ff/c6/7a6202a534e32103a285b7834a120869557fe198d51d7cfe59754c8bda9c/cryptography-50.0.0-cp39-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:910e1d2668e7de9648f2bcee30e180db2a6b15c30f887d7c4c93ddf96e3992e3", size = 4745252, upload-time = "2026-07-31T14:24:26.118Z" },
-    { url = "https://files.pythonhosted.org/packages/85/4f/0fa8c2f4428198f15d9ff8d63400e27afbf94ce833f6108da1eb3753f945/cryptography-50.0.0-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:a91296cb61e8df6f86d0c19cc4068228da256bf59bf86049fbd821084565327f", size = 4728939, upload-time = "2026-07-31T14:24:27.994Z" },
-    { url = "https://files.pythonhosted.org/packages/d1/63/54dd723490ba2dc09b299682c10b38db38f159728bcaae8c591b8af2f22d/cryptography-50.0.0-cp39-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:e722f16708d854fe924790e051061f6704a472c3bac347b6fd88033ea8dd0dc5", size = 4748483, upload-time = "2026-07-31T14:24:30.254Z" },
-    { url = "https://files.pythonhosted.org/packages/1d/dd/7c77d26285cc7f6991efce64a0f5b4f9383bfa5dd8c5033003eaf7db4cdb/cryptography-50.0.0-cp39-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:d764dcf130c428ef66786f866dd750f53182bc608813489915e9fc106bb0c82f", size = 5367599, upload-time = "2026-07-31T14:24:32.457Z" },
-    { url = "https://files.pythonhosted.org/packages/46/c9/f60aed34c013f317f92817b6c171c2d22a78270fa41109bd4b08af26b194/cryptography-50.0.0-cp39-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:105110f43a471dbd0060b9c9516cb8a6a79233631a04cc2ba16f28323ac6e025", size = 4762647, upload-time = "2026-07-31T14:24:34.599Z" },
-    { url = "https://files.pythonhosted.org/packages/be/f3/f9a0173b139372c3a48ed98154b45cc6b9de17c789d5ab552e621c293609/cryptography-50.0.0-cp39-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:828743d939e9629bc267b8e2d08d8bb67cd4319c771a33d4b18b22dd8fb7440a", size = 4385197, upload-time = "2026-07-31T14:24:36.647Z" },
-    { url = "https://files.pythonhosted.org/packages/d8/36/83bb81f6e569bc38e1e4a7bc80f29b46bb9601920bc455fc8e888f5d5742/cryptography-50.0.0-cp39-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:2a8183b489dc1f7f80f135780fadc1108f14b31b8a40411c7a5b17425f65f28b", size = 4748095, upload-time = "2026-07-31T14:24:39.493Z" },
-    { url = "https://files.pythonhosted.org/packages/6b/16/d3008eff98c764979865834c3d386d4fd041b5f52e7f34fc29ac1a5eb515/cryptography-50.0.0-cp39-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:6e7d61120573a7f2cd94cc095f9e81f6967c61ccdf194285aa143ecec8e0b708", size = 5325948, upload-time = "2026-07-31T14:24:41.556Z" },
-    { url = "https://files.pythonhosted.org/packages/9c/f8/d97f9603efda3888187bfdb893f26c41be4735c10631d05d284ee6b047c4/cryptography-50.0.0-cp39-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:37fdb0d0111f1e2ff07139dfb79f1b49531f8e213c46f1163dd7642979b58c47", size = 4762400, upload-time = "2026-07-31T14:24:43.636Z" },
-    { url = "https://files.pythonhosted.org/packages/64/a2/4615c8f7d81a00b1d6e6afe19f694e1543582349fb5f4076f6cb5dc36485/cryptography-50.0.0-cp39-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:c87f62a3d3b9888ed0fdde100ec06aa61ca9cd44bad9057d1dff9a516b5f5bb9", size = 4878208, upload-time = "2026-07-31T14:24:45.522Z" },
-    { url = "https://files.pythonhosted.org/packages/d2/1a/efcfb02f91407149a0dacffffab791f7e19bf6385f63b3666dc8b5e5c9c8/cryptography-50.0.0-cp39-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:65c2c3add92b45fd0709db8594536aea39c2a67af0e27ffcf049c498501140b7", size = 5037050, upload-time = "2026-07-31T14:24:47.697Z" },
-    { url = "https://files.pythonhosted.org/packages/57/30/4a22984d4f1bdfb8c054f07a92bc176b97a3134cc1d6c4b3bffb1f3688b4/cryptography-50.0.0-cp39-abi3-win_amd64.whl", hash = "sha256:d24fead1d4d076e1bfb006dcec392074a3cd8d7b4fc8a595aa64073b2b7a96ba", size = 3874135, upload-time = "2026-07-31T14:24:50.085Z" },
-    { url = "https://files.pythonhosted.org/packages/9d/3e/e54cde8c01631a5a8226ccd617eab9e57fd5cfdad90f1a9e6bb570794631/cryptography-50.0.0-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:5e34edd123674534acd70147f0ca331eaa2c74e6325fb2028c886aa26ba0b68c", size = 3963170, upload-time = "2026-07-31T14:24:51.968Z" },
-    { url = "https://files.pythonhosted.org/packages/01/b6/0b9e125e90f3d2dcf599a218a899cda7326a3158cfa258723f0b398b08f6/cryptography-50.0.0-pp311-pypy311_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:8eb5e1172eb569ea8a872796576e6a67c276351728b6455d5beb01242b027c6a", size = 4692441, upload-time = "2026-07-31T14:24:53.743Z" },
-    { url = "https://files.pythonhosted.org/packages/53/c9/a5151588710785a96d7bc4de27d4cd62f263bbbcb203cfe29df537eb6505/cryptography-50.0.0-pp311-pypy311_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:910d11e1a385c654bf738bf3e6b8e6ed5de0f5610fcae2be9e5b398d8081d20e", size = 4699810, upload-time = "2026-07-31T14:24:55.746Z" },
-    { url = "https://files.pythonhosted.org/packages/c7/1a/15b92b25eb6ce3089cd49377ae990a0f3ad485a510f968aed1f19dbdcdf2/cryptography-50.0.0-pp311-pypy311_pp73-manylinux_2_34_aarch64.whl", hash = "sha256:62598a8a57f815db4c6259a4e97d857dab56697e7de8e8ab02352ab74da1995d", size = 4691924, upload-time = "2026-07-31T14:24:58.082Z" },
-    { url = "https://files.pythonhosted.org/packages/62/15/219075012ab13e8905f3cd572204f4acb4b111df787104346b9bc0cea789/cryptography-50.0.0-pp311-pypy311_pp73-manylinux_2_34_x86_64.whl", hash = "sha256:07479a1cb08219ab719147e742e76090c9c773321959bb94946fffdd397a6437", size = 4699593, upload-time = "2026-07-31T14:24:59.951Z" },
-    { url = "https://files.pythonhosted.org/packages/8e/b5/c2c5fce26f0ee40d21bafe7f191d29a34b35a65ac4fe8a1191d1983612e9/cryptography-50.0.0-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:c99c003e088647b8a5b7c145d6f78c335f6348332b62e142d411c4b63d1460b9", size = 3813796, upload-time = "2026-07-31T14:25:02.298Z" },
+    { url = "https://files.pythonhosted.org/packages/1b/bc/ee4137cbbe105652c0ee4252792b78fc8e7afa4b8e61d9d5dc05a7f45731/cryptography-48.0.1-cp311-abi3-macosx_10_9_universal2.whl", hash = "sha256:3e4a1a3232eef2e6c732827d5722db29a0cc8b27af2a4d865b094cf954be9ca1", size = 8008324, upload-time = "2026-06-09T22:31:00.702Z" },
+    { url = "https://files.pythonhosted.org/packages/d5/85/6379d42181bfc713094f081360fc5784d6c816b599d45e7f082502d173ce/cryptography-48.0.1-cp311-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:32143b24adb918f078134e1e230f1eb8cc04886b92c28b5f0041aaf3e5699225", size = 4696243, upload-time = "2026-06-09T22:32:33.446Z" },
+    { url = "https://files.pythonhosted.org/packages/9c/87/c85d147b53323c7eb4d850920c8901377323c2a0ff8d79c262d4fee89aa2/cryptography-48.0.1-cp311-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:f0d27a5696721ef7a672b8c810f6aded391058e0b9486e63e6d93baf765da691", size = 4713235, upload-time = "2026-06-09T22:31:40.141Z" },
+    { url = "https://files.pythonhosted.org/packages/79/58/67cbf8cf1ee7c54b439ca07bbecf8362c07afc11a3724fea70f745784add/cryptography-48.0.1-cp311-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:eb86ce1af36fe65041b6db9a8bb064ee621a7e5fded0f80d475ec243477cd242", size = 4702323, upload-time = "2026-06-09T22:31:42.191Z" },
+    { url = "https://files.pythonhosted.org/packages/89/c6/24266ac10c47f6cd2a865f4446062b466da1d1f10b27189eac00e61bf0c9/cryptography-48.0.1-cp311-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:b024e784ad6c077ee0147b35ea9cbfc1e34e1fd4c1dcca214c2794d73a12df08", size = 5300085, upload-time = "2026-06-09T22:31:58.703Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/bb/cc4b78784f97efc8c5874c2a9743708d172be6663024b34a0467885ae0c8/cryptography-48.0.1-cp311-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:3752f2dbc8f07a30aad2932c986cea495b03bb554887828225da104f732852b6", size = 4746137, upload-time = "2026-06-09T22:31:31.01Z" },
+    { url = "https://files.pythonhosted.org/packages/1f/52/0c44de3f5267f8fbe8e835138017522a333436166e406f0db9b9e6e3033f/cryptography-48.0.1-cp311-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:bd81490cd5801d755cf97bb68ac191f14b708470b1c7cf4580f669b9c9264cd8", size = 4333867, upload-time = "2026-06-09T22:32:28.096Z" },
+    { url = "https://files.pythonhosted.org/packages/9a/2e/772d7adbfa931537bc401640b7cac9976bff689bda187833e5d63b428e49/cryptography-48.0.1-cp311-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:66fd0771e7b9c6dcd44cf1120690d2338d16d72795cf40cae2786a39eba65429", size = 4701805, upload-time = "2026-06-09T22:31:38.284Z" },
+    { url = "https://files.pythonhosted.org/packages/f8/a3/b06844f303873493c963caf581c04df31c7035e0c1b0f02c4814d319ec80/cryptography-48.0.1-cp311-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:3fd2ca57062b241c856670b073487d2e86c4637937ca5601e48f97bf8e11fc8f", size = 5258461, upload-time = "2026-06-09T22:31:04.187Z" },
+    { url = "https://files.pythonhosted.org/packages/9f/13/8b765e2e12b07c74941caadb9d1c8fdc006c4dfbf2b8f2d610519758954d/cryptography-48.0.1-cp311-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:0ee6ea481db1ab889cba043ec1eda17bb9c1ea79db6722f779c3667f9f70322f", size = 4745488, upload-time = "2026-06-09T22:32:30.07Z" },
+    { url = "https://files.pythonhosted.org/packages/2e/aa/48972bce55049b32a94f4907eda4d75fa385aad8a39506cc2fc72196ecf0/cryptography-48.0.1-cp311-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:f2ceef93cb096aa3c4cc4b5c94ca6131f9196d28c64d6111533402a9b2054d41", size = 4830256, upload-time = "2026-06-09T22:31:43.868Z" },
+    { url = "https://files.pythonhosted.org/packages/47/a2/e5079a032fb85cf6005046ca92bbd78b0c82dad2b5751ab8c311659da06f/cryptography-48.0.1-cp311-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:9bd3f92d76217892b15df84ca256c2c113d386fdda7a7d8691aeeced976507c6", size = 4979117, upload-time = "2026-06-09T22:31:05.845Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/a0/8f50cae9c74e718ed769d63ed5c74bd0ea830c9550a74629cebd1b9c7bc7/cryptography-48.0.1-cp311-abi3-win32.whl", hash = "sha256:b9a32b876490d66c8bcc9963ef220199569748434ab01a9d6aaeabf88e7f5158", size = 3304154, upload-time = "2026-06-09T22:32:16.845Z" },
+    { url = "https://files.pythonhosted.org/packages/c5/69/0572c77dbace6fef72f33755bd52ea399c71367250d366237f8691826b9e/cryptography-48.0.1-cp311-abi3-win_amd64.whl", hash = "sha256:39489bfca54c7a1f6b297efcd8bc608ab92d16c4ca631b0cad4da46724588b24", size = 3817138, upload-time = "2026-06-09T22:32:00.388Z" },
+    { url = "https://files.pythonhosted.org/packages/ca/6c/00fa2a95997164c8b2072ce327c23d4ab20809ccc323ea5fab91e53a4bba/cryptography-48.0.1-cp39-abi3-macosx_10_9_universal2.whl", hash = "sha256:4fdc69f8e4316bcf0c8c8ec1f26f285d12e8142d88d96c876a59a03be3f6ae67", size = 7987408, upload-time = "2026-06-09T22:32:20.777Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/d9/45f309a7e4e5f3f8f121d6d3be9e94024a7726ec598d6e08ae04edb2f04d/cryptography-48.0.1-cp39-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:48fe40804d4caa2288f24e70ca8c64c42dd826da0ad7e4f1b41b2128d679e6c8", size = 4690196, upload-time = "2026-06-09T22:31:54.74Z" },
+    { url = "https://files.pythonhosted.org/packages/5f/9f/a1bc8bcc798811b8527eb374bbccf30a3f3e806829d967118222bf1125eb/cryptography-48.0.1-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:86be3b1b0b6bf09482fb50a979c508d2950ed95f5621ec77f4e385962006b83a", size = 4696782, upload-time = "2026-06-09T22:31:45.615Z" },
+    { url = "https://files.pythonhosted.org/packages/66/c2/81a4fb4e4373c500bb526bc337ac5719dd31dd15b970b84a238168c6aa08/cryptography-48.0.1-cp39-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:4ab0a343c807bbcd90c971cd1ecf072937cd01847a9e002bef88fb47ac6be577", size = 4696618, upload-time = "2026-06-09T22:31:11.564Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/0b/aa68b221dde92d09cb29a024ede17550ee21e77a404e59fc093c82bb51e1/cryptography-48.0.1-cp39-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:9621de99d2da096006b629979efd8ae7eb2d8b822488d0c89ee4000c306c59b1", size = 5289970, upload-time = "2026-06-09T22:31:20.368Z" },
+    { url = "https://files.pythonhosted.org/packages/78/13/fba657f958d2af66ea959a4ba01212632089249d34af1ae48054136344d7/cryptography-48.0.1-cp39-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:88c852a0ae366e262e5a1744b685e6a433dc8788dd2a277e418bf4904203609d", size = 4731873, upload-time = "2026-06-09T22:31:22.253Z" },
+    { url = "https://files.pythonhosted.org/packages/4c/4c/9a964756d24a26b3e34dfcb16f961b89838786e6700b635b0d1e3adff4b6/cryptography-48.0.1-cp39-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:43c5835e2cb98c8733d86f57d6fc879b613f5c3478607281c3e36daffc6dd8a6", size = 4330804, upload-time = "2026-06-09T22:31:36.56Z" },
+    { url = "https://files.pythonhosted.org/packages/4b/0f/a10f3a6eb12950a10e3a874070283aa2dd5875b2bfd15fad8a3e17b3f13e/cryptography-48.0.1-cp39-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:fe0180af5bf9236518a087e35bf2d9a347d5f5f51e63c579d683ddff424e3d46", size = 4696217, upload-time = "2026-06-09T22:31:13.351Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/6f/5cd12f951165ea73ef85266775d97e4c763b2474ccfd816dd69d3a18d6f8/cryptography-48.0.1-cp39-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:b7a2d1a937a738a881737cec135a38bb61470589b17515b9f73f571d0ae10401", size = 5245252, upload-time = "2026-06-09T22:32:02.193Z" },
+    { url = "https://files.pythonhosted.org/packages/68/ab/8aaa12e4516ec4464033ab79b6f3b592bd5a92102467c4ace8a0d970203f/cryptography-48.0.1-cp39-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:b74ca3b8e5ecdd833bf6a002ca41b4793bb27fb8f1c06ffaf2643c9e9140e31b", size = 4731388, upload-time = "2026-06-09T22:32:04.019Z" },
+    { url = "https://files.pythonhosted.org/packages/1b/24/50027ea4dca85ec1f40688f3c24fb32ccacd520583c9592c3cc95628e6fb/cryptography-48.0.1-cp39-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:2c37f2461406063b417837f5f3daab668652acd82423efcd7f0a9f04be972de1", size = 4824186, upload-time = "2026-06-09T22:32:18.707Z" },
+    { url = "https://files.pythonhosted.org/packages/52/41/04cb5eb17085ade6f50cc611fb657df6a0f5885350de8764ece89c050197/cryptography-48.0.1-cp39-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:86fe77abb1bd87afb251d4d02ada7ecf53a32cee9b67d976abb2e45a13297475", size = 4964539, upload-time = "2026-06-09T22:31:18.793Z" },
+    { url = "https://files.pythonhosted.org/packages/36/bf/ed70785c496e89d7e73b7cda2d21f2447fd6d4e821714b8d04ff217fed92/cryptography-48.0.1-cp39-abi3-win32.whl", hash = "sha256:6b2c0c3e6ccf3ade7750f836ef3ee36eea250cc467d45c256895573ac08cc6f1", size = 3282307, upload-time = "2026-06-09T22:30:53.162Z" },
+    { url = "https://files.pythonhosted.org/packages/b3/ff/371ea7d252656ee1eb6d83eeeef3d1d0c6baf1d6497687d081ea03814670/cryptography-48.0.1-cp39-abi3-win_amd64.whl", hash = "sha256:9a49ca6c81417f6a5edb50375a60cccdd70fa0a91a5211829dbea74eba94d2ac", size = 3793408, upload-time = "2026-06-09T22:32:15.191Z" },
+    { url = "https://files.pythonhosted.org/packages/a9/d3/eb4e394e587341fdad09a09101fa76478ead3a78b0ad63e55c22f0d75c02/cryptography-48.0.1-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:08a597acce1ff37f347400087776599e2348a3a8bc53b44120e463cd274efe4a", size = 3951747, upload-time = "2026-06-09T22:31:23.871Z" },
+    { url = "https://files.pythonhosted.org/packages/e0/4a/3f43451b4f858bfceaaaffc649e6e787e8d4fb332a1d443af39ab02cc8f1/cryptography-48.0.1-pp311-pypy311_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:735824ec41b7f74a7c45fb1591349333e4c696cb6c044e5f46356e560143e4cd", size = 4641226, upload-time = "2026-06-09T22:31:02.532Z" },
+    { url = "https://files.pythonhosted.org/packages/73/4e/855584c2c23b09e4ce2d3b9c30e983e679cd60b068c513c6bbdb91e11782/cryptography-48.0.1-pp311-pypy311_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:92a46e1d638daa264ba2971c0b0489c9409787943efae4d60ffda3d091ef832c", size = 4668958, upload-time = "2026-06-09T22:32:06.213Z" },
+    { url = "https://files.pythonhosted.org/packages/42/3b/d35750e41d803d1e516fd6d6011f065424924da7af1748cef4cc9cb3ede1/cryptography-48.0.1-pp311-pypy311_pp73-manylinux_2_34_aarch64.whl", hash = "sha256:7e234ac052af99f2700826a5c29ea99d9c1b1f80341cde62d11c8154dc8e0bd9", size = 4640793, upload-time = "2026-06-09T22:32:26.331Z" },
+    { url = "https://files.pythonhosted.org/packages/ca/aa/cdb7181fe865285e87e96825aaab239400f1de0c3bfba9bd9769b79f1a92/cryptography-48.0.1-pp311-pypy311_pp73-manylinux_2_34_x86_64.whl", hash = "sha256:33842cf0888951cef5bc7ac724ab844a42044c1727b967b7f8997289a0464f92", size = 4668505, upload-time = "2026-06-09T22:31:27.534Z" },
+    { url = "https://files.pythonhosted.org/packages/5d/8c/ce3823c06c2804f194f9e64f0d67fa3f4094a39f2bb1a990cd03603af8fc/cryptography-48.0.1-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:6184ca7b174f28d7c703f1290d4b297217c45355f77a98f67e9b7f14549ac54a", size = 3742204, upload-time = "2026-06-09T22:31:34.773Z" },
 ]
 
 [[package]]
@@ -4202,7 +4203,7 @@ wheels = [
 
 [package.optional-dependencies]
 broker = [
-    { name = "pymsalruntime", marker = "sys_platform == 'win32'" },
+    { name = "pymsalruntime" },
 ]
 
 [[package]]
@@ -4426,7 +4427,7 @@ wheels = [
 
 [[package]]
 name = "oci"
-version = "2.184.1"
+version = "2.183.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "certifi" },
@@ -4439,9 +4440,9 @@ dependencies = [
     { name = "pytz" },
     { name = "urllib3" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/74/2d/fa5368cfabb868f4111c6978e8b5f66aa3a55076c40c1a59ac3081b0227b/oci-2.184.1.tar.gz", hash = "sha256:617dad69caf8dd6e521d224dbc3e8a8bc289906943a0214fd2c3419094e26435", size = 17990631, upload-time = "2026-08-11T11:01:26.194Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/1e/2a/77bd6cbf1c69b2f368fe3d6462d84369b0cba15e37ce713cdc08d459b95a/oci-2.183.0.tar.gz", hash = "sha256:ff572ef5f2030a788796bb509d257e6a41c6510ef9b4b6a75a079efd06e533ce", size = 17759723, upload-time = "2026-07-28T06:02:29.76Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/5f/63/5ae22e42aaf96a5da74dc2b9de449c78b4d7418cce621d5da723b3e49f32/oci-2.184.1-py3-none-any.whl", hash = "sha256:bd814e38a70da2190e721937455a08689ab13c0750bd2ef8dd0c98b2dc5a38ea", size = 36628063, upload-time = "2026-08-11T11:01:18.178Z" },
+    { url = "https://files.pythonhosted.org/packages/a9/de/8574b3e527996a099d196e87794a4652d91a0c3185fcc7fdbb5649b75a8a/oci-2.183.0-py3-none-any.whl", hash = "sha256:bd789c98a94d7c5ea08c20d11dcf68c9cd1ad479b134727d80a930b84387070b", size = 36133501, upload-time = "2026-07-28T06:02:18.239Z" },
 ]
 
 [[package]]
@@ -4835,8 +4836,8 @@ wheels = [
 
 [[package]]
 name = "prowler"
-version = "5.42.0"
-source = { git = "https://github.com/prowler-cloud/prowler.git?rev=v5.42#4727da7ca71a87be629a888184705eb3f2e4324e" }
+version = "5.37.1"
+source = { git = "https://github.com/prowler-cloud/prowler.git?rev=v5.37#fbbf9fe1cdfbac1869b950a078ac36098dbb4ddc" }
 dependencies = [
     { name = "alibabacloud-actiontrail20200706" },
     { name = "alibabacloud-credentials" },
@@ -4928,17 +4929,14 @@ dependencies = [
     { name = "stackit-iaas" },
     { name = "stackit-objectstorage" },
     { name = "stackit-resourcemanager" },
-    { name = "stackit-ske" },
     { name = "tabulate" },
-    { name = "truststore" },
     { name = "tzlocal" },
     { name = "uuid6" },
-    { name = "zstandard" },
 ]
 
 [[package]]
 name = "prowler-api"
-version = "1.43.1"
+version = "1.38.1"
 source = { virtual = "." }
 dependencies = [
     { name = "cartography" },
@@ -5038,12 +5036,12 @@ requires-dist = [
     { name = "matplotlib", specifier = "==3.10.8" },
     { name = "neo4j", specifier = "==6.1.0" },
     { name = "openai", specifier = "==1.109.1" },
-    { name = "prowler", git = "https://github.com/prowler-cloud/prowler.git?rev=v5.42" },
+    { name = "prowler", git = "https://github.com/prowler-cloud/prowler.git?rev=v5.37" },
     { name = "psycopg2-binary", specifier = "==2.9.9" },
     { name = "pytest-celery", extras = ["redis"], specifier = "==1.3.0" },
     { name = "reportlab", specifier = "==4.4.10" },
     { name = "sentry-sdk", extras = ["django"], specifier = "==2.56.0" },
-    { name = "sqlparse", specifier = "==0.6.0" },
+    { name = "sqlparse", specifier = "==0.5.5" },
     { name = "uuid6", specifier = "==2024.7.10" },
     { name = "uvicorn-worker", specifier = "==0.4.0" },
     { name = "uvloop", specifier = "==0.22.1" },
@@ -5429,15 +5427,15 @@ wheels = [
 
 [[package]]
 name = "pyopenssl"
-version = "26.4.0"
+version = "26.2.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "cryptography" },
     { name = "typing-extensions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/3f/e8/7325d258199b159eb2c03fe32107533e2832e70e63f4fb88a6aa00023201/pyopenssl-26.4.0.tar.gz", hash = "sha256:28dfcce0162b9211413e26dfbfdf1d24317fbeba18fc93c12400a1856b2a0bc7", size = 182046, upload-time = "2026-08-01T19:50:50.512Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/1a/51/27a5ad5f939d08f690a326ef9582cda7140555180db71695f6fb747d6a36/pyopenssl-26.2.0.tar.gz", hash = "sha256:8c6fcecd1183a7fc897548dfe388b0cdb7f37e018200d8409cf33959dbe35387", size = 182195, upload-time = "2026-05-04T23:06:09.72Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/51/ad/2cf6d3fa2fae5c79e1ed9960c0d42badd0f94d81dd12b50604cdc839e648/pyopenssl-26.4.0-py3-none-any.whl", hash = "sha256:f0eb0cb2d581d3ad2b9c489468485e7f2ab6727d08401bcf9d824c3caddf3c1c", size = 56026, upload-time = "2026-08-01T19:50:48.94Z" },
+    { url = "https://files.pythonhosted.org/packages/73/b8/a0e2790ae249d6f38c9f66de7a211621a7ab2650217bcd04e1262f578a56/pyopenssl-26.2.0-py3-none-any.whl", hash = "sha256:4f9d971bc5298b8bc1fab282803da04bf000c755d4ad9d99b52de2569ca19a70", size = 55823, upload-time = "2026-05-04T23:06:08.395Z" },
 ]
 
 [[package]]
@@ -6052,11 +6050,11 @@ wheels = [
 
 [[package]]
 name = "sqlparse"
-version = "0.6.0"
+version = "0.5.5"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/5f/d3/3f06a1006f2261d1342aefb3c71eed02f5d4ca5bdbecd86ebc12ad38306e/sqlparse-0.6.0.tar.gz", hash = "sha256:113c35c75365ab9cc9c7231d68c6428fb11c085fc8e9eb1ad659b7ddbf6cd2b9", size = 178477, upload-time = "2026-08-13T19:16:06.396Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/90/76/437d71068094df0726366574cf3432a4ed754217b436eb7429415cf2d480/sqlparse-0.5.5.tar.gz", hash = "sha256:e20d4a9b0b8585fdf63b10d30066c7c94c5d7a7ec47c889a2d83a3caa93ff28e", size = 120815, upload-time = "2025-12-19T07:17:45.073Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/d9/50/f00935da0ec7cbf325f8dc4f772ae46fbc7b672dd62876e73f0a94adda57/sqlparse-0.6.0-py3-none-any.whl", hash = "sha256:b861c0288ce2fa56209a9a6412d2e066ac664b3873b89c26c9d8415e8e32996f", size = 50070, upload-time = "2026-08-13T19:16:04.062Z" },
+    { url = "https://files.pythonhosted.org/packages/49/4b/359f28a903c13438ef59ebeee215fb25da53066db67b305c125f1c6d2a25/sqlparse-0.5.5-py3-none-any.whl", hash = "sha256:12a08b3bf3eec877c519589833aed092e2444e68240a3577e8e26148acc7b1ba", size = 46138, upload-time = "2025-12-19T07:17:46.573Z" },
 ]
 
 [[package]]
@@ -6120,21 +6118,6 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/c7/9c/38a74d0f7a89b4320f6d2366fb660638bda8860daa08748b12c713d84381/stackit_resourcemanager-0.8.0-py3-none-any.whl", hash = "sha256:dd04bb8353d041a137c4dcba190beabded7acfaff1bc98b218fce20a99389ebc", size = 81288, upload-time = "2026-05-13T09:43:07.81Z" },
 ]
 
-[[package]]
-name = "stackit-ske"
-version = "1.12.0"
-source = { registry = "https://pypi.org/simple" }
-dependencies = [
-    { name = "pydantic" },
-    { name = "python-dateutil" },
-    { name = "requests" },
-    { name = "stackit-core" },
-]
-sdist = { url = "https://files.pythonhosted.org/packages/cd/9e/df3ad585cb96d028354f4253568e9879d81bb9395d5ebfa268fa9350e2df/stackit_ske-1.12.0.tar.gz", hash = "sha256:62814279f3b7fb2387648f92d14453a8905ad60115c07579f2741ddb7d1fcc94", size = 37239, upload-time = "2026-06-30T11:18:49.39Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/00/37/dc54fb7185a2d4da37308322ea1a7b992312030b2e37262de4eb4003f5c7/stackit_ske-1.12.0-py3-none-any.whl", hash = "sha256:45bd8084d87f14f818b3d7e824450248c8784ed204ca1b2dc108f491dcbdb1a3", size = 93142, upload-time = "2026-06-30T11:18:48.233Z" },
-]
-
 [[package]]
 name = "statsd"
 version = "4.0.1"
@@ -6243,15 +6226,6 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/d0/30/dc54f88dd4a2b5dc8a0279bdd7270e735851848b762aeb1c1184ed1f6b14/tqdm-4.67.1-py3-none-any.whl", hash = "sha256:26445eca388f82e72884e0d580d5464cd801a3ea01e63e5601bdff9ba6a48de2", size = 78540, upload-time = "2024-11-24T20:12:19.698Z" },
 ]
 
-[[package]]
-name = "truststore"
-version = "0.10.4"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/53/a3/1585216310e344e8102c22482f6060c7a6ea0322b63e026372e6dcefcfd6/truststore-0.10.4.tar.gz", hash = "sha256:9d91bd436463ad5e4ee4aba766628dd6cd7010cf3e2461756b3303710eebc301", size = 26169, upload-time = "2025-08-12T18:49:02.73Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/19/97/56608b2249fe206a67cd573bc93cd9896e1efb9e98bce9c163bcdc704b88/truststore-0.10.4-py3-none-any.whl", hash = "sha256:adaeaecf1cbb5f4de3b1959b42d41f6fab57b2b1666adb59e89cb0b53361d981", size = 18660, upload-time = "2025-08-12T18:49:01.46Z" },
-]
-
 [[package]]
 name = "typer"
 version = "0.21.1"
@@ -6648,71 +6622,41 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/4a/81/2f171fbc4222066957e6b9220c4fb9146792540102c37e6d94e5d14aad97/zope_interface-8.2-cp312-cp312-win_amd64.whl", hash = "sha256:845d14e580220ae4544bd4d7eb800f0b6034fe5585fc2536806e0a26c2ee6640", size = 212444, upload-time = "2026-01-09T08:05:25.148Z" },
 ]
 
-[[package]]
-name = "zstandard"
-version = "0.25.0"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/fd/aa/3e0508d5a5dd96529cdc5a97011299056e14c6505b678fd58938792794b1/zstandard-0.25.0.tar.gz", hash = "sha256:7713e1179d162cf5c7906da876ec2ccb9c3a9dcbdffef0cc7f70c3667a205f0b", size = 711513, upload-time = "2025-09-14T22:15:54.002Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/2a/83/c3ca27c363d104980f1c9cee1101cc8ba724ac8c28a033ede6aab89585b1/zstandard-0.25.0-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:933b65d7680ea337180733cf9e87293cc5500cc0eb3fc8769f4d3c88d724ec5c", size = 795254, upload-time = "2025-09-14T22:16:26.137Z" },
-    { url = "https://files.pythonhosted.org/packages/ac/4d/e66465c5411a7cf4866aeadc7d108081d8ceba9bc7abe6b14aa21c671ec3/zstandard-0.25.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:a3f79487c687b1fc69f19e487cd949bf3aae653d181dfb5fde3bf6d18894706f", size = 640559, upload-time = "2025-09-14T22:16:27.973Z" },
-    { url = "https://files.pythonhosted.org/packages/12/56/354fe655905f290d3b147b33fe946b0f27e791e4b50a5f004c802cb3eb7b/zstandard-0.25.0-cp311-cp311-manylinux2010_i686.manylinux2014_i686.manylinux_2_12_i686.manylinux_2_17_i686.whl", hash = "sha256:0bbc9a0c65ce0eea3c34a691e3c4b6889f5f3909ba4822ab385fab9057099431", size = 5348020, upload-time = "2025-09-14T22:16:29.523Z" },
-    { url = "https://files.pythonhosted.org/packages/3b/13/2b7ed68bd85e69a2069bcc72141d378f22cae5a0f3b353a2c8f50ef30c1b/zstandard-0.25.0-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:01582723b3ccd6939ab7b3a78622c573799d5d8737b534b86d0e06ac18dbde4a", size = 5058126, upload-time = "2025-09-14T22:16:31.811Z" },
-    { url = "https://files.pythonhosted.org/packages/c9/dd/fdaf0674f4b10d92cb120ccff58bbb6626bf8368f00ebfd2a41ba4a0dc99/zstandard-0.25.0-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:5f1ad7bf88535edcf30038f6919abe087f606f62c00a87d7e33e7fc57cb69fcc", size = 5405390, upload-time = "2025-09-14T22:16:33.486Z" },
-    { url = "https://files.pythonhosted.org/packages/0f/67/354d1555575bc2490435f90d67ca4dd65238ff2f119f30f72d5cde09c2ad/zstandard-0.25.0-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:06acb75eebeedb77b69048031282737717a63e71e4ae3f77cc0c3b9508320df6", size = 5452914, upload-time = "2025-09-14T22:16:35.277Z" },
-    { url = "https://files.pythonhosted.org/packages/bb/1f/e9cfd801a3f9190bf3e759c422bbfd2247db9d7f3d54a56ecde70137791a/zstandard-0.25.0-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:9300d02ea7c6506f00e627e287e0492a5eb0371ec1670ae852fefffa6164b072", size = 5559635, upload-time = "2025-09-14T22:16:37.141Z" },
-    { url = "https://files.pythonhosted.org/packages/21/88/5ba550f797ca953a52d708c8e4f380959e7e3280af029e38fbf47b55916e/zstandard-0.25.0-cp311-cp311-musllinux_1_1_aarch64.whl", hash = "sha256:bfd06b1c5584b657a2892a6014c2f4c20e0db0208c159148fa78c65f7e0b0277", size = 5048277, upload-time = "2025-09-14T22:16:38.807Z" },
-    { url = "https://files.pythonhosted.org/packages/46/c0/ca3e533b4fa03112facbe7fbe7779cb1ebec215688e5df576fe5429172e0/zstandard-0.25.0-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:f373da2c1757bb7f1acaf09369cdc1d51d84131e50d5fa9863982fd626466313", size = 5574377, upload-time = "2025-09-14T22:16:40.523Z" },
-    { url = "https://files.pythonhosted.org/packages/12/9b/3fb626390113f272abd0799fd677ea33d5fc3ec185e62e6be534493c4b60/zstandard-0.25.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:6c0e5a65158a7946e7a7affa6418878ef97ab66636f13353b8502d7ea03c8097", size = 4961493, upload-time = "2025-09-14T22:16:43.3Z" },
-    { url = "https://files.pythonhosted.org/packages/cb/d3/23094a6b6a4b1343b27ae68249daa17ae0651fcfec9ed4de09d14b940285/zstandard-0.25.0-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:c8e167d5adf59476fa3e37bee730890e389410c354771a62e3c076c86f9f7778", size = 5269018, upload-time = "2025-09-14T22:16:45.292Z" },
-    { url = "https://files.pythonhosted.org/packages/8c/a7/bb5a0c1c0f3f4b5e9d5b55198e39de91e04ba7c205cc46fcb0f95f0383c1/zstandard-0.25.0-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:98750a309eb2f020da61e727de7d7ba3c57c97cf6213f6f6277bb7fb42a8e065", size = 5443672, upload-time = "2025-09-14T22:16:47.076Z" },
-    { url = "https://files.pythonhosted.org/packages/27/22/503347aa08d073993f25109c36c8d9f029c7d5949198050962cb568dfa5e/zstandard-0.25.0-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:22a086cff1b6ceca18a8dd6096ec631e430e93a8e70a9ca5efa7561a00f826fa", size = 5822753, upload-time = "2025-09-14T22:16:49.316Z" },
-    { url = "https://files.pythonhosted.org/packages/e2/be/94267dc6ee64f0f8ba2b2ae7c7a2df934a816baaa7291db9e1aa77394c3c/zstandard-0.25.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:72d35d7aa0bba323965da807a462b0966c91608ef3a48ba761678cb20ce5d8b7", size = 5366047, upload-time = "2025-09-14T22:16:51.328Z" },
-    { url = "https://files.pythonhosted.org/packages/7b/a3/732893eab0a3a7aecff8b99052fecf9f605cf0fb5fb6d0290e36beee47a4/zstandard-0.25.0-cp311-cp311-win32.whl", hash = "sha256:f5aeea11ded7320a84dcdd62a3d95b5186834224a9e55b92ccae35d21a8b63d4", size = 436484, upload-time = "2025-09-14T22:16:55.005Z" },
-    { url = "https://files.pythonhosted.org/packages/43/a3/c6155f5c1cce691cb80dfd38627046e50af3ee9ddc5d0b45b9b063bfb8c9/zstandard-0.25.0-cp311-cp311-win_amd64.whl", hash = "sha256:daab68faadb847063d0c56f361a289c4f268706b598afbf9ad113cbe5c38b6b2", size = 506183, upload-time = "2025-09-14T22:16:52.753Z" },
-    { url = "https://files.pythonhosted.org/packages/8c/3e/8945ab86a0820cc0e0cdbf38086a92868a9172020fdab8a03ac19662b0e5/zstandard-0.25.0-cp311-cp311-win_arm64.whl", hash = "sha256:22a06c5df3751bb7dc67406f5374734ccee8ed37fc5981bf1ad7041831fa1137", size = 462533, upload-time = "2025-09-14T22:16:53.878Z" },
-    { url = "https://files.pythonhosted.org/packages/82/fc/f26eb6ef91ae723a03e16eddb198abcfce2bc5a42e224d44cc8b6765e57e/zstandard-0.25.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:7b3c3a3ab9daa3eed242d6ecceead93aebbb8f5f84318d82cee643e019c4b73b", size = 795738, upload-time = "2025-09-14T22:16:56.237Z" },
-    { url = "https://files.pythonhosted.org/packages/aa/1c/d920d64b22f8dd028a8b90e2d756e431a5d86194caa78e3819c7bf53b4b3/zstandard-0.25.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:913cbd31a400febff93b564a23e17c3ed2d56c064006f54efec210d586171c00", size = 640436, upload-time = "2025-09-14T22:16:57.774Z" },
-    { url = "https://files.pythonhosted.org/packages/53/6c/288c3f0bd9fcfe9ca41e2c2fbfd17b2097f6af57b62a81161941f09afa76/zstandard-0.25.0-cp312-cp312-manylinux2010_i686.manylinux2014_i686.manylinux_2_12_i686.manylinux_2_17_i686.whl", hash = "sha256:011d388c76b11a0c165374ce660ce2c8efa8e5d87f34996aa80f9c0816698b64", size = 5343019, upload-time = "2025-09-14T22:16:59.302Z" },
-    { url = "https://files.pythonhosted.org/packages/1e/15/efef5a2f204a64bdb5571e6161d49f7ef0fffdbca953a615efbec045f60f/zstandard-0.25.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:6dffecc361d079bb48d7caef5d673c88c8988d3d33fb74ab95b7ee6da42652ea", size = 5063012, upload-time = "2025-09-14T22:17:01.156Z" },
-    { url = "https://files.pythonhosted.org/packages/b7/37/a6ce629ffdb43959e92e87ebdaeebb5ac81c944b6a75c9c47e300f85abdf/zstandard-0.25.0-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:7149623bba7fdf7e7f24312953bcf73cae103db8cae49f8154dd1eadc8a29ecb", size = 5394148, upload-time = "2025-09-14T22:17:03.091Z" },
-    { url = "https://files.pythonhosted.org/packages/e3/79/2bf870b3abeb5c070fe2d670a5a8d1057a8270f125ef7676d29ea900f496/zstandard-0.25.0-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:6a573a35693e03cf1d67799fd01b50ff578515a8aeadd4595d2a7fa9f3ec002a", size = 5451652, upload-time = "2025-09-14T22:17:04.979Z" },
-    { url = "https://files.pythonhosted.org/packages/53/60/7be26e610767316c028a2cbedb9a3beabdbe33e2182c373f71a1c0b88f36/zstandard-0.25.0-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:5a56ba0db2d244117ed744dfa8f6f5b366e14148e00de44723413b2f3938a902", size = 5546993, upload-time = "2025-09-14T22:17:06.781Z" },
-    { url = "https://files.pythonhosted.org/packages/85/c7/3483ad9ff0662623f3648479b0380d2de5510abf00990468c286c6b04017/zstandard-0.25.0-cp312-cp312-musllinux_1_1_aarch64.whl", hash = "sha256:10ef2a79ab8e2974e2075fb984e5b9806c64134810fac21576f0668e7ea19f8f", size = 5046806, upload-time = "2025-09-14T22:17:08.415Z" },
-    { url = "https://files.pythonhosted.org/packages/08/b3/206883dd25b8d1591a1caa44b54c2aad84badccf2f1de9e2d60a446f9a25/zstandard-0.25.0-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:aaf21ba8fb76d102b696781bddaa0954b782536446083ae3fdaa6f16b25a1c4b", size = 5576659, upload-time = "2025-09-14T22:17:10.164Z" },
-    { url = "https://files.pythonhosted.org/packages/9d/31/76c0779101453e6c117b0ff22565865c54f48f8bd807df2b00c2c404b8e0/zstandard-0.25.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:1869da9571d5e94a85a5e8d57e4e8807b175c9e4a6294e3b66fa4efb074d90f6", size = 4953933, upload-time = "2025-09-14T22:17:11.857Z" },
-    { url = "https://files.pythonhosted.org/packages/18/e1/97680c664a1bf9a247a280a053d98e251424af51f1b196c6d52f117c9720/zstandard-0.25.0-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:809c5bcb2c67cd0ed81e9229d227d4ca28f82d0f778fc5fea624a9def3963f91", size = 5268008, upload-time = "2025-09-14T22:17:13.627Z" },
-    { url = "https://files.pythonhosted.org/packages/1e/73/316e4010de585ac798e154e88fd81bb16afc5c5cb1a72eeb16dd37e8024a/zstandard-0.25.0-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:f27662e4f7dbf9f9c12391cb37b4c4c3cb90ffbd3b1fb9284dadbbb8935fa708", size = 5433517, upload-time = "2025-09-14T22:17:16.103Z" },
-    { url = "https://files.pythonhosted.org/packages/5b/60/dd0f8cfa8129c5a0ce3ea6b7f70be5b33d2618013a161e1ff26c2b39787c/zstandard-0.25.0-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:99c0c846e6e61718715a3c9437ccc625de26593fea60189567f0118dc9db7512", size = 5814292, upload-time = "2025-09-14T22:17:17.827Z" },
-    { url = "https://files.pythonhosted.org/packages/fc/5f/75aafd4b9d11b5407b641b8e41a57864097663699f23e9ad4dbb91dc6bfe/zstandard-0.25.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:474d2596a2dbc241a556e965fb76002c1ce655445e4e3bf38e5477d413165ffa", size = 5360237, upload-time = "2025-09-14T22:17:19.954Z" },
-    { url = "https://files.pythonhosted.org/packages/ff/8d/0309daffea4fcac7981021dbf21cdb2e3427a9e76bafbcdbdf5392ff99a4/zstandard-0.25.0-cp312-cp312-win32.whl", hash = "sha256:23ebc8f17a03133b4426bcc04aabd68f8236eb78c3760f12783385171b0fd8bd", size = 436922, upload-time = "2025-09-14T22:17:24.398Z" },
-    { url = "https://files.pythonhosted.org/packages/79/3b/fa54d9015f945330510cb5d0b0501e8253c127cca7ebe8ba46a965df18c5/zstandard-0.25.0-cp312-cp312-win_amd64.whl", hash = "sha256:ffef5a74088f1e09947aecf91011136665152e0b4b359c42be3373897fb39b01", size = 506276, upload-time = "2025-09-14T22:17:21.429Z" },
-    { url = "https://files.pythonhosted.org/packages/ea/6b/8b51697e5319b1f9ac71087b0af9a40d8a6288ff8025c36486e0c12abcc4/zstandard-0.25.0-cp312-cp312-win_arm64.whl", hash = "sha256:181eb40e0b6a29b3cd2849f825e0fa34397f649170673d385f3598ae17cca2e9", size = 462679, upload-time = "2025-09-14T22:17:23.147Z" },
-]
-
 [[package]]
 name = "zstd"
-version = "1.5.7.2"
+version = "1.5.7.3"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/0f/78/9a476e09c825304df47b98be80d1ffe223733b03550af71325415028f615/zstd-1.5.7.2.tar.gz", hash = "sha256:6d8684c69009be49e1b18ec251a5eb0d7e24f93624990a8a124a1da66a92fc8a", size = 670481, upload-time = "2025-06-23T12:36:08.131Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/49/62/b9c075ad664e7c4cbb3d8d2be7c246506abe1bc7f778eb58d260ef9538c8/zstd-1.5.7.3.tar.gz", hash = "sha256:403e5205f4ac04b92e6b0cda654be2f51de268228a0db0067bc087faacf2f495", size = 672559, upload-time = "2026-01-08T16:24:43.361Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/43/2a/0885f6f1921ec1ef4a8f8ab29ab0a335cc867abe4c7aaa4e5031435a32a5/zstd-1.5.7.2-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:f799c1e9900ad77e7a3d994b9b5146d7cfd1cbd1b61c3db53a697bf21ffcc57b", size = 269702, upload-time = "2025-06-23T12:50:11.695Z" },
-    { url = "https://files.pythonhosted.org/packages/05/e6/629cf6b77e47fc7149f5724fb4853c48edcdeb10d8c64e391d7026cb10e1/zstd-1.5.7.2-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:1ff4c667f29101566a7b71f06bbd677a63192818396003354131f586383db042", size = 228145, upload-time = "2025-06-23T12:50:10.411Z" },
-    { url = "https://files.pythonhosted.org/packages/c4/b8/9ddefd4670bfe9328ca6657ad335eb8d9c657466247e234a579818b6b0b9/zstd-1.5.7.2-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl", hash = "sha256:8526a32fa9f67b07fd09e62474e345f8ca1daf3e37a41137643d45bd1bc90773", size = 1536530, upload-time = "2025-06-23T13:51:38.853Z" },
-    { url = "https://files.pythonhosted.org/packages/d1/6a/1bb836c18760dc1e28ca7a9706016e482ebdea633b980d8505dbb65e18f8/zstd-1.5.7.2-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:2cec2472760d48a7a3445beaba509d3f7850e200fed65db15a1a66e315baec6a", size = 1616141, upload-time = "2025-06-23T13:51:34.152Z" },
-    { url = "https://files.pythonhosted.org/packages/b5/7a/bb6c6e2cb2a066e347dc27d45d5205058b69d6c8b8d4ae2ee7d6b91c64a5/zstd-1.5.7.2-cp311-cp311-manylinux_2_4_i686.whl", hash = "sha256:a200c479ee1bb661bc45518e016a1fdc215a1d8f7e4bf6c7de0af254976cfdf6", size = 322188, upload-time = "2025-06-23T13:01:48.704Z" },
-    { url = "https://files.pythonhosted.org/packages/5a/4f/cf0669c8a89fdcc91814bf92bd05cc363d5d12a79b656418c0add6f2d266/zstd-1.5.7.2-cp311-cp311-manylinux_2_4_x86_64.whl", hash = "sha256:f5d159e57a13147aa8293c0f14803a75e9039fd8afdf6cf1c8c2289fb4d2333a", size = 302736, upload-time = "2025-06-23T13:05:33.649Z" },
-    { url = "https://files.pythonhosted.org/packages/be/bc/e5f8b7f61826323e39e099db1eb5c0e09b18315df1b1ff778f7ae9aadcac/zstd-1.5.7.2-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.manylinux_2_24_i686.whl", hash = "sha256:7206934a2bd390080e972a1fed5a897e184dfd71dbb54e978dc11c6b295e1806", size = 1522687, upload-time = "2025-06-23T13:51:35.494Z" },
-    { url = "https://files.pythonhosted.org/packages/d5/8c/7660a949a020ac9d02b3166a25dd1c12144572d77b11ae92a31d341016da/zstd-1.5.7.2-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:7e0027b20f296d1c9a8e85b8436834cf46560240a29d623aa8eaa8911832eb58", size = 2098794, upload-time = "2025-06-23T13:51:37.219Z" },
-    { url = "https://files.pythonhosted.org/packages/bc/b2/730c811a78d670104d40c7f08cc8092577cdff870cba42b3158f20fceb57/zstd-1.5.7.2-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:d6b17e5581dd1a13437079bd62838d2635db8eb8aca9c0e9251faa5d4d40a6d7", size = 2112266, upload-time = "2025-06-23T13:51:31.258Z" },
-    { url = "https://files.pythonhosted.org/packages/44/74/2c16e1632094db36c8920d4c13b8e2e843024d548ae26888c2d22af6a676/zstd-1.5.7.2-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:b13285c99cc710f60dd270785ec75233018870a1831f5655d862745470a0ca29", size = 2109465, upload-time = "2025-06-23T13:51:32.884Z" },
-    { url = "https://files.pythonhosted.org/packages/58/6e/b9c9a834769d96cab2122da1be8c8c700d3f76be796d2b7516e85d2eca0e/zstd-1.5.7.2-cp311-cp311-win32.whl", hash = "sha256:cdb5ec80da299f63f8aeccec0bff3247e96252d4c8442876363ff1b438d8049b", size = 149448, upload-time = "2025-06-23T13:06:21.144Z" },
-    { url = "https://files.pythonhosted.org/packages/47/b7/fc22ad6292a32d7676ab815de3a23573beac3679e8abd9914288d1496ceb/zstd-1.5.7.2-cp311-cp311-win_amd64.whl", hash = "sha256:4f6861c8edceb25fda37cdaf422fc5f15dcc88ced37c6a5b3c9011eda51aa218", size = 166592, upload-time = "2025-06-23T13:06:22.126Z" },
-    { url = "https://files.pythonhosted.org/packages/45/14/096bb77f3e5ef525b452cd6294da33de7f8a8c9647ba78293378fbb0a7ce/zstd-1.5.7.2-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:d2ebe3e60dbace52525fa7aa604479e231dc3e4fcc76d0b4c54d8abce5e58734", size = 269408, upload-time = "2025-06-23T13:11:46.492Z" },
-    { url = "https://files.pythonhosted.org/packages/08/b8/2bc2590a34c733ea0570f366e6ad7d889d05c7825bd3ccab01f36ece71c6/zstd-1.5.7.2-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:ef201b6f7d3a6751d85cc52f9e6198d4d870e83d490172016b64a6dd654a9583", size = 228188, upload-time = "2025-06-23T13:11:47.539Z" },
-    { url = "https://files.pythonhosted.org/packages/b7/80/6252de3a70cfd7767718ad476893f1c7dc129f942cc7ed0322e3137c03d9/zstd-1.5.7.2-cp312-cp312-manylinux_2_14_x86_64.whl", hash = "sha256:ac7bdfedda51b1fcdcf0ab69267d01256fc97ddf666ce894fde0fae9f3630eac", size = 302720, upload-time = "2025-06-23T12:40:11.522Z" },
-    { url = "https://files.pythonhosted.org/packages/af/b6/af908387814b99172d3aea6aeb24b19583aadfa45f6021e5e2a0d6d8e99a/zstd-1.5.7.2-cp312-cp312-manylinux_2_4_i686.whl", hash = "sha256:b835405cc4080b378e45029f2fe500e408d1eaedfba7dd7402aba27af16955f9", size = 322237, upload-time = "2025-06-23T13:17:35.482Z" },
-    { url = "https://files.pythonhosted.org/packages/ed/d7/ab9142e002a7eaa451cb4bb37a74c390c489ba8ae75ade543840496eda04/zstd-1.5.7.2-cp312-cp312-win32.whl", hash = "sha256:e4cf97bb97ed6dbb62d139d68fd42fa1af51fd26fd178c501f7b62040e897c50", size = 149453, upload-time = "2025-06-23T13:13:02.786Z" },
-    { url = "https://files.pythonhosted.org/packages/3e/c7/c182ea7bc283f591e3f3c5f0f239e7a92c9bc1f626642ae2c4dfbe51d6f2/zstd-1.5.7.2-cp312-cp312-win_amd64.whl", hash = "sha256:55e2edc4560a5cf8ee9908595e90a15b1f47536ea9aad4b2889f0e6165890a38", size = 166628, upload-time = "2025-06-23T13:13:03.745Z" },
-    { url = "https://files.pythonhosted.org/packages/cd/c9/a6495a7bf168a78f0a0c01d61d830ebfb401315a64fd1ae8d725c458114c/zstd-1.5.7.2-pp311-pypy311_pp73-manylinux_2_14_x86_64.whl", hash = "sha256:5fb2ff5718fe89181223c23ce7308bd0b4a427239379e2566294da805d8df68a", size = 315542, upload-time = "2025-06-23T12:39:27.598Z" },
+    { url = "https://files.pythonhosted.org/packages/75/0d/8c89c0d010b58c21a7865a239790bb1c6822029c053b1ded858d6b573e3a/zstd-1.5.7.3-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:1a3c1781a24e2ced2c0ddee11d45b1f04018b03615eeb622a62eca4d56d3358a", size = 267641, upload-time = "2026-01-08T16:30:50.812Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/6d/155d8c344d96eca2a5a003a5ddd63373a5f13591fd5cf2b9490250d6805a/zstd-1.5.7.3-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:a6c7c81056362b60a04baa34632e713d596662a860ec34efd8e9b109c10e6ec7", size = 230962, upload-time = "2026-01-08T16:30:49.155Z" },
+    { url = "https://files.pythonhosted.org/packages/c8/c7/ab93916a26eb58cd501ad701974c31b4bc67a7f6abd6c24bef8fe4d7649b/zstd-1.5.7.3-cp311-cp311-manylinux_2_14_x86_64.whl", hash = "sha256:e564f34a55effc7d654eb293468edc80b64d476b0f899f82760ecd8323223ff5", size = 304166, upload-time = "2026-01-10T11:17:45.697Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/54/27a7040a360019a4602343e3c98c0c0a140f382186002c01e1992fd21837/zstd-1.5.7.3-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl", hash = "sha256:fbc49a57188184931d5e3c9f1133cad7eea5a370a9e9418fb8122d58c14340a5", size = 1540288, upload-time = "2026-01-08T17:50:26.913Z" },
+    { url = "https://files.pythonhosted.org/packages/96/93/4a4d4edd1b2e809e0ebbb16000404bdcc9a09743c04ee1661442c9581b75/zstd-1.5.7.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:d121d3e63722819e1fe5effbcd9628d8a7cfea0cddabcc5bb37ea861a6a83424", size = 1619134, upload-time = "2026-01-08T17:50:32.324Z" },
+    { url = "https://files.pythonhosted.org/packages/31/6b/cd6f0a7f4f0d98e4110aa77763cf3e85f594d983ea9ca3d64cc0cee10684/zstd-1.5.7.3-cp311-cp311-manylinux_2_4_i686.whl", hash = "sha256:621f2e7ca8e9eb52a83eb9c91ec3cd283d87591bf75cc658de486b65f44742c7", size = 300166, upload-time = "2026-01-10T11:12:27.938Z" },
+    { url = "https://files.pythonhosted.org/packages/05/3f/c717e0d15127d04b7fa58ba9b4c56e8b88b803048b9766cd9d158dbb22ea/zstd-1.5.7.3-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.manylinux_2_24_i686.whl", hash = "sha256:c1950fcae690ba32d0f31702b335c548fb42547821565925e48576afdad774a5", size = 1525776, upload-time = "2026-01-08T17:50:35.518Z" },
+    { url = "https://files.pythonhosted.org/packages/3e/a2/1813cd787d1a2f9ab8e8a90d28dcbc8e8098997dd04de38897ea8e75dd08/zstd-1.5.7.3-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:bac4f0d03da69115878bedbfa03c4a3f64364e8396b432028c4ce0f05141a0fb", size = 2096057, upload-time = "2026-01-08T17:50:33.984Z" },
+    { url = "https://files.pythonhosted.org/packages/36/ce/f5a3c7c12de458dd9ce15c484d627fe5412b60c155da23dacb5fcf08d9d5/zstd-1.5.7.3-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:da0ab134b7fd28023dedf013751ca850de300a090eb11f689d2a1c178c87d9dc", size = 2132659, upload-time = "2026-01-08T17:50:29.534Z" },
+    { url = "https://files.pythonhosted.org/packages/f1/66/151f9546498bfd8971a0b6ad67d87c26d7a0df17d57f724da674f3778666/zstd-1.5.7.3-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:b9923175842ee8f7602ec9cc578f5fc396896f0e8460d3ac9a5adc3cea77244e", size = 2124811, upload-time = "2026-01-08T17:50:37.612Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/34/4d2dbb36cb2373d3f115c047cb901b64f89de0703d10779da39de9453812/zstd-1.5.7.3-cp311-cp311-win32.whl", hash = "sha256:0612b604948d7b58aecc6788c7ceb53c5f21d94a155bb6ea9bd0f54ffa43725d", size = 150363, upload-time = "2026-01-08T17:11:02.392Z" },
+    { url = "https://files.pythonhosted.org/packages/d9/de/f53687e0dd8c0d0ebfaed9ae88f6a96a1a0388ae7424b469e74bb17ac57d/zstd-1.5.7.3-cp311-cp311-win_amd64.whl", hash = "sha256:5b7f8c81b2bd3b62c0345242247d484cafa4b518d59d18619813d9225af5c5c3", size = 167577, upload-time = "2026-01-08T17:11:03.356Z" },
+    { url = "https://files.pythonhosted.org/packages/f2/58/d4a6a902e229e953ed273fe9b78587ed31f57567aa68d3e34af6056e42af/zstd-1.5.7.3-cp311-cp311-win_arm64.whl", hash = "sha256:ea112e3acd9e1765adca35df7b54ac75b36194290f64ea03a3a59664209c8527", size = 157238, upload-time = "2026-01-08T16:36:06.25Z" },
+    { url = "https://files.pythonhosted.org/packages/aa/ed/5a3bf2e29dc56d4cc7619929bb51f0c758de6d02967cc73c5d8755a862c0/zstd-1.5.7.3-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:01a39efb0eeab7cc45cb308618233b624b0840d5e16dcf85456b6cca0592f203", size = 268124, upload-time = "2026-01-08T16:29:57.091Z" },
+    { url = "https://files.pythonhosted.org/packages/e2/1d/efc2074ac90af938e78f2ed4004639fe24f294d9086c5280f8d9a02b9897/zstd-1.5.7.3-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:7a8e8838cf35fa3987bfe1958584cc22e1797efce8e155a63544b4144fc671f8", size = 230988, upload-time = "2026-01-08T16:29:55.604Z" },
+    { url = "https://files.pythonhosted.org/packages/2a/52/178393b8d70e23fba67f42dfce4663e4e8a30867110168beb490a36d4639/zstd-1.5.7.3-cp312-cp312-manylinux_2_14_i686.whl", hash = "sha256:f3920ac1d1cc7e9f252f3e29f217fe3cd36f2191bb3dbcae826c29e189b7ad54", size = 300207, upload-time = "2026-01-10T11:26:58.351Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/7a/8dcd86a2efb2ed3f9dae39545a05d3c7ed26c7678330786ce4a44cd8b099/zstd-1.5.7.3-cp312-cp312-manylinux_2_14_x86_64.whl", hash = "sha256:143f9062953fb5590cbd47c1040d357336742c79696bf90b6d5b835279a68304", size = 304154, upload-time = "2026-01-10T11:17:40.91Z" },
+    { url = "https://files.pythonhosted.org/packages/6f/ce/0c96905ab01ffe0e53a3cec8132123b82db26bd583a71608029bcc789ebc/zstd-1.5.7.3-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:36d1fd8647e47e1f21b345e192f1a279e925678c23dad8236b547d04456cd699", size = 2162222, upload-time = "2026-01-08T18:02:22.762Z" },
+    { url = "https://files.pythonhosted.org/packages/11/c4/db4807d6a68b4628c74fd379de7e3c67ec34f19a2a80ac246b3837cde6cb/zstd-1.5.7.3-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:f1538db419afa62773cf534fc7f3009ff59ecf55ecee4e889587ac2ef0010ed8", size = 2201732, upload-time = "2026-01-08T18:02:20.835Z" },
+    { url = "https://files.pythonhosted.org/packages/c5/99/c19a3c0f5580ff9c33a74f06d98d6060ed1fa6bd09b55aed9be852ec191f/zstd-1.5.7.3-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:c5efd16adb092e2a547a7d51cfdaf6fd5680528227684c5bafc7669ab4a55f41", size = 2096459, upload-time = "2026-01-08T18:02:25.336Z" },
+    { url = "https://files.pythonhosted.org/packages/23/fd/02eac30419475dbe50212c119043a2d0698a0cbc756da85fd3fd9abddf42/zstd-1.5.7.3-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:39b3438e64637d80a5b1860526903b92020acb9bae9ceb5adffd9838c1441328", size = 2125442, upload-time = "2026-01-08T18:02:17.715Z" },
+    { url = "https://files.pythonhosted.org/packages/bb/43/3a16ff0a8c913bb9825379db1bd533c75c57c2d2f31dd9111aa9b53711f4/zstd-1.5.7.3-cp312-cp312-win32.whl", hash = "sha256:cbf48c53461e224ffc2490cfe5120a1ff40d14c84d2b512c6d6d99fc91685cf3", size = 150367, upload-time = "2026-01-08T17:03:40.178Z" },
+    { url = "https://files.pythonhosted.org/packages/46/83/b85875d7428e63dfa9247e41d17fac611443c774f7892f8643bd4164a6b2/zstd-1.5.7.3-cp312-cp312-win_amd64.whl", hash = "sha256:943a189910f2fea997462e3e4d7fbf727a06d231ef801ebee557b1c87568981c", size = 167604, upload-time = "2026-01-08T17:03:41.355Z" },
+    { url = "https://files.pythonhosted.org/packages/37/42/cf291e26804de2f55500cdac93f5e9fa6267cf315def8aa402529bae3a87/zstd-1.5.7.3-cp312-cp312-win_arm64.whl", hash = "sha256:85c4d508f8109afa7c51c4960626c3325af2cf1e442c6c36ebfea15d04757e3f", size = 157241, upload-time = "2026-01-08T16:47:34.615Z" },
+    { url = "https://files.pythonhosted.org/packages/04/b8/d13d584867d5eb1bc607877a870858e02a256d4706a4274e475413a000aa/zstd-1.5.7.3-pp311-pypy311_pp73-macosx_10_15_x86_64.whl", hash = "sha256:76c49ea969bc08389ea59155cea7c5dea224522ffc62f443f3c0a915f5fd184d", size = 260025, upload-time = "2026-01-08T16:57:45.739Z" },
+    { url = "https://files.pythonhosted.org/packages/16/a1/1e5faf75bedfd2bfccfb83e18736b115bed6e348504bd21800cd8f30dcea/zstd-1.5.7.3-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:6b1a638ff3dfce8f4cb1203c662fb5606dd99b4a62c5ddc4c406d2d1326bcfdd", size = 221038, upload-time = "2026-01-08T17:16:32.005Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/2c/0fe74d8b2029eef8000bc71aac5b3e5b55d00581238711cf627814183ea3/zstd-1.5.7.3-pp311-pypy311_pp73-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:5e96a5cb100a0edc162935227f2d9784b1031ce4a8a83e96e66eae2673c10143", size = 326792, upload-time = "2026-01-08T16:57:35.631Z" },
+    { url = "https://files.pythonhosted.org/packages/96/e0/2c7f081f3524f872128ff31bea2acb6b21cb1dacccef920eb6a1a77a87c6/zstd-1.5.7.3-pp311-pypy311_pp73-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:1bda0bbf3a9553720cd33f1f85940a259656c7ffba4be717ff82b7f062052188", size = 322283, upload-time = "2026-01-08T16:57:36.759Z" },
+    { url = "https://files.pythonhosted.org/packages/c9/a7/3bebfcc18d66b90bc7b506a61b2ff4af5ee1b0b16e784ea644afa06241c5/zstd-1.5.7.3-pp311-pypy311_pp73-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:ac36e4022422f6e49b3f07bdbb8a964fd348223d3dc9c82ad5398a4f0432a719", size = 311553, upload-time = "2026-01-08T16:57:38.465Z" },
+    { url = "https://files.pythonhosted.org/packages/41/75/8a791cae2c98e5e44a158e15db50d21b7ec0b37aeaffa68d151bc8ffb6d6/zstd-1.5.7.3-pp311-pypy311_pp73-manylinux_2_14_x86_64.whl", hash = "sha256:fa4d760a220541b18ce732a3a2cf7547ea05afc76d05b3b39edebfeb721f6079", size = 317071, upload-time = "2026-01-08T16:36:07.47Z" },
+    { url = "https://files.pythonhosted.org/packages/2f/25/b6624e6b08d515242154436c9d06fb20b790d300ac82e84f3c4c133e25e1/zstd-1.5.7.3-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:a69e60146bf8aaa6a0e6c9a94a7c5f3133d68091e2e5c5a3c5ababf71fd5ec7a", size = 167654, upload-time = "2026-01-08T17:00:56.667Z" },
 ]

codecov.yml

@@ -6,19 +6,12 @@ component_management:
     - component_id: "api"
       paths:
         - "api/**"
-    - component_id: "mcp_server"
-      paths:
-        - "mcp_server/**"
 
 flags:
   api:
     paths:
       - "api/**"
     carryforward: true
-  mcp:
-    paths:
-      - "mcp_server/**"
-    carryforward: true
 
 comment:
   layout: "header, diff, flags, components"

docker-compose-dev.yml

@@ -104,7 +104,7 @@ services:
       retries: 3
 
   neo4j:
-    image: graphstack/dozerdb:5.26.27.0@sha256:9b54d6b3a98a76c00bd23e8e78d8c82081ff168162aebd47b25c234e092cb0a0
+    image: graphstack/dozerdb:5.26.3.0@sha256:a77526ea3918fdc46d1fff70c4aea7d71d3874a26ecec059179d6775845b1247
     hostname: "neo4j"
     volumes:
       - ./_data/neo4j:/data

docker-compose.yml

@@ -96,7 +96,7 @@ services:
       retries: 3
 
   neo4j:
-    image: graphstack/dozerdb:5.26.27.0@sha256:9b54d6b3a98a76c00bd23e8e78d8c82081ff168162aebd47b25c234e092cb0a0
+    image: graphstack/dozerdb:5.26.3.0@sha256:a77526ea3918fdc46d1fff70c4aea7d71d3874a26ecec059179d6775845b1247
     hostname: "neo4j"
     volumes:
       - ./_data/neo4j:/data

docs/changelog.mdx

@@ -4,565 +4,6 @@ description: "New features and improvements in each Prowler release"
 rss: true
 ---
 
-<Update label="v5.41.0" description="September 2, 2026">
-  ### 📥 Scans — Import Findings from the Browser
-
-  <Note>
-  This feature is available exclusively in **Prowler Cloud** and **Prowler Private Cloud** with a [subscription](https://prowler.com/pricing).
-  </Note>
-
-  Findings produced outside the platform, by the Prowler CLI or a CI pipeline, can now be brought into the app without leaving the browser. The Scans page gains an "Import Findings" dialog that takes a Prowler `.ocsf.json` report by drag-and-drop or file picker, hands it to the ingestion API and tracks the job to completion, reporting how many records were processed and how many were invalid. Files that are not a `.ocsf.json` report, or are empty, are refused before any upload starts, and a rejected upload or a failed status poll can be retried in place. The dialog is available to roles holding the Manage Ingestions permission.
-
-  ![Import Findings button on the Scans page](/images/prowler-app/import-findings/import-findings-button.png)
-
-  ![Import findings dialog with the drag-and-drop area](/images/prowler-app/import-findings/import-findings-dialog.png)
-
-  Read more in the [Import Findings documentation](https://docs.prowler.com/user-guide/tutorials/prowler-import-findings#using-the-ui).
-
-  ### 🎫 Jira Integration — Finding Reference in Every Issue
-
-  Every Jira issue created from a finding now carries a stable reference back to it. Issues are labeled `prowler`, `prowler-<provider>`, `prowler-<severity>`, `prowler-<check-id>` and `prowler-finding-<finding-uid>`, so they can be filtered, searched with JQL or matched by automation; labels are sanitized to Jira's limits so a long or unusual value never blocks issue creation. The issue also links back to the finding in Prowler, filtered by its UID so the link keeps working after later scans, and names the Prowler organization that sent it. Prowler Cloud always includes the link; Prowler Local Server enables it by setting `DJANGO_UI_BASE_URL` in the API environment.
-
-  Read more in the [Jira integration documentation](https://docs.prowler.com/user-guide/tutorials/prowler-app-jira-integration).
-
-  ### 📚 Compliance — CIS Google Workspace Foundations Benchmark v1.4.0
-
-  Prowler now ships the CIS Google Workspace Foundations Benchmark v1.4.0. Alongside the new framework, the Google Workspace checks mapped to CIS were reworked to evaluate the benchmark's full audit procedure instead of a single condition, so Gmail spoofing actions, 2-Step Verification, password expiration and alert severity left on Google's defaults no longer pass. Expect new `FAIL` findings on domains that rely on those defaults. Three accuracy fixes also land:
-
-  - `security_2sv_enforced` and `security_2sv_hardware_keys_admins` report `MANUAL` instead of judging domain-wide values that a group or a sub-organizational unit overrides; a domain-wide failure is still reported as such, with the override noted.
-  - `rules_*_alert_configured` no longer passes a rule whose delivery to the alert center is disabled.
-  - `security_password_policy_strong` no longer fails a domain that never touched the password strength setting, since Google enforces strong passwords by default.
-
-  `security_login_challenges_configured` was unmapped from CIS Google Workspace requirement 4.1.4.1 (Post-SSO verification) and `security_2sv_enforced` from CISA SCuBA `GWS.COMMONCONTROLS.1.1` (phishing-resistant MFA), because neither check can prove what those requirements ask for.
-
-  Read more in the [Compliance documentation](https://docs.prowler.com/user-guide/compliance/tutorials/compliance).
-
-  ### 🔍 Checks
-
-  Ten new AWS checks land in this release, eight of them contributed by @tamg-aws. Thank you!
-
-  #### Amazon Bedrock AgentCore
-
-  - `iam_policy_passrole_to_bedrock_agentcore_restricted` flags customer-managed IAM policies that allow `iam:PassRole` over every role where the passed role can reach Bedrock AgentCore, so any principal holding the policy could run agent code under any role in the account.
-  - `iam_policy_no_agentcore_workload_access_token_wildcard` flags customer-managed IAM policies that allow `bedrock-agentcore:GetWorkloadAccessToken`, `GetWorkloadAccessTokenForJWT` or `GetWorkloadAccessTokenForUserId` on resources reaching workload identities other than the caller's own.
-  - `cloudwatch_log_group_agentcore_data_protection_policy_enabled` verifies that Bedrock AgentCore log groups mask sensitive data with a CloudWatch Logs data protection policy. The log group prefixes are configurable through `agentcore_log_group_name_prefixes` in `config.yaml`.
-
-  #### Amazon GuardDuty
-
-  - `guardduty_runtime_monitoring_enabled` flags detectors without unified Runtime Monitoring, the only feature that covers Amazon EC2 instances and Amazon ECS on AWS Fargate tasks in addition to Amazon EKS.
-  - `guardduty_ai_protection_enabled` flags detectors without AI Protection, which analyzes CloudTrail data events from Amazon Bedrock, Amazon Bedrock AgentCore and Amazon SageMaker AI. A detector that does not report the feature is `MANUAL` rather than `FAIL`.
-
-  `guardduty_eks_runtime_monitoring_enabled` no longer reports `FAIL` for detectors that use unified Runtime Monitoring, which is mutually exclusive with `EKS_RUNTIME_MONITORING` and already covers Amazon EKS.
-
-  #### Amazon ECR and EKS
-
-  - `ecr_registry_enhanced_scanning_enabled` verifies that the ECR registry scan type is enhanced (Amazon Inspector, covering programming language packages and continuous rescanning) instead of basic, reporting `MANUAL` when the registry scanning configuration cannot be read.
-  - `eks_cluster_vpc_cni_network_policy_enforced` flags EKS clusters whose Amazon VPC CNI managed add-on does not enable Kubernetes network policy enforcement, reporting `MANUAL` where the EKS API cannot show the setting.
-
-  #### AWS IAM, Elastic Beanstalk and MemoryDB
-
-  - `iam_role_service_trust_restricts_source_to_account` flags IAM roles whose trust policy lets an AWS service principal assume the role without confining the request to a specific source account, including trust policies that `iam_role_cross_service_confused_deputy_prevention` does not evaluate.
-  - `elasticbeanstalk_environment_no_secrets_in_configuration` scans the option settings of every Elastic Beanstalk environment for hardcoded secrets. Thanks to @haneul-24!
-  - `memorydb_cluster_in_transit_encryption_enabled` verifies that MemoryDB clusters have in-transit encryption (TLS) enabled. Thanks to @UTKARSH698!
-
-  Explore all AWS checks at [Prowler Hub](https://hub.prowler.com/check?provider=aws).
-
-  ### 🐳 Image Provider — On-Premises Registries
-
-  Scanning registries that live on private networks is now supported end to end. `PROWLER_IMAGE_PROVIDER_ALLOWED_PRIVATE_NETWORKS` takes a comma-separated list of IPs and CIDRs the provider may reach, while every other non-public address, including link-local and loopback, stays blocked by the SSRF guard. Authentication negotiation is also more resilient: the provider falls back to Basic when a registry such as Harbor rejects the negotiated bearer token, and switches to a bearer token when the server answers a Basic or anonymous request with a Bearer challenge. `--registry-insecure` now propagates to Trivy through `TRIVY_INSECURE`, so images behind self-signed certificates can be pulled and scanned, not just enumerated. The flag now disables certificate validation for the image pull too, so keep it for trusted internal registries only.
-
-  Registry scans also skip non-image OCI artifacts (Helm charts, cosign signatures, SBOM attestations), no longer abort the whole scan when Trivy fails on a single image, and enumerate repositories in parallel instead of one request at a time.
-
-  Read more in the [Image provider documentation](https://docs.prowler.com/user-guide/providers/image/getting-started-image#on-premises-registries-and-private-networks).
-
-  ### 🛠️ Prowler MCP Server — Tool Failures Reported as Errors
-
-  Prowler Local Server tools now report a failure as an MCP tool execution error (`isError: true`, with the explanation in `content`) instead of a successful result carrying an `{"error": ...}` object, which clients and models read as a success. The Prowler Documentation and Prowler Hub tools follow the same rule: `prowler_docs_search` no longer reports a failed search as zero matches, `prowler_docs_get_document` no longer reports a failed fetch as a missing page, and `prowler_hub_get_check_code` and `prowler_hub_get_check_fixer` now name the provider a check ID actually belongs to instead of reporting it as nonexistent. `prowler_get_compliance_framework_state_details` also rejects a call that passes both `scan_id` and `provider_id` instead of silently ignoring the provider.
-
-  Read more in the [Prowler MCP documentation](https://docs.prowler.com/getting-started/products/prowler-mcp).
-
-  ### 🙌 External Contributors
-
-  Thank you to our community contributors for this release!
-
-  - @tamg-aws: GuardDuty unified Runtime Monitoring and AI Protection checks ([#12564](https://github.com/prowler-cloud/prowler/pull/12564)), EKS VPC CNI network policy check ([#12661](https://github.com/prowler-cloud/prowler/pull/12661)), ECR enhanced scanning check ([#12660](https://github.com/prowler-cloud/prowler/pull/12660)), Bedrock AgentCore IAM and service trust checks ([#12664](https://github.com/prowler-cloud/prowler/pull/12664)), AgentCore log group data protection check ([#12662](https://github.com/prowler-cloud/prowler/pull/12662)), and fixes to ECR scan frequency ([#12560](https://github.com/prowler-cloud/prowler/pull/12560)), CloudWatch metric filters ([#12561](https://github.com/prowler-cloud/prowler/pull/12561)) and SageMaker direct internet access ([#12659](https://github.com/prowler-cloud/prowler/pull/12659))
-  - @haneul-24: AWS `elasticbeanstalk_environment_no_secrets_in_configuration` check ([#12378](https://github.com/prowler-cloud/prowler/pull/12378))
-  - @UTKARSH698: AWS `memorydb_cluster_in_transit_encryption_enabled` check ([#12246](https://github.com/prowler-cloud/prowler/pull/12246))
-  - @ye11oc4t: GitHub repository discovery pagination for unscoped scans ([#12460](https://github.com/prowler-cloud/prowler/pull/12460))
-
-  See the [full release notes on GitHub](https://github.com/prowler-cloud/prowler/releases/tag/5.41.0) for the complete list of changes.
-</Update>
-
-<Update label="v5.40.0" description="August 28, 2026">
-  ### 💬 Slack Integration — Alert Channel Destinations
-
-  <Note>
-  This feature is available exclusively in **Prowler Cloud** and **Prowler Private Cloud** with a [subscription](https://prowler.com/pricing).
-  </Note>
-
-  Alerts can now reach Slack. Connect a Slack workspace from the Integrations page, authorize one or several destination channels (the connection check confirms each channel with a one-time message and names any channel Slack refuses), and pick those channels in the alert modal's "Destination channels" selector, next to the "Recipients" selector for email. The alerts list summarizes both in a single "Destinations" column, showing a rule's email recipients and Slack channels at a glance. Disconnecting the workspace and recovering from revoked credentials are handled from the same page.
-
-  ![Connected Slack workspace on the Integrations page](/images/prowler-app/slack/connected-workspace.png)
-
-  ![Alert rule with Slack channel destinations](/images/prowler-app/alerts/create-alert-modal.png)
-
-  Read more in the [Slack integration documentation](https://docs.prowler.com/user-guide/tutorials/prowler-app-slack-integration) and the [Alerts documentation](https://docs.prowler.com/user-guide/tutorials/prowler-alerts).
-
-  ### 🤖 Lighthouse AI — Answer Feedback
-
-  <Note>
-  This feature is available exclusively in **Prowler Cloud** and **Prowler Private Cloud** with a [subscription](https://prowler.com/pricing).
-  </Note>
-
-  Every Lighthouse AI answer can now be rated with a thumbs up or thumbs down, with an optional field to describe what worked or what did not. Feedback is collected per answer, directly in the chat, and tells the team where Lighthouse should improve next.
-
-  Read more in the [Lighthouse AI documentation](https://docs.prowler.com/getting-started/products/prowler-cloud-lighthouse).
-
-  ### 📥 Providers — Imported Findings Indicator
-
-  <Note>
-  This feature is available exclusively in **Prowler Cloud** and **Prowler Private Cloud** with a [subscription](https://prowler.com/pricing).
-  </Note>
-
-  Providers whose findings were imported with the Prowler CLI now show an "Imported provider" indicator next to their connection status in the providers table. In accounts that mix connected providers with Import Findings uploads, the table now tells them apart at a glance.
-
-  ![Provider row with the Imported provider indicator and its tooltip](/images/changelog/v5.40.0-imported-provider-indicator.png)
-
-  Read more in the [Import Findings documentation](https://docs.prowler.com/user-guide/tutorials/prowler-import-findings).
-
-  ### 📚 Compliance — NCSC Cyber Essentials 3.3
-
-  Cyber Essentials is the UK National Cyber Security Centre (NCSC) scheme certifying the baseline technical controls an organization must implement, and cloud services are explicitly in scope and cannot be excluded from an assessment. Prowler now includes NCSC Cyber Essentials: Requirements for IT Infrastructure v3.3 (April 2026) as a universal framework, with its 28 requirements organized in the five control themes: Firewalls, Secure Configuration, Security Update Management, User Access Control, and Malware Protection.
-
-  Sixteen requirements map to Azure checks covering the controls the applicant organization owns under the shared responsibility model. The remaining twelve apply to end-user devices, on-premises network appliances, or organizational process, which cloud control-plane evidence cannot observe, so they are reported as Manual.
-
-  Contributed by @m-khan-97. Thank you!
-
-  Read more in the [Compliance documentation](https://docs.prowler.com/user-guide/compliance/tutorials/compliance).
-
-  ### 🔍 Checks
-
-  Fifteen new checks land across seven providers in this release.
-
-  #### AWS
-
-  - `ecr_repository_image_no_secrets` scans the latest image of each ECR repository, both its configuration and its filesystem layers, for hardcoded secrets. Thanks to @esquaredsec!
-  - Four new Amazon Bedrock checks, thanks to @tamg-aws!
-    - `bedrock_guardrail_contextual_grounding_filter_enabled` verifies that guardrails enable both contextual grounding filters, blocking responses that are not supported by the retrieved source or do not answer the question asked.
-    - `bedrock_custom_model_encrypted_with_cmk` verifies that custom models are encrypted at rest with a customer-managed KMS key instead of an AWS-owned key the organization cannot audit, rotate, or revoke.
-    - `bedrock_knowledge_base_encrypted_with_cmk` verifies that each knowledge-base data source encrypts with a customer-managed KMS key the transient storage used while documents are chunked and embedded.
-    - `bedrock_agent_role_not_shared_across_agents` verifies that every agent has a dedicated execution role, so no agent inherits another's permissions.
-  - `rolesanywhere_profile_restricts_session_permissions` flags IAM Roles Anywhere profiles that reference an administrative role without scoping down the vended session with a session policy or managed policies.
-
-  Explore all AWS checks at [Prowler Hub](https://hub.prowler.com/check?provider=aws).
-
-  #### GCP
-
-  - `iam_workload_identity_pool_provider_attribute_condition` flags Workload Identity Federation providers that trust a multi-tenant issuer without an attribute condition restricting which external identities can impersonate federated principals.
-
-  Explore all GCP checks at [Prowler Hub](https://hub.prowler.com/check?provider=gcp).
-
-  #### GitHub
-
-  Three new checks harden GitHub Actions defaults, all contributed by @Edneam. Thank you!
-
-  - `organization_default_workflow_permissions_read_only` and `repository_default_workflow_permissions_read_only` verify that workflows get a read-only default `GITHUB_TOKEN` at the organization and repository level.
-  - `organization_actions_pull_request_approval_disabled` verifies that organizations prevent GitHub Actions from creating and approving pull requests.
-
-  Explore all GitHub checks at [Prowler Hub](https://hub.prowler.com/check?provider=github).
-
-  #### Microsoft 365
-
-  - `defender_domain_dmarc_records_published` checks that every Exchange Online domain publishes a DMARC record with an enforcing policy (`p=quarantine` or `p=reject`). Thanks to @Rishi943!
-
-  Explore all Microsoft 365 checks at [Prowler Hub](https://hub.prowler.com/check?provider=m365).
-
-  #### Alibaba Cloud
-
-  - `oss_bucket_versioning_enabled` verifies that OSS buckets keep versioning enabled, allowing recovery from accidental or malicious object overwrite and deletion. Thanks to @abidedavana!
-  - `oss_bucket_server_side_encryption_enabled` verifies that OSS buckets define a default server-side encryption rule, either AES256 or KMS. Thanks to @alexchen-sys!
-
-  OSS bucket logging, versioning, default encryption, and ACL configurations are also now read correctly from the Alibaba Cloud SDK, so the checks reading them no longer report every bucket as unconfigured.
-
-  Explore all Alibaba Cloud checks at [Prowler Hub](https://hub.prowler.com/check?provider=alibabacloud).
-
-  #### Huawei Cloud
-
-  - `vpc_security_group_open_egress` flags VPC security groups that allow open egress to the internet. Thanks to @tomitobio!
-
-  Explore all Huawei Cloud checks at [Prowler Hub](https://hub.prowler.com/check?provider=huaweicloud).
-
-  #### STACKIT
-
-  - `ske_cluster_no_public_endpoint` flags SKE clusters whose Kubernetes API endpoint is reachable from the whole internet, because the ACL extension is disabled or its allowed CIDR list contains `0.0.0.0/0` or `::/0`. Thanks to @johannes-engler-mw!
-
-  Explore all STACKIT checks at [Prowler Hub](https://hub.prowler.com/check?provider=stackit).
-
-  ### 🔐 Security Updates
-
-  - The API and SDK container images upgrade OpenSSL to 3.5.7-1~deb13u2, patching ten high CVEs; the UI image upgrades `libcrypto3` and `libssl3` to 3.5.8-r0, patching seven high CVEs; the MCP Server image patches CVE-2026-14456 (OpenSSL), CVE-2026-11822, and CVE-2026-11824 (SQLite).
-  - `sqlparse` upgraded to 0.6.0 in the API, patching CVE-2026-54284, CVE-2026-59893, and CVE-2026-71491.
-
-  ### 🙌 External Contributors
-
-  Thank you to our community contributors for this release!
-
-  - @Edneam: GitHub `organization_default_workflow_permissions_read_only` ([#12122](https://github.com/prowler-cloud/prowler/pull/12122)), `repository_default_workflow_permissions_read_only` ([#12143](https://github.com/prowler-cloud/prowler/pull/12143)), and `organization_actions_pull_request_approval_disabled` ([#12394](https://github.com/prowler-cloud/prowler/pull/12394)) checks
-  - @tamg-aws: four AWS Bedrock checks covering guardrail grounding, CMK encryption, and agent role isolation ([#12459](https://github.com/prowler-cloud/prowler/pull/12459))
-  - @esquaredsec: AWS `ecr_repository_image_no_secrets` check ([#12123](https://github.com/prowler-cloud/prowler/pull/12123))
-  - @Rishi943: Microsoft 365 `defender_domain_dmarc_records_published` check ([#11936](https://github.com/prowler-cloud/prowler/pull/11936))
-  - @abidedavana: Alibaba Cloud `oss_bucket_versioning_enabled` check ([#11913](https://github.com/prowler-cloud/prowler/pull/11913))
-  - @alexchen-sys: Alibaba Cloud `oss_bucket_server_side_encryption_enabled` check ([#11981](https://github.com/prowler-cloud/prowler/pull/11981))
-  - @tomitobio: Huawei Cloud `vpc_security_group_open_egress` check ([#12209](https://github.com/prowler-cloud/prowler/pull/12209))
-  - @johannes-engler-mw: STACKIT `ske_cluster_no_public_endpoint` check ([#11943](https://github.com/prowler-cloud/prowler/pull/11943))
-  - @gabrielfrdev: cluster name in Kubernetes compliance report outputs ([#12506](https://github.com/prowler-cloud/prowler/pull/12506))
-  - @jfgmesquita: AWS FSBP compliance mapping fix for IAM.9 and EKS.1 ([#12372](https://github.com/prowler-cloud/prowler/pull/12372))
-  - @hackertwinten: `ec2_securitygroup_not_used` no longer flags security groups held only by scaled-down AWS Batch compute environments ([#12458](https://github.com/prowler-cloud/prowler/pull/12458))
-  - @0xTaoZ: ECS task-definition checks no longer report PASS when `DescribeTaskDefinition` fails, shipped early in v5.39.1 ([#12217](https://github.com/prowler-cloud/prowler/pull/12217))
-  - @ye11oc4t: `ses_identity_not_publicly_accessible` now evaluates every identity authorization policy, shipped early in v5.39.1 ([#12464](https://github.com/prowler-cloud/prowler/pull/12464))
-  - @Zuhef: IaC provider raises typed exceptions instead of `sys.exit` when cloning the scanned repository or running Trivy fails ([#12227](https://github.com/prowler-cloud/prowler/pull/12227)), Kubernetes kubelet checks no longer disappear from the scan when a `kubelet-config` ConfigMap is broken ([#12225](https://github.com/prowler-cloud/prowler/pull/12225)), and the CLI `--slack` summary is sent for scans with no findings instead of failing with `ZeroDivisionError` ([#12229](https://github.com/prowler-cloud/prowler/pull/12229))
-  - @m-khan-97: NCSC Cyber Essentials 3.3 compliance framework with Azure provider coverage across the five Cyber Essentials themes ([#11588](https://github.com/prowler-cloud/prowler/pull/11588))
-
-  See the [full release notes on GitHub](https://github.com/prowler-cloud/prowler/releases/tag/5.40.0) for the complete list of changes.
-</Update>
-
-<Update label="v5.39.0" description="August 13, 2026">
-  ### 🤖 Lighthouse AI — Finding Skills
-
-  <Note>
-  This feature is available exclusively in **Prowler Cloud** and **Prowler Private Cloud** with a [subscription](https://prowler.com/pricing).
-  </Note>
-
-  Lighthouse AI now embeds a Skills menu on every finding, answering the questions an analyst actually asks. **Contextual Fix** produces the fix for the finding, **Triage Decision** judges whether it is real and closes it out when it is not, and **Systemic Scope** determines whether the problem is a one-off or everywhere. A free-form "Ask Lighthouse anything" prompt sits in the same menu, and each run shows its progress and offers follow-up actions such as creating a Jira issue or muting the finding.
-
-  ![Lighthouse AI Skills menu on a finding resource](/images/changelog/v5.39.0-lighthouse-finding-skills.png)
-
-  Read more in the [Lighthouse AI documentation](https://docs.prowler.com/getting-started/products/prowler-cloud-lighthouse).
-
-  ### ☁️ Azure Management Group Onboarding
-
-  <Note>
-  This feature is available exclusively in **Prowler Cloud** and **Prowler Private Cloud** with a [subscription](https://prowler.com/pricing).
-  </Note>
-
-  Azure subscriptions no longer onboard one at a time. Choose "Add Multiple Subscriptions With Azure Management Group" in the add-provider wizard, enter the Microsoft Entra tenant ID, and authenticate once with a single tenant-wide service principal: Prowler discovers the entire management-group hierarchy under the tenant root, lets you select the subscriptions to onboard, and creates their providers with the management-group structure preserved. Azure now matches the one-step onboarding that AWS Organizations and GCP organizations already have.
-
-  ![Azure onboarding method selector with the Management Group option](/images/changelog/v5.39.0-azure-mg-selector.png)
-
-  Read more in the [Azure Management Groups documentation](https://docs.prowler.com/user-guide/tutorials/prowler-cloud-azure-management-groups).
-
-  ### ✅ Findings Triage — Verify MANUAL Findings as PASS
-
-  <Note>
-  This feature is available exclusively in **Prowler Cloud** and **Prowler Private Cloud** with a [subscription](https://prowler.com/pricing).
-  </Note>
-
-  Checks that require human judgment report `MANUAL` findings. For these findings, and only for them, the triage status selector now offers **Resolved**: choosing it asks for the required written evidence and verifies the finding as passing. The finding then reports an effective `PASS` while preserving the raw `MANUAL` scan result, across findings, finding groups, compliance reports, and scans, with the attestation's author, evidence, and validity always visible. Attestations expire automatically after 90 days, or as soon as a new scan reports a real failure, returning the finding to the review queue.
-
-  ![Triage status selector offering Resolved on a MANUAL finding](/images/changelog/v5.39.0-manual-pass-selector.png)
-
-  ![Manual Pass details showing evidence, author, and validity](/images/changelog/v5.39.0-manual-pass-details.png)
-
-  Read more in the [Findings Triage documentation](https://docs.prowler.com/user-guide/tutorials/prowler-app-findings-triage#verify-a-manual-finding-as-pass).
-
-  ### ☁️ Prowler Cloud MCP — Organizations Management and Grouped Jira Dispatch
-
-  <Note>
-  This feature is available exclusively in **Prowler Cloud** and **Prowler Private Cloud** with a [subscription](https://prowler.com/pricing).
-  </Note>
-
-  The hosted Prowler Cloud MCP server adds eight organization tools, so an agent can onboard and manage entire cloud organizations end to end: create the organization, discover its accounts, subscriptions, and projects, apply the selection, and manage the resulting providers. The tools cover AWS Organizations, GCP organizations, and Azure tenant root management groups, and they are available to Lighthouse AI.
-
-  `prowler_send_findings_to_jira` also gains Cloud-only dispatch capabilities: select failed findings by check IDs against the latest completed scan, and send them in grouped mode, one Jira work item per check listing up to 50 affected resources, with per-group error reporting.
-
-  Read more in the [Prowler MCP tools documentation](https://docs.prowler.com/getting-started/basic-usage/prowler-mcp-tools) and its [Jira operations reference](https://docs.prowler.com/getting-started/basic-usage/prowler-mcp-tools#jira-operations).
-
-  ### 🕸️ Attack Paths — Grouped Graph with Outcome Destinations
-
-  <Note>
-  This feature is available exclusively in **Prowler Cloud** and **Prowler Private Cloud** with a [subscription](https://prowler.com/pricing).
-  </Note>
-
-  The Attack Paths graph now reads from source to destination. Resources of the same class collapse into a single expandable node with a count, clicking reveals its members, and every path terminates in an explicit outcome node naming the destination impact: code execution, privilege escalation, public exposure, or resource inventory. The per-account hub node is gone, and the clicked resource stays highlighted while its findings are expanded.
-
-  ![Attack Paths graph from the Internet to a public exposure outcome node](/images/changelog/v5.39.0-attack-paths-graph.png)
-
-  Explore the full Attack Paths query catalog at [Prowler Hub](https://hub.prowler.com/attack-paths).
-
-  Read more in the [Attack Paths documentation](https://docs.prowler.com/user-guide/tutorials/prowler-app-attack-paths).
-
-  ### 📚 New Compliance Framework — CMMC 2.0
-
-  The Cybersecurity Maturity Model Certification (CMMC) is the certification the US Department of Defense requires from contractors and suppliers that handle federal contract data. Prowler now includes CMMC 2.0 as a universal framework with all 149 requirements defined by the CMMC Program rule (32 CFR Part 170), organized in its three levels:
-
-  - **Level 1 (Foundational):** 15 requirements for the basic safeguarding of Federal Contract Information, from FAR 52.204-21.
-  - **Level 2 (Advanced):** 110 requirements from NIST SP 800-171 Rev 2, protecting Controlled Unclassified Information.
-  - **Level 3 (Expert):** 24 enhanced requirements from NIST SP 800-172 for the most sensitive programs.
-
-  Requirements map to Prowler checks across AWS, Azure, GCP, Alibaba Cloud, Oracle Cloud, and Microsoft 365, so one framework reports the compliance posture of the whole estate.
-
-  Read more in the [Compliance documentation](https://docs.prowler.com/user-guide/compliance/tutorials/compliance).
-
-  ### 🔍 Checks
-
-  #### Microsoft 365
-
-  Twenty new Entra ID checks expand the coverage of CIS Microsoft 365 Foundations Benchmark v7.0.0:
-
-  - **Password protection:** custom banned password list, on-premises enforcement, and lockout threshold and duration.
-  - **Default user permissions:** security group and Microsoft 365 group creation restricted, and guest invitations limited to allowed domains.
-  - **Conditional Access:** high and medium sign-in risk blocked, authentication transfer blocked, untrusted locations blocked, trusted named locations defined, sign-in frequency enforced, and token protection enforced.
-  - **Sessions and authentication methods:** idle session timeout configured, email one-time passcodes disabled, and Microsoft Authenticator context shown.
-  - **PIM and access reviews:** approval required to activate the Global Administrator and Privileged Role Administrator roles, and access reviews configured for guest users and privileged roles.
-
-  Explore all Microsoft 365 checks at [Prowler Hub](https://hub.prowler.com/check?provider=m365).
-
-  #### AWS
-
-  Two new checks detect hardcoded secrets:
-
-  - `batch_job_definition_no_secrets` scans Batch job definition environment variables and command parameters. Thanks to @praneetrajv!
-  - `awslambda_layer_no_secrets_in_content` scans Lambda layer package content. Thanks to @ganiganesh25!
-
-  Explore all AWS checks at [Prowler Hub](https://hub.prowler.com/check?provider=aws).
-
-  ### 🙌 External Contributors
-
-  Thank you to our community contributors for this release!
-
-  - @praneetrajv: AWS `batch_job_definition_no_secrets` check ([#12117](https://github.com/prowler-cloud/prowler/pull/12117))
-  - @ganiganesh25: AWS `awslambda_layer_no_secrets_in_content` check ([#12233](https://github.com/prowler-cloud/prowler/pull/12233))
-  - @andoniaf: GitHub `organization_repository_creation_limited` now reports low severity when repository creation is limited to private or internal visibility ([#12164](https://github.com/prowler-cloud/prowler/pull/12164))
-
-  See the [full release notes on GitHub](https://github.com/prowler-cloud/prowler/releases/tag/5.39.0) for the complete list of changes.
-</Update>
-
-<Update label="v5.38.0" description="August 6, 2026">
-  ### 📌 Compliance Watchlist
-
-  <Note>
-  This feature is available exclusively in **Prowler Cloud** and **Prowler Private Cloud** with a [subscription](https://prowler.com/pricing).
-  </Note>
-
-  Compliance Watchlist keeps the frameworks an organization tracks in one shared list. Pin frameworks from any compliance view, manage several at once through a searchable catalog, and filter the Compliance section to show only the pinned frameworks.
-
-  The Overview page now reports the latest score for every pinned framework, while finding details highlight the watched frameworks associated with each check. Universal frameworks remain a single watchlist entry across provider views, keeping the organization's priorities consistent everywhere.
-
-  ![Compliance Watchlist editor](/images/compliance/prowler-app-compliance-watchlist-editor.png)
-
-  Read more in the [Compliance Watchlist documentation](https://docs.prowler.com/user-guide/compliance/tutorials/compliance#tracking-frameworks-with-the-compliance-watchlist).
-
-  ### 🔐 SAML SSO - Multiple Email Domains
-
-  <Note>
-  This feature is available exclusively in **Prowler Cloud** and **Prowler Private Cloud** with a [subscription](https://prowler.com/pricing).
-  </Note>
-
-  One SAML configuration can now authorize a primary email domain and up to 19 additional domains through the same Identity Provider. Every domain shares one stable Assertion Consumer Service (ACS) URL based on the primary domain, so subsidiaries, acquired companies, regional domains, and multiple brands no longer require separate tenants or duplicated SAML applications.
-
-  Domain ownership remains tenant-bound throughout the authentication flow. During service provider-initiated sign-in, the discovery domain and the domain asserted by the Identity Provider must resolve to the same tenant before provisioning continues.
-
-  ![SAML configuration with multiple email domains](/images/prowler-app/saml/saml-multiple-domains.png)
-
-  Read more in the [SAML SSO documentation](https://docs.prowler.com/user-guide/tutorials/prowler-app-sso#add-multiple-saml-domains).
-
-  ### 👥 User Sign-In Methods
-
-  <Note>
-  This feature is available exclusively in **Prowler Cloud** and **Prowler Private Cloud** with a [subscription](https://prowler.com/pricing).
-  </Note>
-
-  The Users table now shows each account's sign-in methods as tags, including email/password, Google, GitHub, SAML with linked domains, and Partner SSO. Accounts without a reported method display a placeholder.
-
-  ![Users table showing sign-in method tags](/images/changelog/v5.38.0-user-sign-in-methods.png)
-
-  ### 🕸️ Attack Paths - Expanded AWS Privilege-Escalation Coverage
-
-  Attack Paths adds 20 AWS privilege-escalation queries from [pathfinding.cloud](https://pathfinding.cloud), while `iam_policy_allows_privilege_escalation` gains 22 additional escalation combinations.
-
-  The new coverage includes service `iam:PassRole` paths across AWS Batch, Braket, Cognito Identity, ECS, EMR, EMR Serverless, GameLift, Glue, EC2 Image Builder, Kinesis Analytics, HealthOmics, EventBridge Scheduler, Systems Manager, and Step Functions. It also covers existing-resource abuse, permissions-boundary removal, role assumption, and IAM Identity Center permission-set policy injection.
-
-  The query catalog now exposes each AWS query's outcome category, distinguishing code execution, privilege escalation, public exposure, and resource inventory.
-
-  Explore the full Attack Paths query catalog at [Prowler Hub](https://hub.prowler.com/attack-paths).
-
-  Read more in the [Attack Paths documentation](https://docs.prowler.com/user-guide/tutorials/prowler-app-attack-paths).
-
-  ### 🔍 Checks
-
-  #### Microsoft 365
-
-  Twelve new checks expand the coverage of CIS Microsoft 365 Foundations Benchmark v7.0.0:
-
-  - **Admin Center:** Shared Bookings is disabled.
-  - **Defender:** Priority account protection and strict preset security policies are enabled.
-  - **Entra ID:** Six checks cover device registration restrictions, local administrator behavior, device limits, LAPS, and BitLocker key visibility.
-  - **Exchange Online:** Personal accounts in Outlook on the web are disabled and Direct Send is rejected.
-  - **Microsoft Teams:** External access from trial-only tenants is blocked.
-
-  Explore all Microsoft 365 checks at [Prowler Hub](https://hub.prowler.com/check?provider=m365).
-
-  ### 🔐 Security
-
-  - Prowler API, UI, SDK, and MCP container images now publish per-architecture Software Bills of Materials (SBOMs) and build-provenance attestations. Prowler Cloud production and Prowler Private Cloud images carry the same attestations.
-  - SDK and API container builds verify the checksums of downloaded PowerShell, Trivy, and zizmor binaries before installation.
-  - Grype now complements Trivy across the container-image security gates, detecting components and vulnerabilities that manifest-based scanners can miss and blocking fixable high and critical findings.
-  - `aiohttp` was upgraded to 3.14.3 to address CVE-2026-69244. `cryptography` was upgraded to 50.0.0 to address CVE-2026-69247 and CVE-2026-69249.
-
-  See the [full release notes on GitHub](https://github.com/prowler-cloud/prowler/releases/tag/5.38.0) for the complete list of changes.
-</Update>
-
-<Update label="v5.37.0" description="August 3, 2026">
-  ### 💬 Lighthouse AI — Context-Aware Chat and a Bigger Toolbox
-
-  <Note>
-  This feature is available exclusively in **Prowler Cloud** and **Prowler Private Cloud** with a [subscription](https://prowler.com/pricing).
-  </Note>
-
-  Lighthouse AI is now aware of your working context when in Prowler Cloud. Messages carry page-aware context — the page you are on, the finding or resource open in the side panel, and its metadata — so "explain this" just works, and each page offers concise contextual suggestions to start from.
-
-  ![Lighthouse AI answering "explain this finding" from the side panel, with the page context chip highlighted in the composer](/images/prowler-app/lighthouse/prowler-cloud/side-panel-context-aware.png)
-
-  Lighthouse also gained access to every tool family the Prowler MCP server advertises: scan configurations, scan scheduling, finding triage, alert rules and recipients, integrations, users, and roles. Every action remains gated by RBAC: Lighthouse AI can only do what the user asking could do themselves.
-
-  Read more in the [Lighthouse AI documentation](/getting-started/products/prowler-cloud-lighthouse).
-
-  ### 🔌 Prowler MCP — Integrations, Users, and Roles
-
-  Prowler MCP gained three tool families, available on both the Cloud and the self-hosted Local MCP Server:
-
-  - **[Integrations](/getting-started/basic-usage/prowler-mcp-tools#integrations-management)** — manage where Prowler sends its results, with the full lifecycle for Amazon S3, AWS Security Hub, and Jira: create them, update credentials, configuration and attached providers, re-check connections, and delete them — plus turning findings into Jira work items directly from a conversation.
-  - **[Users](/getting-started/basic-usage/prowler-mcp-tools#user-management)** — read-only tools to list the tenant users with their emails and identify the authenticated user.
-  - **[Roles](/getting-started/basic-usage/prowler-mcp-tools#role-management)** — browse the RBAC roles defined in the tenant, inspect the capabilities each one grants, and set the role a user holds.
-
-  ### ☁️ Prowler MCP — Cloud-Only Tools
-
-  <Note>
-  This feature is available exclusively in **Prowler Cloud** and **Prowler Private Cloud** with a [subscription](https://prowler.com/pricing). These tools are exposed only by the Cloud MCP Server at `https://mcp.prowler.com/mcp`; the self-hosted Local MCP Server **does not** include them.
-  </Note>
-
-  A new `prowler_cloud_*` namespace adds 32 tools so your AI assistant can run Prowler Cloud workflows end to end instead of only reading from them:
-
-  - **[Alerts](/getting-started/basic-usage/prowler-mcp-tools#alerts)** — create and manage alert rules and email recipients, and browse the fired-alert history. Rule conditions can be dry-run before saving, so you can see what a rule would match without persisting anything.
-  - **[Findings Triage](/getting-started/basic-usage/prowler-mcp-tools#findings-triage)** — set a finding's triage status and attach notes documenting the decision. Unlike muting, the finding stays visible.
-  - **[Scan Scheduling](/getting-started/basic-usage/prowler-mcp-tools#scan-scheduling)** — configure daily, interval, weekly, or monthly recurring scans, one provider at a time or applied across many at once.
-  - **[Scan Configurations](/getting-started/basic-usage/prowler-mcp-tools#scan-configurations)** — build reusable check and compliance selections and attach them to providers.
-
-  Read more in the [Prowler MCP tools reference](/getting-started/basic-usage/prowler-mcp-tools#prowler-cloud-tools).
-
-  ### 🧭 Compliance — Grouped by provider of the same type
-
-  <Note>
-  This feature is available exclusively in **Prowler Cloud** and **Prowler Private Cloud** with a [subscription](https://prowler.com/pricing).
-  </Note>
-
-  One framework, every provider, a single answer. Building on the cross-provider-type roll-up, the Compliance section now groups compliance for all providers of the same type: a **single-provider framework** — CIS AWS, CIS GCP, ENS for Azure — is aggregated across the latest completed scan of every provider of that type. Each framework card rolls up into a consolidated posture with a per-provider breakdown, a findings drill-down, and a combined executive PDF report. Requirement status follows the same strict precedence (FAIL over PASS over MANUAL), so one failing provider flags the requirement for the whole estate.
-
-  ![Across providers compliance section](/images/compliance/prowler-app-across-providers-expanded.png)
-
-  The Compliance tabs were also renamed to say what they aggregate: "Per Scan" is now **Single Scan**, "Cross-Provider" is now **Multiple Scans**, and Compliance lands on Multiple Scans by default.
-
-  ![Cross-provider compliance detail across providers](/images/compliance/prowler-app-across-providers-detail.png)
-
-  Read more in the [Cross-Provider Compliance documentation](/user-guide/compliance/tutorials/cross-provider-compliance).
-
-  ### ☁️ GCP Organization Onboarding
-
-  <Note>
-  This feature is available exclusively in **Prowler Cloud** and **Prowler Private Cloud** with a [subscription](https://prowler.com/pricing).
-  </Note>
-
-  Onboarding an entire Google Cloud organization is now a single guided flow. Provide an organization-level credential and Prowler discovers the full hierarchy, every folder and project. Pick the folders and projects to onboard from a selection tree, set custom aliases, test the connection, and launch: each selected project is registered as a provider, with no need to add them one by one. Post-onboarding management is covered too, including credential replacement and organization-wide deletion.
-
-  Read more in the [GCP Organizations documentation](/user-guide/tutorials/prowler-cloud-gcp-organizations).
-
-  ### 🕸️ Attack Paths — More Privilege Escalation Queries
-
-  Attack Paths adds four AWS privilege-escalation detection queries from [pathfinding.cloud](https://pathfinding.cloud). Thanks to @paramanandmallik!
-
-  - **[STS-002](https://hub.prowler.com/attack-paths/aws-sts-privesc-cross-account-trust)** — cross-account role trust
-  - **[STS-003](https://hub.prowler.com/attack-paths/aws-sts-privesc-wildcard-trust)** — wildcard role trust
-  - **[IAM-022](https://hub.prowler.com/attack-paths/aws-iam-privesc-delete-user-permissions-boundary)** — user permissions-boundary removal
-  - **[SSO-001](https://hub.prowler.com/attack-paths/aws-sso-privesc-permission-set-escalation)** — IAM Identity Center permission-set escalation
-
-  The query info panel now links every query to its page on [Prowler Hub](https://hub.prowler.com), and the IAM privilege-escalation queries were reworked to run efficiently on accounts with many IAM roles, users, or groups, fixing runtime errors and timeouts on large graphs.
-
-  Read more in the [Attack Paths documentation](/user-guide/tutorials/prowler-app-attack-paths).
-
-  ### 🛡️ AWS Confidential Computing — Nitro Enclaves Checks
-
-  Prowler adds the first CSPM coverage for confidential computing workloads on AWS, with **11 new checks** for [Nitro Enclaves](https://aws.amazon.com/ec2/nitro/nitro-enclaves/), developed together with [Guillermo Ruiz](https://www.linkedin.com/in/gruizesteban/) from AWS.
-
-  - **Workload host environment (EC2)** — five `ec2_confidential_workload_host_*` checks for the parent instance: IMDSv2 not enforced, public IP exposure, unrestricted ingress, exposed vsock proxy ports, and hosts not running.
-  - **KMS attestation policy** — six `kms_key_enclave_*` checks for the key policies gating enclave secrets: attestation not enforced or bypassable, missing deployment binding, debug-mode attestations, PCR mismatches, and unknown enclave images.
-
-  All checks are fully passive, using AWS APIs and CloudTrail with no instance access or SSM agent required, and are mapped across 23 compliance frameworks, including NIST 800-53 Rev 5, PCI-DSS v4.0, ISO 27001:2022, SOC 2, HIPAA, and MITRE ATT&CK.
-
-  Read more about it in this [blog post](https://prowler.com/blog/your-llm-runs-in-a-nitro-enclave-who-is-checking-the-enclave).
-
-  Try them out now at [cloud.prowler.com](https://cloud.prowler.com/sign-up)!
-
-  ### 🏢 New Provider — Huawei Cloud
-
-  Prowler now scans [**Huawei Cloud**](https://www.huaweicloud.com/), with **25 checks** across ten services: CTS, ECS, ELB, EVS, IAM, KMS, OBS, RDS, VPC, and WAF, plus the CIS Huawei Cloud Foundations Benchmark 1.0 compliance framework. Thanks to @tomitobio for their 1st provider in Prowler!
-
-  To scan a Huawei Cloud account, export the IAM user's access key credentials and run Prowler CLI:
-
-  ```bash
-  export HUAWEICLOUD_ACCESS_KEY_ID="your-access-key-id"
-  export HUAWEICLOUD_SECRET_ACCESS_KEY="your-secret-access-key"
-
-  prowler huaweicloud
-  ```
-
-  Read more in the [Huawei Cloud documentation](/user-guide/providers/huaweicloud/getting-started-huaweicloud). Explore all Huawei Cloud checks at [Prowler Hub](https://hub.prowler.com/check?provider=huaweicloud).
-
-  ### 🔍 Checks
-
-  #### AWS
-
-  - `codecommit_repository_no_secrets`, alongside the new `codecommit` service, scans files tracked at the tip of each repository's default branch for hardcoded secrets. Thanks to @Sid-0602!
-  - `glue_catalog_connection_no_secrets` detects secrets in Glue Data Catalog connection properties. Thanks to @l46983284-cpu, @Rishi943, and @UTKARSH698!
-  - `ec2_instance_stopped_older_than_specific_days` detects EC2 instances stopped longer than a configurable number of days (default 30). Thanks to @Nithin078!
-  - `sagemaker_endpoint_config_kms_encryption_enabled` verifies SageMaker endpoint configurations use a KMS key for storage volume encryption. Thanks to @Nithin078 and @l46983284-cpu!
-
-  Read more in the [AWS documentation](/user-guide/providers/aws/getting-started-aws). Explore all AWS checks at [Prowler Hub](https://hub.prowler.com/check?provider=aws).
-
-  ### 📤 OCSF Output — MITRE ATT&CK Enrichment
-
-  OCSF detection finding output now populates `finding_info.analytic` with the Prowler check rule and `finding_info.attacks` with MITRE ATT&CK technique and tactic objects for findings with MITRE ATT&CK compliance metadata. Thanks to @AlexanderSanin!
-
-  ### 🐞 Fixed
-
-  - AWS Security Hub integrations now persist successful recovery checks during finding delivery, keeping connection status and the last-checked time accurate.
-  - Social sign-up now creates authentication, tenant, and membership records in a single transaction, fully rolling back failed provisioning to prevent incomplete accounts.
-  - The SAML configuration form keeps the ACS URL field stable while generating the callback URL and exposes the copy action only after a valid URL is available.
-  - SAML users without a `userType` attribute and without an existing role now receive a least-privilege `read_only` fallback role, so role-dependent operations continue to work without granting management permissions.
-
-  ### 🔐 Security
-
-  - Provider deletion, connection checks, scan creation, provider secrets, provider groups, and daily schedules now respect role provider-group visibility.
-  - HTML reports escape provider-originated finding fields, preventing stored cross-site scripting through malicious cloud resource tags. https://github.com/prowler-cloud/prowler/security/advisories/GHSA-c2jg-2778-ggm4
-  - Authentication with an API key whose owning user was deleted now returns `401`, and user deletion revokes the user's API keys across all their tenants.
-
-  ### 🙌 External Contributors
-
-  Thank you to our community contributors for this release!
-
-  - @tomitobio: Huawei Cloud provider with CIS 1.0 benchmark ([#11950](https://github.com/prowler-cloud/prowler/pull/11950))
-  - @paramanandmallik: four AWS privilege-escalation Attack Paths queries ([#11460](https://github.com/prowler-cloud/prowler/pull/11460))
-  - @Sid-0602: AWS `codecommit` service and `codecommit_repository_no_secrets` check ([#11846](https://github.com/prowler-cloud/prowler/pull/11846))
-  - @l46983284-cpu, @Rishi943, and @UTKARSH698: AWS `glue_catalog_connection_no_secrets` check ([#11963](https://github.com/prowler-cloud/prowler/pull/11963))
-  - @Nithin078: AWS `ec2_instance_stopped_older_than_specific_days` ([#12076](https://github.com/prowler-cloud/prowler/pull/12076)) and `sagemaker_endpoint_config_kms_encryption_enabled` ([#12118](https://github.com/prowler-cloud/prowler/pull/12118), co-authored with @l46983284-cpu) checks
-  - @AlexanderSanin: MITRE ATT&CK enrichment in OCSF detection finding output ([#11492](https://github.com/prowler-cloud/prowler/pull/11492))
-  - @stefanobaldo: GCP gen2 Cloud Functions IAM policy retrieval is now thread-safe ([#12107](https://github.com/prowler-cloud/prowler/pull/12107))
-  - @rayair250-droid: GCP SSH and RDP firewall checks now detect exposed ports in any position within multi-port rules ([#12115](https://github.com/prowler-cloud/prowler/pull/12115))
-  - @jbchief-dev: secret ignore patterns now use Kingfisher-compatible LF line indexing ([#12141](https://github.com/prowler-cloud/prowler/pull/12141))
-  - @bmbferreira: Helm chart improvements — immutable chart versions on release ([#12056](https://github.com/prowler-cloud/prowler/pull/12056)) and capped Celery worker concurrency ([#12054](https://github.com/prowler-cloud/prowler/pull/12054))
-
-  See the [full release notes on GitHub](https://github.com/prowler-cloud/prowler/releases/tag/5.37.0) for the complete list of changes.
-</Update>
-
 <Update label="v5.36.0" description="July 24, 2026">
   ### 🎫 Finding Groups - Jira
 

docs/developer-guide/aws-details.mdx

@@ -57,7 +57,7 @@ The AWS provider implementation follows the general [Provider structure](/develo
 The generic service pattern is described in [service page](/developer-guide/services#service-structure-and-initialisation). You can find all the right now implemented services in the following locations:
 
 - Directly in the code, in location [`prowler/providers/aws/services/`](https://github.com/prowler-cloud/prowler/tree/master/prowler/providers/aws/services)
-- In the [Prowler Hub](https://hub.prowler.com/) for a more human-readable view.
+- In the [Prowler Hub](https://hub.prowler.com/). For a more human-readable view.
 
 The best reference to understand how to implement a new service is following the [service implementation documentation](/developer-guide/services#adding-a-new-service) and taking other services already implemented as reference. In next subsection you can find a list of common patterns that are used across all AWS services.
 
@@ -131,7 +131,7 @@ def _get_email_identities(self, identity):
 The AWS checks pattern is described in [checks page](/developer-guide/checks). You can find all the right now implemented checks:
 
 - Directly in the code, within each service folder, each check has its own folder named after the name of the check. (e.g. [`prowler/providers/aws/services/s3/s3_bucket_acl_prohibited/`](https://github.com/prowler-cloud/prowler/tree/master/prowler/providers/aws/services/s3/s3_bucket_acl_prohibited))
-- In the [Prowler Hub](https://hub.prowler.com/) for a more human-readable view.
+- In the [Prowler Hub](https://hub.prowler.com/). For a more human-readable view.
 
 The best reference to understand how to implement a new check is following the [check creation documentation](/developer-guide/checks#creating-a-check) and taking other similar checks as reference.
 

docs/developer-guide/checks.mdx

@@ -129,42 +129,12 @@ Each check **must** populate the `report.status` and `report.status_extended` fi
 - Status field: `report.status`
     - `PASS` – Assigned when the check confirms compliance with the configured value.
     - `FAIL` – Assigned when the check detects non-compliance with the configured value.
-    - `MANUAL` – This status must not be used unless manual verification is necessary to determine whether the status (`report.status`) passes (`PASS`) or fails (`FAIL`). This includes the case where Prowler could not retrieve the data needed to evaluate the resource (see below).
+    - `MANUAL` – This status must not be used unless manual verification is necessary to determine whether the status (`report.status`) passes (`PASS`) or fails (`FAIL`).
 
 - Status extended field: `report.status_extended`
     - It **must** end with a period (`.`).
     - It **must** include the audited service, the resource, and a concise explanation of the check result, for instance: `EC2 AMI ami-0123456789 is not public.`.
 
-### Permission and Data-Availability Errors Are Not Findings
-
-A `FAIL` must only be emitted when an insecure condition has actually been detected. A check **must never** report `FAIL` because the underlying API call failed: missing permissions or scopes on the scanning identity, an API that is not enabled, a feature that is not licensed, or data that could not be retrieved are scan-configuration problems, not security issues. Reporting them as `FAIL` surfaces a misleading (and often high-severity) finding to the user and skews compliance scores.
-
-When the service layer cannot obtain the data a check depends on, the check must:
-
-1. Emit a single `MANUAL` finding scoped to the widest affected resource (the tenant, account, project or subscription), not one finding per resource. For example, if user registration details cannot be read, emit one tenant-level `MANUAL` instead of one per user.
-2. Explain in `status_extended` that the check could not be evaluated and what to fix, naming the permission, scope, API or license required, for instance: `Cannot evaluate credential exposure for privileged users: unable to query Microsoft Defender XDR Advanced Hunting. Verify that the ThreatHunting.Read.All permission is granted to the scanning application.`
-3. Leave the check's severity untouched. Do not override `report.check_metadata.Severity` to hide the problem.
-
-The service layer must make the distinction possible: log the error and expose it to checks in a way that cannot be confused with a legitimate empty result. Common patterns already used in Prowler are:
-
-- Defaulting the attribute to `None` (data could not be read) instead of `[]`/`{}` (data was read and is empty), e.g. the `metric_filters is not None` guard in `prowler/providers/aws/services/cloudwatch/lib/metric_filters.py`.
-- Keeping an availability flag raised on any denied listing, e.g. `logs_client.metric_filters_unavailable` consumed by the AWS CloudWatch metric filter checks.
-- Keeping an error flag or message next to the data, e.g. `entra_client.user_registration_details_error` in M365 or `*_scan_errors` in AWS Bedrock.
-- Keeping a set of resources whose lookup failed, e.g. `accessapproval_client.settings_lookup_failed` in GCP.
-
-Make sure the error branch only captures real access errors. A `404`/not-found response frequently means the feature is simply not configured, which **is** a legitimate `FAIL`; a `403` or an unexpected exception is not. An "API not enabled" error is usually a scan-configuration problem too — **except** when the API's activation is itself the control being audited (e.g. GCP Access Approval: with `accessapproval.googleapis.com` disabled the feature provably cannot be enabled, so a definitive API-disabled state is a legitimate `FAIL`, while an undetermined state stays `MANUAL`).
-
-```python
-if <service>_client.<data> is None:
-    report = CheckReport<Provider>(metadata=self.metadata(), resource={})
-    report.resource_name = "<Tenant/Account-level resource>"
-    report.resource_id = "<stable-id>"
-    report.status = "MANUAL"
-    report.status_extended = "Cannot evaluate <requirement>: <data> could not be retrieved. Verify that <permission/API/license> is granted to the scanning identity."
-    findings.append(report)
-    return findings
-```
-
 ### Prowler's Check Severity Levels
 
 The severity of each check is defined in the metadata file using the `Severity` field. Severity values are always lowercase and must be one of the predefined categories below.
@@ -254,9 +224,9 @@ Each check **must** populate the report with a unique identifier for the audited
             - `resource_name`: Description of the configuration (e.g., "SharePoint Settings")
 - GitHub
     - Resource ID — `report.resource_id`.
-        - The ID of the GitHub resource. This is a system-generated integer that uniquely identifies the resource within the GitHub platform.
+        - The ID of the Github resource. This is a system-generated integer that uniquely identifies the resource within the Github platform.
     - Resource Name — `report.resource_name`.
-        - The name of the GitHub resource. In the case of a repository, this is just the repository name. For full repository names use the resource `full_name`.
+        - The name of the Github resource. In the case of a repository, this is just the repository name. For full repository names use the resource `full_name`.
 
 ### Configurable Checks in Prowler
 
@@ -467,7 +437,6 @@ The metadata structure is enforced in code using a Pydantic model. For reference
 - Use clear, actionable, and user-friendly language in `status_extended` to explain the result. Always provide information to identify the resource.
 - Use helper functions/utilities for repeated logic to avoid code duplication. Save them in the `lib` folder of the service.
 - Handle exceptions gracefully: catch errors per resource, log them, and continue processing other resources.
-- Never report `FAIL` because data could not be retrieved (missing permissions, API not enabled, feature not licensed). Emit a single `MANUAL` finding explaining what is required instead; see [Permission and Data-Availability Errors Are Not Findings](#permission-and-data-availability-errors-are-not-findings).
 - Document the check with a class and function level docstring explaining what it does, what it checks, and any caveats or provider-specific behaviors.
 - Use type hints for the `execute()` method (e.g., `-> list[CheckReport<Provider>]`) for clarity and static analysis.
 - Ensure checks are efficient; avoid excessive nested loops. If the complexity is high, consider refactoring the check.

docs/developer-guide/debugging.mdx

@@ -10,7 +10,7 @@ Visual Studio Code (also referred to as VSCode) provides an integrated debugger
 
 ### Debugging Configuration Example
 
-The following file is an example of a [debugging configuration](https://code.visualstudio.com/docs/editor/debugging#_launch-configurations) file for [Visual Studio Code](https://code.visualstudio.com/).
+The following file is an example of a [debugging configuration](https://code.visualstudio.com/docs/editor/debugging#_launch-configurations) file for [Virtual Studio Code](https://code.visualstudio.com/).
 
 This file must be placed inside the *.vscode* directory and named *launch.json*:
 

docs/developer-guide/end2end-testing.mdx

@@ -50,7 +50,7 @@ When adding or maintaining E2E tests for Prowler Local Server, follow these guid
      ```
 
 5. **Tag and document scenarios**
-   - Follow the existing naming convention for suites and test cases (for example, `SCANS-E2E-001`, `PROVIDER-E2E-003`) and use tags such as `@e2e`, `@serial` and feature tags (for example, `@providers`, `@scans`, `@aws`) to filter and organize tests.
+   - Follow the existing naming convention for suites and test cases (for example, `SCANS-E2E-001`, `PROVIDER-E2E-003`) and use tags such as `@e2e`, `@serial` and feature tags (for example, `@providers`, `@scans`,`@aws`) to filter and organize tests.
 
    **Example:**
      ```typescript
@@ -71,7 +71,7 @@ When adding or maintaining E2E tests for Prowler Local Server, follow these guid
        }
      );
      ```
-   -  Document each one in the Markdown files under `ui/tests`, including **Priority**, **Tags**, **Description**, **Preconditions**, **Flow steps**, **Expected results**, **Key verification points** and **Notes**.
+   -  Document each one in the Markdown files under `ui/tests`, including **Priority**, **Tags**, **Description**, **Preconditions**, **Flow steps**, **Expected results**,**Key verification points** and **Notes**.
 
    **Example**
    ```Markdown
@@ -256,7 +256,7 @@ To execute E2E tests for Prowler Local Server:
    pnpm run test:e2e
    ```
 
-   This command runs Playwright with the configured projects.
+   This command runs Playwright with the configured projects
 
 2. **Run E2E tests with the Playwright UI runner**
 

docs/developer-guide/mcp-server.mdx

@@ -120,14 +120,14 @@ class NewFeatureTools(BaseTool):
 
         Returns complete feature details including configuration and metadata.
         """
-        response = await self.api_client.get(f"/api/v1/features/{feature_id}")
-        return DetailedFeature.from_api_response(response["data"]).model_dump()
+        try:
+            response = await self.api_client.get(f"/api/v1/features/{feature_id}")
+            return DetailedFeature.from_api_response(response["data"]).model_dump()
+        except Exception as e:
+            self.logger.error(f"Failed to get feature {feature_id}: {e}")
+            return {"error": str(e), "status": "failed"}
 ```
 
-There is no `try`/`except` here on purpose. A failed request raises, and
-[Error Handling](#error-handling) explains what turns that raise into a message
-the agent can act on.
-
 ### Step 2: Create the Models
 
 Create corresponding models in `prowler_app/models/`:
@@ -369,62 +369,18 @@ async def search_items(self, status: str = Field(...)) -> dict:
 
 ### Error Handling
 
-**Raise, never return.** A returned `{"error": ...}` dict is reported to the
-client as `isError: false` -- a *successful* tool call whose payload happens to
-mention a failure. Clients and models read that as success. A raised exception
-becomes a spec-correct tool execution error instead.
-
-The common case therefore needs no handler at all:
+Return structured error responses instead of raising exceptions:
 
 ```python
 async def get_item(self, item_id: str) -> dict:
-    response = await self.api_client.get(f"/api/v1/items/{item_id}")
-    return DetailedItem.from_api_response(response["data"]).model_dump()
+    try:
+        response = await self.api_client.get(f"/api/v1/items/{item_id}")
+        return DetailedItem.from_api_response(response["data"]).model_dump()
+    except Exception as e:
+        self.logger.error(f"Failed to get item {item_id}: {e}")
+        return {"error": str(e), "status": "failed"}
 ```
 
-`prowler_mcp_server/lib/errors.py` classifies the failures every tool shares --
-a rejected credential, a missing permission, a rate limit, an outage, an
-unreachable API, a bad argument -- and gives each one a message that says what
-went wrong and what to do about it. Anything it does not recognise is masked,
-because `mask_error_details=True` is set on every sub-server and upstream
-response bodies must never be replayed into a model's context.
-
-Three ways to raise, in the order to reach for them:
-
-```python
-from fastmcp.exceptions import ToolError
-
-from prowler_mcp_server.lib.errors import InvalidArgument
-
-# 1. An argument this server rejected before any request went out. The message
-#    is repeated to the agent verbatim, so write it for one to read.
-if not 1 <= page_size <= 1000:
-    raise InvalidArgument("page_size must be between 1 and 1000.")
-
-# 2. A request the API answered or never answered: let it propagate untouched.
-#    `ProwlerAPIError` and `ProwlerAPIUnreachable` are what the classifier keys
-#    on, and the second one is what stops a retry from duplicating a write.
-response = await self.api_client.get(f"/api/v1/items/{item_id}")
-data = response["data"]
-
-# 3. A sentence the classifier cannot know -- a resource name, a precondition,
-#    the next tool to call. NOTE the absent `from` clause: it is what marks the
-#    message as already final. With `from e` the classifier would replace it.
-if not data:
-    raise ToolError(
-        f"No item with the ID {item_id!r} exists. Use prowler_list_items to "
-        "find a valid one."
-    )
-```
-
-The one thing that still *returns* rather than raises is a write whose outcome is
-genuinely unknown. `prowler_send_findings_to_jira` is the worked example: work
-items are created one at a time and Prowler cannot delete them, so a dispatch
-that stopped halfway answers with a result object carrying
-`safe_to_retry: false`. "This may have been applied" is a fact about the world,
-not an error, and squashing it into one loses the only thing that stops a retry
-from duplicating the write.
-
 ### Parameter Descriptions
 
 Use Pydantic `Field()` with clear descriptions. This also helps LLMs understand
@@ -470,150 +426,6 @@ For complete installation and deployment options, see:
 
 For development I recommend to use the [Model Context Protocol Inspector](https://github.com/modelcontextprotocol/inspector) as MCP client to test and debug your tools.
 
-## Testing
-
-Tests live in `mcp_server/tests/`, mirroring the source tree, and use the `test_*.py`
-prefix (the same convention as the API, not the SDK's `*_test.py` suffix).
-
-From `mcp_server/`:
-
-```bash
-cd mcp_server
-
-uv run pytest                              # Whole suite
-uv run pytest tests/prowler_app/models     # One area
-uv run pytest --cov=./prowler_mcp_server   # With coverage
-```
-
-From the repository root:
-
-```bash
-make test-mcp   # Runs the MCP suite exactly as CI does
-```
-
-Async tests need no marker — `asyncio_mode` is set to `auto`.
-
-### Reading the Coverage Numbers
-
-<Warning>
-Coverage here has a high floor that means nothing. `coverage.py` measures
-*statements*, and in a Pydantic model module nearly every statement is a class-body
-field declaration that runs at **import** time. `prowler_app/server.py` imports
-every tool module — and therefore every model module — when it is first imported,
-so all of those declarations execute and count as covered before a single test runs.
-
-Importing the package and executing no tests at all already reports **36% overall**,
-with individual model modules between 54% and 84%. A model module sitting at ~68%
-with no tests written for it has **none** of its behaviour covered: the covered lines
-are its imports, `class` statements and `Field(...)` declarations, and the missing
-ranges are its `from_api_response()` bodies.
-
-Judge a module against that import-only floor, not against zero, and do not set a
-Codecov target from the raw total.
-</Warning>
-
-### Shared Fixtures
-
-All fixtures live in `mcp_server/tests/conftest.py`. Three are autouse and apply to
-every test: the environment is pinned to deterministic values, real socket
-connections are blocked, and the API client singleton registry is snapshotted and
-restored.
-
-| Fixture | What it gives you |
-|---------|-------------------|
-| `mock_api_client` | The API client singleton with its transport mocked. The workhorse. |
-| `mock_router` | Route registry and request recorder |
-| `mcp_root_server` | The mounted root server, for in-memory client tests |
-| `health_client` | Starlette `TestClient` for the `/health` route |
-| `http_request_headers` | Injects request headers for HTTP-transport auth tests |
-| `hub_router` / `docs_router` | Mock the Hub and Docs sub-servers' sync HTTP clients |
-| `api_client` / `isolated_api_client` | The live singleton / a freshly-constructed one |
-
-Helpers live in `mcp_server/tests/helpers/`: JSON:API document builders
-(`jsonapi.py`), the `MockRouter` (`http.py`), tool-contract assertions
-(`assertions.py`) and fake credentials (`tokens.py`).
-
-### Writing a Tool Test
-
-Drive tools through an in-memory MCP client, and open the client inside the test —
-FastMCP warns that holding a client in a fixture causes event-loop problems.
-
-```python
-from fastmcp import Client
-
-from tests.helpers.jsonapi import jsonapi_collection, jsonapi_resource
-
-FINDING_ATTRIBUTES = {
-    "uid": "prowler-aws-s3_bucket_public_access-123456789012-us-east-1-my-bucket",
-    "status": "FAIL",
-    "severity": "high",
-    "status_extended": "S3 bucket my-bucket is publicly accessible.",
-    "delta": "new",
-    "muted": False,
-    "muted_reason": None,
-    "check_metadata": {"checkid": "s3_bucket_public_access"},
-}
-
-
-async def test_search_without_dates_queries_the_latest_scan_endpoint(
-    mcp_root_server, mock_api_client, mock_router
-):
-    """With no date range the tool targets the cheaper `/findings/latest`."""
-    mock_router.add(
-        "GET",
-        "/api/v1/findings/latest",
-        json=jsonapi_collection(
-            [jsonapi_resource("findings", "f1", FINDING_ATTRIBUTES)]
-        ),
-    )
-
-    async with Client(mcp_root_server) as client:
-        result = await client.call_tool("prowler_search_security_findings", {})
-
-    assert result.data["findings"][0]["check_id"] == "s3_bucket_public_access"
-    assert mock_router.paths() == ["GET /api/v1/findings/latest"]
-```
-
-The exemplar suite covers `findings` end to end — `tests/prowler_app/models/test_findings.py`
-and `tests/prowler_app/tools/test_findings.py`. It is deliberately one feature
-across both layers rather than a scattering of unrelated samples, and `findings`
-is the feature that exercises the whole foundation: two-tier models, nested
-sub-models, both relationship shapes, endpoint switching on a date range,
-list-to-CSV filter encoding, and a tool that returns prose instead of a model.
-
-Note the two files share a name. That is why `__init__.py` is required in every
-`tests/` subdirectory here — without it they would collide on import.
-
-<Warning>
-Tool parameters are declared with pydantic `Field(default=...)`, and only FastMCP's
-tool wrapper resolves those defaults. Calling a tool method directly with an
-argument omitted leaves it as a raw `FieldInfo` object, which is truthy — so a
-filter such as `if email:` silently builds a query out of the `FieldInfo` repr.
-Call tools through the client, or pass every argument explicitly.
-</Warning>
-
-### Why the API Key Is Pinned, Not Stripped
-
-`prowler_app/server.py` builds every tool at import time. Constructing a tool
-reaches `ProwlerAppAuth`, which raises when `PROWLER_API_KEY` is missing, and
-`load_all_tools` swallows that error per tool class. The result is that the whole
-`prowler_*` namespace registers **zero** tools while the server still logs
-"Successfully mounted Prowler tools server".
-
-The suite therefore pins a fake key in `[tool.pytest_env]`, which is applied before
-any test module is imported, and `tests/test_server.py` asserts each namespace is
-non-empty so this failure can never return silently.
-
-<Note>
-`ProwlerAppAuth` resolves `PROWLER_MCP_TRANSPORT_MODE` and `API_BASE_URL` in its
-default arguments, which Python evaluates once at module import. `monkeypatch.setenv`
-cannot change them — pass `mode=` and `base_url=` explicitly in auth tests.
-</Note>
-
-For the full set of rules and templates, see the
-[`prowler-test-mcp` skill](https://github.com/prowler-cloud/prowler/blob/master/skills/prowler-test-mcp/SKILL.md)
-and the [official FastMCP testing guide](https://gofastmcp.com/development/tests).
-
 ## Related Documentation
 
 <CardGroup cols={2}>

docs/developer-guide/provider.mdx

@@ -25,7 +25,7 @@ For providers supported by Prowler, refer to [Prowler Hub](https://hub.prowler.c
 
 Prowler supports several types of providers, each with its own implementation pattern and use case. Understanding these differences is key to designing your provider correctly.
 
-### Classifying Your Provider
+### Classifying your Provider
 
 Before implementing a new provider, you need to determine which type it belongs to. This classification will guide your implementation approach and help you choose the right patterns and libraries.
 
@@ -107,7 +107,7 @@ Once you have decided the provider you want or need to add to Prowler, the next
 - **SDK Providers**: Low complexity. You have mature examples like AWS, Azure, GCP, Kubernetes, etc. that you can leverage to implement your provider.
 - **API Providers**: Medium complexity. You need to implement the authentication and session management, and the API calls to the provider. You now have NHN and MongoDB Atlas as example to follow.
 - **Tool/Wrapper Providers**: High complexity. You need to implement the argument/output mapping to the provider and handle problems that the tool/wrapper may have. You now have IAC and the PowerShell wrapper as example to follow.
-- **Hybrid Providers**: High complexity. You need to "customize" your provider, mixing the other types of providers to achieve the desired result. You have M365 (msgraph SDK + PowerShell wrapper) and GitHub (PyGithub SDK + graphql API requests) as examples.
+- **Hybrid Providers**: High complexity. You need to "customize" your provider, mixing the other types of providers in order to achieve the desired result. You have M365 (msgraph SDK + PowerShell wrapper) and Github (PyGithub SDK + graphql API requests) as examples.
 
 ### Determining Regional vs Non-Regional Architecture
 
@@ -814,7 +814,7 @@ class YourProviderMutelist(Mutelist):
 Region management is essential for cloud providers that operate across multiple geographic locations. This component handles region validation and provides region-specific functionality.
 
 <Note>
-Regions are optional, only if the provider has regions, for example GitHub does not have regions, but AWS does.
+Regions are optional, only if the provider has regions, for example Github does not have regions, but AWS does.
 </Note>
 
 **File:** `prowler/providers/<provider_name>/lib/regions/<provider_name>_regions.py`
@@ -1090,7 +1090,7 @@ Main registration makes your provider discoverable by Prowler's core system. It'
                 cis.batch_write_data_to_file()
 ```
 
-#### Step 11: Register in the List of Providers
+#### Step 11: Register in the list of providers
 
 **Explanation:**
 This is needed to be able to use the provider in the generic checks. The provider must be registered in the `init_global_provider` method to handle CLI arguments and initialization.
@@ -1773,7 +1773,7 @@ The implementation of the mutelist is the same as the [SDK providers](#step-5-im
 Region management is essential for cloud providers that operate across multiple geographic locations. This component handles region validation and provides region-specific functionality.
 
 <Note>
-Regions are optional, only if the provider has regions, for example GitHub does not have regions, but AWS does.
+Regions are optional, only if the provider has regions, for example Github does not have regions, but AWS does.
 </Note>
 
 **File:** `prowler/providers/<provider_name>/lib/regions/<provider_name>_regions.py`
@@ -1966,7 +1966,7 @@ Main registration makes your provider discoverable by Prowler's core system. It'
 
 This step is the same as the [SDK providers](#step-10-register-in-main).
 
-#### Step 11: Register in the List of Providers
+#### Step 11: Register in the list of providers
 
 **Explanation:**
 This is needed to be able to use the provider in the generic checks. The provider must be registered in the `init_global_provider` method to handle CLI arguments and initialization.
@@ -2648,7 +2648,7 @@ Main registration makes your provider discoverable by Prowler's core system. It'
 
 This step is the same as the [SDK providers](#step-10-register-in-main).
 
-#### Step 7: Register in the List of Providers
+#### Step 7: Register in the list of providers
 
 **Explanation:**
 This is needed to be able to use the provider in the generic checks. The provider must be registered in the `init_global_provider` method to handle CLI arguments and initialization.
@@ -2808,7 +2808,7 @@ def validate_your_provider_uid(value):
 **Provider Model:**
 The `Provider` model already exists and supports all provider types. Ensure your provider type is included in the choices.
 
-### 2.2. Add the Provider to the Provider Choices
+### 2.2. Add the provider to the Provider Choices
 
 Update the `return_prowler_provider` function to include your provider. This function is crucial for the API to instantiate the correct provider class.
 
@@ -3209,7 +3209,7 @@ class YourProviderAPITestCase(APITestCase):
         self.assertEqual(response.status_code, 201)
 ```
 
-#### 2.6.1. Add Your Mocked Provider to the Tests
+#### 2.6.1. Add your mocked provider to the tests
 
 If needed, add a named provider fixture or extend the provider factory defaults so tests can request only the provider they need.
 
@@ -3272,7 +3272,7 @@ Your provider will be available through these endpoints:
 - `DELETE /api/v1/providers/{id}/` - Delete provider
 - `POST /api/v1/providers/secrets/` - Add provider credentials
 
-### 2.9. Update the Provider If Needed
+### 2.9. Update the provider if needed
 
 Depending on your provider's authentication requirements, you may need to add new authentication methods that are compatible with the API. This involves updating the provider class to support additional credential types beyond the basic ones.
 

docs/developer-guide/security-compliance-framework.mdx

@@ -18,7 +18,7 @@ A compliance framework must represent the **complete state** of the source catal
 Requirement coverage feeds the compliance percentage calculations and the metadata surfaces (dashboards, widgets, exports). Missing requirements skew those metrics and break the report as a faithful snapshot of the framework.
 </Warning>
 
-### Two Supported Schemas
+### Two supported schemas
 
 | Schema | When to use | File location | Discovered as |
 | --- | --- | --- | --- |
@@ -45,7 +45,7 @@ Before adding a new framework, complete the following checks:
 
 ## Universal Compliance Framework
 
-### Where the File Lives
+### Where the file lives
 
 Place the file at the top level of the compliance directory:
 
@@ -57,7 +57,7 @@ Examples in the repository: `prowler/compliance/csa_ccm_4.0.json`, `prowler/comp
 
 The file is auto-discovered — there is **no** need to register it in any `__init__.py`, modify `prowler/lib/outputs/`, or update any other Python module. The framework key Prowler CLI accepts via `--compliance` is the basename of the JSON file without `.json` (`dora_2022_2554.json` → `dora_2022_2554`).
 
-### Top-Level Structure
+### Top-level structure
 
 ```json
 {
@@ -198,7 +198,7 @@ Per requirement:
 
 For MITRE-style frameworks, additional optional fields are available on the requirement: `tactics`, `sub_techniques`, `platforms`, `technique_url` (these are populated automatically when adapting a legacy MITRE JSON to the universal model).
 
-### Multi-Provider Frameworks
+### Multi-provider frameworks
 
 A single universal file can cover any number of providers. The framework appears under each provider's `--list-compliance` output as long as **at least one** requirement has that provider key in its `checks` dict.
 
@@ -226,7 +226,7 @@ The legacy schema spans **four layers** — a complete contribution must touch e
 
 The universal schema collapses Layers 3 and 4 into declarative configuration inside the JSON — that is the main reason it is preferred for new contributions.
 
-### Directory Structure and File Naming
+### Directory structure and file naming
 
 Compliance frameworks live at:
 
@@ -259,7 +259,7 @@ prowler/lib/outputs/compliance/<framework>/
 └── __init__.py
 ```
 
-### JSON Schema Reference
+### JSON schema reference
 
 Every legacy compliance file is a JSON document with the following top-level keys. `Framework`, `Name` and `Provider` are validated non-empty by the root validator `framework_and_provider_must_not_be_empty` (`compliance_models.py`).
 
@@ -362,7 +362,7 @@ For the remaining attribute classes (`AWS_Well_Architected_Requirement_Attribute
 The `Attributes` field is a Pydantic `Union`. The generic attribute model **must** remain the last element of that Union — otherwise Pydantic v1 silently coerces every framework into the generic shape and your specialized fields are dropped. Adding a brand-new attribute shape requires inserting the Pydantic class **before** `Generic_Compliance_Requirement_Attribute`.
 </Note>
 
-#### Minimal Working Example
+#### Minimal working example
 
 The following snippet is a complete, valid framework file named `my_framework_1.0_aws.json`, saved at `prowler/compliance/aws/my_framework_1.0_aws.json`. It uses the generic attribute shape for simplicity.
 
@@ -408,7 +408,7 @@ The following snippet is a complete, valid framework file named `my_framework_1.
 }
 ```
 
-### Mapping Checks to Requirements
+### Mapping checks to requirements
 
 Each requirement links to the Prowler checks that, together, produce a PASS or FAIL verdict for that control.
 
@@ -425,7 +425,7 @@ To discover available checks:
 uv run python prowler-cli.py <provider> --list-checks
 ```
 
-### Supporting Multiple Providers (Legacy)
+### Supporting multiple providers (legacy)
 
 The legacy schema binds each file to a single provider. To cover several providers with the same framework, ship one JSON file per provider:
 
@@ -439,7 +439,7 @@ Keep the `Framework` and `Version` values identical across the files so the disp
 
 For a brand-new framework that spans several providers, **prefer the universal schema** — it covers every provider from a single file. If you must use the legacy schema, add one transformer per provider in `prowler/lib/outputs/compliance/<framework>/` and extend the summary-table dispatcher accordingly. See [Output Formatter](#output-formatter).
 
-### Output Formatter
+### Output formatter
 
 Legacy frameworks render in two forms: a detailed CSV report written to disk, and a summary table printed in the CLI. Both are produced by the output formatter package for the framework. Universal frameworks do **not** need a Python output formatter — the `outputs` config inside the JSON drives rendering — so this section applies only to the legacy schema.
 
@@ -453,19 +453,19 @@ prowler/lib/outputs/compliance/my_framework/
 └── models.py                  # CSV row Pydantic model
 ```
 
-#### Step 1 — Define the CSV Row Model
+#### Step 1 — Define the CSV row model
 
 In `models.py`, declare a Pydantic v1 model with one field per CSV column. Use existing models such as `AWSCISModel` in `prowler/lib/outputs/compliance/cis/models.py` as the reference. Fields typically include `Provider`, `Description`, `AccountId`, `Region`, `AssessmentDate`, `Requirements_Id`, `Requirements_Description`, one `Requirements_Attributes_*` field per attribute key, plus the finding fields `Status`, `StatusExtended`, `ResourceId`, `ResourceName`, `CheckId`, `Muted`, `Framework`, `Name`.
 
-#### Step 2 — Implement the Transformer
+#### Step 2 — Implement the transformer
 
 In `my_framework_aws.py`, subclass `ComplianceOutput` from `prowler.lib.outputs.compliance.compliance_output` and implement `transform(findings, compliance, compliance_name)`. Iterate over `findings`, match each finding to the requirements it satisfies through `finding.compliance.get(compliance_name, [])`, and append one row per attribute to `self._data`.
 
-#### Step 3 — Add the Summary-Table Dispatcher
+#### Step 3 — Add the summary-table dispatcher
 
 In `my_framework.py`, implement `get_my_framework_table(findings, bulk_checks_metadata, compliance_framework, output_filename, output_directory, compliance_overview)` following the pattern in `prowler/lib/outputs/compliance/cis/cis.py`.
 
-#### Step 4 — Register the Framework in the Dispatchers
+#### Step 4 — Register the framework in the dispatchers
 
 - Add the dispatcher call in `prowler/lib/outputs/compliance/compliance.py`, inside `display_compliance_table`, with a branch such as `elif "my_framework" in compliance_framework:`.
 - Register the CSV model and transformer in `prowler/lib/outputs/compliance/compliance_output.py` so the CSV file is emitted during the scan.
@@ -474,7 +474,7 @@ In `my_framework.py`, implement `get_my_framework_table(findings, bulk_checks_me
 For NIST-style catalogs that use `Generic_Compliance_Requirement_Attribute`, no custom formatter is needed. The generic formatter in `prowler/lib/outputs/compliance/generic/` handles them automatically, provided the JSON validates against the generic attribute schema.
 </Note>
 
-### Legacy-to-Universal Adapter
+### Legacy-to-universal adapter
 
 At load time, every legacy file is transparently adapted to a `ComplianceFramework` via `adapt_legacy_to_universal()` (`compliance_models.py`), which: (a) flattens the first element of `Attributes` into a flat `attributes` dict, (b) wraps `Checks` as `{provider_lower: [...]}`, (c) infers `attributes_metadata` from the matched Pydantic class via `_infer_attribute_metadata()`. The rest of Prowler (CSV/OCSF/PDF output, CLI table) then treats both formats identically.
 
@@ -497,7 +497,7 @@ Configuration guardrails close that gap. A requirement declares the configuratio
 Guardrails are an **optional** safety net for configurable checks. A requirement that maps only to non-configurable checks does not need them. When the field is absent, behavior is unchanged.
 </Note>
 
-### Where Guardrails Are Declared
+### Where guardrails are declared
 
 The field is attached to each requirement and exists in both schemas:
 
@@ -506,7 +506,7 @@ The field is attached to each requirement and exists in both schemas:
 
 When a legacy file is adapted to the universal model, `adapt_legacy_to_universal()` copies `ConfigRequirements` into `config_requirements` (`compliance_models.py`), so downstream code only ever reads one shape.
 
-### Constraint Schema
+### Constraint schema
 
 Each entry in the list is a single constraint with the following fields:
 
@@ -533,7 +533,7 @@ Each entry in the list is a single constraint with the following fields:
 `subset` / `superset` require both the applied value and `Value` to be lists; any other type is treated as not satisfied. For `eq` against a boolean, declare `Value` as a JSON boolean (`false`, not `0`) — the model keeps booleans distinct from integers.
 </Note>
 
-### How Guardrails Are Evaluated
+### How guardrails are evaluated
 
 All evaluation lives in one shared module, `prowler/lib/check/compliance_config_eval.py`, consumed by every compliance output (CSV, OCSF, and the CLI tables) and reused by the Prowler API backend so the rule is defined exactly once.
 
@@ -547,7 +547,7 @@ All evaluation lives in one shared module, `prowler/lib/check/compliance_config_
 Guardrails only ever make a result **stricter** (they can turn PASS into FAIL); they never relax a real FAIL into PASS. A requirement with no constraints, or whose keys all use defaults, is reported exactly as before.
 </Warning>
 
-### Example: Legacy Framework
+### Example: legacy framework
 
 From `prowler/compliance/aws/cis_6.0_aws.json`, requirement 2.11 declares two guardrails — one per configurable check it maps to:
 
@@ -590,7 +590,7 @@ A boolean guardrail from the same file: requirement 2.5 (IAM Access Analyzer) on
 ]
 ```
 
-### Example: Universal Framework
+### Example: universal framework
 
 The universal schema uses the lowercase `config_requirements` key with the identical object shape:
 
@@ -616,7 +616,7 @@ The universal schema uses the lowercase `config_requirements` key with the ident
 
 Each constraint declares the `Provider` it targets so the guardrail is only evaluated on scans of that provider — essential for universal frameworks like CSA CCM and DORA, where one requirement maps checks across `aws`, `azure`, `gcp` and more. Because the operator is `subset`, adding `"TLS 1.0"` to `recommended_minimal_tls_versions` widens the allowlist beyond `["TLS 1.2", "TLS 1.3"]` and the requirement is forced to FAIL.
 
-### What the User Sees
+### What the user sees
 
 With a loosened config, the affected requirement's findings report:
 
@@ -630,7 +630,7 @@ StatusExtended: Configuration not valid for this requirement. The check
 
 The same `Configuration not valid for this requirement.` message appears identically across the CSV, OCSF, and console-table outputs.
 
-### Authoring Guidelines
+### Authoring guidelines
 
 - Declare a guardrail only for keys whose value actually changes whether the requirement is met. Most configurable checks do not need one.
 - Set `Value` to the **strictest** configuration the control tolerates — the same number the control text cites (CIS 45 days, NIST ≤90, and so on).
@@ -639,7 +639,7 @@ The same `Configuration not valid for this requirement.` message appears identic
 - Pick the operator from the value's role: a max threshold is `lte`, a min threshold is `gte`, a toggle is `eq`, an allowlist is `subset`, a denylist is `superset`.
 - An unrecognized operator does **not** block the requirement — a malformed constraint is treated as satisfied rather than failing the whole framework. Validate your JSON with the tests below.
 
-### Testing Guardrails
+### Testing guardrails
 
 The shared evaluator and the per-output integration are covered by:
 
@@ -670,7 +670,7 @@ Prowler matches frameworks by concatenating `Framework` and `Version`. A missing
 
 Before opening a PR, validate the JSON loads cleanly against the model and that every referenced check actually exists.
 
-### 1. Schema Validation
+### 1. Schema validation
 
 For **universal** frameworks, load the file and inspect what was parsed. The framework key inside `bulk` is the **basename of the JSON file** (without `.json`); for `prowler/compliance/dora_2022_2554.json` that key is `dora_2022_2554`, for `prowler/compliance/aws/cis_5.0_aws.json` it is `cis_5.0_aws`.
 
@@ -688,7 +688,7 @@ bulk = get_bulk_compliance_frameworks_universal("aws")
 assert "<your_framework_filename_without_json>" in bulk
 ```
 
-### 2. Check Existence Cross-Check
+### 2. Check existence cross-check
 
 There is **no automatic check-existence validation** at load time. Cross-check that every check name in your framework maps to a real check directory:
 
@@ -708,7 +708,7 @@ missing = referenced - real
 assert not missing, f"checks referenced in framework but not found in repo: {sorted(missing)}"
 ```
 
-### 3. CLI Smoke Test
+### 3. CLI smoke test
 
 ```bash
 uv run python prowler-cli.py <provider> --list-compliance
@@ -728,7 +728,7 @@ Verify that:
 - The CLI summary table lists every section / pillar of the framework.
 - Findings roll up under the expected requirements.
 
-### 4. Inspect the CSV Output
+### 4. Inspect the CSV output
 
 Open the generated CSV and confirm:
 

docs/developer-guide/server-sent-events.mdx

@@ -12,7 +12,7 @@ This guide explains how to add a **Server-Sent Events (SSE)** endpoint to the Pr
 The platform ships the SSE **infrastructure** (`api.sse`) and wiring. No feature endpoint streams over SSE out of the box — this guide shows how to build one on top of the shared base.
 </Info>
 
-## When to Use SSE
+## When to use SSE
 
 | Need | Use |
 |------|-----|
@@ -22,7 +22,7 @@ The platform ships the SSE **infrastructure** (`api.sse`) and wiring. No feature
 
 SSE is the right tool when the **client only consumes**: scan progress, long-running job checkpoints, streamed LLM tokens, cross-client resource-sync notifications. It rides on plain HTTP, reconnects automatically in the browser via the native [`EventSource`](https://developer.mozilla.org/en-US/docs/Web/API/EventSource) API, and needs no extra protocol.
 
-## How It Works
+## How it works
 
 SSE is wired through [`django-eventstream`](https://github.com/fanout/django_eventstream) and a small platform layer in `api/src/backend/api/sse/`:
 
@@ -34,11 +34,11 @@ SSE is wired through [`django-eventstream`](https://github.com/fanout/django_eve
 | `make_channel_name` / `tenant_id_from_channel` | `api/sse/utils.py` | Single source of truth for the channel-name format, so publishers and the channel manager agree byte-for-byte. |
 | Settings | `config/settings/eventstream.py` | Valkey Pub/Sub backend (dedicated DB), channel manager, allowed headers. |
 
-### Transport: The Server Runs on ASGI
+### Transport: the server runs on ASGI
 
 SSE connections are long-lived. Holding one open per synchronous worker would exhaust the worker pool, so the API runs under Gunicorn's native **`asgi` worker** (`config.asgi:application`). Streams are parked on the event loop while ordinary CRUD endpoints keep their synchronous execution (Django runs sync views in a thread-sensitive executor under ASGI). This is configured in `config/guniconf.py` and used by both the dev and production entrypoints — no separate server process is needed.
 
-### The Data Flow
+### The data flow
 
 ```
 publisher (Celery task / view)             subscriber (browser, CLI)
@@ -53,7 +53,7 @@ publisher (Celery task / view)             subscriber (browser, CLI)
 
 A publisher anywhere in the system (most often a Celery task) calls `send_event(channel, event_type, payload)`. `django-eventstream` fans it out over Valkey Pub/Sub to every connection subscribed to that channel.
 
-## Adding an SSE Endpoint to Your Feature
+## Adding an SSE endpoint to your feature
 
 The example below streams progress for a long-running **scan**. Adapt the resource, prefix, and event names to your feature.
 
@@ -161,7 +161,7 @@ publish_end(channel, scan_id=str(scan.id))
 
 </Steps>
 
-## Event Naming Convention
+## Event naming convention
 
 Every event uses an event type of the form **`<resource>.<verb>`** (lowercased, dot-separated). The verb comes from this platform-wide vocabulary — if you need a verb that is not listed, document the addition in this guide so the catalog stays discoverable.
 
@@ -197,7 +197,7 @@ curl -N -H "Authorization: Bearer $JWT" \
   https://<host>/api/v1/scans/$SCAN_ID/event-stream
 ```
 
-## Tenant Isolation & Security Model
+## Tenant isolation & security model
 
 Authorization is enforced at two layers:
 
@@ -206,7 +206,7 @@ Authorization is enforced at two layers:
 
 Because the tenant id lives inside the channel name, this gate works for any feature without the platform knowing anything about it.
 
-## Reconnect & State Recovery
+## Reconnect & state recovery
 
 The platform deliberately ships **without server-side replay** (`is_channel_reliable` returns `False`). When a client reconnects, it does **not** receive missed events. Instead:
 
@@ -215,7 +215,7 @@ The platform deliberately ships **without server-side replay** (`is_channel_reli
 
 Design your event payloads accordingly: deltas are ephemeral and concatenated in-flight; the durable truth always lives behind a REST resource.
 
-## Local Development
+## Local development
 
 - The dev and production entrypoints both launch Gunicorn with the `asgi` worker (`config.asgi:application`). In dev, `DJANGO_DEBUG=True` enables hot reload; `preload_app` is automatically disabled under debug so edited code is picked up.
 - SSE uses a **dedicated Valkey database** (`EVENTSTREAM_VALKEY_DB`, default `2`) kept separate from the Celery broker so a noisy broker cannot crowd out streaming traffic. It reuses the same `VALKEY_*` connection settings as the rest of the platform.

docs/developer-guide/services.mdx

@@ -537,7 +537,7 @@ This architecture allows Prowler to efficiently scan AWS accounts with resources
 
 ## Best Practices
 
-- When available in the provider, use threading or parallelization utilities for all methods that can be parallelized to maximize performance and reduce scan time.
+- When available in the provider, use threading or parallelization utilities for all methods that can be parallelized by to maximize performance and reduce scan time.
 - Define a Pydantic `BaseModel` for every resource you manage, and use these models for all resource data handling.
 - Log every major step (start, success, error) in resource discovery and attribute collection for traceability and debugging; include as much context as possible.
 - Catch and log all exceptions, providing detailed context (region, subscription, resource, error type, line number) to aid troubleshooting.