fix(container): patch Pillow, certifi, uv, aiohttp and Trivy CVEs (#13110 )

Co-authored-by: Pedro Martín <pedromarting3@gmail.com>
fix(api): scope metadata endpoints to role provider groups (#13094 )
2026-11-02 17:34:35 +00:00 · 2026-10-21 17:00:23 +02:00 · 2026-10-20 08:05:35 +02:00 · 2026-10-16 10:42:39 +02:00 · 2026-10-16 10:04:41 +02:00 · 2026-10-15 13:27:30 +02:00
308 changed files with 13535 additions and 1466 deletions
@@ -174,7 +174,7 @@ SENTRY_RELEASE=local
 # REO_DEV_CLIENT_ID=

 #### Prowler release version ####
-NEXT_PUBLIC_PROWLER_RELEASE_VERSION=v5.44.0
+NEXT_PUBLIC_PROWLER_RELEASE_VERSION=v5.45.1

 # Social login credentials
 SOCIAL_GOOGLE_OAUTH_CALLBACK_URL="${AUTH_URL}/api/auth/callback/google"
@@ -19,10 +19,10 @@
 # AI
 /mcp_server/ @prowler-cloud/engineering

-# Platform
-/.github/ @prowler-cloud/platform
-/Makefile @prowler-cloud/platform
-/kubernetes/ @prowler-cloud/platform
-**/Dockerfile* @prowler-cloud/platform
-**/docker-compose*.yml @prowler-cloud/platform
-**/docker-compose*.yaml @prowler-cloud/platform
+# CI and infrastructure
+/.github/ @prowler-cloud/engineering
+/Makefile @prowler-cloud/engineering
+/kubernetes/ @prowler-cloud/engineering
+**/Dockerfile* @prowler-cloud/engineering
+**/docker-compose*.yml @prowler-cloud/engineering
+**/docker-compose*.yaml @prowler-cloud/engineering
@@ -38,13 +38,16 @@ jobs:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
-          # PRs only need the diff range; push to master/release walks the new range from event.before.
-          # 50 is enough headroom for the longest realistic PR/push chain without paying for a full clone.
-          fetch-depth: 50
+          # Full history: a shallow clone cuts the PR's ancestry, git can no longer exclude commits
+          # already on the base branch, and TruffleHog scans the cut-off commit as a root (the whole
+          # tree as added). PRs that merge master in hit this and fail on pre-existing content.
+          fetch-depth: 0
          persist-credentials: false

      - name: Scan diff for secrets with TruffleHog
        # Action auto-injects --since-commit/--branch from event payload; passing them in extra_args produces duplicate flags.
-        uses: trufflesecurity/trufflehog@37b77001d0174ebec2fcca2bd83ff83a6d45a3ab # v3.95.3
+        uses: trufflesecurity/trufflehog@e76dff8a7e57d6df0c60ad8cbf5d5cba505a8fc9 # v3.99.2
        with:
+          # The action runs the `latest` image unless told otherwise: pin the scanner to the action's release.
+          version: 3.99.2@sha256:47a84bc18a0d04a165498bbbd3bacfd84176661cbc91f8e0f85467f6a771e99a
          extra_args: --results=verified,unknown
@@ -84,6 +84,8 @@ jobs:
        fi

    - name: Checkout release branch
+      env:
+        GH_TOKEN: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }}
      run: |
        echo "Checking out branch $BRANCH_NAME for release $PROWLER_VERSION..."
        if git show-ref --verify --quiet "refs/heads/$BRANCH_NAME"; then
@@ -92,8 +94,32 @@ jobs:
        elif git show-ref --verify --quiet "refs/remotes/origin/$BRANCH_NAME"; then
          echo "Branch $BRANCH_NAME exists remotely, checking out..."
          git checkout -b "$BRANCH_NAME" "origin/$BRANCH_NAME"
+        elif [ "$PATCH_VERSION" -eq 0 ]; then
+          # Only cut the branch once the compiled changelogs are on master
+          MASTER_SHA=$(git rev-parse origin/master)
+          VERSION_REGEX="${PROWLER_VERSION//./\\.}"
+          FOUND_CHANGELOG=false
+          for changelog in prowler/CHANGELOG.md api/CHANGELOG.md ui/CHANGELOG.md mcp_server/CHANGELOG.md; do
+            if git show "origin/master:$changelog" 2>/dev/null | grep -qE "^## \[.*\(Prowler v?${VERSION_REGEX}\)"; then
+              FOUND_CHANGELOG=true
+              break
+            fi
+          done
+          if [ "$FOUND_CHANGELOG" != "true" ]; then
+            echo "ERROR: No changelog entry for Prowler $PROWLER_VERSION on master. Merge the compiled changelogs PR first."
+            exit 1
+          fi
+          # Check the SDK version on master before creating the remote branch
+          if ! git show "origin/master:pyproject.toml" | grep -qE "^version = \"${VERSION_REGEX}\"$" \
+            || ! git show "origin/master:prowler/config/config.py" | grep -qE "^prowler_version = \"${VERSION_REGEX}\"$"; then
+            echo "ERROR: pyproject.toml or prowler/config/config.py on master is not at version $PROWLER_VERSION. Fix master before creating $BRANCH_NAME."
+            exit 1
+          fi
+          echo "Branch $BRANCH_NAME does not exist, creating it from master ($MASTER_SHA)..."
+          gh api --method POST "repos/${GITHUB_REPOSITORY}/git/refs" -f ref="refs/heads/${BRANCH_NAME}" -f sha="${MASTER_SHA}"
+          git checkout -b "$BRANCH_NAME" "$MASTER_SHA"
        else
-          echo "ERROR: Branch $BRANCH_NAME does not exist. For minor releases (X.Y.0), create it manually first. For patch releases (X.Y.Z), the branch should already exist."
+          echo "ERROR: Branch $BRANCH_NAME does not exist. For patch releases (X.Y.Z), the branch should already exist."
          exit 1
        fi

@@ -390,4 +416,3 @@ jobs:
      if: always()
      run: |
        rm -f prowler_changelog.md api_changelog.md ui_changelog.md mcp_changelog.md combined_changelog.md
-
@@ -0,0 +1,27 @@
+name: 'Tools: Release Freeze Lift'
+
+run-name: 'Lift release freeze after Prowler ${{ github.event.release.tag_name }}'
+
+on:
+  release:
+    types:
+      - 'published'
+
+permissions: {}
+
+jobs:
+  release-freeze-lift:
+    if: github.repository == 'prowler-cloud/prowler' && !github.event.release.prerelease
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - name: Disable release freeze
+        env:
+          GH_TOKEN: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }}
+        run: |
+          gh variable set RELEASE_FREEZE --body false --repo "${GITHUB_REPOSITORY}"
@@ -76,7 +76,7 @@ jobs:

            ### Changes

-            This PR updates the `OCI_COMMERCIAL_REGIONS` dictionary in `prowler/providers/oraclecloud/config.py` with the latest regions fetched from the OCI Identity API (`list_regions()`).
+            This PR updates the `OCI_COMMERCIAL_REGIONS` dictionary in `prowler/providers/oraclecloud/config.py` and the matching list in `ui/lib/provider-credentials/oci-regions.ts` with the latest regions fetched from the OCI Identity API (`list_regions()`).

            - Government regions (`OCI_GOVERNMENT_REGIONS`) are preserved unchanged
            - DOD regions (`OCI_US_DOD_REGIONS`) are preserved unchanged
@@ -640,6 +640,30 @@ jobs:
          flags: prowler-py${{ matrix.python-version }}-e2enetworks
          files: ./e2enetworks_coverage.xml

+      # Huawei Cloud Provider
+      - name: Check if Huawei Cloud files changed
+        if: steps.check-changes.outputs.any_changed == 'true'
+        id: changed-huaweicloud
+        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
+        with:
+          files: |
+            ./prowler/**/huaweicloud/**
+            ./tests/**/huaweicloud/**
+            ./uv.lock
+
+      - name: Run Huawei Cloud tests
+        if: steps.changed-huaweicloud.outputs.any_changed == 'true'
+        run: uv run pytest -n auto --cov=./prowler/providers/huaweicloud --cov-report=xml:huaweicloud_coverage.xml tests/providers/huaweicloud
+
+      - name: Upload Huawei Cloud coverage to Codecov
+        if: steps.changed-huaweicloud.outputs.any_changed == 'true'
+        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        env:
+          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+        with:
+          flags: prowler-py${{ matrix.python-version }}-huaweicloud
+          files: ./huaweicloud_coverage.xml
+
      # External Provider (dynamic loading)
      - name: Check if External Provider files changed
        if: steps.check-changes.outputs.any_changed == 'true'
@@ -7,66 +7,19 @@

 ignore:

-  # Modules compiled into the Trivy binary we ship.
-  # Only a Trivy rebuild by its vendor can change these; the version is pinned in our Dockerfile.
-  # CVE-2026-71556 is the same temporary exception documented in .trivyignore.yaml:
-  # Trivy 0.73.0 still embeds go-git 5.19.1, while the 5.19.2 fix is merged only on
-  # Trivy main. Remove this entry with the Trivy exception by 2026-09-15.
-  # https://github.com/aquasecurity/trivy/blob/v0.73.0/go.mod#L46
-  # https://github.com/aquasecurity/trivy/commit/a2edba9a03987ba0d2ebc8212c1a9a1e6979497b
-  - vulnerability: CVE-2026-71556
-    package:
-      name: github.com/go-git/go-git/v5
-  # CVE-2026-84304 is the same temporary exception documented in .trivyignore.yaml:
-  # Trivy 0.74.0 still embeds grpc 1.82.1, while the 1.83.1 fix is not in any release.
-  # Prowler only runs `trivy image` / `trivy fs`, never client/server mode, so no gRPC
-  # endpoint exists in the image. Pinned to the embedded version so the rule stops
-  # matching on its own once Trivy bumps grpc. Remove with the Trivy exception by 2026-10-15.
-  # https://github.com/aquasecurity/trivy/pull/11176
-  - vulnerability: CVE-2026-84304
-    package:
-      name: google.golang.org/grpc
-      version: v1.82.1
-  # CVE-2026-84445 is the same temporary exception documented in .trivyignore.yaml:
-  # Trivy 0.74.0 still embeds grpc 1.82.1, while the 1.82.2 / 1.83.2 fix is not in any
-  # release. The panic needs a gRPC server built with `xds.NewGRPCServer()`; Prowler only
-  # runs `trivy image` / `trivy fs`, so the image serves no gRPC at all. Pinned to the
-  # embedded version so the rule stops matching on its own once Trivy bumps grpc. Remove
-  # with the Trivy exception by 2026-10-15.
-  # https://github.com/advisories/GHSA-2v4p-qf9q-27wj
-  - vulnerability: CVE-2026-84445
-    package:
-      name: google.golang.org/grpc
-      version: v1.82.1
-  # CVE-2026-56855 / CVE-2026-78662 are the same temporary exception documented in
-  # .trivyignore.yaml: Trivy 0.74.0 still embeds golang.org/x/crypto v0.55.0, while the
-  # 0.56.0 fix (published 2026-09-02) hasn't reached any Trivy release, or even Trivy
-  # main, yet. Pinned to the embedded version so the rule stops matching on its own once
-  # Trivy bumps it. Remove with the Trivy exception by 2026-10-15.
-  - vulnerability: CVE-2026-56855
-    package:
-      name: golang.org/x/crypto
-      version: v0.55.0
-  - vulnerability: CVE-2026-78662
-    package:
-      name: golang.org/x/crypto
-      version: v0.55.0
-  - vulnerability: CVE-2026-56852
-    package:
-      name: golang.org/x/text
-  - vulnerability: GHSA-hrxh-6v49-42gf
-    package:
-      name: google.golang.org/grpc
-  - vulnerability: CVE-2026-50151
-    package:
-      name: oras.land/oras-go/v2
-
  # Shipped inside the PowerShell tarball, in its bundled MicrosoftTeams module.
  # Not a dependency we declare, and not one we can upgrade independently.
  - vulnerability: CVE-2026-26127
    package:
      name: Microsoft.Bcl.Memory

+  # Documented in .trivyignore.yaml: ships inside ExchangeOnlineManagement
+  # 3.10.1, the latest gallery release. Re-check on the next EXO release.
+  - vulnerability: CVE-2026-84008
+    package:
+      name: System.Security.Cryptography.Pkcs
+      version: 10.0.0
+
  # The .NET runtime bundled inside the PowerShell tarball the Dockerfile pins.
  # CVE-2026-62901 is the same temporary exception documented in .trivyignore.yaml:
  # fixed in .NET 9.0.19 / 10.0.11 (2026-08-11), but no published PowerShell release
@@ -126,3 +79,18 @@ ignore:
  - vulnerability: CVE-2026-82049
    package:
      name: python
+
+  # zlib in the Alpine base images of the UI (node:24.18.1-alpine) and MCP
+  # (python:3.13.14-alpine3.23) containers. CVE-2026-85091 is a heap overflow in
+  # gz_vacate() reached only through non-blocking gzwrite() followed by gzprintf() after
+  # a write stall. Node links its own bundled zlib and the MCP server never writes gzip
+  # files, so neither image calls that path. TEMPORARY: the 1.3.2-r1 fix is in the
+  # Alpine index and could be taken with `apk add --upgrade`, but we wait for the base
+  # images to ship it instead (the newest node:24-alpine and python:3.13-alpine3.23 still
+  # carry 1.3.2-r0). Pinned to that version so the rule stops matching on its own once a
+  # base image moves forward. Remove when the base digests are bumped, by 2026-11-07.
+  # https://security.alpinelinux.org/vuln/CVE-2026-85091
+  - vulnerability: CVE-2026-85091
+    package:
+      name: zlib
+      version: 1.3.2-r0
@@ -68,11 +68,18 @@ vulnerabilities:
    expired_at: 2026-11-30

  # Declared in the SPDX manifest that ships inside PowerShell's MicrosoftTeams module
-  # (Modules/MicrosoftTeams/7.9.0/_manifest/spdx_2.2/manifest.spdx.json). Trivy reads that
+  # (Modules/MicrosoftTeams/8.0.0/_manifest/spdx_2.2/manifest.spdx.json). Trivy reads that
  # SBOM and reports what it declares, which is not the same as what the image contains:
  # there is no Node runtime and no node_modules anywhere in the image, and the .NET
  # assemblies target net472, a Windows-only framework. Nothing here is reachable, and none
  # of it is a dependency we declare -- only Microsoft can change the module's contents.
+# proxy-addr 2.0.7 (CVE-2026-90711) is one more such declaration: no file named proxy-addr
+# exists in the image, only its purl inside that manifest. The UI lock lists proxy-addr 2.0.7
+# through express, but the Next standalone output does not ship it, so the shared entry
+# hides nothing real in the UI image either (checked on prowlercloud/prowler-ui:latest).
+# @modelcontextprotocol/sdk 1.27.1 (CVE-2026-104850) is another: only its purl is in that
+# manifest. The entry is pinned to 1.27.1 because the UI really depends on the SDK (1.26.0
+# via @langchain/mcp-adapters), and a version-less purl would hide that finding too.
  - id: CVE-2020-0606
    purls:
      - "pkg:nuget/Microsoft.WindowsDesktop.App.Ref"
@@ -101,6 +108,23 @@ vulnerabilities:
    purls:
      - "pkg:nuget/System.Security.Cryptography.Xml"
    expired_at: 2027-01-31
+  # Same manifest, pinned to 8.0.4: PowerShell's own copy is also flagged by these CVEs.
+  - id: CVE-2026-96222
+    purls:
+      - "pkg:nuget/System.Security.Cryptography.Xml@8.0.4"
+    expired_at: 2027-01-31
+  - id: CVE-2026-96958
+    purls:
+      - "pkg:nuget/System.Security.Cryptography.Xml@8.0.4"
+    expired_at: 2027-01-31
+  - id: CVE-2026-96959
+    purls:
+      - "pkg:nuget/System.Security.Cryptography.Xml@8.0.4"
+    expired_at: 2027-01-31
+  - id: CVE-2026-96960
+    purls:
+      - "pkg:nuget/System.Security.Cryptography.Xml@8.0.4"
+    expired_at: 2027-01-31
  - id: CVE-2026-13676
    purls:
      - "pkg:npm/fast-uri"
@@ -129,80 +153,76 @@ vulnerabilities:
    purls:
      - "pkg:npm/fast-uri"
    expired_at: 2027-01-31
+  - id: CVE-2026-84292
+    purls:
+      - "pkg:npm/fast-uri"
+    expired_at: 2027-01-31
  - id: CVE-2026-69192
    purls:
      - "pkg:npm/ip-address"
    expired_at: 2027-01-31
+  - id: CVE-2026-101898
+    purls:
+      - "pkg:npm/axios"
+    expired_at: 2027-01-31
+  - id: CVE-2026-101901
+    purls:
+      - "pkg:npm/axios"
+    expired_at: 2027-01-31
+  - id: CVE-2026-101903
+    purls:
+      - "pkg:npm/axios"
+    expired_at: 2027-01-31
+  - id: CVE-2026-101905
+    purls:
+      - "pkg:npm/axios"
+    expired_at: 2027-01-31
+  - id: CVE-2026-101906
+    purls:
+      - "pkg:npm/axios"
+    expired_at: 2027-01-31
+  - id: CVE-2026-101907
+    purls:
+      - "pkg:npm/axios"
+    expired_at: 2027-01-31
+  - id: CVE-2026-101909
+    purls:
+      - "pkg:npm/axios"
+    expired_at: 2027-01-31
+  - id: CVE-2026-90711
+    purls:
+      - "pkg:npm/proxy-addr"
+    expired_at: 2027-01-31
+  - id: CVE-2026-104850
+    purls:
+      - "pkg:npm/%40modelcontextprotocol%2Fsdk@1.27.1"
+    expired_at: 2027-01-31
+  # Two more SDK declarations and follow-redirects 1.16.0 from the same manifest. The SDK
+  # entries stay pinned to 1.27.1 for the reason above. No lock in this repo lists
+  # follow-redirects, so its pin only keeps a future real dependency from being hidden.
+  - id: CVE-2026-111767
+    purls:
+      - "pkg:npm/%40modelcontextprotocol%2Fsdk@1.27.1"
+    expired_at: 2027-01-31
+  - id: CVE-2026-111768
+    purls:
+      - "pkg:npm/%40modelcontextprotocol%2Fsdk@1.27.1"
+    expired_at: 2027-01-31
+  - id: CVE-2026-111755
+    purls:
+      - "pkg:npm/follow-redirects@1.16.0"
+    expired_at: 2027-01-31
+  - id: CVE-2026-111756
+    purls:
+      - "pkg:npm/follow-redirects@1.16.0"
+    expired_at: 2027-01-31

-  # CVE-2026-84304 is a DoS in grpc-go <= 1.83.0: a peer fragments a gRPC stream into
-  # millions of tiny HTTP/2 DATA frames until the receiver runs out of heap. Fixed in
-  # 1.83.1 (published 2026-09-01). Trivy 0.74.0, the latest published release and the
-  # version the images ship, pins 1.82.1 as an indirect dependency:
-  # https://github.com/aquasecurity/trivy/blob/v0.74.0/go.mod
-  # Upstream bump still open: https://github.com/aquasecurity/trivy/pull/11176
-  # Trivy only speaks gRPC in client/server mode (`trivy server`, `--server`). Prowler
-  # invokes it exclusively as `trivy image` and `trivy fs` on a local path, so no gRPC
-  # listener or connection ever exists in the image and the affected path is not
-  # reachable. Remove this temporary suppression as soon as a Trivy release pins
-  # grpc >= 1.83.1.
-  - id: CVE-2026-84304
+  # Unlike the manifest entries above, this DLL ships in the image:
+  # ExchangeOnlineManagement/3.10.1/netCore/System.Security.Cryptography.Pkcs.dll. It is a
+  # DoS in CMS/PKCS parsing; Prowler only feeds it the tenant's own certificate. 3.10.1 is
+  # the latest gallery release, so only Microsoft can update it. Re-check on the next EXO
+  # release.
+  - id: CVE-2026-84008
    purls:
-      - "pkg:golang/google.golang.org/grpc"
-    expired_at: 2026-10-15
-
-  # CVE-2026-84445 is a DoS in grpc-go servers built with `xds.NewGRPCServer()`: a request
-  # carrying neither `:authority` nor `Host` reaches the xDS routing interceptor, which
-  # indexes an empty slice of authorities and panics. The per-RPC goroutine does not
-  # recover, so the whole server process dies. Fixed in 1.82.2 and 1.83.2 (published
-  # 2026-09-08). Trivy 0.74.0, the latest published release and the version the images
-  # ship, pins 1.82.1 as an indirect dependency:
-  # https://github.com/aquasecurity/trivy/blob/v0.74.0/go.mod
-  # Trivy main already carries 1.83.2, but no published release includes it yet.
-  # The reachability argument is the one made for CVE-2026-84304 above, only narrower:
-  # this panic needs an xDS-managed gRPC server. Prowler invokes Trivy exclusively as
-  # `trivy image` and `trivy fs` on a local path, never `trivy server`, so the image runs
-  # no gRPC server at all, xDS or otherwise. Remove this temporary suppression as soon as
-  # a Trivy release pins grpc >= 1.83.2.
-  # https://github.com/advisories/GHSA-2v4p-qf9q-27wj
-  - id: CVE-2026-84445
-    purls:
-      - "pkg:golang/google.golang.org/grpc@v1.82.1"
-    expired_at: 2026-10-15
-
-  # CVE-2026-56855 and CVE-2026-78662 are DoS deadlocks in x/crypto/ssh: a malicious peer
-  # can flood or misuse channel messages (RFC 4254) to block the whole connection.
-  # Fixed in golang.org/x/crypto v0.56.0 (published 2026-09-02). Trivy 0.74.0, the latest
-  # published release and the version the images ship, still pins v0.55.0, and Trivy main
-  # has not bumped it either:
-  # https://github.com/aquasecurity/trivy/blob/v0.74.0/go.mod
-  # x/crypto/ssh is pulled in transitively through go-git's ssh transport, the same
-  # dependency chain as the CVE-2026-71556 entry above. Prowler invokes Trivy only with
-  # `fs` on an existing local path or with `image`; it never asks Trivy to clone over SSH
-  # or to run `trivy server`, so no SSH connection -- as client or server -- ever exists in
-  # the image and the affected code path is not reachable. Remove this temporary
-  # suppression as soon as a fixed Trivy release is available.
-  - id: CVE-2026-56855
-    purls:
-      - "pkg:golang/golang.org/x/crypto@v0.55.0"
-    expired_at: 2026-10-15
-  - id: CVE-2026-78662
-    purls:
-      - "pkg:golang/golang.org/x/crypto@v0.55.0"
-    expired_at: 2026-10-15
-
-  - id: CVE-2026-56852
-    purls:
-      - "pkg:golang/golang.org/x/text"
-    expired_at: 2026-12-31
-  - id: GHSA-hrxh-6v49-42gf
-    purls:
-      - "pkg:golang/google.golang.org/grpc"
-    expired_at: 2026-12-31
-  - id: CVE-2026-50151
-    purls:
-      - "pkg:golang/oras.land/oras-go/v2"
-    expired_at: 2026-12-31
-  - id: CVE-2026-50163
-    purls:
-      - "pkg:golang/oras.land/oras-go/v2"
-    expired_at: 2026-12-31
+      - "pkg:nuget/System.Security.Cryptography.Pkcs@10.0.0"
+    expired_at: 2026-12-15
@@ -1,24 +1,24 @@
-FROM python:3.12.13-slim-trixie@sha256:57cd7c3a7a273101a6485ba99423ee568157882804b1124b4dd04266317710de AS build
+FROM python:3.12.15-slim-trixie@sha256:05cda9777409a9c3ffddd94a4c476b79f0769a0b4857f0c7ed9226b6800b0d6f AS build

 LABEL maintainer="https://github.com/prowler-cloud/prowler"
 LABEL org.opencontainers.image.source="https://github.com/prowler-cloud/prowler"

-ARG POWERSHELL_VERSION=7.5.11
+ARG POWERSHELL_VERSION=7.5.12
 ENV POWERSHELL_VERSION=${POWERSHELL_VERSION}
 # Opt out of PowerShell telemetry (Application Insights -> dc.services.visualstudio.com)
 ENV POWERSHELL_TELEMETRY_OPTOUT=1

-ARG TRIVY_VERSION=0.74.0
+ARG TRIVY_VERSION=0.76.1
 ENV TRIVY_VERSION=${TRIVY_VERSION}

 ARG ZIZMOR_VERSION=1.24.1
 ENV ZIZMOR_VERSION=${ZIZMOR_VERSION}

 # Pinned here, not fetched with the artefact: a compromised release ships its own checksum.
-ARG TRIVY_SHA256_AMD64=2ae6fe3ee734b7fdf11335663e18c75ea12dccc76062f09f164a3b0f8be4371a
-ARG TRIVY_SHA256_ARM64=b94ce1976bbf3c15b514b605ee88be7c6d94a29be2302847ff01cb794d47aad5
-ARG POWERSHELL_SHA256_AMD64=82a8b13d92b0f3ae48e56cf2f3f7961679371736ca90145ca71617c2913ba9d8
-ARG POWERSHELL_SHA256_ARM64=830ebda118c731ece3fa7e6b7e8573a21346387cbbca5b2f5e3b9bfe24f96672
+ARG TRIVY_SHA256_AMD64=c7cbe3137fb8a48a17574bede3dd6beb16742d1e9772929940fc90082c39d9c0
+ARG TRIVY_SHA256_ARM64=e174dff2a6dba5e3ae41f8d0537a6324405bd08132497340304c6b20e0f16a1f
+ARG POWERSHELL_SHA256_AMD64=db85ae1f45005ffd20e456890585167257151fa99406ccd7ab344f7cf3a766fd
+ARG POWERSHELL_SHA256_ARM64=29eb382cd510e4bd246902650ff6cf9f3b56f959d1bd0be75e0a1e425177c831
 ARG ZIZMOR_SHA256_AMD64=a8000f3c683319a523d3b20df0e75457ba591f049cfcbfa98966631b56733c03
 ARG ZIZMOR_SHA256_ARM64=d66e37ef8a375fb07939c630ebf9709a6e0f20242bdc3faf672a7ed97e0b768d

@@ -121,7 +121,7 @@ ENV HOME='/home/prowler'
 ENV PATH="${HOME}/.local/bin:${PATH}"
 #hadolint ignore=DL3013
 RUN pip install --no-cache-dir --upgrade pip && \
-    pip install --no-cache-dir uv==0.12.0
+    pip install --no-cache-dir uv==0.13.4

 RUN uv sync --locked --compile-bytecode && \
    rm -rf ~/.cache/uv
@@ -4,6 +4,55 @@ All notable changes to the **Prowler API** are documented in this file.

 <!-- changelog: release notes start -->

+## [1.46.0] (Prowler v5.45.0)
+
+### 🐞 Fixed
+
+- OCI provider secrets keep the region as home region for credential validation and scans, instead of always using us-ashburn-1 [(#12865)](https://github.com/prowler-cloud/prowler/pull/12865)
+- Gunicorn workers are now recycled after 10000 requests (plus up to 1000 of jitter) to cap memory growth, configurable with `GUNICORN_MAX_REQUESTS` and `GUNICORN_MAX_REQUESTS_JITTER` [(#13047)](https://github.com/prowler-cloud/prowler/pull/13047)
+
+### 🔐 Security
+
+- `pyjwt` from 2.13.0 to 2.14.0, patching GHSA-ffc3-869f-jxw9 [(#12911)](https://github.com/prowler-cloud/prowler/pull/12911)
+- Sentry error events no longer include user identity, IP addresses, cookies, headers or request bodies, which could contain personal data or provider credentials [(#12912)](https://github.com/prowler-cloud/prowler/pull/12912)
+- Kubernetes kubeconfig validation accepts only inline credentials and known cluster fields, rejecting file-path fields (`tokenFile`, `client-certificate`, `client-key`, `certificate-authority`), command-based authentication (`exec`, `cmd-path`), `auth-provider` directives, proxy URLs and unknown user or cluster keys; stored kubeconfigs are re-validated before each scan and connection test [(#12952)](https://github.com/prowler-cloud/prowler/pull/12952)
+- `django` from 5.1.15 to 5.2.17, patching CVE-2026-15307 [(#12953)](https://github.com/prowler-cloud/prowler/pull/12953)
+- `dulwich` from 1.2.5 to 1.2.9, patching GHSA-5fqc-mrg8-w798, GHSA-8mcx-5rqc-vhmf, GHSA-8w8g-wq8h-fq33 and GHSA-cm62-gvxx-vmxx [(#12953)](https://github.com/prowler-cloud/prowler/pull/12953)
+- `urllib3` from 2.7.0 to 2.8.0, patching CVE-2026-97687 and CVE-2026-97689 [(#12953)](https://github.com/prowler-cloud/prowler/pull/12953)
+- `pymongo` from 4.15.1 to 4.18.2, patching CVE-2026-96748 and CVE-2026-96749 [(#12955)](https://github.com/prowler-cloud/prowler/pull/12955)
+- `GET /api/v1/users/{id}` no longer exposes another user's memberships, roles or tenant names from tenants other than the one in the request token [(#12965)](https://github.com/prowler-cloud/prowler/pull/12965)
+- Python base image from 3.12.13 to 3.12.15 and Trivy from 0.74.0 to 0.75.0 in the API container image, patching CVE-2026-19445, CVE-2026-19553 and the grpc-go and x/crypto CVEs bundled in Trivy [(#13009)](https://github.com/prowler-cloud/prowler/pull/13009)
+- PowerShell from 7.5.11 to 7.5.12 in the API container image, bundling .NET runtime 9.0.21 [(#13037)](https://github.com/prowler-cloud/prowler/pull/13037)
+
+---
+
+## [1.45.0] (Prowler v5.44.0)
+
+### 🚀 Added
+
+- Scan output uploads and downloads can now target S3-compatible object storage such as MinIO directly via `DJANGO_OUTPUT_S3_AWS_ENDPOINT_URL`, instead of relying on process-wide AWS environment variables that also hijacked unrelated AWS API calls [(#12871)](https://github.com/prowler-cloud/prowler/pull/12871)
+
+### 🔄 Changed
+
+- Unify how every endpoint resolves a provider latest completed scan, so overlapping scans no longer make findings, compliance and mute rules read from different scans [(#12858)](https://github.com/prowler-cloud/prowler/pull/12858)
+
+### 🐞 Fixed
+
+- Celery loggers are now declared explicitly in `custom_logging.py` so fatal worker errors are no longer silenced by `disable_existing_loggers=True`. All long-running services in `docker-compose.yml` now have `restart: unless-stopped` so containers recover automatically after unexpected crashes. [(#12465)](https://github.com/prowler-cloud/prowler/pull/12465)
+- Scan report downloads from an S3 bucket with default SSE-KMS encryption no longer fail with an `InvalidArgument` error: when `DJANGO_OUTPUT_S3_AWS_DEFAULT_REGION` is set, presigned download URLs are signed with AWS Signature Version 4 for that region [(#12746)](https://github.com/prowler-cloud/prowler/pull/12746)
+- Adds a periodic sweep that drops orphaned Attack Paths temp Neo4j scan databases left behind when a worker or Neo4j crashes mid-scan, before they accumulate unbounded [(#12832)](https://github.com/prowler-cloud/prowler/pull/12832)
+- Providers whose most recent completed scan has no `completed_at` timestamp are no longer missing from every endpoint that reports a provider's latest scan, which now falls back to scan creation order instead of skipping the provider [(#12858)](https://github.com/prowler-cloud/prowler/pull/12858)
+- Resources no longer keep a stale failed findings count forever when a scoped or imported scan for the same provider completes after a full scan, which used to make the full scan skip its own cleanup [(#12858)](https://github.com/prowler-cloud/prowler/pull/12858)
+- `POST /api/v1/scans` again returns the new scan id in the response `task_args`, which had been empty since the scan broker publish moved to transaction commit [(#12878)](https://github.com/prowler-cloud/prowler/pull/12878)
+- API key authentication no longer locks the key row on every request and now throttles `last_used_at` updates to once per 60 seconds, preventing a hot key from serializing all its requests onto a single locked row [(#12882)](https://github.com/prowler-cloud/prowler/pull/12882)
+- Provider deletion no longer fails when the provider has Attack Paths scans recorded on a sink that is no longer configured, such as Neptune after moving back to Neo4j [(#12894)](https://github.com/prowler-cloud/prowler/pull/12894)
+
+### 🔐 Security
+
+- `DELETE /api/v1/tasks/{id}` requires the permission of the operation that queued the task and rejects provider deletions, and `GET /api/v1/tasks` hides tasks of providers outside the visibility of the role [(#12893)](https://github.com/prowler-cloud/prowler/pull/12893)
+
+---
+
 ## [1.44.0] (Prowler v5.43.0)

 ### 🐞 Fixed
@@ -1,23 +1,23 @@
-FROM python:3.12.13-slim-trixie@sha256:57cd7c3a7a273101a6485ba99423ee568157882804b1124b4dd04266317710de AS build
+FROM python:3.12.15-slim-trixie@sha256:05cda9777409a9c3ffddd94a4c476b79f0769a0b4857f0c7ed9226b6800b0d6f AS build

 LABEL maintainer="https://github.com/prowler-cloud/api"

-ARG POWERSHELL_VERSION=7.5.11
+ARG POWERSHELL_VERSION=7.5.12
 ENV POWERSHELL_VERSION=${POWERSHELL_VERSION}
 # Opt out of PowerShell telemetry (Application Insights -> dc.services.visualstudio.com)
 ENV POWERSHELL_TELEMETRY_OPTOUT=1

-ARG TRIVY_VERSION=0.74.0
+ARG TRIVY_VERSION=0.76.1
 ENV TRIVY_VERSION=${TRIVY_VERSION}

 ARG ZIZMOR_VERSION=1.24.1
 ENV ZIZMOR_VERSION=${ZIZMOR_VERSION}

 # Pinned here, not fetched with the artefact: a compromised release ships its own checksum.
-ARG TRIVY_SHA256_AMD64=2ae6fe3ee734b7fdf11335663e18c75ea12dccc76062f09f164a3b0f8be4371a
-ARG TRIVY_SHA256_ARM64=b94ce1976bbf3c15b514b605ee88be7c6d94a29be2302847ff01cb794d47aad5
-ARG POWERSHELL_SHA256_AMD64=82a8b13d92b0f3ae48e56cf2f3f7961679371736ca90145ca71617c2913ba9d8
-ARG POWERSHELL_SHA256_ARM64=830ebda118c731ece3fa7e6b7e8573a21346387cbbca5b2f5e3b9bfe24f96672
+ARG TRIVY_SHA256_AMD64=c7cbe3137fb8a48a17574bede3dd6beb16742d1e9772929940fc90082c39d9c0
+ARG TRIVY_SHA256_ARM64=e174dff2a6dba5e3ae41f8d0537a6324405bd08132497340304c6b20e0f16a1f
+ARG POWERSHELL_SHA256_AMD64=db85ae1f45005ffd20e456890585167257151fa99406ccd7ab344f7cf3a766fd
+ARG POWERSHELL_SHA256_ARM64=29eb382cd510e4bd246902650ff6cf9f3b56f959d1bd0be75e0a1e425177c831
 ARG ZIZMOR_SHA256_AMD64=a8000f3c683319a523d3b20df0e75457ba591f049cfcbfa98966631b56733c03
 ARG ZIZMOR_SHA256_ARM64=d66e37ef8a375fb07939c630ebf9709a6e0f20242bdc3faf672a7ed97e0b768d

@@ -125,7 +125,7 @@ RUN mkdir -p /tmp/prowler_api_output
 COPY --chown=prowler:prowler pyproject.toml uv.lock ./

 RUN pip install --no-cache-dir --upgrade pip && \
-    pip install --no-cache-dir uv==0.12.0
+    pip install --no-cache-dir uv==0.13.4

 ENV PATH="/home/prowler/.local/bin:$PATH"

@@ -0,0 +1 @@
+Pillow from 12.3.0 to 13.0.0, certifi to 2026.10.19, aiohttp to 3.14.5 with yarl 1.25.1, uv to 0.13.4 and Trivy to 0.76.1 in the API container image, patching the Pillow JPEG decoder heap overflow, the compromised emSign root CAs bundled in certifi and uv, the aiohttp resource exhaustion advisories and the Go 1.27.2 stdlib CVE in the Trivy binary
@@ -0,0 +1 @@
+Trivy from 0.75.0 to 0.76.0 in the API container image, built with Go 1.27.2 and x/net 0.60.0, patching the HTTP/2 and TLS CVEs bundled in Trivy 0.75.0
@@ -1 +0,0 @@
-API key authentication no longer locks the key row on every request and now throttles `last_used_at` updates to once per 60 seconds, preventing a hot key from serializing all its requests onto a single locked row
@@ -1 +0,0 @@
-Adds a periodic sweep that drops orphaned Attack Paths temp Neo4j scan databases left behind when a worker or Neo4j crashes mid-scan, before they accumulate unbounded
@@ -1 +0,0 @@
-Resources no longer keep a stale failed findings count forever when a scoped or imported scan for the same provider completes after a full scan, which used to make the full scan skip its own cleanup
@@ -1 +0,0 @@
-Providers whose most recent completed scan has no `completed_at` timestamp are no longer missing from every endpoint that reports a provider's latest scan, which now falls back to scan creation order instead of skipping the provider
@@ -1 +0,0 @@
-Unify how every endpoint resolves a provider latest completed scan, so overlapping scans no longer make findings, compliance and mute rules read from different scans
@@ -0,0 +1 @@
+`GET /resources/metadata`, `GET /resources/metadata/latest`, `GET /findings/metadata` and `GET /findings/metadata/latest` now honour the provider groups of the caller role instead of aggregating every provider in the tenant
@@ -0,0 +1 @@
+Compliance report PDF cover table wraps every value, so long account IDs such as OCI tenancy OCIDs no longer overflow their cell
@@ -1 +0,0 @@
-Provider deletion no longer fails when the provider has Attack Paths scans recorded on a sink that is no longer configured, such as Neptune after moving back to Neo4j
@@ -1 +0,0 @@
-Scan output uploads and downloads can now target S3-compatible object storage such as MinIO directly via `DJANGO_OUTPUT_S3_AWS_ENDPOINT_URL`, instead of relying on process-wide AWS environment variables that also hijacked unrelated AWS API calls
@@ -1 +0,0 @@
-Scan report downloads from an S3 bucket with default SSE-KMS encryption no longer fail with an `InvalidArgument` error: when `DJANGO_OUTPUT_S3_AWS_DEFAULT_REGION` is set, presigned download URLs are signed with AWS Signature Version 4 for that region
@@ -1 +0,0 @@
-`POST /api/v1/scans` again returns the new scan id in the response `task_args`, which had been empty since the scan broker publish moved to transaction commit
@@ -1 +0,0 @@
-`DELETE /api/v1/tasks/{id}` requires the permission of the operation that queued the task and rejects provider deletions, and `GET /api/v1/tasks` hides tasks of providers outside the visibility of the role
@@ -1 +0,0 @@
-Celery loggers are now declared explicitly in `custom_logging.py` so fatal worker errors are no longer silenced by `disable_existing_loggers=True`. All long-running services in `docker-compose.yml` now have `restart: unless-stopped` so containers recover automatically after unexpected crashes.
@@ -25,7 +25,7 @@ authors = [{name = "Prowler Engineering", email = "engineering@prowler.com"}]
 dependencies = [
  "celery (==5.6.2)",
  "dj-rest-auth[with_social,jwt] (==7.0.1)",
-  "django (==5.1.15)",
+  "django (==5.2.17)",
  "django-allauth[saml] (==65.15.0)",
  "django-celery-beat (==2.9.0)",
  "django-celery-results (==2.6.0)",
@@ -45,7 +45,7 @@ dependencies = [
  "gunicorn==26.0.0",
  "uvloop==0.22.1",
  "lxml==6.1.0",
-  "prowler @ git+https://github.com/prowler-cloud/prowler.git@master",
+  "prowler @ git+https://github.com/prowler-cloud/prowler.git@v5.45",
  "psycopg2-binary==2.9.9",
  "pytest-celery[redis] (==1.3.0)",
  "sentry-sdk[django] (==2.56.0)",
@@ -71,7 +71,7 @@ name = "prowler-api"
 package-mode = false
 # Needed for the SDK compatibility
 requires-python = ">=3.11,<3.13"
-version = "1.45.0"
+version = "1.46.1"

 # Shared ruff baseline (kept in sync with mcp_server/pyproject.toml).
 # target-version tracks this project's lowest supported Python.
@@ -100,7 +100,7 @@ constraint-dependencies = [
  "aiobotocore==2.25.1",
  "aiofiles==24.1.0",
  "aiohappyeyeballs==2.6.1",
-  "aiohttp==3.14.3",
+  "aiohttp==3.14.5",
  "aioitertools==0.13.0",
  "aiosignal==1.4.0",
  "alibabacloud-actiontrail20200706==2.4.1",
@@ -196,7 +196,7 @@ constraint-dependencies = [
  "botocore==1.40.61",
  "cartography==0.138.1",
  "celery==5.6.2",
-  "certifi==2026.1.4",
+  "certifi==2026.10.19",
  "cffi==2.0.0",
  "charset-normalizer==3.4.4",
  "circuitbreaker==2.1.3",
@@ -222,7 +222,7 @@ constraint-dependencies = [
  "dill==0.4.1",
  "distro==1.9.0",
  "dj-rest-auth==7.0.1",
-  "django==5.1.15",
+  "django==5.2.17",
  "django-allauth==65.15.0",
  "django-celery-beat==2.9.0",
  "django-celery-results==2.6.0",
@@ -246,7 +246,7 @@ constraint-dependencies = [
  "drf-simple-apikey==2.2.1",
  "drf-spectacular==0.27.2",
  "drf-spectacular-jsonapi==0.5.1",
-  "dulwich==1.2.5",
+  "dulwich==1.2.9",
  "duo-client==5.5.0",
  "durationpy==0.10",
  "email-validator==2.2.0",
@@ -350,7 +350,7 @@ constraint-dependencies = [
  "pagerduty==6.1.0",
  "pandas==2.2.3",
  "pbr==7.0.3",
-  "pillow==12.3.0",
+  "pillow==13.0.0",
  "pkginfo==1.12.1.2",
  "platformdirs==4.5.1",
  "plotly==6.5.2",
@@ -375,7 +375,7 @@ constraint-dependencies = [
  "pydantic-core==2.41.5",
  "pygithub==2.8.0",
  "pygments==2.20.0",
-  "pyjwt==2.13.0",
+  "pyjwt==2.14.0",
  "pylint==3.2.5",
  "pymsalruntime==0.18.1",
  "pynacl==1.6.2",
@@ -439,7 +439,7 @@ constraint-dependencies = [
  "tzdata==2025.3",
  "tzlocal==5.3.1",
  "uritemplate==4.2.0",
-  "urllib3==2.7.0",
+  "urllib3==2.8.0",
  "uuid6==2024.7.10",
  "uvicorn==0.49.0",
  "uvloop==0.22.1",
@@ -453,7 +453,7 @@ constraint-dependencies = [
  "xlsxwriter==3.2.9",
  "xmlsec==1.3.17",
  "xmltodict==1.0.2",
-  "yarl==1.22.0",
+  "yarl==1.25.1",
  "zipp==3.23.0",
  "zope-event==6.1",
  "zope-interface==8.2",
@@ -475,15 +475,17 @@ constraint-dependencies = [
 # a constraint cannot satisfy against the SDK's hard pins, so override the whole set
 # to 1.9.10 until the SDK bump propagates to the pinned master rev.
 #
-# prowler@master hard-pins dulwich==0.23.0 and pyjwt==2.12.1 in [project.dependencies].
-# dulwich 1.2.5 patches GHSA-897w-fcg9-f6xj (arbitrary file write) and pyjwt 2.13.0
-# patches PYSEC-2026-179 (HMAC/JWK key-confusion); a constraint cannot satisfy these
-# against the SDK's hard pins, so override them to the patched versions until the SDK
-# bump propagates to the pinned master rev. pyjwt keeps the [crypto] extra because an
+# The API installs prowler from a pinned master git rev whose dulwich and pyjwt pins trail
+# the root pyproject.toml. dulwich 1.2.9 patches GHSA-5fqc-mrg8-w798, GHSA-8mcx-5rqc-vhmf,
+# GHSA-8w8g-wq8h-fq33 and GHSA-cm62-gvxx-vmxx, and pyjwt 2.14.0 patches GHSA-ffc3-869f-jxw9,
+# so override both until that rev is refreshed. pyjwt keeps the [crypto] extra because an
 # override replaces the whole requirement; bare pyjwt would drop it from the consumers
 # that request pyjwt[crypto] and leave cryptography (needed for RS256) only transitive.
 override-dependencies = [
  "okta==3.4.2",
+  # huaweicloudsdkcore (via prowler) pins pymongo==4.15.1 exactly; CVE-2026-96748 and
+  # CVE-2026-96749 are fixed in 4.18.2. Only bson types are used, so the override is safe.
+  "pymongo==4.18.2",
  # prowler requires cryptography==50.0.0. Two api-only dependencies still cap it below
  # 49 and cannot move yet: msal, pinned exactly by azure-cli-core (2.83.0 -> 1.35.0b1,
  # 2.89.1 -> 1.36.0, both <49; cartography needs azure-cli-core), and workos 8.3.0
@@ -499,6 +501,6 @@ override-dependencies = [
  "microsoft-kiota-serialization-json==1.9.10",
  "microsoft-kiota-serialization-multipart==1.9.10",
  "microsoft-kiota-serialization-text==1.9.10",
-  "dulwich==1.2.5",
-  "pyjwt[crypto]==2.13.0"
+  "dulwich==1.2.9",
+  "pyjwt[crypto]==2.14.0"
 ]
@@ -1,7 +1,7 @@
 openapi: 3.0.3
 info:
  title: Prowler API
-  version: 1.45.0
+  version: 1.46.1
  description: |-
    Prowler API specification.

@@ -30,6 +30,21 @@ def test_initialize_sentry_uses_configured_dsn():
    assert mock_init.call_args.kwargs["before_send"] is sentry_settings.before_send


+def test_initialize_sentry_sends_no_personal_data():
+    with (
+        patch.object(
+            sentry_settings.env,
+            "str",
+            return_value="https://fake-public-key@sentry.example.invalid/1",
+        ),
+        patch.object(sentry_settings.sentry_sdk, "init") as mock_init,
+    ):
+        sentry_settings.initialize_sentry()
+
+    assert mock_init.call_args.kwargs["send_default_pii"] is False
+    assert mock_init.call_args.kwargs["max_request_body_size"] == "never"
+
+
 def _make_log_record(msg, level=logging.ERROR, name="test", args=None):
    """Build a real LogRecord so getMessage() works like in production."""
    record = logging.LogRecord(
@@ -5,6 +5,8 @@ from api.v1.serializer_utils.integrations import (
 )
 from api.v1.serializer_utils.providers import ProviderSecretField
 from api.v1.serializers import (
+    KUBERNETES_KUBECONFIG_INVALID_ERROR,
+    KUBERNETES_KUBECONFIG_NON_INLINE_CREDENTIALS_ERROR,
    ImageProviderSecret,
    IntegrationSerializer,
    IntegrationUpdateSerializer,
@@ -215,36 +217,34 @@ class TestOracleCloudProviderSecret:
        assert serializer.is_valid(), serializer.errors
        assert "region" not in serializer.validated_data

-    def test_accepts_and_ignores_region_field(self):
-        secret = self.valid_secret(region="us-phoenix-1")
-        serializer = OracleCloudProviderSecret(data=secret)
-
-        assert serializer.is_valid(), serializer.errors
-
-        assert "region" not in serializer.validated_data
-
-    @pytest.mark.parametrize(
-        "legacy_field, legacy_value",
-        [
-            ("region", None),
-            ("region", ""),
-            ("region", {"name": "us-ashburn-1"}),
-        ],
-    )
-    def test_accepts_and_ignores_any_legacy_region_value(
-        self, legacy_field, legacy_value
-    ):
+    def test_keeps_region_as_home_region(self):
        serializer = OracleCloudProviderSecret(
-            data=self.valid_secret(**{legacy_field: legacy_value})
+            data=self.valid_secret(region=" me-abudhabi-1 ")
        )

        assert serializer.is_valid(), serializer.errors
+        assert serializer.validated_data["region"] == "me-abudhabi-1"

-        assert legacy_field not in serializer.validated_data
+    def test_rejects_unknown_region(self):
+        serializer = OracleCloudProviderSecret(
+            data=self.valid_secret(region="mars-north-1")
+        )
+
+        assert not serializer.is_valid()
+        assert "region" in serializer.errors
+
+    @pytest.mark.parametrize("legacy_value", [None, "", {"name": "us-ashburn-1"}])
+    def test_drops_blank_or_non_string_region(self, legacy_value):
+        serializer = OracleCloudProviderSecret(
+            data=self.valid_secret(region=legacy_value)
+        )
+
+        assert serializer.is_valid(), serializer.errors
+        assert "region" not in serializer.validated_data


 class TestProviderSecretFieldSchema:
-    def test_oraclecloud_schema_includes_legacy_region_field(self):
+    def test_oraclecloud_schema_region_is_not_deprecated(self):
        schema = ProviderSecretField._spectacular_annotation["field"]
        oraclecloud_schema = next(
            credential_schema
@@ -253,7 +253,7 @@ class TestProviderSecretFieldSchema:
            == "Oracle Cloud Infrastructure (OCI) API Key Credentials"
        )

-        assert oraclecloud_schema["properties"]["region"]["deprecated"] is True
+        assert "deprecated" not in oraclecloud_schema["properties"]["region"]


 class TestKubernetesProviderSecret:
@@ -342,6 +342,278 @@ current-context: test-context
        assert not serializer.is_valid()
        assert "kubeconfig_content" in serializer.errors

+    @staticmethod
+    def _kubeconfig(user_extra="", cluster_extra=""):
+        return f"""
+apiVersion: v1
+kind: Config
+clusters:
+  - name: test-cluster
+    cluster:
+      server: https://kubernetes.example.test
+{cluster_extra}
+users:
+  - name: test-user
+    user:
+      token: test-token
+{user_extra}
+contexts:
+  - name: test-context
+    context:
+      cluster: test-cluster
+      user: test-user
+current-context: test-context
+"""
+
+    @staticmethod
+    def _assert_rejected_without_echo(
+        kubeconfig_content, leaked_value, expected_message
+    ):
+        serializer = KubernetesProviderSecret(
+            data={"kubeconfig_content": kubeconfig_content}
+        )
+
+        assert serializer.is_valid() is False
+        assert serializer.errors["kubeconfig_content"] == [expected_message]
+        assert leaked_value not in str(serializer.errors)
+
+    def test_inline_token_with_certificate_authority_data_is_accepted(self):
+        kubeconfig_content = self._kubeconfig(
+            cluster_extra="      certificate-authority-data: dGVzdA=="
+        )
+
+        serializer = KubernetesProviderSecret(
+            data={"kubeconfig_content": kubeconfig_content}
+        )
+
+        assert serializer.is_valid()
+
+    def test_kubeconfig_with_token_file_is_rejected(self):
+        self._assert_rejected_without_echo(
+            self._kubeconfig(user_extra="      tokenFile: /etc/passwd"),
+            "/etc/passwd",
+            KUBERNETES_KUBECONFIG_NON_INLINE_CREDENTIALS_ERROR,
+        )
+
+    def test_kubeconfig_with_client_certificate_file_is_rejected(self):
+        self._assert_rejected_without_echo(
+            self._kubeconfig(user_extra="      client-certificate: /etc/passwd"),
+            "/etc/passwd",
+            KUBERNETES_KUBECONFIG_NON_INLINE_CREDENTIALS_ERROR,
+        )
+
+    def test_kubeconfig_with_client_key_file_is_rejected(self):
+        self._assert_rejected_without_echo(
+            self._kubeconfig(user_extra="      client-key: /etc/passwd"),
+            "/etc/passwd",
+            KUBERNETES_KUBECONFIG_NON_INLINE_CREDENTIALS_ERROR,
+        )
+
+    def test_kubeconfig_with_certificate_authority_file_is_rejected(self):
+        self._assert_rejected_without_echo(
+            self._kubeconfig(cluster_extra="      certificate-authority: /etc/passwd"),
+            "/etc/passwd",
+            KUBERNETES_KUBECONFIG_NON_INLINE_CREDENTIALS_ERROR,
+        )
+
+    def test_kubeconfig_with_cluster_proxy_url_is_rejected(self):
+        self._assert_rejected_without_echo(
+            self._kubeconfig(cluster_extra="      proxy-url: http://proxy.evil.test"),
+            "proxy.evil.test",
+            KUBERNETES_KUBECONFIG_NON_INLINE_CREDENTIALS_ERROR,
+        )
+
+    @pytest.mark.parametrize("provider_name", ["gcp", "oidc", "azure"])
+    def test_kubeconfig_with_any_auth_provider_is_rejected(self, provider_name):
+        self._assert_rejected_without_echo(
+            self._kubeconfig(
+                user_extra=(
+                    "      auth-provider:\n"
+                    f"        name: {provider_name}\n"
+                    "        config:\n"
+                    "          idp-issuer-url: https://idp.evil.test"
+                )
+            ),
+            "idp.evil.test",
+            KUBERNETES_KUBECONFIG_NON_INLINE_CREDENTIALS_ERROR,
+        )
+
+    def test_kubeconfig_with_unknown_user_key_is_rejected(self):
+        self._assert_rejected_without_echo(
+            self._kubeconfig(user_extra="      bogus: /etc/passwd"),
+            "/etc/passwd",
+            KUBERNETES_KUBECONFIG_NON_INLINE_CREDENTIALS_ERROR,
+        )
+
+    def test_kubeconfig_with_unknown_cluster_key_is_rejected(self):
+        self._assert_rejected_without_echo(
+            self._kubeconfig(cluster_extra="      bogus: /etc/passwd"),
+            "/etc/passwd",
+            KUBERNETES_KUBECONFIG_NON_INLINE_CREDENTIALS_ERROR,
+        )
+
+    def test_kubeconfig_with_allowlisted_cluster_keys_is_accepted(self):
+        serializer = KubernetesProviderSecret(
+            data={
+                "kubeconfig_content": self._kubeconfig(
+                    cluster_extra=(
+                        "      certificate-authority-data: dGVzdA==\n"
+                        "      insecure-skip-tls-verify: false\n"
+                        "      tls-server-name: kubernetes.example.test\n"
+                        "      disable-compression: true\n"
+                        "      extensions: []"
+                    )
+                )
+            }
+        )
+
+        assert serializer.is_valid(), serializer.errors
+
+    def test_kubeconfig_with_non_list_clusters_is_rejected(self):
+        kubeconfig_content = """
+apiVersion: v1
+kind: Config
+clusters:
+  name: /etc/passwd
+"""
+        self._assert_rejected_without_echo(
+            kubeconfig_content, "/etc/passwd", KUBERNETES_KUBECONFIG_INVALID_ERROR
+        )
+
+    def test_kubeconfig_with_non_dict_cluster_entry_is_rejected(self):
+        kubeconfig_content = """
+apiVersion: v1
+kind: Config
+clusters:
+  - /etc/passwd
+"""
+        self._assert_rejected_without_echo(
+            kubeconfig_content, "/etc/passwd", KUBERNETES_KUBECONFIG_INVALID_ERROR
+        )
+
+    def test_kubeconfig_with_non_dict_cluster_value_is_rejected(self):
+        kubeconfig_content = """
+apiVersion: v1
+kind: Config
+clusters:
+  - name: test-cluster
+    cluster: /etc/passwd
+"""
+        self._assert_rejected_without_echo(
+            kubeconfig_content, "/etc/passwd", KUBERNETES_KUBECONFIG_INVALID_ERROR
+        )
+
+    @pytest.mark.parametrize(
+        "user_extra",
+        [
+            "      token: test-token",
+            "      username: test-user\n      password: test-password",
+            "      client-certificate-data: dGVzdA==\n      client-key-data: dGVzdA==",
+            "      token: test-token\n      as: other-user",
+            "      token: test-token\n      as-uid: 1234",
+            "      token: test-token\n      as-groups:\n        - group-a",
+            "      token: test-token\n      as-user-extra:\n        scopes:\n          - read",
+        ],
+        ids=[
+            "token",
+            "username-password",
+            "client-cert-data",
+            "as",
+            "as-uid",
+            "as-groups",
+            "as-user-extra",
+        ],
+    )
+    def test_kubeconfig_with_allowlisted_user_keys_is_accepted(self, user_extra):
+        kubeconfig_content = f"""
+apiVersion: v1
+kind: Config
+clusters:
+  - name: test-cluster
+    cluster:
+      server: https://kubernetes.example.test
+      certificate-authority-data: dGVzdA==
+users:
+  - name: test-user
+    user:
+{user_extra}
+contexts:
+  - name: test-context
+    context:
+      cluster: test-cluster
+      user: test-user
+current-context: test-context
+"""
+
+        serializer = KubernetesProviderSecret(
+            data={"kubeconfig_content": kubeconfig_content}
+        )
+
+        assert serializer.is_valid()
+
+    @pytest.mark.parametrize(
+        "kubeconfig_content",
+        [
+            """
+apiVersion: v1
+kind: Config
+clusters:
+  - name: test-cluster
+    cluster:
+      server: https://kubernetes.example.test
+users:
+  - name: good-user
+    user:
+      token: test-token
+  - name: bad-user
+    user:
+      tokenFile: /etc/passwd
+""",
+            """
+apiVersion: v1
+kind: Config
+clusters:
+  - name: good-cluster
+    cluster:
+      server: https://kubernetes.example.test
+  - name: bad-cluster
+    cluster:
+      server: https://kubernetes.example.test
+      certificate-authority: /etc/passwd
+users:
+  - name: test-user
+    user:
+      token: test-token
+""",
+        ],
+        ids=["second-user", "second-cluster"],
+    )
+    def test_kubeconfig_with_bad_second_entry_is_rejected(self, kubeconfig_content):
+        self._assert_rejected_without_echo(
+            kubeconfig_content,
+            "/etc/passwd",
+            KUBERNETES_KUBECONFIG_NON_INLINE_CREDENTIALS_ERROR,
+        )
+
+    def test_kubeconfig_with_indented_document_is_rejected(self):
+        kubeconfig_content = (
+            "  wrapper:\n"
+            "  users:\n"
+            "  - name: u\n"
+            "    user:\n"
+            "      tokenFile: /etc/passwd\n"
+            "  clusters:\n"
+            "  - name: c\n"
+            "    cluster:\n"
+            "      server: https://example.test\n"
+        )
+
+        self._assert_rejected_without_echo(
+            kubeconfig_content,
+            "/etc/passwd",
+            KUBERNETES_KUBECONFIG_NON_INLINE_CREDENTIALS_ERROR,
+        )
+
    def test_malformed_kubeconfig_is_rejected(self):
        serializer = KubernetesProviderSecret(
            data={"kubeconfig_content": "apiVersion: ["}
@@ -14,6 +14,7 @@ from api.utils import (
    return_prowler_provider,
    validate_invitation,
 )
+from api.v1.serializers import KUBERNETES_KUBECONFIG_NON_INLINE_CREDENTIALS_ERROR
 from prowler.providers.alibabacloud.alibabacloud_provider import AlibabacloudProvider
 from prowler.providers.aws.aws_provider import AwsProvider
 from prowler.providers.aws.lib.security_hub.security_hub import SecurityHubConnection
@@ -35,6 +36,34 @@ from prowler.providers.oraclecloud.oraclecloud_provider import OraclecloudProvid
 from prowler.providers.vercel.vercel_provider import VercelProvider
 from rest_framework.exceptions import NotFound, ValidationError

+VALID_KUBECONFIG = """\
+apiVersion: v1
+kind: Config
+clusters:
+- name: test-cluster
+  cluster:
+    server: https://example.invalid:6443
+    certificate-authority-data: Y2E=
+users:
+- name: test-user
+  user:
+    token: test-token
+contexts:
+- name: test-context
+  context:
+    cluster: test-cluster
+    user: test-user
+current-context: test-context
+"""
+
+TOKEN_FILE_KUBECONFIG = VALID_KUBECONFIG.replace(
+    "token: test-token", "tokenFile: /etc/passwd"
+)
+
+EXEC_KUBECONFIG = VALID_KUBECONFIG.replace(
+    "token: test-token", "exec:\n      command: test-command"
+)
+

 class TestMergeDicts:
    def test_simple_merge(self):
@@ -172,7 +201,7 @@ class TestInitializeProwlerProvider:
        )

    @patch("api.utils.return_prowler_provider")
-    def test_initialize_oraclecloud_provider_removes_region_string(
+    def test_initialize_oraclecloud_provider_passes_region_as_home_region(
        self, mock_return_prowler_provider
    ):
        provider = MagicMock()
@@ -182,7 +211,7 @@ class TestInitializeProwlerProvider:
            "fingerprint": "00:11:22:33:44:55:66:77",
            "key_content": "fake-base64-key-content",
            "tenancy": "ocid1.tenancy.oc1..fake",
-            "region": "us-ashburn-1",
+            "region": "me-abudhabi-1",
        }
        mock_return_prowler_provider.return_value = MagicMock()

@@ -193,6 +222,7 @@ class TestInitializeProwlerProvider:
            fingerprint="00:11:22:33:44:55:66:77",
            key_content="fake-base64-key-content",
            tenancy="ocid1.tenancy.oc1..fake",
+            home_region="me-abudhabi-1",
        )

    @patch("api.utils.return_prowler_provider")
@@ -254,15 +284,73 @@ class TestProwlerProviderConnectionTest:
            fingerprint="00:11:22:33:44:55:66:77",
            key_content="fake-base64-key-content",
            tenancy="ocid1.tenancy.oc1..aaaaaaaexample",
-            region=getattr(
-                OraclecloudProvider,
-                "_bootstrap_region",
-                OraclecloudProvider._home_region,
-            ),
+            region=OraclecloudProvider._bootstrap_region,
            provider_id="ocid1.tenancy.oc1..aaaaaaaexample",
            raise_on_exception=False,
        )

+    @patch("api.utils.return_prowler_provider")
+    def test_oraclecloud_connection_test_uses_stored_region_for_identity(
+        self, mock_return_prowler_provider
+    ):
+        provider = MagicMock()
+        provider.uid = "ocid1.tenancy.oc1..aaaaaaaexample"
+        provider.provider = Provider.ProviderChoices.ORACLECLOUD.value
+        provider.secret.secret = {
+            "user": "ocid1.user.oc1..aaaaaaaexample",
+            "fingerprint": "00:11:22:33:44:55:66:77",
+            "key_content": "fake-base64-key-content",
+            "tenancy": "ocid1.tenancy.oc1..aaaaaaaexample",
+            "region": "me-abudhabi-1",
+        }
+        mock_return_prowler_provider.return_value = MagicMock()
+
+        prowler_provider_connection_test(provider)
+
+        mock_return_prowler_provider.return_value.test_connection.assert_called_once_with(
+            user="ocid1.user.oc1..aaaaaaaexample",
+            fingerprint="00:11:22:33:44:55:66:77",
+            key_content="fake-base64-key-content",
+            tenancy="ocid1.tenancy.oc1..aaaaaaaexample",
+            region="me-abudhabi-1",
+            provider_id="ocid1.tenancy.oc1..aaaaaaaexample",
+            raise_on_exception=False,
+        )
+
+    @patch("api.utils.return_prowler_provider")
+    def test_kubernetes_connection_test_rejects_invalid_kubeconfig(
+        self, mock_return_prowler_provider
+    ):
+        provider = MagicMock()
+        provider.provider = Provider.ProviderChoices.KUBERNETES.value
+        provider.uid = "provider_uid"
+        provider.secret.secret = {"kubeconfig_content": TOKEN_FILE_KUBECONFIG}
+
+        connection = prowler_provider_connection_test(provider)
+
+        assert connection.is_connected is False
+        assert (
+            str(connection.error) == KUBERNETES_KUBECONFIG_NON_INLINE_CREDENTIALS_ERROR
+        )
+        mock_return_prowler_provider.return_value.test_connection.assert_not_called()
+
+    @patch("api.utils.return_prowler_provider")
+    def test_kubernetes_connection_test_with_valid_kubeconfig(
+        self, mock_return_prowler_provider
+    ):
+        provider = MagicMock()
+        provider.provider = Provider.ProviderChoices.KUBERNETES.value
+        provider.uid = "provider_uid"
+        provider.secret.secret = {"kubeconfig_content": VALID_KUBECONFIG}
+
+        prowler_provider_connection_test(provider)
+
+        mock_return_prowler_provider.return_value.test_connection.assert_called_once_with(
+            kubeconfig_content=VALID_KUBECONFIG,
+            provider_id="provider_uid",
+            raise_on_exception=False,
+        )
+
    @pytest.mark.django_db
    @patch("api.utils.return_prowler_provider")
    def test_prowler_provider_connection_test_without_secret(
@@ -380,10 +468,6 @@ class TestGetProwlerProviderKwargs:
                Provider.ProviderChoices.GOOGLEWORKSPACE.value,
                {},
            ),
-            (
-                Provider.ProviderChoices.KUBERNETES.value,
-                {"context": "provider_uid"},
-            ),
            (
                Provider.ProviderChoices.M365.value,
                {},
@@ -434,7 +518,40 @@ class TestGetProwlerProviderKwargs:
        expected_result = {**secret_dict, **expected_extra_kwargs}
        assert result == expected_result

-    def test_get_prowler_provider_kwargs_oraclecloud_removes_region(
+    def test_get_prowler_provider_kwargs_kubernetes_valid_kubeconfig(self):
+        provider = MagicMock()
+        provider.provider = Provider.ProviderChoices.KUBERNETES.value
+        provider.uid = "provider_uid"
+        provider.secret.secret = {"kubeconfig_content": VALID_KUBECONFIG}
+
+        assert get_prowler_provider_kwargs(provider) == {
+            "kubeconfig_content": VALID_KUBECONFIG,
+            "context": "provider_uid",
+        }
+
+    @pytest.mark.parametrize(
+        "secret",
+        [
+            {"kubeconfig_content": TOKEN_FILE_KUBECONFIG},
+            {"kubeconfig_content": EXEC_KUBECONFIG},
+            {"kubeconfig_content": "[]"},
+            {"key": "value"},
+        ],
+    )
+    def test_get_prowler_provider_kwargs_kubernetes_rejects_invalid_kubeconfig(
+        self, secret
+    ):
+        provider = MagicMock()
+        provider.provider = Provider.ProviderChoices.KUBERNETES.value
+        provider.uid = "provider_uid"
+        provider.secret.secret = secret
+
+        with pytest.raises(ValidationError) as exc_info:
+            get_prowler_provider_kwargs(provider)
+
+        assert "/etc/passwd" not in str(exc_info.value)
+
+    def test_get_prowler_provider_kwargs_oraclecloud_maps_region_to_home_region(
        self,
    ):
        secret_dict = {
@@ -461,6 +578,7 @@ class TestGetProwlerProviderKwargs:
            "key_content": "-----BEGIN PRIVATE KEY-----\nfake\n-----END PRIVATE KEY-----",
            "tenancy": "ocid1.tenancy.oc1..fake",
            "pass_phrase": "fake-passphrase",
+            "home_region": "us-ashburn-1",
        }

    def test_get_prowler_provider_kwargs_with_mutelist(self):
@@ -63,6 +63,7 @@ from api.models import (
 from api.rbac.permissions import TASK_REVOKE_PERMISSIONS
 from api.rls import Tenant
 from api.uuid_utils import datetime_to_uuid7
+from api.v1.serializers import MembershipIncludeSerializer
 from api.v1.views import (
    ComplianceOverviewViewSet,
    CustomSAMLLoginView,
@@ -97,6 +98,11 @@ from rest_framework_simplejwt.token_blacklist.models import (
    OutstandingToken,
 )
 from rest_framework_simplejwt.tokens import RefreshToken
+from tasks.jobs.backfill import (
+    aggregate_scan_category_summaries,
+    aggregate_scan_resource_group_summaries,
+    backfill_resource_scan_summaries,
+)


 class TestViewSet:
@@ -133,6 +139,145 @@ class TestUserViewSet:
        assert response.status_code == status.HTTP_200_OK
        assert response.json()["data"]["attributes"]["email"] == create_test_user.email

+    @staticmethod
+    def _shared_user_in_two_tenants(tenant_a, tenant_b):
+        shared_user = User.objects.create_user(
+            name="shared_user",
+            email=f"shared-user-{uuid4()}@prowler.com",
+            password="TmpPass123@",
+        )
+        Membership.objects.create(user=shared_user, tenant=tenant_a)
+        Membership.objects.create(user=shared_user, tenant=tenant_b)
+        role_a = Role.objects.create(name="role-a", tenant=tenant_a)
+        role_b = Role.objects.create(name="role-b", tenant=tenant_b)
+        UserRoleRelationship.objects.create(
+            user=shared_user, role=role_a, tenant=tenant_a
+        )
+        UserRoleRelationship.objects.create(
+            user=shared_user, role=role_b, tenant=tenant_b
+        )
+        return shared_user, role_a, role_b
+
+    @staticmethod
+    def _user_in_two_tenants_with_unique_roles(tenant_a, tenant_b):
+        suffix = uuid4()
+        user = User.objects.create_user(
+            name="scaled_user",
+            email=f"scaled-user-{suffix}@prowler.com",
+            password="TmpPass123@",
+        )
+        for tenant in (tenant_a, tenant_b):
+            Membership.objects.create(user=user, tenant=tenant)
+            role = Role.objects.create(name=f"role-{tenant.id}-{suffix}", tenant=tenant)
+            UserRoleRelationship.objects.create(user=user, role=role, tenant=tenant)
+        return user
+
+    def test_users_list_query_count_does_not_grow_with_user_count(
+        self, authenticated_client, tenants_fixture
+    ):
+        tenant_a, tenant_b, _ = tenants_fixture
+        self._user_in_two_tenants_with_unique_roles(tenant_a, tenant_b)
+        params = {"include": "memberships,roles"}
+
+        with CaptureQueriesContext(connection) as baseline:
+            response = authenticated_client.get(reverse("user-list"), params)
+        assert response.status_code == status.HTTP_200_OK
+        baseline_users = len(response.json()["data"])
+
+        for _ in range(3):
+            self._user_in_two_tenants_with_unique_roles(tenant_a, tenant_b)
+
+        with CaptureQueriesContext(connection) as scaled:
+            response = authenticated_client.get(reverse("user-list"), params)
+        assert response.status_code == status.HTTP_200_OK
+        assert len(response.json()["data"]) > baseline_users
+
+        assert len(scaled.captured_queries) == len(baseline.captured_queries), (
+            "Tenant-scoped relations are re-querying per user: "
+            f"{len(baseline.captured_queries)} queries for {baseline_users} users "
+            f"vs {len(scaled.captured_queries)} for "
+            f"{len(response.json()['data'])}. The prefetch is being discarded."
+        )
+
+    def test_users_retrieve_scopes_relations_to_active_tenant(
+        self, authenticated_client, tenants_fixture
+    ):
+        tenant_a, tenant_b, _ = tenants_fixture
+        shared_user, role_a, role_b = self._shared_user_in_two_tenants(
+            tenant_a, tenant_b
+        )
+
+        response = authenticated_client.get(
+            reverse("user-detail", kwargs={"pk": shared_user.id}),
+            {"include": "memberships,roles,memberships.tenant"},
+        )
+
+        assert response.status_code == status.HTTP_200_OK
+        payload = response.json()
+        relationships = payload["data"]["relationships"]
+        assert len(relationships["memberships"]["data"]) == 1
+        assert [item["id"] for item in relationships["roles"]["data"]] == [
+            str(role_a.id)
+        ]
+
+        included = payload["included"]
+        included_memberships = [i for i in included if i["type"] == "memberships"]
+        assert len(included_memberships) == 1
+        assert included_memberships[0]["relationships"]["tenant"]["data"]["id"] == str(
+            tenant_a.id
+        )
+        assert {i["id"] for i in included if i["type"] == "roles"} == {str(role_a.id)}
+        assert {
+            i["attributes"]["name"] for i in included if i["type"] == "tenants"
+        } == {tenant_a.name}
+        body = response.content.decode()
+        assert tenant_b.name not in body
+        assert str(tenant_b.id) not in body
+        assert str(role_b.id) not in body
+
+    def test_users_me_keeps_own_memberships_and_scopes_roles(
+        self, authenticated_client, create_test_user, tenants_fixture
+    ):
+        tenant_a, tenant_b, _ = tenants_fixture
+
+        response = authenticated_client.get(
+            reverse("user-me"), {"include": "memberships,roles,memberships.tenant"}
+        )
+
+        assert response.status_code == status.HTTP_200_OK
+        payload = response.json()
+        relationships = payload["data"]["relationships"]
+        assert len(relationships["memberships"]["data"]) == 2
+        assert {
+            i["attributes"]["name"]
+            for i in payload["included"]
+            if i["type"] == "tenants"
+        } == {tenant_a.name, tenant_b.name}
+        active_roles = create_test_user.roles.filter(tenant_id=tenant_a.id)
+        assert {i["id"] for i in relationships["roles"]["data"]} == {
+            str(role.id) for role in active_roles
+        }
+
+    def test_membership_include_serializer_hides_tenant_of_non_member(
+        self, create_test_user, tenants_fixture
+    ):
+        tenant_a, _, isolated_tenant = tenants_fixture
+        outsider = User.objects.create_user(
+            name="outsider",
+            email=f"outsider-{uuid4()}@prowler.com",
+            password="TmpPass123@",
+        )
+        foreign_membership = Membership.objects.create(
+            user=outsider, tenant=isolated_tenant
+        )
+        own_membership = Membership.objects.get(user=create_test_user, tenant=tenant_a)
+        request = SimpleNamespace(user=create_test_user, tenant_id=str(tenant_a.id))
+
+        serializer = MembershipIncludeSerializer(context={"request": request})
+
+        assert serializer.get_tenant(own_membership) == tenant_a
+        assert serializer.get_tenant(foreign_membership) is None
+
    def test_users_create(self, client):
        valid_user_payload = {
            "name": "test",
@@ -3363,7 +3508,7 @@ current-context: test-context
        provider_secret = ProviderSecret.objects.get()
        assert "region" not in provider_secret.secret

-    def test_provider_secrets_create_oraclecloud_accepts_and_ignores_region(
+    def test_provider_secrets_create_oraclecloud_stores_region(
        self,
        authenticated_client,
        oraclecloud_provider,
@@ -3372,14 +3517,14 @@ current-context: test-context
            authenticated_client,
            oraclecloud_provider,
            self._oraclecloud_secret(
-                key_content="  test-key-content  ", region=" us-ashburn-1 "
+                key_content="  test-key-content  ", region=" me-abudhabi-1 "
            ),
        )

        assert response.status_code == status.HTTP_201_CREATED
        provider_secret = ProviderSecret.objects.get()
        assert provider_secret.secret["key_content"] == "test-key-content"
-        assert "region" not in provider_secret.secret
+        assert provider_secret.secret["region"] == "me-abudhabi-1"

    def test_provider_secrets_update_oraclecloud_without_region_stores_no_region(
        self,
@@ -3412,7 +3557,7 @@ current-context: test-context
        provider_secret.refresh_from_db()
        assert "region" not in provider_secret.secret

-    def test_provider_secrets_update_oraclecloud_accepts_and_ignores_region(
+    def test_provider_secrets_update_oraclecloud_stores_region(
        self,
        authenticated_client,
        oraclecloud_provider,
@@ -3430,7 +3575,7 @@ current-context: test-context
                "type": "provider-secrets",
                "id": str(provider_secret.id),
                "attributes": {
-                    "secret": self._oraclecloud_secret(region=" us-ashburn-1 ")
+                    "secret": self._oraclecloud_secret(region=" me-abudhabi-1 ")
                },
            }
        }
@@ -3443,7 +3588,7 @@ current-context: test-context

        assert response.status_code == status.HTTP_200_OK
        provider_secret.refresh_from_db()
-        assert "region" not in provider_secret.secret
+        assert provider_secret.secret["region"] == "me-abudhabi-1"

    @pytest.mark.parametrize(
        "attributes, error_code, error_pointer",
@@ -6949,6 +7094,99 @@ class TestAttackPathsScanViewSet:
        assert response.status_code == status.HTTP_400_BAD_REQUEST


+def _client_restricted_to_provider(tenant, provider, factory):
+    """Authenticated client for a fresh member whose role only sees `provider`."""
+    user = User.objects.create_user(
+        name=f"restricted-{uuid4()}",
+        email=f"restricted-{uuid4()}@prowler.com",
+        password=TEST_PASSWORD,
+    )
+    Membership.objects.create(
+        user=user, tenant=tenant, role=Membership.RoleChoices.MEMBER
+    )
+    role = Role.objects.create(
+        name=f"restricted-{uuid4()}",
+        tenant_id=tenant.id,
+        manage_users=False,
+        manage_account=False,
+        manage_billing=False,
+        manage_providers=False,
+        manage_integrations=False,
+        manage_scans=False,
+        unlimited_visibility=False,
+    )
+    UserRoleRelationship.objects.create(user=user, role=role, tenant_id=tenant.id)
+    provider_group = ProviderGroup.objects.create(
+        name=f"restricted-{uuid4()}", tenant_id=tenant.id
+    )
+    ProviderGroupMembership.objects.create(
+        tenant_id=tenant.id, provider_group=provider_group, provider=provider
+    )
+    RoleProviderGroupRelationship.objects.create(
+        tenant_id=tenant.id, role=role, provider_group=provider_group
+    )
+    return factory(user, tenant)
+
+
+def _completed_scan_with_summaries(
+    tenant, provider, resources, *, categories, resource_group
+):
+    """Completed scan for `provider` with one finding over `resources`, summary tables filled."""
+    tenant_id = str(tenant.id)
+    scan = Scan.objects.create(
+        name=f"scan-{uuid4()}",
+        provider=provider,
+        trigger=Scan.TriggerChoices.MANUAL,
+        state=StateChoices.COMPLETED,
+        tenant_id=tenant_id,
+    )
+    finding = Finding.objects.create(
+        tenant_id=tenant_id,
+        uid=f"finding-{uuid4()}",
+        scan=scan,
+        delta="new",
+        status=Status.FAIL,
+        status_extended="test status",
+        impact=Severity.critical,
+        impact_extended="test impact",
+        severity=Severity.critical,
+        raw_result={"status": Status.FAIL},
+        check_id="scoped_check",
+        check_metadata={"CheckId": "scoped_check"},
+        categories=categories,
+        resource_groups=resource_group,
+        first_seen_at="2024-01-02T00:00:00Z",
+    )
+    finding.add_resources(resources)
+    backfill_resource_scan_summaries(tenant_id, str(scan.id))
+    aggregate_scan_category_summaries(tenant_id, str(scan.id))
+    aggregate_scan_resource_group_summaries(tenant_id, str(scan.id))
+    return scan
+
+
+@pytest.fixture
+def scans_per_provider_fixture(tenants_fixture, aws_provider_pair, resources_fixture):
+    """One completed scan per provider; provider 2 only owns the `test` typed resource."""
+    tenant = tenants_fixture[0]
+    provider1, provider2 = aws_provider_pair
+    resource1, resource2, resource3 = resources_fixture
+    _completed_scan_with_summaries(
+        tenant,
+        provider1,
+        [resource1, resource2],
+        categories=["iam"],
+        resource_group="identity",
+    )
+    _completed_scan_with_summaries(
+        tenant,
+        provider2,
+        [resource3],
+        categories=["data-protection"],
+        resource_group="data",
+    )
+    return tenant, provider2
+
+
@pytest.mark.django_db
 class TestResourceViewSet:
    def test_resources_list_none(self, authenticated_client):
@@ -7320,6 +7558,42 @@ class TestResourceViewSet:
        assert attributes["types"] == [latest_scan_resource.type]
        assert "groups" in attributes

+    def test_resources_metadata_restricted_to_provider_group(
+        self, authenticated_client_for_tenant_factory, scans_per_provider_fixture
+    ):
+        tenant, provider2 = scans_per_provider_fixture
+        client = _client_restricted_to_provider(
+            tenant, provider2, authenticated_client_for_tenant_factory
+        )
+
+        response = client.get(
+            reverse("resource-metadata"), {"filter[updated_at]": TODAY}
+        )
+
+        assert response.status_code == status.HTTP_200_OK
+        attributes = response.json()["data"]["attributes"]
+        assert set(attributes["services"]) == {"ec2"}
+        assert set(attributes["regions"]) == {"us-east-1"}
+        assert set(attributes["types"]) == {"test"}
+        assert set(attributes["groups"]) == {"compute"}
+
+    def test_resources_metadata_latest_restricted_to_provider_group(
+        self, authenticated_client_for_tenant_factory, scans_per_provider_fixture
+    ):
+        tenant, provider2 = scans_per_provider_fixture
+        client = _client_restricted_to_provider(
+            tenant, provider2, authenticated_client_for_tenant_factory
+        )
+
+        response = client.get(reverse("resource-metadata_latest"))
+
+        assert response.status_code == status.HTTP_200_OK
+        attributes = response.json()["data"]["attributes"]
+        assert set(attributes["services"]) == {"ec2"}
+        assert set(attributes["regions"]) == {"us-east-1"}
+        assert set(attributes["types"]) == {"test"}
+        assert set(attributes["groups"]) == {"compute"}
+
    def test_resources_latest_filter_by_provider_id(
        self, authenticated_client, latest_scan_resource
    ):
@@ -8952,6 +9226,53 @@ class TestFindingViewSet:
        assert "groups" in attributes
        assert "ai_ml" in attributes["groups"]

+    @patch("api.v1.views.backfill_scan_resource_summaries_task.apply_async")
+    def test_findings_metadata_restricted_to_provider_group(
+        self,
+        mock_backfill,
+        authenticated_client_for_tenant_factory,
+        scans_per_provider_fixture,
+    ):
+        tenant, provider2 = scans_per_provider_fixture
+        client = _client_restricted_to_provider(
+            tenant, provider2, authenticated_client_for_tenant_factory
+        )
+
+        response = client.get(
+            reverse("finding-metadata"), {"filter[inserted_at]": TODAY}
+        )
+
+        assert response.status_code == status.HTTP_200_OK
+        mock_backfill.assert_not_called()
+        attributes = response.json()["data"]["attributes"]
+        assert set(attributes["services"]) == {"ec2"}
+        assert set(attributes["regions"]) == {"us-east-1"}
+        assert set(attributes["resource_types"]) == {"test"}
+        assert set(attributes["categories"]) == {"data-protection"}
+
+    @patch("api.v1.views.backfill_scan_resource_summaries_task.apply_async")
+    def test_findings_metadata_latest_restricted_to_provider_group(
+        self,
+        mock_backfill,
+        authenticated_client_for_tenant_factory,
+        scans_per_provider_fixture,
+    ):
+        tenant, provider2 = scans_per_provider_fixture
+        client = _client_restricted_to_provider(
+            tenant, provider2, authenticated_client_for_tenant_factory
+        )
+
+        response = client.get(reverse("finding-metadata_latest"))
+
+        assert response.status_code == status.HTTP_200_OK
+        mock_backfill.assert_not_called()
+        attributes = response.json()["data"]["attributes"]
+        assert set(attributes["services"]) == {"ec2"}
+        assert set(attributes["regions"]) == {"us-east-1"}
+        assert set(attributes["resource_types"]) == {"test"}
+        assert set(attributes["categories"]) == {"data-protection"}
+        assert set(attributes["groups"]) == {"data"}
+
    def test_findings_filter_by_category(
        self, authenticated_client, findings_with_categories
    ):
@@ -17,7 +17,7 @@ from api.models import (
    Role,
    UserRoleRelationship,
 )
-from api.v1.serializers import FindingMetadataSerializer
+from api.v1.serializers import FindingMetadataSerializer, KubernetesProviderSecret
 from django.contrib.postgres.aggregates import ArrayAgg
 from django.db import transaction
 from django.db.models import Subquery
@@ -201,6 +201,13 @@ def return_prowler_provider(
    return prowler_provider


+def _validate_kubernetes_secret(secret: dict) -> None:
+    """Re-validate a stored kubeconfig at use time; errors never echo its content."""
+    KubernetesProviderSecret(
+        data={"kubeconfig_content": secret.get("kubeconfig_content")}
+    ).is_valid(raise_exception=True)
+
+
 def get_prowler_provider_kwargs(
    provider: Provider, mutelist_processor: Processor | None = None
 ) -> dict:
@@ -225,6 +232,7 @@ def get_prowler_provider_kwargs(
            "project_ids": [provider.uid],
        }
    elif provider.provider == Provider.ProviderChoices.KUBERNETES.value:
+        _validate_kubernetes_secret(prowler_provider_kwargs)
        prowler_provider_kwargs = {**prowler_provider_kwargs, "context": provider.uid}
    elif provider.provider == Provider.ProviderChoices.GITHUB.value:
        if provider.uid:
@@ -302,17 +310,26 @@ def get_prowler_provider_kwargs(
 def _normalize_oraclecloud_provider_kwargs(secret: dict) -> dict:
    """Normalize external OCI secret fields into SDK provider kwargs."""
    prowler_provider_kwargs = secret.copy()
-    prowler_provider_kwargs.pop("region", None)
+    home_region = _oraclecloud_home_region(prowler_provider_kwargs.pop("region", None))
+    if home_region:
+        prowler_provider_kwargs["home_region"] = home_region

    return prowler_provider_kwargs


+def _oraclecloud_home_region(region) -> str | None:
+    """Return the stored OCI region as a home region, ignoring blank or non-string legacy values."""
+    if isinstance(region, str) and region.strip():
+        return region.strip()
+    return None
+
+
 def _normalize_oraclecloud_connection_test_kwargs(secret: dict) -> dict:
    """Normalize external OCI secret fields into test_connection kwargs."""
    from prowler.providers.oraclecloud.oraclecloud_provider import OraclecloudProvider

    prowler_provider_kwargs = secret.copy()
-    prowler_provider_kwargs.pop("region", None)
+    home_region = _oraclecloud_home_region(prowler_provider_kwargs.pop("region", None))

    if (
        prowler_provider_kwargs.get("user")
@@ -323,11 +340,9 @@ def _normalize_oraclecloud_connection_test_kwargs(secret: dict) -> dict:
            or prowler_provider_kwargs.get("key_file")
        )
    ):
-        # Connection validation needs one OCI endpoint, but scans remain unfiltered.
-        prowler_provider_kwargs["region"] = getattr(
-            OraclecloudProvider,
-            "_bootstrap_region",
-            OraclecloudProvider._home_region,
+        # Identity calls only succeed in a region the tenancy is subscribed to.
+        prowler_provider_kwargs["region"] = (
+            home_region or OraclecloudProvider._bootstrap_region
        )

    return prowler_provider_kwargs
@@ -385,6 +400,16 @@ def prowler_provider_connection_test(provider: Provider) -> Connection:
    except Provider.secret.RelatedObjectDoesNotExist as secret_error:
        return Connection(is_connected=False, error=secret_error)

+    if provider.provider == Provider.ProviderChoices.KUBERNETES.value:
+        # A rejected stored kubeconfig is a failed connection, not a task error.
+        try:
+            _validate_kubernetes_secret(prowler_provider_kwargs)
+        except ValidationError as validation_error:
+            return Connection(
+                is_connected=False,
+                error=Exception(validation_error.detail["kubeconfig_content"][0]),
+            )
+
    # For IaC provider, construct the kwargs properly for test_connection
    if provider.provider == Provider.ProviderChoices.IAC.value:
        # Don't pass repository_url from secret, use scan_repository_url with the UID
@@ -214,7 +214,8 @@ from rest_framework_json_api import serializers
                    "kubeconfig_content": {
                        "type": "string",
                        "description": "The content of the Kubernetes kubeconfig file, encoded as a string. "
-                        "Kubeconfig command-based authentication is not supported in Prowler Cloud for security reasons.",
+                        "Only inline credentials are supported: token, username/password, or client-certificate-data with client-key-data for users, and certificate-authority-data for clusters. "
+                        "File-path and auth-provider kubeconfig fields are not supported.",
                    }
                },
                "required": ["kubeconfig_content"],
@@ -301,8 +302,7 @@ from rest_framework_json_api import serializers
                    },
                    "region": {
                        "type": "string",
-                        "deprecated": True,
-                        "description": "Legacy OCI region field accepted for backwards compatibility but ignored; OCI scans all regions.",
+                        "description": "Optional OCI home region (or any region the tenancy is subscribed to) used to validate the credentials. It does not filter the scan, which covers all subscribed regions. Defaults to us-ashburn-1.",
                    },
                },
                "required": ["user", "fingerprint", "tenancy"],
@@ -71,6 +71,7 @@ from django.db import IntegrityError, transaction
 from drf_spectacular.utils import extend_schema_field
 from jwt.exceptions import InvalidKeyError
 from prowler.lib.mutelist.mutelist import Mutelist
+from prowler.providers.oraclecloud.config import OCI_REGIONS
 from rest_framework.reverse import reverse
 from rest_framework.validators import UniqueTogetherValidator
 from rest_framework_json_api import serializers
@@ -376,27 +377,48 @@ class UserSerializer(BaseModelSerializerV1):
    def _can_view_relationships(self, instance) -> bool:
        """Allow self to view own relationships. Require manage_account to view others."""
        role = self.context.get("role")
+        return self._is_self(instance) or bool(role and role.manage_account)
+
+    def _is_self(self, instance) -> bool:
        request = self.context.get("request")
-        is_self = bool(
+        return bool(
            request
            and getattr(request, "user", None)
            and getattr(instance, "id", None) == request.user.id
        )
-        return is_self or (role and role.manage_account)
+
+    def _active_tenant_id(self):
+        return getattr(self.context.get("request"), "tenant_id", None)
+
+    @staticmethod
+    def _in_tenant(related_manager, tenant_id):
+        """Filter a prefetched related manager in memory.
+
+        ``.filter()`` clones the queryset without its result cache, so it would
+        discard the viewset's prefetch and re-query once per serialized user.
+        """
+        return [
+            item
+            for item in related_manager.all()
+            if str(item.tenant_id) == str(tenant_id)
+        ]

    def get_roles(self, instance):
-        return (
-            instance.roles.all()
-            if self._can_view_relationships(instance)
-            else Role.objects.none()
-        )
+        tenant_id = self._active_tenant_id()
+        if not tenant_id or not self._can_view_relationships(instance):
+            return Role.objects.none()
+        return self._in_tenant(instance.roles, tenant_id)

    def get_memberships(self, instance):
-        return (
-            instance.memberships.all()
-            if self._can_view_relationships(instance)
-            else Membership.objects.none()
-        )
+        if not self._can_view_relationships(instance):
+            return Membership.objects.none()
+        # Own memberships span tenants on purpose: the tenant switcher reads them.
+        if self._is_self(instance):
+            return instance.memberships.all()
+        tenant_id = self._active_tenant_id()
+        if not tenant_id:
+            return Membership.objects.none()
+        return self._in_tenant(instance.memberships, tenant_id)


 class UserMeSerializer(UserSerializer):
@@ -730,11 +752,32 @@ class MembershipIncludeSerializer(serializers.ModelSerializer):

    included_serializers = {"tenant": "api.v1.serializers.TenantIncludeSerializer"}

+    _REQUESTER_TENANTS_ATTR = "_prowler_requester_tenants"
+
+    def _requester_tenants(self):
+        """Tenants the requester belongs to, resolved once per request.
+
+        Memoised on the request because DRF builds a serializer instance per
+        included object, so a per-instance cache would still query per membership.
+        """
+        request = self.context.get("request")
+        user = getattr(request, "user", None)
+        if user is None:
+            return {}
+        tenants = getattr(request, self._REQUESTER_TENANTS_ATTR, None)
+        if tenants is None:
+            tenants = {
+                tenant.id: tenant
+                for tenant in Tenant.objects.using(MainRouter.admin_db).filter(
+                    membership__user_id=user.id
+                )
+            }
+            setattr(request, self._REQUESTER_TENANTS_ATTR, tenants)
+        return tenants
+
    def get_tenant(self, instance):
-        try:
-            return Tenant.objects.using(MainRouter.admin_db).get(id=instance.tenant_id)
-        except Tenant.DoesNotExist:
-            return None
+        """Resolve the tenant only when the requester is a member of it."""
+        return self._requester_tenants().get(instance.tenant_id)


 # Provider Groups
@@ -1658,14 +1701,43 @@ class FindingMetadataSerializer(BaseSerializerV1):


 # Provider secrets
-KUBERNETES_KUBECONFIG_UNSUPPORTED_COMMAND_AUTH_ERROR = (
-    "Kubernetes kubeconfig command-based authentication is not supported in "
-    "Prowler Cloud for security reasons."
+KUBERNETES_KUBECONFIG_NON_INLINE_CREDENTIALS_ERROR = (
+    "Only inline Kubernetes credentials are supported. "
+    "For user authentication use token, username/password, or client-certificate-data with client-key-data; "
+    "clusters may use certificate-authority-data. "
+    "File-path fields (tokenFile, client-certificate, client-key, certificate-authority), "
+    "command-based authentication (exec, cmd-path), auth-provider directives, and proxy URLs are not supported."
 )
 KUBERNETES_KUBECONFIG_INVALID_ERROR = "Invalid Kubernetes kubeconfig content."


-def kubeconfig_contains_unsupported_command_auth(kubeconfig: dict) -> bool:
+KUBECONFIG_ALLOWED_USER_KEYS = frozenset(
+    {
+        "token",
+        "username",
+        "password",
+        "client-certificate-data",
+        "client-key-data",
+        "as",
+        "as-uid",
+        "as-groups",
+        "as-user-extra",
+    }
+)
+KUBECONFIG_ALLOWED_CLUSTER_KEYS = frozenset(
+    {
+        "server",
+        "certificate-authority-data",
+        "insecure-skip-tls-verify",
+        "tls-server-name",
+        "disable-compression",
+        "extensions",
+    }
+)
+
+
+def kubeconfig_is_inline_only_credentials(kubeconfig: dict) -> bool:
+    """Accept only inline credentials; reject file-reference and auth-provider fields."""
    users = kubeconfig.get("users", [])
    if not isinstance(users, list):
        raise ValidationError(KUBERNETES_KUBECONFIG_INVALID_ERROR)
@@ -1678,21 +1750,25 @@ def kubeconfig_contains_unsupported_command_auth(kubeconfig: dict) -> bool:
        if not isinstance(user, dict):
            raise ValidationError(KUBERNETES_KUBECONFIG_INVALID_ERROR)

-        if "exec" in user:
-            return True
+        if any(key not in KUBECONFIG_ALLOWED_USER_KEYS for key in user):
+            return False

-        auth_provider = user.get("auth-provider", {})
-        if not isinstance(auth_provider, dict):
-            continue
+    clusters = kubeconfig.get("clusters", [])
+    if not isinstance(clusters, list):
+        raise ValidationError(KUBERNETES_KUBECONFIG_INVALID_ERROR)

-        auth_provider_config = auth_provider.get("config", {})
-        if not isinstance(auth_provider_config, dict):
-            continue
+    for cluster_entry in clusters:
+        if not isinstance(cluster_entry, dict):
+            raise ValidationError(KUBERNETES_KUBECONFIG_INVALID_ERROR)

-        if "cmd-path" in auth_provider_config:
-            return True
+        cluster = cluster_entry.get("cluster", {})
+        if not isinstance(cluster, dict):
+            raise ValidationError(KUBERNETES_KUBECONFIG_INVALID_ERROR)

-    return False
+        if any(key not in KUBECONFIG_ALLOWED_CLUSTER_KEYS for key in cluster):
+            return False
+
+    return True


 class BaseWriteProviderSecretSerializer(BaseWriteSerializer):
@@ -1875,7 +1951,7 @@ class MongoDBAtlasProviderSecret(serializers.Serializer):


 class KubernetesProviderSecret(serializers.Serializer):
-    kubeconfig_content = serializers.CharField()
+    kubeconfig_content = serializers.CharField(trim_whitespace=False)

    def validate_kubeconfig_content(self, kubeconfig_content):
        try:
@@ -1888,9 +1964,9 @@ class KubernetesProviderSecret(serializers.Serializer):
        if not isinstance(kubeconfig, dict):
            raise serializers.ValidationError(KUBERNETES_KUBECONFIG_INVALID_ERROR)

-        if kubeconfig_contains_unsupported_command_auth(kubeconfig):
+        if not kubeconfig_is_inline_only_credentials(kubeconfig):
            raise serializers.ValidationError(
-                KUBERNETES_KUBECONFIG_UNSUPPORTED_COMMAND_AUTH_ERROR
+                KUBERNETES_KUBECONFIG_NON_INLINE_CREDENTIALS_ERROR
            )

        return kubeconfig_content
@@ -1917,9 +1993,16 @@ class IacProviderSecret(serializers.Serializer):
        resource_name = "provider-secrets"


-class LegacyOCIRegionField(serializers.Field):
+class OCIHomeRegionField(serializers.Field):
+    """Optional OCI home region; blank or non-string legacy values are dropped."""
+
    def to_internal_value(self, data):
-        return data
+        if not isinstance(data, str) or not data.strip():
+            return None
+        region = data.strip()
+        if region not in OCI_REGIONS:
+            raise serializers.ValidationError(f"Invalid OCI region: {region}")
+        return region

    def to_representation(self, value):
        return value
@@ -1932,10 +2015,11 @@ class OracleCloudProviderSecret(serializers.Serializer):
    key_content = serializers.CharField(required=False)
    tenancy = serializers.CharField()
    pass_phrase = serializers.CharField(required=False)
-    region = LegacyOCIRegionField(required=False, allow_null=True)
+    region = OCIHomeRegionField(required=False, allow_null=True)

    def validate(self, attrs):
-        attrs.pop("region", None)
+        if not attrs.get("region"):
+            attrs.pop("region", None)

        if "key_file" not in attrs and "key_content" not in attrs:
            raise serializers.ValidationError(
@@ -351,6 +351,15 @@ from tasks.tasks import (

 logger = logging.getLogger(BackendLogger.API)

+
+def _scans_visible_to(role, tenant_id):
+    """Tenant scans, narrowed to the role's provider groups unless it has unlimited visibility."""
+    scans = Scan.all_objects.filter(tenant_id=tenant_id)
+    if role.unlimited_visibility:
+        return scans
+    return scans.filter(provider__in=get_providers(role))
+
+
 CACHE_DECORATOR = cache_control(
    max_age=django_settings.CACHE_MAX_AGE,
    stale_while_revalidate=django_settings.CACHE_STALE_WHILE_REVALIDATE,
@@ -1896,7 +1905,7 @@ class ProviderViewSet(DisablePaginationMixin, BaseRLSViewSet):
            self.required_permissions = [Permissions.MANAGE_PROVIDERS]

    def get_queryset(self):
-        user_roles = get_role(self.request.user, self.request.tenant_id)
+        user_roles = self.user_role
        if user_roles.unlimited_visibility:
            # User has unlimited visibility, return all providers
            queryset = Provider.objects.filter(tenant_id=self.request.tenant_id)
@@ -3058,7 +3067,7 @@ class AttackPathsScanViewSet(BaseRLSViewSet):
        return super().get_serializer_class()

    def get_queryset(self):
-        user_roles = get_role(self.request.user, self.request.tenant_id)
+        user_roles = self.user_role
        base_queryset = AttackPathsScan.objects.filter(tenant_id=self.request.tenant_id)

        if user_roles.unlimited_visibility:
@@ -3412,7 +3421,7 @@ class ResourceViewSet(PaginateByPkMixin, BaseRLSViewSet):
    required_permissions = []

    def get_queryset(self):
-        user_roles = get_role(self.request.user, self.request.tenant_id)
+        user_roles = self.user_role
        if user_roles.unlimited_visibility:
            # User has unlimited visibility, return all scans
            queryset = Resource.all_objects.filter(tenant_id=self.request.tenant_id)
@@ -3544,8 +3553,15 @@ class ResourceViewSet(PaginateByPkMixin, BaseRLSViewSet):

        tenant_id = request.tenant_id
        query_params = request.query_params
+        user_roles = self.user_role

        queryset = ResourceScanSummary.objects.filter(tenant_id=tenant_id)
+        if not user_roles.unlimited_visibility:
+            queryset = queryset.filter(
+                scan_id__in=_scans_visible_to(user_roles, tenant_id).values_list(
+                    "id", flat=True
+                )
+            )

        if scans := query_params.get("filter[scan__in]") or query_params.get(
            "filter[scan]"
@@ -3623,7 +3639,10 @@ class ResourceViewSet(PaginateByPkMixin, BaseRLSViewSet):
        all_groups = Resource.objects.filter(
            tenant_id=tenant_id,
            groups__isnull=False,
-        ).values_list("groups", flat=True)
+        )
+        if not user_roles.unlimited_visibility:
+            all_groups = all_groups.filter(provider__in=get_providers(user_roles))
+        all_groups = all_groups.values_list("groups", flat=True)
        groups = sorted(
            {g for groups_list in all_groups if groups_list for g in groups_list}
        )
@@ -3648,9 +3667,10 @@ class ResourceViewSet(PaginateByPkMixin, BaseRLSViewSet):
    def metadata_latest(self, request):
        tenant_id = request.tenant_id
        query_params = request.query_params
+        user_roles = self.user_role

-        latest_scans_queryset = Scan.all_objects.filter(
-            tenant_id=tenant_id
+        latest_scans_queryset = _scans_visible_to(
+            user_roles, tenant_id
        ).latest_per_provider()

        queryset = ResourceScanSummary.objects.filter(
@@ -3691,7 +3711,10 @@ class ResourceViewSet(PaginateByPkMixin, BaseRLSViewSet):
        all_groups = Resource.objects.filter(
            tenant_id=tenant_id,
            groups__isnull=False,
-        ).values_list("groups", flat=True)
+        )
+        if not user_roles.unlimited_visibility:
+            all_groups = all_groups.filter(provider__in=get_providers(user_roles))
+        all_groups = all_groups.values_list("groups", flat=True)
        groups = sorted(
            {g for groups_list in all_groups if groups_list for g in groups_list}
        )
@@ -4028,7 +4051,7 @@ class FindingViewSet(PaginateByPkMixin, BaseRLSViewSet):

    def get_queryset(self):
        tenant_id = self.request.tenant_id
-        user_roles = get_role(self.request.user, self.request.tenant_id)
+        user_roles = self.user_role
        if user_roles.unlimited_visibility:
            # User has unlimited visibility, return all findings
            queryset = Finding.all_objects.filter(tenant_id=tenant_id)
@@ -4102,8 +4125,16 @@ class FindingViewSet(PaginateByPkMixin, BaseRLSViewSet):

        tenant_id = request.tenant_id
        query_params = request.query_params
+        user_roles = self.user_role
+        visible_scan_ids = (
+            None
+            if user_roles.unlimited_visibility
+            else _scans_visible_to(user_roles, tenant_id).values_list("id", flat=True)
+        )

        queryset = ResourceScanSummary.objects.filter(tenant_id=tenant_id)
+        if not user_roles.unlimited_visibility:
+            queryset = queryset.filter(scan_id__in=visible_scan_ids)
        scan_based_filters = {}
        category_scan_filters = {}  # Filters for ScanCategorySummary

@@ -4161,7 +4192,10 @@ class FindingViewSet(PaginateByPkMixin, BaseRLSViewSet):
        if not queryset.exists():
            raw_scans_ids = Scan.objects.filter(
                tenant_id=tenant_id, **scan_based_filters
-            ).values_list("id", "unique_resource_count")
+            )
+            if not user_roles.unlimited_visibility:
+                raw_scans_ids = raw_scans_ids.filter(id__in=visible_scan_ids)
+            raw_scans_ids = raw_scans_ids.values_list("id", "unique_resource_count")
            scan_ids = [
                scan_id for scan_id, count in raw_scans_ids if count and count > 0
            ]
@@ -4203,11 +4237,13 @@ class FindingViewSet(PaginateByPkMixin, BaseRLSViewSet):
        )

        # Get categories from ScanCategorySummary using same scan filters
+        category_summaries = ScanCategorySummary.objects.filter(
+            tenant_id=tenant_id, **category_scan_filters
+        )
+        if not user_roles.unlimited_visibility:
+            category_summaries = category_summaries.filter(scan_id__in=visible_scan_ids)
        categories = list(
-            ScanCategorySummary.objects.filter(
-                tenant_id=tenant_id, **category_scan_filters
-            )
-            .values_list("category", flat=True)
+            category_summaries.values_list("category", flat=True)
            .distinct()
            .order_by("category")
        )
@@ -4262,9 +4298,10 @@ class FindingViewSet(PaginateByPkMixin, BaseRLSViewSet):
    def metadata_latest(self, request):
        tenant_id = request.tenant_id
        query_params = request.query_params
+        user_roles = self.user_role

-        latest_scans_queryset = Scan.all_objects.filter(
-            tenant_id=tenant_id
+        latest_scans_queryset = _scans_visible_to(
+            user_roles, tenant_id
        ).latest_per_provider()
        raw_latest_scans_ids = list(
            latest_scans_queryset.values_list("id", "unique_resource_count")
@@ -130,6 +130,8 @@ REST_FRAMEWORK = {
 SPECTACULAR_SETTINGS = {
    "SERVE_INCLUDE_SCHEMA": False,
    "COMPONENT_SPLIT_REQUEST": True,
+    # redoc@latest is 3.x, whose standalone bundle fails as a classic script
+    "REDOC_DIST": "https://cdn.jsdelivr.net/npm/redoc@2.5.1",
    "PREPROCESSING_HOOKS": [
        "drf_spectacular_jsonapi.hooks.fix_nested_path_parameters",
    ],
@@ -53,6 +53,10 @@ preload_app = not DEBUG
 # that may take longer, such as complex API operations.
 timeout = env.int("GUNICORN_TIMEOUT", default=120)

+# Recycle workers after N requests (+ jitter) to cap memory growth. GUNICORN_MAX_REQUESTS=0 disables.
+max_requests = env.int("GUNICORN_MAX_REQUESTS", default=10000)
+max_requests_jitter = env.int("GUNICORN_MAX_REQUESTS_JITTER", default=1000)
+
 # Logging
 logconfig_dict = DJANGO_LOGGERS
 gunicorn_logger = logging.getLogger(BackendLogger.GUNICORN)
@@ -193,10 +193,10 @@ def initialize_sentry():

    sentry_sdk.init(
        dsn=sentry_dsn,
-        # Add data like request headers and IP for users,
-        # see https://docs.sentry.io/platforms/python/data-management/data-collected/ for more info
        before_send=before_send,
-        send_default_pii=True,
+        # No user identity, IPs, cookies, headers or request bodies: bodies carry emails and provider details.
+        send_default_pii=False,
+        max_request_body_size="never",
        traces_sample_rate=env.float("DJANGO_SENTRY_TRACES_SAMPLE_RATE", default=0.02),
        _experiments={
            # Set continuous_profiling_auto_start to True
@@ -172,14 +172,10 @@ class CISReportGenerator(BaseComplianceReportGenerator):

        # Metadata table via base class helper
        info_rows = self._build_info_rows(data, language=self.config.language)
-        metadata_data = []
-        for label, value in info_rows:
-            if label in ("Name:", "Description:") and value:
-                metadata_data.append(
-                    [label, Paragraph(str(value), self.styles["normal_center"])]
-                )
-            else:
-                metadata_data.append([label, value])
+        metadata_data = [
+            [label, Paragraph(escape_html(str(value)), self.styles["normal_center"])]
+            for label, value in info_rows
+        ]

        metadata_table = Table(metadata_data, colWidths=[2 * inch, 4 * inch])
        metadata_table.setStyle(
@@ -13,7 +13,7 @@ from .base import (
    get_requirement_metadata,
 )
 from .charts import create_horizontal_bar_chart, create_radar_chart
-from .components import get_color_for_compliance
+from .components import escape_html, get_color_for_compliance
 from .config import (
    COLOR_BG_BLUE,
    COLOR_BLUE,
@@ -99,15 +99,10 @@ class ENSReportGenerator(BaseComplianceReportGenerator):

        # Compliance info table - use base class helper for consistency
        info_rows = self._build_info_rows(data, language="es")
-        # Convert tuples to lists and wrap long text in Paragraphs
-        info_data = []
-        for label, value in info_rows:
-            if label in ("Nombre:", "Descripción:") and value:
-                info_data.append(
-                    [label, Paragraph(value, self.styles["normal_center"])]
-                )
-            else:
-                info_data.append([label, value])
+        info_data = [
+            [label, Paragraph(escape_html(str(value)), self.styles["normal_center"])]
+            for label, value in info_rows
+        ]

        info_table = Table(info_data, colWidths=[2 * inch, 4 * inch])
        info_table.setStyle(
@@ -11,6 +11,7 @@ from .base import (
    get_requirement_metadata,
 )
 from .charts import create_horizontal_bar_chart, get_chart_color_for_percentage
+from .components import escape_html
 from .config import (
    COLOR_BORDER_GRAY,
    COLOR_DARK_GRAY,
@@ -111,15 +112,10 @@ class NIS2ReportGenerator(BaseComplianceReportGenerator):

        # Compliance metadata table - use base class helper for consistency
        info_rows = self._build_info_rows(data, language="en")
-        # Convert tuples to lists and wrap long text in Paragraphs
-        metadata_data = []
-        for label, value in info_rows:
-            if label in ("Name:", "Description:") and value:
-                metadata_data.append(
-                    [label, Paragraph(value, self.styles["normal_center"])]
-                )
-            else:
-                metadata_data.append([label, value])
+        metadata_data = [
+            [label, Paragraph(escape_html(str(value)), self.styles["normal_center"])]
+            for label, value in info_rows
+        ]

        metadata_table = Table(metadata_data, colWidths=[2 * inch, 4 * inch])
        metadata_table.setStyle(
@@ -3,7 +3,8 @@ from datetime import UTC, datetime
 from unittest.mock import MagicMock, patch

 import pytest
-from api.models import Integration, LighthouseConfiguration, Provider
+from api.models import Integration, LighthouseConfiguration, Provider, ProviderSecret
+from api.v1.serializers import KUBERNETES_KUBECONFIG_NON_INLINE_CREDENTIALS_ERROR
 from tasks.jobs.connection import (
    check_integration_connection,
    check_lighthouse_connection,
@@ -65,17 +66,52 @@ def test_check_provider_connection_exception(

    mock_provider_connection_test.return_value = MagicMock()
    mock_provider_connection_test.return_value.is_connected = False
-    mock_provider_connection_test.return_value.error = Exception()
+    mock_provider_connection_test.return_value.error = Exception(
+        "Unable to assume role"
+    )

    result = check_provider_connection(provider_id="provider_id")

    assert result["connected"] is False
-    assert result["error"] is not None
+    assert result["error"] == "Unable to assume role"

    mock_provider_instance.save.assert_called_once()
    assert mock_provider_instance.connected is False


+@pytest.mark.django_db
+def test_check_provider_connection_with_stored_non_inline_kubeconfig(
+    kubernetes_provider,
+):
+    """A kubeconfig stored before the inline-only rule marks the provider as disconnected."""
+    kubernetes_provider.connected = True
+    kubernetes_provider.save()
+    ProviderSecret.objects.create(
+        tenant_id=kubernetes_provider.tenant_id,
+        provider=kubernetes_provider,
+        secret_type=ProviderSecret.TypeChoices.STATIC,
+        secret={
+            "kubeconfig_content": (
+                "apiVersion: v1\n"
+                "kind: Config\n"
+                "users:\n"
+                "- name: test-user\n"
+                "  user:\n"
+                "    tokenFile: /etc/passwd\n"
+            )
+        },
+    )
+
+    result = check_provider_connection(provider_id=str(kubernetes_provider.id))
+
+    kubernetes_provider.refresh_from_db()
+    assert result == {
+        "connected": False,
+        "error": KUBERNETES_KUBECONFIG_NON_INLINE_CREDENTIALS_ERROR,
+    }
+    assert kubernetes_provider.connected is False
+
+
@pytest.mark.parametrize(
    "lighthouse_data",
    [
@@ -2,6 +2,7 @@ from unittest.mock import Mock, patch

 import pytest
 from api.models import StatusChoices
+from reportlab.lib.units import inch
 from reportlab.platypus import Image, LongTable, Paragraph, Table
 from tasks.jobs.reports import FRAMEWORK_REGISTRY, ComplianceData, RequirementData
 from tasks.jobs.reports import cis as cis_report_module
@@ -582,3 +583,24 @@ class TestCISCoverPage:
        paragraphs = [e for e in elements if isinstance(e, Paragraph)]
        content = " ".join(str(p.text) for p in paragraphs)
        assert "AWS" in content
+
+    def test_cover_page_wraps_long_account_id(
+        self, cis_generator, basic_cis_compliance_data
+    ):
+        provider = Mock()
+        provider.provider = "oraclecloud"
+        provider.uid = "ocid1.tenancy.oc1.." + "a" * 70
+        provider.alias = None
+        basic_cis_compliance_data.provider_obj = provider
+        elements = cis_generator.create_cover_page(basic_cis_compliance_data)
+        table = next(
+            e
+            for e in elements
+            if isinstance(e, Table)
+            and any(row[0] == "Account ID:" for row in e._cellvalues)
+        )
+        values = [row[1] for row in table._cellvalues]
+        assert all(isinstance(v, Paragraph) for v in values)
+        account_id = next(v for v in values if v.text == provider.uid)
+        _, height = account_id.wrap(4 * inch, 1000)
+        assert height > account_id.style.leading
@@ -2,6 +2,7 @@ import io
 from unittest.mock import Mock, patch

 import pytest
+from reportlab.lib.units import inch
 from reportlab.platypus import Image, PageBreak, Paragraph, Table
 from tasks.jobs.reports import FRAMEWORK_REGISTRY, ComplianceData, RequirementData
 from tasks.jobs.reports import ens as ens_report_module
@@ -189,6 +190,31 @@ class TestENSCoverPage:
        tables = [e for e in elements if isinstance(e, Table)]
        assert len(tables) >= 1  # At least info table

+    def test_cover_page_wraps_long_account_id(
+        self, ens_generator, basic_ens_compliance_data
+    ):
+        provider = Mock()
+        provider.provider = "oraclecloud"
+        provider.uid = "ocid1.tenancy.oc1.." + "a" * 70
+        provider.alias = None
+        basic_ens_compliance_data.provider_obj = provider
+        basic_ens_compliance_data.requirements = []
+        basic_ens_compliance_data.attributes_by_requirement_id = {}
+
+        elements = ens_generator.create_cover_page(basic_ens_compliance_data)
+
+        table = next(
+            e
+            for e in elements
+            if isinstance(e, Table)
+            and any(row[0] == "Account ID:" for row in e._cellvalues)
+        )
+        values = [row[1] for row in table._cellvalues]
+        assert all(isinstance(v, Paragraph) for v in values)
+        account_id = next(v for v in values if v.text == provider.uid)
+        _, height = account_id.wrap(4 * inch, 1000)
+        assert height > account_id.style.leading
+
    def test_cover_page_has_warning_about_manual(
        self, ens_generator, basic_ens_compliance_data
    ):
@@ -2,6 +2,7 @@ import io
 from unittest.mock import Mock, patch

 import pytest
+from reportlab.lib.units import inch
 from reportlab.platypus import Image, PageBreak, Paragraph, Table
 from tasks.jobs.reports import FRAMEWORK_REGISTRY, ComplianceData, RequirementData
 from tasks.jobs.reports import nis2 as nis2_report_module
@@ -214,6 +215,31 @@ class TestNIS2CoverPage:
        tables = [e for e in elements if isinstance(e, Table)]
        assert len(tables) >= 1

+    def test_cover_page_wraps_long_account_id(
+        self, nis2_generator, basic_nis2_compliance_data
+    ):
+        provider = Mock()
+        provider.provider = "oraclecloud"
+        provider.uid = "ocid1.tenancy.oc1.." + "a" * 70
+        provider.alias = None
+        basic_nis2_compliance_data.provider_obj = provider
+        basic_nis2_compliance_data.requirements = []
+        basic_nis2_compliance_data.attributes_by_requirement_id = {}
+
+        elements = nis2_generator.create_cover_page(basic_nis2_compliance_data)
+
+        table = next(
+            e
+            for e in elements
+            if isinstance(e, Table)
+            and any(row[0] == "Account ID:" for row in e._cellvalues)
+        )
+        values = [row[1] for row in table._cellvalues]
+        assert all(isinstance(v, Paragraph) for v in values)
+        account_id = next(v for v in values if v.text == provider.uid)
+        _, height = account_id.wrap(4 * inch, 1000)
+        assert height > account_id.style.leading
+

 # =============================================================================
 # Executive Summary Tests
@@ -1,5 +1,5 @@
 version = 1
-revision = 3
+revision = 2
 requires-python = ">=3.11, <3.13"
 resolution-markers = [
    "python_full_version >= '3.12' and sys_platform == 'win32'",
@@ -16,7 +16,7 @@ constraints = [
    { name = "aiobotocore", specifier = "==2.25.1" },
    { name = "aiofiles", specifier = "==24.1.0" },
    { name = "aiohappyeyeballs", specifier = "==2.6.1" },
-    { name = "aiohttp", specifier = "==3.14.3" },
+    { name = "aiohttp", specifier = "==3.14.5" },
    { name = "aioitertools", specifier = "==0.13.0" },
    { name = "aiosignal", specifier = "==1.4.0" },
    { name = "alibabacloud-actiontrail20200706", specifier = "==2.4.1" },
@@ -112,7 +112,7 @@ constraints = [
    { name = "botocore", specifier = "==1.40.61" },
    { name = "cartography", specifier = "==0.138.1" },
    { name = "celery", specifier = "==5.6.2" },
-    { name = "certifi", specifier = "==2026.1.4" },
+    { name = "certifi", specifier = "==2026.10.19" },
    { name = "cffi", specifier = "==2.0.0" },
    { name = "charset-normalizer", specifier = "==3.4.4" },
    { name = "circuitbreaker", specifier = "==2.1.3" },
@@ -138,7 +138,7 @@ constraints = [
    { name = "dill", specifier = "==0.4.1" },
    { name = "distro", specifier = "==1.9.0" },
    { name = "dj-rest-auth", specifier = "==7.0.1" },
-    { name = "django", specifier = "==5.1.15" },
+    { name = "django", specifier = "==5.2.17" },
    { name = "django-allauth", specifier = "==65.15.0" },
    { name = "django-celery-beat", specifier = "==2.9.0" },
    { name = "django-celery-results", specifier = "==2.6.0" },
@@ -162,7 +162,7 @@ constraints = [
    { name = "drf-simple-apikey", specifier = "==2.2.1" },
    { name = "drf-spectacular", specifier = "==0.27.2" },
    { name = "drf-spectacular-jsonapi", specifier = "==0.5.1" },
-    { name = "dulwich", specifier = "==1.2.5" },
+    { name = "dulwich", specifier = "==1.2.9" },
    { name = "duo-client", specifier = "==5.5.0" },
    { name = "durationpy", specifier = "==0.10" },
    { name = "email-validator", specifier = "==2.2.0" },
@@ -266,7 +266,7 @@ constraints = [
    { name = "pagerduty", specifier = "==6.1.0" },
    { name = "pandas", specifier = "==2.2.3" },
    { name = "pbr", specifier = "==7.0.3" },
-    { name = "pillow", specifier = "==12.3.0" },
+    { name = "pillow", specifier = "==13.0.0" },
    { name = "pkginfo", specifier = "==1.12.1.2" },
    { name = "platformdirs", specifier = "==4.5.1" },
    { name = "plotly", specifier = "==6.5.2" },
@@ -291,7 +291,7 @@ constraints = [
    { name = "pydantic-core", specifier = "==2.41.5" },
    { name = "pygithub", specifier = "==2.8.0" },
    { name = "pygments", specifier = "==2.20.0" },
-    { name = "pyjwt", specifier = "==2.13.0" },
+    { name = "pyjwt", specifier = "==2.14.0" },
    { name = "pylint", specifier = "==3.2.5" },
    { name = "pymsalruntime", specifier = "==0.18.1" },
    { name = "pynacl", specifier = "==1.6.2" },
@@ -355,7 +355,7 @@ constraints = [
    { name = "tzdata", specifier = "==2025.3" },
    { name = "tzlocal", specifier = "==5.3.1" },
    { name = "uritemplate", specifier = "==4.2.0" },
-    { name = "urllib3", specifier = "==2.7.0" },
+    { name = "urllib3", specifier = "==2.8.0" },
    { name = "uuid6", specifier = "==2024.7.10" },
    { name = "uvicorn", specifier = "==0.49.0" },
    { name = "uvloop", specifier = "==0.22.1" },
@@ -369,7 +369,7 @@ constraints = [
    { name = "xlsxwriter", specifier = "==3.2.9" },
    { name = "xmlsec", specifier = "==1.3.17" },
    { name = "xmltodict", specifier = "==1.0.2" },
-    { name = "yarl", specifier = "==1.22.0" },
+    { name = "yarl", specifier = "==1.25.1" },
    { name = "zipp", specifier = "==3.23.0" },
    { name = "zope-event", specifier = "==6.1" },
    { name = "zope-interface", specifier = "==8.2" },
@@ -378,7 +378,7 @@ constraints = [
 overrides = [
    { name = "azure-mgmt-containerservice", specifier = "==34.1.0" },
    { name = "cryptography", specifier = "==50.0.0" },
-    { name = "dulwich", specifier = "==1.2.5" },
+    { name = "dulwich", specifier = "==1.2.9" },
    { name = "microsoft-kiota-abstractions", specifier = "==1.9.10" },
    { name = "microsoft-kiota-authentication-azure", specifier = "==1.9.10" },
    { name = "microsoft-kiota-http", specifier = "==1.9.10" },
@@ -387,7 +387,8 @@ overrides = [
    { name = "microsoft-kiota-serialization-multipart", specifier = "==1.9.10" },
    { name = "microsoft-kiota-serialization-text", specifier = "==1.9.10" },
    { name = "okta", specifier = "==3.4.2" },
-    { name = "pyjwt", extras = ["crypto"], specifier = "==2.13.0" },
+    { name = "pyjwt", extras = ["crypto"], specifier = "==2.14.0" },
+    { name = "pymongo", specifier = "==4.18.2" },
 ]

 [[package]]
@@ -479,7 +480,7 @@ wheels = [

 [[package]]
 name = "aiohttp"
-version = "3.14.3"
+version = "3.14.5"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
    { name = "aiohappyeyeballs" },
@@ -491,44 +492,45 @@ dependencies = [
    { name = "typing-extensions" },
    { name = "yarl" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/58/d9/22ce5786ac0c1653ae8b6c23bded02c1686d11f0dbb45b31ce128e0df985/aiohttp-3.14.3.tar.gz", hash = "sha256:9491196535a88924a60afd5b5f434b5b203b6cc616250878dbdb223a8f7844bc", size = 7971213, upload-time = "2026-07-23T01:57:27.037Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/6c/4c/bdccd81e9ee225b69c60e7766c9a5b05364f118f4d383713b89a682d772d/aiohttp-3.14.5.tar.gz", hash = "sha256:5558a7f5a05af9ecf744af91e5baefc436f93c9333e656c27ec253f9a6bbe178", size = 8078052, upload-time = "2026-10-11T01:05:12.408Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/f8/5c/b3e4ff8ad43a8afef9602c5e90285936da1beaea8b029016b793891f03c3/aiohttp-3.14.3-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:e568e14940c09955aa51f4e645b6daa18a581c5dcfcd73744dcc86a856e3ced3", size = 764250, upload-time = "2026-07-23T01:52:48.525Z" },
-    { url = "https://files.pythonhosted.org/packages/0e/da/f1b384465e51449d844056b75070461da03a9a23e6c1747003695bf4172a/aiohttp-3.14.3-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:54cfcdee2770dac994417cbb0ee1f3eb0e7cb6b30c79bf44f2c02ff79ec5124a", size = 516281, upload-time = "2026-07-23T01:52:51.047Z" },
-    { url = "https://files.pythonhosted.org/packages/b9/3f/01264f820ee2e3712a827892b1cd6ff80f3300c1fcbffbb45714a915d47a/aiohttp-3.14.3-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:21c016079415ed3fd676963e9793700a566d85dbbd6bfc564b9b2d209147dcc8", size = 514742, upload-time = "2026-07-23T01:52:53.779Z" },
-    { url = "https://files.pythonhosted.org/packages/9e/8d/a71c6f2db52ac1ed142b133f7feddaa6b70539c3f4de24d7e226c95b794c/aiohttp-3.14.3-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:d6088ec9894113802bddb3c09e974929aed2c7b3a8c456219b8aab4481f1a239", size = 1780613, upload-time = "2026-07-23T01:52:56.948Z" },
-    { url = "https://files.pythonhosted.org/packages/a5/11/3dd9b3fb3a170f6ec9011b5291d876a6fab4086714c9e158600edf01b4fd/aiohttp-3.14.3-cp311-cp311-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:16ea7e24c309fb7c0bbd505d149abe4fe4dccfb8db911db7dbec0921bc889a6f", size = 1737688, upload-time = "2026-07-23T01:52:59.294Z" },
-    { url = "https://files.pythonhosted.org/packages/6d/3e/834c26918be7d88068822b40e0db30fca50b5f4fe79104aa16a93f1d74e6/aiohttp-3.14.3-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:56f355e79f71aef2a85c80305cc915f894b170dba76de5fe84f6351939b83c06", size = 1845742, upload-time = "2026-07-23T01:53:01.641Z" },
-    { url = "https://files.pythonhosted.org/packages/cc/c9/49ab8572df7d66bc13d11e31f781292badb04180dd87ba98733066c6aed7/aiohttp-3.14.3-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:18c441d0a8fca6de8d1f546849b9f0ab20d435993e2c5b59562b2fae6be2f929", size = 1928412, upload-time = "2026-07-23T01:53:04.018Z" },
-    { url = "https://files.pythonhosted.org/packages/a5/b9/2b8f0c0ce09c87a1daf80fd483431b56b1435d3f62789bc86f572e1245de/aiohttp-3.14.3-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:53e7b4ce82b54a8bcc71b3b67a5cbd177ca1d7f592cbc92cd38b7349f73482db", size = 1786220, upload-time = "2026-07-23T01:53:06.481Z" },
-    { url = "https://files.pythonhosted.org/packages/85/00/9c45f81de11710460edfa1dc81317b6e882703b160926c879a9d20da9fcc/aiohttp-3.14.3-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:f55119f7bf25f49ed210f6096090715da24f2943c62102448915fde3c62877ce", size = 1637231, upload-time = "2026-07-23T01:53:10.258Z" },
-    { url = "https://files.pythonhosted.org/packages/19/ce/967d628e910756f3539c6107cb7844a1b69440dcb3029a5ee7871b09ab63/aiohttp-3.14.3-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:9aa6e61fdf20105c4144e755bd586008ff450791d67b1c8146fdc15959c4d51c", size = 1753161, upload-time = "2026-07-23T01:53:13.817Z" },
-    { url = "https://files.pythonhosted.org/packages/11/b2/0c3d4114f0aee4f580f5b3b4eb71b24d7a23b834ea506a4dfebe76513f35/aiohttp-3.14.3-cp311-cp311-musllinux_1_2_armv7l.whl", hash = "sha256:ccd4893707b3e2a13e39c90d43cf80edf2e4d0457935bcc103bf2346214c3f15", size = 1756356, upload-time = "2026-07-23T01:53:16.211Z" },
-    { url = "https://files.pythonhosted.org/packages/63/5d/99e7d91c82f1399d1ae2a854e080bd1493fbc31e5e959dbc4ec33dac3bec/aiohttp-3.14.3-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:b2466434105a4e03113c36ec775cc2ebe6676b62eae326fa670bb607ef788c1c", size = 1819846, upload-time = "2026-07-23T01:53:18.289Z" },
-    { url = "https://files.pythonhosted.org/packages/ad/05/d5e1cb6480eeffd3f901d40a2c5e2d1e7effdc797837da3b490272699f13/aiohttp-3.14.3-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:ba59d59aba08ac02fc03b0c8983ccd5ee39a199d0552ce9e6d2b4845b34d59ae", size = 1628531, upload-time = "2026-07-23T01:53:23.86Z" },
-    { url = "https://files.pythonhosted.org/packages/c9/90/b934682bcaefae18a9e04f3dff5b68522ba810906358ae5029b68110ea3b/aiohttp-3.14.3-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:ed099d105449c4f9e84f24af203cd131349d4761d8813fa7e02c32e7128cd910", size = 1832712, upload-time = "2026-07-23T01:53:27.551Z" },
-    { url = "https://files.pythonhosted.org/packages/21/df/6061679faaf81fac746e7307c7adb71e858071a5d34c27583afefc64f543/aiohttp-3.14.3-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:152516815ef926786a0b6ae2b8f1fd2e0c71582dee0b435636865316fd4891b7", size = 1775014, upload-time = "2026-07-23T01:53:30.223Z" },
-    { url = "https://files.pythonhosted.org/packages/8a/1d/f854878bbc69b88faefe924b619a34a6f59ec05fd387c77690667eaa75eb/aiohttp-3.14.3-cp311-cp311-win32.whl", hash = "sha256:a4af35c443e0b1a1bd6a8af3f3485d7fda15c142751a00f3ff8090f0b93346fa", size = 456006, upload-time = "2026-07-23T01:53:34.97Z" },
-    { url = "https://files.pythonhosted.org/packages/73/0c/2af9d1674baccd1dbd47282a93d660a22e57ef6167c856deb24b4214fbab/aiohttp-3.14.3-cp311-cp311-win_amd64.whl", hash = "sha256:e1e74298bab6ee0d6e749ed4fd1901c7e604bdda32c03d787a2cc71c46d0433d", size = 481069, upload-time = "2026-07-23T01:53:39.673Z" },
-    { url = "https://files.pythonhosted.org/packages/8e/76/88401ff3fc95e85c5fc38d588f36f55e61ecb64343b2bc8d69326f453cc0/aiohttp-3.14.3-cp311-cp311-win_arm64.whl", hash = "sha256:03cd2bde3d7f085b64e549c985f4bb928cad7e8ecf5323bfca320db548d81b39", size = 453021, upload-time = "2026-07-23T01:53:43.749Z" },
-    { url = "https://files.pythonhosted.org/packages/18/d4/eb96299230e20acf2efae207cb8d69051f1f68e357e5ea5e479bf6fb097a/aiohttp-3.14.3-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:39aded8c7f3b935b54aab1d8d73c70ec0ee2d3ec3b943e0e86611bc150ba47f5", size = 754690, upload-time = "2026-07-23T01:53:47.332Z" },
-    { url = "https://files.pythonhosted.org/packages/88/11/e7a70a209eb9a067c0d3212b518a0134e3484f5178c7533878b6b514d469/aiohttp-3.14.3-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:5bcb6ff3fdab1258a192679ff1a05d44f59626430aa05cd1a9d2447423599228", size = 509484, upload-time = "2026-07-23T01:53:51.159Z" },
-    { url = "https://files.pythonhosted.org/packages/30/07/4bbc222cc8dbe31d4c3e8a5baad2286e4d42026ac0c570027b89afce6344/aiohttp-3.14.3-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:617105e2c3018ee38d0c8ce5ee3c84f621a6d8b9f723202aacaff28449ca91ee", size = 511949, upload-time = "2026-07-23T01:53:55.083Z" },
-    { url = "https://files.pythonhosted.org/packages/54/b9/42e74c46b7b7c794b995bbc1f573fb48950c38b19d8600c62a6804ee2d67/aiohttp-3.14.3-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f631fe87a6f30df5fbe6d79640b25e4cffb38c31c7fb6f10871517b84b0f8c1a", size = 1765282, upload-time = "2026-07-23T01:53:59.662Z" },
-    { url = "https://files.pythonhosted.org/packages/6b/ed/62bc4d74363ad346d518e0720363a949f63e2e23439a79eb5813d4d29bb3/aiohttp-3.14.3-cp312-cp312-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:a94dbaae5ae27bd849c93570669bff91e0510f33a80805738e3de72a7be0447b", size = 1741511, upload-time = "2026-07-23T01:54:04.063Z" },
-    { url = "https://files.pythonhosted.org/packages/d0/9f/181e8a8bc79e47d13c7fc4540bd7a3b729d9505609c61f392a8dd2fbfe55/aiohttp-3.14.3-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:8f2f1c4c032c7cedd7d8da6f54c97b70266c6570c3108d3fdffee7188bb70529", size = 1810680, upload-time = "2026-07-23T01:54:09.882Z" },
-    { url = "https://files.pythonhosted.org/packages/5c/9a/dec94d6ad694552fe3424e3f1928d7a606a5d9d9433a04e7ecdd9d38ae7f/aiohttp-3.14.3-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:ea05e1f97ceea523942d9b2a7d7c0359d781d683d6b043f5943a602b14da4787", size = 1905646, upload-time = "2026-07-23T01:54:13.475Z" },
-    { url = "https://files.pythonhosted.org/packages/52/b7/7cd31f29d6055bd711ae6e669367fba6f5ae9de463910a793e30556a8db7/aiohttp-3.14.3-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:543906c127fb1d929b95076db19b83fa2d46751006ff1e23b093aa5ac4d8db42", size = 1792122, upload-time = "2026-07-23T01:54:15.752Z" },
-    { url = "https://files.pythonhosted.org/packages/66/73/10b1ef93afa61f4963c746257b70ced619cf31a4798671de5fdb2608501d/aiohttp-3.14.3-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:0a5ff2dfbb9ce645fa5b8ef3e02c6c0b9cc3f6030ff863d0c51fffc50cb5541b", size = 1591127, upload-time = "2026-07-23T01:54:19.489Z" },
-    { url = "https://files.pythonhosted.org/packages/49/ed/3b203fa6de1b338c14acdc06bf6ca9b043b7944f005966958c2ced932cde/aiohttp-3.14.3-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:041badb8f84396357c4d3ad26de6afd7a32b112f43d3c63045c0c8278cfd2043", size = 1725210, upload-time = "2026-07-23T01:54:24.129Z" },
-    { url = "https://files.pythonhosted.org/packages/28/b7/1c2aab8c706436dcc28598452488ac9cd7c409da815237c28c27d58993e6/aiohttp-3.14.3-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:530125ee1163c4219af35dc3aa1206e541e7b31b6efc1a3f93b70a136f65d427", size = 1764848, upload-time = "2026-07-23T01:54:27.973Z" },
-    { url = "https://files.pythonhosted.org/packages/54/50/94c28f08b131c4bf10984ea2c7a536c9920608bb2d6e7f95642c30cc87b7/aiohttp-3.14.3-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:c8653fd547c93a61aadc612007790f5555cdd18946fa48cf45e26d8ea4ea473d", size = 1777102, upload-time = "2026-07-23T01:54:31.775Z" },
-    { url = "https://files.pythonhosted.org/packages/13/d4/e7d09ba7d345fb2d74440fd2fa033c5e079fac05552927705986f41a364f/aiohttp-3.14.3-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:89176250f686cb9853c0fb7ead90e639e915b84a6f43eedc2a4e7ec21f1037f0", size = 1580205, upload-time = "2026-07-23T01:54:34.518Z" },
-    { url = "https://files.pythonhosted.org/packages/a3/84/072a91d68e1e1eb587985b54baab94221277f877e8ef274fc213a0ceae28/aiohttp-3.14.3-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:3a26434dafe408229ff3403458ca58de24fb51936504decac49ce6755f77e59d", size = 1797219, upload-time = "2026-07-23T01:54:36.995Z" },
-    { url = "https://files.pythonhosted.org/packages/e0/eb/aad34e897e668424d6e995da5dff8a4a09af93363d3392488772957a63aa/aiohttp-3.14.3-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:d1558173930a5a8d3069cee5c92fc91c87c4dbcb099debbb3622053717145a19", size = 1768629, upload-time = "2026-07-23T01:54:40.103Z" },
-    { url = "https://files.pythonhosted.org/packages/b6/2b/6bb88ddba0fecd9122aa3ebcad25996cf6c083a4a7040dbb3a4f97972af6/aiohttp-3.14.3-cp312-cp312-win32.whl", hash = "sha256:16100ad3ab8d649fdfbee87602d9d2dcdca9df0b9eda8a1b5fdc0d41f96da559", size = 451481, upload-time = "2026-07-23T01:54:42.547Z" },
-    { url = "https://files.pythonhosted.org/packages/76/9b/f2f8f108da17ecef2cc3efc424e8b7ad3782b1a8360f7b8eae8ced84f6ea/aiohttp-3.14.3-cp312-cp312-win_amd64.whl", hash = "sha256:33a2d7c28d33797a2e99923dffa63f83d908a19b6bf26cfe80fa790aa5e1a75a", size = 476845, upload-time = "2026-07-23T01:54:44.853Z" },
-    { url = "https://files.pythonhosted.org/packages/3e/44/28dac80a8941b604f4da10ce21097614ca1bf905ce93dca28d8d7de9c1e7/aiohttp-3.14.3-cp312-cp312-win_arm64.whl", hash = "sha256:362a3fd481769cac1a824514bcd86fda51c65e8fe6e051099e008fddde6db17c", size = 448050, upload-time = "2026-07-23T01:54:47.087Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/f3/8997f18890a92c79f77fcfbb4f78ca17c2d4ab109e9eb6d31b4e9de194a0/aiohttp-3.14.5-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:d51db97c96384fbfcaf8f4c65922183a68b94f891c3c10c862ef5f6df2adbb1f", size = 832358, upload-time = "2026-10-11T00:59:42.195Z" },
+    { url = "https://files.pythonhosted.org/packages/8e/42/084651e9efb5cadb99265f786df60f2a7b353cead7bfd2c87003cb4867ad/aiohttp-3.14.5-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:ae53924aa853a7a2ca20ed4142c7c6b56338e4d4cd999e2980075b9efc2e257a", size = 559636, upload-time = "2026-10-11T00:59:43.677Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/fe/92838944e601f0fe195fd3f3ada37e29fbee3d19bfd323fe15937ec79d36/aiohttp-3.14.5-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:a2c473a355f9239efcb72c92d5abfd8fcdb0cc78c8e9af607e72ca12dbb36593", size = 552588, upload-time = "2026-10-11T00:59:45.592Z" },
+    { url = "https://files.pythonhosted.org/packages/8f/b8/dd9b95c5c20ceae1b47738e656bd79e9883e3117a9cc8b143901eb604e9a/aiohttp-3.14.5-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:32e8fa6644e541fcd7e02430588c7fc93b602c1778ea0bc345505db76b61cfb4", size = 1928224, upload-time = "2026-10-11T00:59:47.294Z" },
+    { url = "https://files.pythonhosted.org/packages/c6/47/70010cd2ba8746968d53d433ff328c33f06a66c99da5f3de759c64a6b2eb/aiohttp-3.14.5-cp311-cp311-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:579f97d5120f2971876d2ddca2968135f6944d00c44c3a6590ad7d86ca9b403f", size = 1877674, upload-time = "2026-10-11T00:59:49.472Z" },
+    { url = "https://files.pythonhosted.org/packages/c5/a1/b026f071dbd87f0bdba86b92d47e46f3899e3ad7143b6e0fe7e7887090b4/aiohttp-3.14.5-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:24409db442e2fb6e766bc7f3943851a8381dec3098140e43bb2e843b79e31b12", size = 1985850, upload-time = "2026-10-11T00:59:51.296Z" },
+    { url = "https://files.pythonhosted.org/packages/36/d1/f7b6f6f8c3cb5a71b53baeddc2e70c224c28b12a23a55c42994c504019b7/aiohttp-3.14.5-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:5e8f97c0488ffda3082766ac0f2c8150a9a58c4d05788330e479cfd449b37939", size = 2105471, upload-time = "2026-10-11T00:59:53.191Z" },
+    { url = "https://files.pythonhosted.org/packages/42/74/2a2b22953de15c6c8a80debf26db3047e4e8a5a5db6dd7c2c6c01eec0605/aiohttp-3.14.5-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:50a195903119008fe9cc68710535eb37f556ffffd6a7759afe70a2c145587045", size = 1929915, upload-time = "2026-10-11T00:59:55.609Z" },
+    { url = "https://files.pythonhosted.org/packages/33/ad/f80e8d33933d0eacd0217efa3b7fb32c9f48ed480ed0db53cf9948bf474f/aiohttp-3.14.5-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:0133c3c3b54a0bf1e71fa5c1ad95c93f07fd54e24ef1fe182f5122e1573d2bf1", size = 1773832, upload-time = "2026-10-11T00:59:57.611Z" },
+    { url = "https://files.pythonhosted.org/packages/04/a4/0273d239f3e3bb69438f209c64c82e1f98dc60d5db264795e41f7dd05dcb/aiohttp-3.14.5-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:c172db893e516e1358e65a95ee20b7ce7173963eefe318b6ab2a2220688b999e", size = 1901001, upload-time = "2026-10-11T01:00:00.605Z" },
+    { url = "https://files.pythonhosted.org/packages/16/ed/7dd439d26c654645bc34ca3c9a822fc11c1c51801fed1cefdfe1cc41c1f6/aiohttp-3.14.5-cp311-cp311-musllinux_1_2_armv7l.whl", hash = "sha256:f2a7966bda23dd85051f1661ce0ace38d6890e05ec6c357ecae9d2479cba377e", size = 1907218, upload-time = "2026-10-11T01:00:02.699Z" },
+    { url = "https://files.pythonhosted.org/packages/32/dd/86249c3b8248562a17fd3e22ee0c164378d65766f01aceef62cf52783710/aiohttp-3.14.5-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:4887d130a7bbfed3a85493bb5a25e5b5b558d40c1d986dd16970d2bb26d63793", size = 1958650, upload-time = "2026-10-11T01:00:04.851Z" },
+    { url = "https://files.pythonhosted.org/packages/bc/0b/ca4d53d68f683ce195807fd0aeb063bf6d1c6b39343fff234c9524e8d5a9/aiohttp-3.14.5-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:225c579c23b68b343cccea27a7e06e3bd8ec23a09c30b427eb3f1e4ca6239b20", size = 1760057, upload-time = "2026-10-11T01:00:06.978Z" },
+    { url = "https://files.pythonhosted.org/packages/6b/42/005437ffd7fa56c2ce3347add40404b654a32754ce91f2e2a14b9e5ab2bc/aiohttp-3.14.5-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:ab52d8f1fc1b64821c1fbad64a647ed6203627004059a6d1ed4f0858a1499703", size = 1978081, upload-time = "2026-10-11T01:00:08.868Z" },
+    { url = "https://files.pythonhosted.org/packages/03/71/3a5b66fe1b7b23d3c6524350817ed55de5feb7fbb4cccba7cbe044d118dd/aiohttp-3.14.5-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:cb131d775a1573c1aee66656bd78b023577bbdb6cb8349a07773bd4f73e68a6e", size = 1922954, upload-time = "2026-10-11T01:00:11.035Z" },
+    { url = "https://files.pythonhosted.org/packages/69/84/d08a554f281d42fd7c6b2b6dd7738f3e3a7a9f657ddd87e11ca2091cdfe3/aiohttp-3.14.5-cp311-cp311-win32.whl", hash = "sha256:e87046c8ff77a8decdb6a41d8ab25824b47531b2da933aeab0c1e21c7acff329", size = 488101, upload-time = "2026-10-11T01:00:12.933Z" },
+    { url = "https://files.pythonhosted.org/packages/0f/15/52b5e65f02b33686ae49f1518548ae4f5a7adaf31d9d3c54fa12a143137b/aiohttp-3.14.5-cp311-cp311-win_amd64.whl", hash = "sha256:6f275c11d1aa6d4c458e05a68be084efe3c55a113d99e3f46a318098e52948fc", size = 512575, upload-time = "2026-10-11T01:00:14.743Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/b9/bb75012635f3defb0f7cbb7c4ae391e36bb9cb3fbdca3b9944e2ebebf743/aiohttp-3.14.5-cp311-cp311-win_arm64.whl", hash = "sha256:b032a0023eb41d768ce77d83210ab2a3c389bc0b09313273c7e1eca48c10a755", size = 493179, upload-time = "2026-10-11T01:00:16.961Z" },
+    { url = "https://files.pythonhosted.org/packages/d5/94/6ba86efddcb616c811b40e6a0dfdd862738f647e4e3860a961075d5e9ed8/aiohttp-3.14.5-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:df37b620684e19b5e25724412518ccafc3b1a49cdac706fdbd2f983fad943450", size = 817499, upload-time = "2026-10-11T01:00:18.901Z" },
+    { url = "https://files.pythonhosted.org/packages/5e/e1/7bca6d84dabd228aa8eb4b7f9feac2586aaa9be5505d7d65bf287a615c43/aiohttp-3.14.5-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:ef60869969180ec2464f1349aff07138ae35ca2200f0946cb3552e49e8f301a8", size = 549467, upload-time = "2026-10-11T01:00:20.854Z" },
+    { url = "https://files.pythonhosted.org/packages/64/91/11b89f45ca486252dd67dd5f3231fec04bf5518da39a95cb3997619f17fb/aiohttp-3.14.5-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:d079c0a0135c36e7beb6f1c88087c8f108dc5891cdd0b5eafa778421bda70ed2", size = 548067, upload-time = "2026-10-11T01:00:22.659Z" },
+    { url = "https://files.pythonhosted.org/packages/22/ff/c6615806c14aab34f82b9424ccde8ce6e417315fd57ce1c5b4d4747888e1/aiohttp-3.14.5-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:abfda5cb094a829f7bc25216a32f7db2e85cc65bd59910f8e7b40b3d9b224764", size = 1896245, upload-time = "2026-10-11T01:00:24.638Z" },
+    { url = "https://files.pythonhosted.org/packages/39/b2/25a8c971ae6a92c8394d77e42422d7f38989e05cf41a5ceb92d73d67ab7e/aiohttp-3.14.5-cp312-cp312-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:9cc882cf8619109583c906b4d4a85d6a111a98afa34b7a450d1e08118d016820", size = 1872180, upload-time = "2026-10-11T01:00:26.838Z" },
+    { url = "https://files.pythonhosted.org/packages/2f/d5/99f93ea36cc5205e47c1e5a803e087f2ad21b5430b5db2e942cb6e988a37/aiohttp-3.14.5-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:7457580535e019e1247ea35d6a02bf081ad30c26d0cbc210c93f6c3ab67a0835", size = 1937261, upload-time = "2026-10-11T01:00:28.74Z" },
+    { url = "https://files.pythonhosted.org/packages/40/a6/9ac9c9e6695040bd73d2584a1b59a9388f6433c76d5294a7bf591e21ffe5/aiohttp-3.14.5-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:c5ed596aedb9c42afd3fe0aae3117725378ac73d2cc5ddc735056fbdb96c5d02", size = 2064994, upload-time = "2026-10-11T01:00:30.623Z" },
+    { url = "https://files.pythonhosted.org/packages/da/e4/aa172eb534b7f02f1f8ff1c3213347eaf3cf218db91a727c6863c22f1035/aiohttp-3.14.5-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:20f085697d7e911f1f73c43ed03fafbed1e7121797e2eb5428efa80398060584", size = 1919630, upload-time = "2026-10-11T01:00:32.548Z" },
+    { url = "https://files.pythonhosted.org/packages/06/7d/4eedafc5bababa8932636c141e346806966eade12c0b7e5946d43bf8218b/aiohttp-3.14.5-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:74b0a9c8270f9b0a11410e124ff8d4f18bfc1f1837440ec84da5ae7b50927b5d", size = 1710016, upload-time = "2026-10-11T01:00:34.471Z" },
+    { url = "https://files.pythonhosted.org/packages/b2/94/eee018537ba19da0ceb2ac79cab83faed4ac49568e08376e2799043f2538/aiohttp-3.14.5-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:19e2ba471507c34f8252402ab50f5ab512398b9ea8c8f1cb26beb3f75793ba30", size = 1858112, upload-time = "2026-10-11T01:00:36.581Z" },
+    { url = "https://files.pythonhosted.org/packages/68/76/354653a306547238f3427283905972d796ba7c292ba9977abec9f2b6f260/aiohttp-3.14.5-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:d418ce2af40c6bb685b3f663e9e8de27cb0a22431d8e88a167348d7f01878073", size = 1896371, upload-time = "2026-10-11T01:00:38.478Z" },
+    { url = "https://files.pythonhosted.org/packages/f2/ec/63e8c7136b570e356345ad3174e3820fdc973ea10712cb6c649bf875755a/aiohttp-3.14.5-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:70cb4008ac2ed1e0ca9e824deb4b53d3aa0d939109698ebf1e723a84337bd794", size = 1905836, upload-time = "2026-10-11T01:00:40.527Z" },
+    { url = "https://files.pythonhosted.org/packages/57/d8/11365bda144b127928cd42533d0eff78a55613c9e28f81941bd6630ea887/aiohttp-3.14.5-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:a23fe35d776bc03cb495938b9594450d047e3bc08c5255315a82323e9cb7d2dd", size = 1696534, upload-time = "2026-10-11T01:00:42.686Z" },
+    { url = "https://files.pythonhosted.org/packages/2f/3d/82df0461b18e00b2998f205c03e0d3010222478c43640aceb8e03dcd7e8f/aiohttp-3.14.5-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:3e0eb43bed3c6801a6cee315195377789e90b2a72c2277a475b578535312488d", size = 1933970, upload-time = "2026-10-11T01:00:44.71Z" },
+    { url = "https://files.pythonhosted.org/packages/03/ad/6ddfe0aacd931c17b53533336d97e9d11a98b96d6ae815a9da0b19f82ccf/aiohttp-3.14.5-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:3be7dd397d64ca3e1869626fa9318aaebb54b7bf93bc72d7a205448d83e4f748", size = 1899501, upload-time = "2026-10-11T01:00:46.629Z" },
+    { url = "https://files.pythonhosted.org/packages/9e/8e/189bdd9ae4793059bb09f6dc880f211a6c6c7859cebcbf33912dbfab7dd7/aiohttp-3.14.5-cp312-cp312-win32.whl", hash = "sha256:eb324e2009fb54db30a071dad7caf6998ee2879c4704007efb244514dad1fec1", size = 480370, upload-time = "2026-10-11T01:00:48.468Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/ce/1f08114679d49655b30a6e0a29858375c94b82c1de1a0bd0a20c2fee8b02/aiohttp-3.14.5-cp312-cp312-win_amd64.whl", hash = "sha256:2cc38a4f2b516bef1714e690df87a0e043faf1a7693c82d860091684453d5111", size = 506141, upload-time = "2026-10-11T01:00:50.272Z" },
+    { url = "https://files.pythonhosted.org/packages/79/d4/c7b4f60b16a1b7e43249fa9031ae05e7e8c341ba4b7d1866f914dafeaa0e/aiohttp-3.14.5-cp312-cp312-win_arm64.whl", hash = "sha256:a63afd1f757de949028387e65a7127b61ad0f775432dbb0e62816ae619fe69ac", size = 488108, upload-time = "2026-10-11T01:00:52.321Z" },
+    { url = "https://files.pythonhosted.org/packages/68/30/173960c42b05a6c59f7558e4b12a4b0d9ba376cf6aa9bde7f9e08a30ca8d/aiohttp-3.14.5-py3-none-any.whl", hash = "sha256:efc21a454892828368b11c2c780de0ff8bc991f73f6b99c6b66e56205470929b", size = 279517, upload-time = "2026-10-11T01:05:08.523Z" },
 ]

 [[package]]
@@ -1227,6 +1229,20 @@ wheels = [
    { url = "https://files.pythonhosted.org/packages/32/b3/8ec1268082f4d20cc8bf723a1a8e6b9e330bcc338a4dbcee9c7737e9dc1c/azure_mgmt_authorization-4.0.0-py3-none-any.whl", hash = "sha256:d8feeb3842e6ddf1a370963ca4f61fb6edc124e8997b807dd025bc9b2379cd1a", size = 1072620, upload-time = "2023-07-25T04:47:49.26Z" },
 ]

+[[package]]
+name = "azure-mgmt-cognitiveservices"
+version = "14.1.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "azure-mgmt-core" },
+    { name = "msrest" },
+    { name = "typing-extensions" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/fa/8e/9fcfdd507413a2536c5458b40942705ea8d74fe4e17f05fd1c32bb0225a9/azure_mgmt_cognitiveservices-14.1.0.tar.gz", hash = "sha256:915191374d0adb443863c20aaea2c9f3b9d558a849ac2b78f152249262fdcaf8", size = 184444, upload-time = "2025-10-24T07:28:14.229Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/d3/25/ed6bbc01a03991255dd22aa41091360d225f1be20c88710af0f4a6c27459/azure_mgmt_cognitiveservices-14.1.0-py3-none-any.whl", hash = "sha256:3c0eecc00d183842a11d754f4f5c3328ff86f2d6c0a2b81b28dd7e073680258e", size = 290096, upload-time = "2025-10-24T07:28:15.766Z" },
+]
+
 [[package]]
 name = "azure-mgmt-compute"
 version = "34.0.0"
@@ -1847,11 +1863,11 @@ wheels = [

 [[package]]
 name = "certifi"
-version = "2026.1.4"
+version = "2026.10.19"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/e0/2d/a891ca51311197f6ad14a7ef42e2399f36cf2f9bd44752b3dc4eab60fdc5/certifi-2026.1.4.tar.gz", hash = "sha256:ac726dd470482006e014ad384921ed6438c457018f4b3d204aea4281258b2120", size = 154268, upload-time = "2026-01-04T02:42:41.825Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/a6/bd/1436c50cc46699de0230fbaacc1d1de7bfec413176099949e9d5112e88f2/certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae", size = 137598, upload-time = "2026-10-20T02:24:16.604Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/e6/ad/3cc14f097111b4de0040c83a525973216457bbeeb63739ef1ed275c1c021/certifi-2026.1.4-py3-none-any.whl", hash = "sha256:9943707519e4add1115f44c2bc244f782c0249876bf51b6599fee1ffbedd685c", size = 152900, upload-time = "2026-01-04T02:42:40.15Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b", size = 136464, upload-time = "2026-10-20T02:24:15.072Z" },
 ]

 [[package]]
@@ -2329,16 +2345,16 @@ with-social = [

 [[package]]
 name = "django"
-version = "5.1.15"
+version = "5.2.17"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
    { name = "asgiref" },
    { name = "sqlparse" },
    { name = "tzdata", marker = "sys_platform == 'win32'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/10/45/1ac68964193cfcc0b0912a0f68025d5bdb54f71ba7b8716e85b959874bd0/django-5.1.15.tar.gz", hash = "sha256:46a356b5ff867bece73fc6365e081f21c569973403ee7e9b9a0316f27d0eb947", size = 10719662, upload-time = "2025-12-02T14:01:31.931Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/d5/d8/43e9d000519adceb189620b6869ff88031e046df91c2e9da72f8f6918399/django-5.2.17.tar.gz", hash = "sha256:9d4d93be539a18ab80d058eb515900e10951e04c537c5a6b394fc49528d3251f", size = 10889740, upload-time = "2026-08-04T15:04:03.173Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/27/79/372e091f0eba4ddb8228245ccd1baaa140e9658711f5e3a0056e540b4c1e/django-5.1.15-py3-none-any.whl", hash = "sha256:117871e58d6eda37f09870b7d73a3d66567b03aecd515b386b1751177c413432", size = 8260901, upload-time = "2025-12-02T14:01:27.352Z" },
+    { url = "https://files.pythonhosted.org/packages/df/f8/ce120525ca78f12b07daf65786679c5d0b54a75285a8958d3ae55e39da35/django-5.2.17-py3-none-any.whl", hash = "sha256:f04fb3b36ee119e1af4fa1d397d5fd6cf12700f49321e84d4f4c642c5b1973db", size = 8315563, upload-time = "2026-08-04T15:03:59.1Z" },
 ]

 [[package]]
@@ -2667,27 +2683,27 @@ wheels = [

 [[package]]
 name = "dulwich"
-version = "1.2.5"
+version = "1.2.9"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
    { name = "typing-extensions", marker = "python_full_version < '3.12'" },
    { name = "urllib3" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/7f/85/ceb8ecff5cdeee4ceeebb86b599476dee559041dacc6c2c50cc0d4711549/dulwich-1.2.5.tar.gz", hash = "sha256:0395b2c8924c3424bafe2d9c1edd5348cc4b21ce9c1d6655bf01f9a5c47164c8", size = 1253230, upload-time = "2026-05-28T22:27:55.17Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/de/17/0a0fa2b998cd9a852b1aa901e3f6145f13a4334f64b91564847e5880968d/dulwich-1.2.9.tar.gz", hash = "sha256:b395466b78eb5c36baf34381b8b831fd26da8a44b428a2eea1d57ba53f68a234", size = 1309797, upload-time = "2026-07-06T20:57:23.202Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/4a/4a/654ae1671610fdf6b65a64586ad67ddd8550d4d08a632b2a4b9614754b6d/dulwich-1.2.5-cp311-cp311-macosx_10_12_x86_64.whl", hash = "sha256:556593fd11637f80f6018bee1916b1a84f5b420423b470ebb3f1a782ad6ef081", size = 1399277, upload-time = "2026-05-28T22:27:00.801Z" },
-    { url = "https://files.pythonhosted.org/packages/85/d8/06ee3bc8eded4bd7adf8adf0c9ea5f19bf96f7e5e626bfaf7311cde4208a/dulwich-1.2.5-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:a70477c991e96cfe8fdd7c866e7251faf71b38bfeb51d6f27554c9cce1caabf3", size = 1382310, upload-time = "2026-05-28T22:27:02.216Z" },
-    { url = "https://files.pythonhosted.org/packages/07/17/a03adf50b9095f9f5d863393f21d585dea39bdc4fdf60788ff3a9407a512/dulwich-1.2.5-cp311-cp311-manylinux_2_28_aarch64.whl", hash = "sha256:9008ef25cabd379cda4fa86000fc38ca14b72afe17db798a8c85c0b2b7ce4d1e", size = 1470993, upload-time = "2026-05-28T22:27:04.075Z" },
-    { url = "https://files.pythonhosted.org/packages/60/58/1dc352d2a5e80befe4338af7208febb44bcfd7496b0dde5ac6dacb07b031/dulwich-1.2.5-cp311-cp311-manylinux_2_28_x86_64.whl", hash = "sha256:a5549f4afc973e0a15ea6b0244d57f848d3f3ee13dac557eb311024aebebf128", size = 1497820, upload-time = "2026-05-28T22:27:05.549Z" },
-    { url = "https://files.pythonhosted.org/packages/c1/a8/e058959a87e7df7753b112ef66a43ccbc57338c1bbdc23a0edf3833396df/dulwich-1.2.5-cp311-cp311-win32.whl", hash = "sha256:5108acead814d1de8b6262d6d8fb90af7e82f5a4d83788b6b48e39d01800a92f", size = 1066549, upload-time = "2026-05-28T22:27:06.832Z" },
-    { url = "https://files.pythonhosted.org/packages/33/91/ff0b444f686718635348986bd73dfce42e947912417893de35de399b878b/dulwich-1.2.5-cp311-cp311-win_amd64.whl", hash = "sha256:5e067b7feceb7034bc99e7c7143a704f1d97d4be7027d9a0aa5a83c0657ff091", size = 1079481, upload-time = "2026-05-28T22:27:08.33Z" },
-    { url = "https://files.pythonhosted.org/packages/19/22/4f75770bbe5521cac61c4820ef46d4fbf8c2175d3519ba3d0378d4ba798e/dulwich-1.2.5-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:701a9ecf7a8a44f5e2459e46befa93530cf36a8b1ae3140aefc007db1d7d0207", size = 1396522, upload-time = "2026-05-28T22:27:09.997Z" },
-    { url = "https://files.pythonhosted.org/packages/e5/b1/c07c347681c0cf6acd4b189bf6e8d6207c71a1347b7a1e865eb40faa46b9/dulwich-1.2.5-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:2f90d68bfa97c4ca71de7507984365aefe27b6d248cb28dc99644d0f3ae8c60b", size = 1334826, upload-time = "2026-05-28T22:27:11.582Z" },
-    { url = "https://files.pythonhosted.org/packages/13/80/6818eb7ce492e18ab2efa92ab901d173b4b0b159e5681c1424f329600c40/dulwich-1.2.5-cp312-cp312-manylinux_2_28_aarch64.whl", hash = "sha256:00b54a1d56ddbacdd8eadd6d4787a51b3a05fefa30eadbf9165fd283a00b90ed", size = 1416616, upload-time = "2026-05-28T22:27:13.195Z" },
-    { url = "https://files.pythonhosted.org/packages/14/a7/9790e60d19870f6554f7583722bb324c1355784316f20aeda1c0b5b1491a/dulwich-1.2.5-cp312-cp312-manylinux_2_28_x86_64.whl", hash = "sha256:d8f7ea8f47e38e5b0de3fab97e07e9c9161ffddc90b3964512cab2b7749df4e6", size = 1441354, upload-time = "2026-05-28T22:27:14.683Z" },
-    { url = "https://files.pythonhosted.org/packages/91/44/0ea8a69c24aa1254ff5996d682eae2eab287d471b937dcdb26d9ea9720b4/dulwich-1.2.5-cp312-cp312-win32.whl", hash = "sha256:8929134acf4ff967203df7600b38535f9b5b590462067a7e30dbce01acb97af9", size = 1017058, upload-time = "2026-05-28T22:27:16.121Z" },
-    { url = "https://files.pythonhosted.org/packages/bd/9c/2fcddda7faec3bae52db7c64bfcb5dc756f597f33fae90e8d4e4b4d3b39b/dulwich-1.2.5-cp312-cp312-win_amd64.whl", hash = "sha256:9693d2c9e226b2ea855c1dc3a87e2f4d972f7523fc0f7924e5997e9f4c23d97f", size = 1031731, upload-time = "2026-05-28T22:27:17.633Z" },
-    { url = "https://files.pythonhosted.org/packages/07/4b/4a18a59ad230581cd0ef460e96001f90762e566dc2dfdba22aa358eb5a0e/dulwich-1.2.5-py3-none-any.whl", hash = "sha256:1679b376433a0fc7f36586afda1d4ed7427afa7a79d4bf17e5014474eea69fa4", size = 686745, upload-time = "2026-05-28T22:27:53.695Z" },
+    { url = "https://files.pythonhosted.org/packages/95/70/0345eb2b07a9b26337d7e9ee2c0fc634be81de9969d683b72eca04878f72/dulwich-1.2.9-cp311-cp311-macosx_10_12_x86_64.whl", hash = "sha256:b01fd4d8bd4fdd2bd99eb465e101b4fac2b50436e317b971da7ac3a1bd3a83d8", size = 1378231, upload-time = "2026-07-06T20:56:20.301Z" },
+    { url = "https://files.pythonhosted.org/packages/56/dd/a699facf7371cb26233ea1f659ff172995cc06a999ba07992d2762a7dc1f/dulwich-1.2.9-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:e92f76f0048b076ef692094d28645c5e0f65dae1d5e393fbb2e8db2edc017cd3", size = 1371812, upload-time = "2026-07-06T20:56:21.958Z" },
+    { url = "https://files.pythonhosted.org/packages/35/02/73baf09f61b66431adb1cd01a9fbe748369a62814b6e27362daaaa924f04/dulwich-1.2.9-cp311-cp311-manylinux_2_28_aarch64.whl", hash = "sha256:ac47e02988bdcde0c23f98275908390448617d491ad5d9cb9f33cf3eb8ad512b", size = 1493888, upload-time = "2026-07-06T20:56:23.697Z" },
+    { url = "https://files.pythonhosted.org/packages/48/e4/aa2dff296c4a9cd769b5a55a8de68622c1605ad39d75b741527e63117acf/dulwich-1.2.9-cp311-cp311-manylinux_2_28_x86_64.whl", hash = "sha256:5e6eb07fbd288059da71019f6746655cd1e136db2f1664fa3e1c81bc11973187", size = 1523051, upload-time = "2026-07-06T20:56:25.525Z" },
+    { url = "https://files.pythonhosted.org/packages/24/da/73162905ffb2041a8f484e46c7bb269cb39cc984335b1e66eef23d38cb1d/dulwich-1.2.9-cp311-cp311-win32.whl", hash = "sha256:e96f5d29bf509ceb2dbf9cf4de67fe6e5d785b22f721814360563be6757e7473", size = 1043350, upload-time = "2026-07-06T20:56:27.443Z" },
+    { url = "https://files.pythonhosted.org/packages/ab/e6/8e40755771b5d05c9268771f26cef8f2ba5f7a849bedcee06504d7f842ae/dulwich-1.2.9-cp311-cp311-win_amd64.whl", hash = "sha256:255c4c3605582fe8958afeff94fc1f0883aedc37495c43a74e031b904f3bb86d", size = 1103738, upload-time = "2026-07-06T20:56:29.145Z" },
+    { url = "https://files.pythonhosted.org/packages/ab/b0/e4f14c603fa42e07d8a7f1d5a73f123a8148d52b79b3cc478797126dcdd3/dulwich-1.2.9-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:3d5a2896b6dc3f0c794d34b3eb1af317a43b557fefbee0099ef83d35bb6e102f", size = 1372001, upload-time = "2026-07-06T20:56:30.605Z" },
+    { url = "https://files.pythonhosted.org/packages/c9/b7/11c40f1c3ce304e7c2e0e759c589430f043a7967689e61ecb0142ad1ebdc/dulwich-1.2.9-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:30e72110630e2990d11770227191dfa730b7c045030f818eca5803c6b89bbc5b", size = 1356130, upload-time = "2026-07-06T20:56:32.176Z" },
+    { url = "https://files.pythonhosted.org/packages/6d/1a/10d61b784c295a4567615579272d91ede81793c72ead207484c0ed845ddd/dulwich-1.2.9-cp312-cp312-manylinux_2_28_aarch64.whl", hash = "sha256:5c636fcb33c4db5495a2dc7686cf6a26cf537060a859982e104dcf67635ea7f7", size = 1437923, upload-time = "2026-07-06T20:56:33.741Z" },
+    { url = "https://files.pythonhosted.org/packages/6e/68/3073e2737e2c3f299e736490ec2e8b5864593858b9d08f36fbcbca80a862/dulwich-1.2.9-cp312-cp312-manylinux_2_28_x86_64.whl", hash = "sha256:1aa1b55f59a046fc8f25a67560473c789b7ec113b85c6a08021aae10c6f78945", size = 1463517, upload-time = "2026-07-06T20:56:35.812Z" },
+    { url = "https://files.pythonhosted.org/packages/f2/61/f96c0da72b08bfbc4e38571374c3000dee13e6d72dd06f25281d36d5b0b7/dulwich-1.2.9-cp312-cp312-win32.whl", hash = "sha256:e27a06f9f71275d712b616ad23008df5f2dcf54a06cb8e2a24be8819ee1ce13a", size = 1082071, upload-time = "2026-07-06T20:56:38.139Z" },
+    { url = "https://files.pythonhosted.org/packages/38/96/567f32885e780aaa7441f9f5c6f162e7271d149e27d3cb661caf939cd671/dulwich-1.2.9-cp312-cp312-win_amd64.whl", hash = "sha256:81e1005ffc5d5c872bfc87ac3442f722bce27ba10e435543d5302853c34abf56", size = 1053612, upload-time = "2026-07-06T20:56:39.977Z" },
+    { url = "https://files.pythonhosted.org/packages/cd/f9/a6677c0e698b5b781d663eb394bd15cc69c4a270b11cdcc128076753d75c/dulwich-1.2.9-py3-none-any.whl", hash = "sha256:79ff0ff35c4e17ccd58f9bfb23f4f8d416b0b09337b8c99ee3b4f10459bb0d68", size = 711459, upload-time = "2026-07-06T20:57:21.516Z" },
 ]

 [[package]]
@@ -3501,6 +3517,17 @@ wheels = [
    { url = "https://files.pythonhosted.org/packages/18/7d/721f162c46e3de604a73674223bf6c6bc6cf7ade25b3751a71288f4dd122/huaweicloudsdkrds-3.1.204-py3-none-any.whl", hash = "sha256:a790b5b3c457a608e5679c101f463b4d037dd9a8a66f6e46144a9e5a4b37780f", size = 1626906, upload-time = "2026-07-09T09:04:06.936Z" },
 ]

+[[package]]
+name = "huaweicloudsdksmn"
+version = "3.1.204"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "huaweicloudsdkcore" },
+]
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/e9/5d/c0de47d011f1932c9c0ddf669c238d9fad01653d438d38203703526799d7/huaweicloudsdksmn-3.1.204-py3-none-any.whl", hash = "sha256:b0818ea9293e27458c8fa1d2da021c98006cbf9ce01cf17a0f1df598c4da3a6c", size = 323674, upload-time = "2026-07-09T09:04:24.804Z" },
+]
+
 [[package]]
 name = "huaweicloudsdkvpc"
 version = "3.1.204"
@@ -4635,33 +4662,38 @@ wheels = [

 [[package]]
 name = "pillow"
-version = "12.3.0"
+version = "13.0.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/1c/3d/bb7fca845737cf9d7dbde16ed1843984665ff2e0a518f5db43e77ec540b9/pillow-12.3.0.tar.gz", hash = "sha256:3b8182a766685eaa002637e28b4ec8d6b18819a0c71f579bf0dbaa5830297cce", size = 47025035, upload-time = "2026-07-01T11:56:38.965Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/ce/a4/9cc30690a394a8305e8be4c9036aa16d0dfddadd09079860b582f562496d/pillow-13.0.0.tar.gz", hash = "sha256:cdcd1ba258178f7356d74170c9a81ba4eab6a5d55748bc402a5a2a6fe6be3510", size = 47058631, upload-time = "2026-10-16T22:18:09.718Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/fb/c8/0a78b0e02d7ac54bc03e5321c9220da52f0c2ea83b21f7c40e7f3169c502/pillow-12.3.0-cp311-cp311-macosx_10_10_x86_64.whl", hash = "sha256:00808c5e14ef63ac5161091d242999076604ff74b883423a11e5d7bbb38bf756", size = 5392415, upload-time = "2026-07-01T11:53:47.162Z" },
-    { url = "https://files.pythonhosted.org/packages/b2/5b/a02d30018abd97ced9f5a6c63d28597694a00d066516b9c1c6de45859fc9/pillow-12.3.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:37d6d0a00072fd2948eb22bce7e1475f34569d90c87c59f7a2ec59541b77f7a6", size = 4785266, upload-time = "2026-07-01T11:53:49.079Z" },
-    { url = "https://files.pythonhosted.org/packages/c8/98/766667a4be768150a202836acd9fad19c06824ca86c4286d3cf6b274964e/pillow-12.3.0-cp311-cp311-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:bcb46e2f9feff8d06323983bd83ed00c201fdcab3d74973e7072a889b3979fcd", size = 6263814, upload-time = "2026-07-01T11:53:51.32Z" },
-    { url = "https://files.pythonhosted.org/packages/3b/2d/ede717bc1144f63886c21fd349bb95860b0d1a21149ff16f2bb362b612b6/pillow-12.3.0-cp311-cp311-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:23d27a3e0307ec2244cc51e7287b919aa68d097504ebe19df4e76a98a3eea5bd", size = 6934408, upload-time = "2026-07-01T11:53:53.487Z" },
-    { url = "https://files.pythonhosted.org/packages/a3/48/9c58b685e69d49c31af6c8eb9012055fab7e665785165c84796e2c73ce72/pillow-12.3.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:4f883547d4b7f0495ebe7056b0cc2aea76094e7a4abc8e933540f3271df27d9c", size = 6337160, upload-time = "2026-07-01T11:53:55.457Z" },
-    { url = "https://files.pythonhosted.org/packages/ff/fa/dc2a5c0ba6df93f67c31d34b808b7ce440b40cdbf96f0b81cde1d1e6fa93/pillow-12.3.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:236ff70b9312fb68943c703aa842ca6a758abfa45ac187a5e7c1452e96ef72b5", size = 7045172, upload-time = "2026-07-01T11:53:57.736Z" },
-    { url = "https://files.pythonhosted.org/packages/86/a5/444817a4d4c4c2417df00513086ca196f388d8f9ef40c2e4ccd1ad1af54b/pillow-12.3.0-cp311-cp311-win32.whl", hash = "sha256:10e41f0fbf1eec8cfd234b8fe17a4caac7c9d0db4c204d3c173a8f9f6ef3232b", size = 6472232, upload-time = "2026-07-01T11:53:59.767Z" },
-    { url = "https://files.pythonhosted.org/packages/63/c6/4bad1b18d132a50b27e1365e1ab163616f7a5bb56d330f66f9d1d9d4f9d4/pillow-12.3.0-cp311-cp311-win_amd64.whl", hash = "sha256:8e95e1385e4998ae9694eeaa4730ba5457ff61185b3a55e2e7bea0880aef452a", size = 7233653, upload-time = "2026-07-01T11:54:02.066Z" },
-    { url = "https://files.pythonhosted.org/packages/fd/16/00f91ab7760dc842f5aad55217e80fc4a7067a0604535249bc8a2d6d9870/pillow-12.3.0-cp311-cp311-win_arm64.whl", hash = "sha256:ebaea975e03d3141d9d3a507df75c9b3ec90fa9d2ffd07567b3a978d9d790b26", size = 2568195, upload-time = "2026-07-01T11:54:04.622Z" },
-    { url = "https://files.pythonhosted.org/packages/37/bf/fb3ebff8ddcb76aac5a01389251bbbb9519922a9b520d8247c1ca864a25d/pillow-12.3.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:ba09209fbe443b4acccebe845d8a138b89a8f4fbaeedd44953490b5315d5e965", size = 5345969, upload-time = "2026-07-01T11:54:06.397Z" },
-    { url = "https://files.pythonhosted.org/packages/d8/66/9a386a92561f402389a4fc70c18838bf6d35eb5eb5c6850b4b2dc64f5048/pillow-12.3.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:ffd0c5368496f41b0944be820fcb7a838aa6e623d250b01acf2643939c3f99d7", size = 4780323, upload-time = "2026-07-01T11:54:09.351Z" },
-    { url = "https://files.pythonhosted.org/packages/25/27/ac8f99618ffd3dde21db0f4d4b1d2ab00c0880595bfd17df103f7f39fd0c/pillow-12.3.0-cp312-cp312-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:d9c7f76c0673154f044e9d78c8655fb4213f6ca31a836df48b40fe5d187717b9", size = 6266838, upload-time = "2026-07-01T11:54:11.71Z" },
-    { url = "https://files.pythonhosted.org/packages/84/21/a35af28dcc61f37ed850a2d64c65c701321dfbf25085e469d5559360cbbf/pillow-12.3.0-cp312-cp312-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:78cb2c6865a35ab8ff8b75fd122f6033b92a62c82801110e48ddd6c936a45d91", size = 6940830, upload-time = "2026-07-01T11:54:13.732Z" },
-    { url = "https://files.pythonhosted.org/packages/eb/51/8b08617af3ad95e33ce6d7dd2c99ed6c8298f7fb131636303956be022e25/pillow-12.3.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:e491916b378fba47242221bb9ead245211b70d504f495d105d17b14a24b4907c", size = 6344383, upload-time = "2026-07-01T11:54:15.756Z" },
-    { url = "https://files.pythonhosted.org/packages/1d/72/cf78ac9780bb93c28328f408973845a309d4d145041665f734572ced1b52/pillow-12.3.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:0dd2064cbc55aaec028ef5fbb60fa47bb6c3e7918e07ff17935284b227a9d2df", size = 7052934, upload-time = "2026-07-01T11:54:17.721Z" },
-    { url = "https://files.pythonhosted.org/packages/20/20/25e0f4dc178a6bc0696793720055519a0de89e7661dae886992decbd2f81/pillow-12.3.0-cp312-cp312-win32.whl", hash = "sha256:dbce0b29841537a2fa4a214c2bbf14de3587c9680caa9b4e217568472490b28f", size = 6472684, upload-time = "2026-07-01T11:54:19.839Z" },
-    { url = "https://files.pythonhosted.org/packages/45/89/da2f7971a317f83d807fdd4065c0af40208e59e692cc43d315a71a0e96d1/pillow-12.3.0-cp312-cp312-win_amd64.whl", hash = "sha256:a2b55dd6b2a4c4b7d87ffa56bdb33fdc5fdb9a462173861a7bc097f17d91cb09", size = 7227137, upload-time = "2026-07-01T11:54:22.025Z" },
-    { url = "https://files.pythonhosted.org/packages/de/47/4845a0a6c0dbf1db8456bd9fc791f13c5ced7ced20606d08a0aacfd25b49/pillow-12.3.0-cp312-cp312-win_arm64.whl", hash = "sha256:331b624368d4f1d069149002f25f44bc61c8919ce8ddb3c45bdad8f6e2d89510", size = 2568267, upload-time = "2026-07-01T11:54:24.051Z" },
-    { url = "https://files.pythonhosted.org/packages/75/18/2e8b40223153ccbc60df07f9e8928dc0c76202aa4e55ae9f53962b6510d6/pillow-12.3.0-pp311-pypy311_pp73-macosx_10_15_x86_64.whl", hash = "sha256:b3c777e849237620b022f7f297dd67705f9f5cf1685f09f02e46f93e92725468", size = 5302510, upload-time = "2026-07-01T11:56:25.736Z" },
-    { url = "https://files.pythonhosted.org/packages/46/3e/51fabf59d5ab801ceab709453d3ab6b180083496579549de4c45ced6528a/pillow-12.3.0-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:b343699e8308bdc51978310e1c959c584e7869cc8c40780058c87da7781a1e94", size = 4736058, upload-time = "2026-07-01T11:56:28.041Z" },
-    { url = "https://files.pythonhosted.org/packages/bf/20/22fe9384b7949e25fb1293bcfc84fb82590ff4ea6b37c95b24d26d793d86/pillow-12.3.0-pp311-pypy311_pp73-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:fbd139c8447d25dd750ab79ee274cc5e1fe80fc56340ab10b18a195e1b6eca3e", size = 5237776, upload-time = "2026-07-01T11:56:30.263Z" },
-    { url = "https://files.pythonhosted.org/packages/08/14/f6ba68107680ffa74b39985f3f30884e41318fbc4250caa423c79b4788bb/pillow-12.3.0-pp311-pypy311_pp73-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:e7e480451b9fa137494bccd3a7d69adbe8ac65a87d97be61e11f1b1050a5bac3", size = 5860358, upload-time = "2026-07-01T11:56:32.68Z" },
-    { url = "https://files.pythonhosted.org/packages/36/54/0169bc772ec491108b62f644f8ecf1fe5d8ae5ebafde2ee2142210166903/pillow-12.3.0-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:04f01d28a6aaff387bf842a13be313df23ba0597a44f1a976c9feb3c6ff4711a", size = 7231786, upload-time = "2026-07-01T11:56:35.046Z" },
+    { url = "https://files.pythonhosted.org/packages/6c/d7/af6af1b8cc55e07cb0489d5b0950bf5a9bb1461eeba825700b6d8d0e26ea/pillow-13.0.0-cp311-cp311-macosx_10_10_x86_64.whl", hash = "sha256:6f38f3f885a09cafc93fd667b1173a92f379e43785d635e7983c893f0da319fb", size = 5592324, upload-time = "2026-10-16T22:15:24.672Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/d2/2c12cb4fbb5d95f38d1001ff3d95fafcb830077018cba40e56a8f932dfbc/pillow-13.0.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:37290fbef0c73e2d51d594eb78fded7dc7170d1c3ad0a890269e6fd8c8c4e061", size = 4856298, upload-time = "2026-10-16T22:15:27.669Z" },
+    { url = "https://files.pythonhosted.org/packages/5c/ee/229b27472483a4801ea94990815e710391836afdf987b4b722b62bd75db6/pillow-13.0.0-cp311-cp311-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:7c88c10dd432f3b39ccdafc9ed81d0c21b8fd634502574da76d1bfa4fe2c76d0", size = 6517304, upload-time = "2026-10-16T22:15:29.43Z" },
+    { url = "https://files.pythonhosted.org/packages/36/46/f509b74787f40ce0627501089d630b2c741b63b244c1f40b640b3b01e181/pillow-13.0.0-cp311-cp311-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:a625df9a2a5597fa5e5266e01aefc82604bb85d291e3547981e863560d75da6c", size = 7140667, upload-time = "2026-10-16T22:15:31.368Z" },
+    { url = "https://files.pythonhosted.org/packages/aa/a4/5a398b8ec2c37145397d6461c0b551c23ec03072aa64f357aed25e582b00/pillow-13.0.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:10b5019883c98f1dd819ca48ffc6f33a91cee04948fe637c605f4345c7cafd6f", size = 6610583, upload-time = "2026-10-16T22:15:34.025Z" },
+    { url = "https://files.pythonhosted.org/packages/4f/7b/f2f1109b230fd4e2d57ab2305de31adc37ea9b4ff8719436c623cb484415/pillow-13.0.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:f391dc92a015c478745192fe4f2e120c2af2aba18d9fe0616341cbf537599806", size = 7218241, upload-time = "2026-10-16T22:15:36.214Z" },
+    { url = "https://files.pythonhosted.org/packages/ab/d3/069edb9083b267746baf59756282cacef904d3475c5288c7216fb5195a98/pillow-13.0.0-cp311-cp311-win32.whl", hash = "sha256:6a0920cb55df5a4d3f6862964908078c0bd59332bdd1bcd20d14e8c70ef27cc5", size = 6515278, upload-time = "2026-10-16T22:15:38.129Z" },
+    { url = "https://files.pythonhosted.org/packages/7d/f6/6e2d96413e4c9dbec12ea584d9e646d602877d4cce3ea669099f959deac6/pillow-13.0.0-cp311-cp311-win_amd64.whl", hash = "sha256:d7710eb676e9bb68965cb045be0d333b4c0d7f9dfbaa7fbf121385b1588683d3", size = 7278471, upload-time = "2026-10-16T22:15:40.286Z" },
+    { url = "https://files.pythonhosted.org/packages/70/e7/baff21f8cb60496c8c250609501b88919eeedb4088d3da106f6c62f3f3c0/pillow-13.0.0-cp311-cp311-win_arm64.whl", hash = "sha256:12fbb851cf323cc19aac3eea1df5ad17b57e91e9fe3cfd06100dba7bb8208c13", size = 2698981, upload-time = "2026-10-16T22:15:42.637Z" },
+    { url = "https://files.pythonhosted.org/packages/7a/b8/58d79332229482eb0d27c82973850808c19d37e5bdc14443d3417bd373f5/pillow-13.0.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:67c8d44ad89fa7eb88de5d6ef6199b1e03dd24974f85a67639fc8badb801fe79", size = 5568643, upload-time = "2026-10-16T22:15:44.474Z" },
+    { url = "https://files.pythonhosted.org/packages/39/4b/f2ed53d83aa44ac19599ac0a54897f867fafb95f406980d1e24083f8cbe3/pillow-13.0.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:fc481f742ccda20e9ed760b8f978dff50f2a4e9bc253ac167fb0a05b0783ef52", size = 4852329, upload-time = "2026-10-16T22:15:46.284Z" },
+    { url = "https://files.pythonhosted.org/packages/3b/bb/9e30e8ed18c20800ee327a12107d5249ad8dc444867b3adfcc21654e3c71/pillow-13.0.0-cp312-cp312-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:8bf295fe459343bc6093c8e5e0df60bfa189e0fcb775a22e2c2488fdeccc6c0d", size = 6519309, upload-time = "2026-10-16T22:15:48.14Z" },
+    { url = "https://files.pythonhosted.org/packages/e6/99/fdf65cc539e266ab93546c261bdf98411fe165c6e4e13f9dbf597097192b/pillow-13.0.0-cp312-cp312-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:42d63be3af4f9b951b199b0a9d23365d37ab14687e6d77b74940432c8515c4ca", size = 7144542, upload-time = "2026-10-16T22:15:50.093Z" },
+    { url = "https://files.pythonhosted.org/packages/26/9b/f38b7c4d8f599537e2d1a6d546cec9beef7536ff8f5c49a3f9c78179d8ac/pillow-13.0.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:4bd024d567eca931b668978d672dba914d4b8e2628e2c3073a2ad178de8a2620", size = 6618042, upload-time = "2026-10-16T22:15:52.054Z" },
+    { url = "https://files.pythonhosted.org/packages/a8/7c/45ee28531f89ee4582967d8a17f7a26d71ca64cd902b93c269590cd60a00/pillow-13.0.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:23edf4ec4b6f4f240e8df6e4985e9ee2ced86474632433e55fb1e2548744bf40", size = 7228137, upload-time = "2026-10-16T22:15:54.009Z" },
+    { url = "https://files.pythonhosted.org/packages/01/bc/9c2a969cb1b70201d04fa17fd5aedf02a732870b8da86bceaaa30b0ca385/pillow-13.0.0-cp312-cp312-win32.whl", hash = "sha256:02464da86f561f410e13b061ec37c3068a9cb557a095494157742d07b3c24a27", size = 6515423, upload-time = "2026-10-16T22:15:56.25Z" },
+    { url = "https://files.pythonhosted.org/packages/ff/cd/73a79ecdc822076002eb24b5e1e4a530b0bb5310fcb6d239abbec877110b/pillow-13.0.0-cp312-cp312-win_amd64.whl", hash = "sha256:ff3fe9eb621fbb9db4c4be33ab946f6bac5f98ab50ca8d3260503653656c961b", size = 7272166, upload-time = "2026-10-16T22:15:58.597Z" },
+    { url = "https://files.pythonhosted.org/packages/4a/a3/be5a1236efd085b3984e4305da8f179ae9dab80c991d2ad78f2bd5c4c843/pillow-13.0.0-cp312-cp312-win_arm64.whl", hash = "sha256:c3bc8ee0271387e0b1e3ad0ff893645990a656e79bf9c42f4f734a3642b11d51", size = 2698943, upload-time = "2026-10-16T22:16:00.637Z" },
+    { url = "https://files.pythonhosted.org/packages/68/c0/fb7b1caf25ed5ac5d46116f09b8b0706b9559833c65c667cecb1a53153f2/pillow-13.0.0-pp311-pypy311_pp80-macosx_10_15_x86_64.whl", hash = "sha256:405be6058e206a86fedce2f715ecc2343f94072d7925251632dffa2c05f70dca", size = 5521630, upload-time = "2026-10-16T22:17:50.008Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/e6/4d11d5b1137f4fc080605cce410cfaae4f303ad400bdec75d27d3083fa29/pillow-13.0.0-pp311-pypy311_pp80-macosx_11_0_arm64.whl", hash = "sha256:b84be41387fc00db28c13c02e30d42b02d8d8f6a4a741a1aee6012ca7f1f6039", size = 4806023, upload-time = "2026-10-16T22:17:51.932Z" },
+    { url = "https://files.pythonhosted.org/packages/f1/45/0923202a658e8ff6aafd72c1a4395ebadcdebaa182c437d8595d3dd3db32/pillow-13.0.0-pp311-pypy311_pp80-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:a192360d512305fe92d3053e4f7627bbad1f7708f1f4ad38cccd9336acabe9ad", size = 5464831, upload-time = "2026-10-16T22:17:53.742Z" },
+    { url = "https://files.pythonhosted.org/packages/07/52/d3e38f0cad1dadea2a658b9a7d6ba8a04048f5ae14f011b806e5c3bd6bcb/pillow-13.0.0-pp311-pypy311_pp80-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:83b37abd87b590acd8f47ca8a61f70893322b11834d36e07c2298dacad4d14d2", size = 6043133, upload-time = "2026-10-16T22:17:55.625Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/f9/2ed7685980c1d64f8131a7d87a19c369424747577152622b73ddeff163b7/pillow-13.0.0-pp311-pypy311_pp80-win_amd64.whl", hash = "sha256:73ee25cf8cf8b75d5a5aeed7cb6588f5e5dbfbb0fde51707b630bbb23897645c", size = 7365208, upload-time = "2026-10-16T22:17:57.509Z" },
+    { url = "https://files.pythonhosted.org/packages/60/da/f6d644e631c5b370c5d0b899f3ccadd2780aab070b29a110527cf4e1fd2c/pillow-13.0.0-pp312-pypy312_pp80-macosx_10_15_x86_64.whl", hash = "sha256:8619685cad8efc4c38c66d3b36aad854523297c43d748b3b6f0cc03c90ba3463", size = 5523188, upload-time = "2026-10-16T22:17:59.334Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/b0/2594f202d743a35d4fe80682bfd96f277e5ca7aecb27cf64ef5bfc1d000b/pillow-13.0.0-pp312-pypy312_pp80-macosx_11_0_arm64.whl", hash = "sha256:7e91e97a929232cdb828889ee6ad0e48d7f40f4ec38818f4e4a8968b2b1af22e", size = 4806808, upload-time = "2026-10-16T22:18:01.188Z" },
+    { url = "https://files.pythonhosted.org/packages/8e/ed/d504165ef79af6fafe25c76726cf30f544cc236002f7ed054f1d51adc4ff/pillow-13.0.0-pp312-pypy312_pp80-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:93ff9c9c3663ce23aaa5d0b6b6abac55359e2a0c06c7e30f3771829af816be63", size = 5464358, upload-time = "2026-10-16T22:18:02.779Z" },
+    { url = "https://files.pythonhosted.org/packages/7b/fe/a10aba5503ca13e9e009b8bd0a1a4ce5584bdce246245fd6f3a83701369c/pillow-13.0.0-pp312-pypy312_pp80-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:e65dd6e75de67b2362a4fa3e16aa627595f65054dc4ec73d64680c84d592fa61", size = 6043514, upload-time = "2026-10-16T22:18:04.538Z" },
+    { url = "https://files.pythonhosted.org/packages/c0/37/66b12dc476041fe523bca29c9d58fbf1ea92a4eaf73acfb9e993948f1191/pillow-13.0.0-pp312-pypy312_pp80-win_amd64.whl", hash = "sha256:567f20f1c75897d7663830da6ea8af719e03d712b1d9ee7f813319f9ece42e5a", size = 7366030, upload-time = "2026-10-16T22:18:06.638Z" },
 ]

 [[package]]
@@ -4835,8 +4867,8 @@ wheels = [

 [[package]]
 name = "prowler"
-version = "5.41.0"
-source = { git = "https://github.com/prowler-cloud/prowler.git?rev=master#f05a490cd74a2c0f11a5d66d8ce29d03fa5c64a2" }
+version = "5.45.0"
+source = { git = "https://github.com/prowler-cloud/prowler.git?rev=v5.45#9b56a3b657ef72c456a50ae9c9a0b044ce81dd5c" }
 dependencies = [
    { name = "alibabacloud-actiontrail20200706" },
    { name = "alibabacloud-credentials" },
@@ -4857,6 +4889,7 @@ dependencies = [
    { name = "azure-mgmt-apimanagement" },
    { name = "azure-mgmt-applicationinsights" },
    { name = "azure-mgmt-authorization" },
+    { name = "azure-mgmt-cognitiveservices" },
    { name = "azure-mgmt-compute" },
    { name = "azure-mgmt-containerregistry" },
    { name = "azure-mgmt-containerservice" },
@@ -4900,6 +4933,7 @@ dependencies = [
    { name = "huaweicloudsdkkms" },
    { name = "huaweicloudsdkobs" },
    { name = "huaweicloudsdkrds" },
+    { name = "huaweicloudsdksmn" },
    { name = "huaweicloudsdkvpc" },
    { name = "huaweicloudsdkwaf" },
    { name = "jsonschema" },
@@ -4938,7 +4972,7 @@ dependencies = [

 [[package]]
 name = "prowler-api"
-version = "1.45.0"
+version = "1.46.1"
 source = { virtual = "." }
 dependencies = [
    { name = "cartography" },
@@ -5012,7 +5046,7 @@ requires-dist = [
    { name = "celery", specifier = "==5.6.2" },
    { name = "defusedxml", specifier = "==0.7.1" },
    { name = "dj-rest-auth", extras = ["with-social", "jwt"], specifier = "==7.0.1" },
-    { name = "django", specifier = "==5.1.15" },
+    { name = "django", specifier = "==5.2.17" },
    { name = "django-allauth", extras = ["saml"], specifier = "==65.15.0" },
    { name = "django-celery-beat", specifier = "==2.9.0" },
    { name = "django-celery-results", specifier = "==2.6.0" },
@@ -5038,7 +5072,7 @@ requires-dist = [
    { name = "matplotlib", specifier = "==3.10.8" },
    { name = "neo4j", specifier = "==6.1.0" },
    { name = "openai", specifier = "==1.109.1" },
-    { name = "prowler", git = "https://github.com/prowler-cloud/prowler.git?rev=master" },
+    { name = "prowler", git = "https://github.com/prowler-cloud/prowler.git?rev=v5.45" },
    { name = "psycopg2-binary", specifier = "==2.9.9" },
    { name = "pytest-celery", extras = ["redis"], specifier = "==1.3.0" },
    { name = "reportlab", specifier = "==4.4.10" },
@@ -5332,11 +5366,11 @@ wheels = [

 [[package]]
 name = "pyjwt"
-version = "2.13.0"
+version = "2.14.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/3b/81/58d0ac84e1ef3a3843791d6954d94c0b33d526c75eeb1efbce9d0a4c4077/pyjwt-2.13.0.tar.gz", hash = "sha256:41571c89ca91598c79e8ef18a2d07367d4810fbbd6f637794879baf1b7703423", size = 107515, upload-time = "2026-05-21T19:54:36.618Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/af/c3/8a3b59c25070cc61dc517fbdfa5dc0904670c96f605cc69759dc09166b99/pyjwt-2.14.0.tar.gz", hash = "sha256:77283c83fb56ecf566a886c757a714bc83668e38156de2cce8263302f42e0b86", size = 113177, upload-time = "2026-09-11T13:11:54.638Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/a3/5e/ecf12fdb62546d64385c158514e9b2b671f7832108ef2ecd2020ce0af2d1/pyjwt-2.13.0-py3-none-any.whl", hash = "sha256:66adcc2aff09b3f1bbd95fc1e1577df8ac8723c978552fd43304c8a290ac5728", size = 31274, upload-time = "2026-05-21T19:54:35.362Z" },
+    { url = "https://files.pythonhosted.org/packages/9c/97/672cb32ce0dfea44b740cb7b4f97038463b9cf7c0ead1aacf595572851d6/pyjwt-2.14.0-py3-none-any.whl", hash = "sha256:ad0cef71c756a56e74863c2919cf0985f72decbcfcb550ee2f422e7c62b5eedc", size = 32896, upload-time = "2026-09-11T13:11:53.409Z" },
 ]

 [package.optional-dependencies]
@@ -5364,33 +5398,33 @@ wheels = [

 [[package]]
 name = "pymongo"
-version = "4.15.1"
+version = "4.18.2"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
    { name = "dnspython" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/22/f5/c0c6732fbd358b75a07e17d7e588fd23d481b9812ca96ceeff90bbf879fc/pymongo-4.15.1.tar.gz", hash = "sha256:b9f379a4333dc3779a6bf7adfd077d4387404ed1561472743486a9c58286f705", size = 2470613, upload-time = "2025-09-16T16:39:47.24Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/dc/04/455039b475bb8afa5af9b8c363fb773a45d898016f04ee40c1c75003a3f9/pymongo-4.18.2.tar.gz", hash = "sha256:1bd4321cc63c06954953eae9eb8fb5d9075296b96c0e3ed34ccb91a0dcce31a5", size = 2746691, upload-time = "2026-09-24T16:59:59.472Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/c9/da/89066930a70b4299844f1155fc23baaa7e30e77c8a0cbf62a2ae06ee34a5/pymongo-4.15.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:363445cc0e899b9e55ac9904a868c8a16a6c81f71c48dbadfd78c98e0b54de27", size = 865410, upload-time = "2025-09-16T16:38:16.279Z" },
-    { url = "https://files.pythonhosted.org/packages/99/8f/a1d0402d52e5ebd14283718abefdc0c16f308cf10bee56cdff04b1f5119b/pymongo-4.15.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:da0a13f345f4b101776dbab92cec66f0b75015df0b007b47bd73bfd0305cc56a", size = 865695, upload-time = "2025-09-16T16:38:18.015Z" },
-    { url = "https://files.pythonhosted.org/packages/53/38/d1ef69028923f86fd00638d9eb16400d4e60a89eabd2011fe631fd3186cf/pymongo-4.15.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:9481a492851e432122a83755d4e69c06aeb087bbf8370bac9f96d112ac1303fd", size = 1434758, upload-time = "2025-09-16T16:38:20.141Z" },
-    { url = "https://files.pythonhosted.org/packages/b0/eb/a8d5dff748a2dd333610b2e4c8120b623e38ea2b5e30ad190d0ce2803840/pymongo-4.15.1-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:625dec3e9cd7c3d336285a20728c01bfc56d37230a99ec537a6a8625af783a43", size = 1485716, upload-time = "2025-09-16T16:38:21.607Z" },
-    { url = "https://files.pythonhosted.org/packages/c4/d4/17ba457a828b733182ddc01a202872fef3006eed6b54450b20dc95a2f77d/pymongo-4.15.1-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:26a31af455bffcc64537a7f67e2f84833a57855a82d05a085a1030c471138990", size = 1460160, upload-time = "2025-09-16T16:38:23.509Z" },
-    { url = "https://files.pythonhosted.org/packages/c3/25/42b8662c09f5ca9c81d18d160f48e58842e0fa4c314ea02613c5e5d54542/pymongo-4.15.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:ea4415970d2a074d5890696af10e174d84cb735f1fa7673020c7538431e1cb6e", size = 1439284, upload-time = "2025-09-16T16:38:25.248Z" },
-    { url = "https://files.pythonhosted.org/packages/b3/bb/46b9d978161828eb91973bd441a3f05f73c789203e976332a8de2832d5db/pymongo-4.15.1-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:51ee050a2e026e2b224d2ed382830194be20a81c78e1ef98f467e469071df3ac", size = 1407933, upload-time = "2025-09-16T16:38:27.045Z" },
-    { url = "https://files.pythonhosted.org/packages/4b/55/bd5af98f675001f4b06f7314b3918e45809424a7ad3510f823f6703cd8f2/pymongo-4.15.1-cp311-cp311-win32.whl", hash = "sha256:9aef07d33839f6429dc24f2ef36e4ec906979cb4f628c57a1c2676cc66625711", size = 844328, upload-time = "2025-09-16T16:38:28.513Z" },
-    { url = "https://files.pythonhosted.org/packages/c3/78/90989a290dd458ed43a8a04fa561ac9c7b3391f395cdacd42e21f0f22ce4/pymongo-4.15.1-cp311-cp311-win_amd64.whl", hash = "sha256:8ea6e5ff4d6747e7b64966629a964db3089e9c1e0206d8f9cc8720c90f5a7af1", size = 858951, upload-time = "2025-09-16T16:38:30.074Z" },
-    { url = "https://files.pythonhosted.org/packages/de/bb/d4d23f06e166cd773f2324cff73841a62d78a1ad16fb799cf7c5490ce32c/pymongo-4.15.1-cp311-cp311-win_arm64.whl", hash = "sha256:bb783d9001b464a6ef3ee76c30ebbb6f977caee7bbc3a9bb1bd2ff596e818c46", size = 848290, upload-time = "2025-09-16T16:38:31.741Z" },
-    { url = "https://files.pythonhosted.org/packages/7e/31/bc4525312083706a59fffe6e8de868054472308230fdee8db0c452c2b831/pymongo-4.15.1-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:bab357c5ff36ba2340dfc94f3338ef399032089d35c3d257ce0c48630b7848b2", size = 920261, upload-time = "2025-09-16T16:38:33.614Z" },
-    { url = "https://files.pythonhosted.org/packages/ae/55/4d99aec625494f21151b8b31e12e06b8ccd3b9dcff609b0dd1acf9bbbc0e/pymongo-4.15.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:46d1af3eb2c274f07815372b5a68f99ecd48750e8ab54d5c3ff36a280fb41c8e", size = 919956, upload-time = "2025-09-16T16:38:35.121Z" },
-    { url = "https://files.pythonhosted.org/packages/be/60/8f1afa41521df950e13f6490ecdef48155fc63b78f926e7649045e07afd1/pymongo-4.15.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:7dc31357379318881186213dc5fc49b62601c955504f65c8e72032b5048950a1", size = 1698596, upload-time = "2025-09-16T16:38:36.586Z" },
-    { url = "https://files.pythonhosted.org/packages/bc/3f/e48d50ee8d6aa0a4cda7889dd73076ec2ab79a232716a5eb0b9df070ffcf/pymongo-4.15.1-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:12140d29da1ecbaefee2a9e65433ef15d6c2c38f97bc6dab0ff246a96f9d20cd", size = 1762833, upload-time = "2025-09-16T16:38:38.09Z" },
-    { url = "https://files.pythonhosted.org/packages/63/87/db976859efc617f608754e051e1468459d9a818fe1ad5d0862e8af57720b/pymongo-4.15.1-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:cf193d2dcd91fa1d1dfa1fd036a3b54f792915a4842d323c0548d23d30461b59", size = 1731875, upload-time = "2025-09-16T16:38:39.742Z" },
-    { url = "https://files.pythonhosted.org/packages/18/59/3643ad52a5064ad3ef8c32910de6da28eb658234c25f2db5366f16bffbfb/pymongo-4.15.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:a2c0bdcf4d57e4861ed323ba430b585ad98c010a83e46cb8aa3b29c248a82be1", size = 1701853, upload-time = "2025-09-16T16:38:41.333Z" },
-    { url = "https://files.pythonhosted.org/packages/d8/96/441c190823f855fc6445ea574b39dca41156acf723c5e6a69ee718421700/pymongo-4.15.1-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:43fcfc19446e0706bbfe86f683a477d1e699b02369dd9c114ec17c7182d1fe2b", size = 1660978, upload-time = "2025-09-16T16:38:42.877Z" },
-    { url = "https://files.pythonhosted.org/packages/47/49/bd7e783fb78aaf9bdaa3f88cc238449be5bc5546e930ec98845ef235f809/pymongo-4.15.1-cp312-cp312-win32.whl", hash = "sha256:e5fedea0e7b3747da836cd5f88b0fa3e2ec5a394371f9b6a6b15927cfeb5455d", size = 891175, upload-time = "2025-09-16T16:38:44.658Z" },
-    { url = "https://files.pythonhosted.org/packages/2e/28/7de5858bdeaa07ea4b277f9eb06123ea358003659fe55e72e4e7c898b321/pymongo-4.15.1-cp312-cp312-win_amd64.whl", hash = "sha256:330a17c1c89e2c3bf03ed391108f928d5881298c17692199d3e0cdf097a20082", size = 910619, upload-time = "2025-09-16T16:38:46.124Z" },
-    { url = "https://files.pythonhosted.org/packages/17/87/c39f4f8415e7c65f8b66413f53a9272211ff7dfe78a5128b27027bf88864/pymongo-4.15.1-cp312-cp312-win_arm64.whl", hash = "sha256:756b7a2a80ec3dd5b89cd62e9d13c573afd456452a53d05663e8ad0c5ff6632b", size = 896229, upload-time = "2025-09-16T16:38:48.563Z" },
+    { url = "https://files.pythonhosted.org/packages/65/01/e8358c562ce4e3255035f16eed43a6f77669b0779f3aa918362c670e869f/pymongo-4.18.2-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:257519b59d8509a950b21c4a626e5295b3ad4397c12ec47e6e93353c49236145", size = 818562, upload-time = "2026-09-24T16:58:20.602Z" },
+    { url = "https://files.pythonhosted.org/packages/1f/18/48a9e7f44a35560284b36bba24622a959ec1dd940e7c4f7cd308cfdba756/pymongo-4.18.2-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:845b890622e7a2f031140f9cb1c0f266c1baa876ea359f7e51d0c38112cb3c6e", size = 819081, upload-time = "2026-09-24T16:58:22.043Z" },
+    { url = "https://files.pythonhosted.org/packages/fc/24/2d9c0bb5649f262257f507b03f84419ac1254e94894cd493bda87fb935e1/pymongo-4.18.2-cp311-cp311-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:a746f7e183c6d48aba6152d9f333e3bae2e8b6b00fac7abe69d4bdb3d10915c8", size = 1023284, upload-time = "2026-09-24T16:58:23.437Z" },
+    { url = "https://files.pythonhosted.org/packages/70/40/af888435ce8e3ae1e1a201b87fb397aa91e3ce115bb1bb3999197f2b9b72/pymongo-4.18.2-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:bf9d13d812e55d406080b8ec3d5b9ef8eb2279bac32529e4f7b41cfefd5340e2", size = 1031549, upload-time = "2026-09-24T16:58:24.869Z" },
+    { url = "https://files.pythonhosted.org/packages/3c/66/f5053862cbeddf37b3184870fa179a3e9d9e27e668c720bb7ab28b65b753/pymongo-4.18.2-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:930e8bcdf781a73d3df05976f5eaca1193102571cb91726e30009d64878ef8ce", size = 1054025, upload-time = "2026-09-24T16:58:26.229Z" },
+    { url = "https://files.pythonhosted.org/packages/70/29/4d7c9d7cb718ea7bbac56465de3aea5f79d1266683c16bdcd40e77746530/pymongo-4.18.2-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:a695bd34d1e942eca93a186e679be196e288370f1a203e383b2187c06349e348", size = 1046337, upload-time = "2026-09-24T16:58:27.822Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/aa/c18c564883c5b2616744d1ee7ab073a3b4045aaa4bbbd524105448d4f630/pymongo-4.18.2-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:d95e339e94b82950bfd62ec9ff8fea9bc8dfd9db0940e9134d1647d366560df5", size = 1032845, upload-time = "2026-09-24T16:58:29.518Z" },
+    { url = "https://files.pythonhosted.org/packages/20/16/f8a1cb7ac3f1c2c45649f18b7cb398779b4b45e1954bbfcb9317c74c744d/pymongo-4.18.2-cp311-cp311-win32.whl", hash = "sha256:2e2a3b816270c493f6645a168150ecbfb19a0bd0d9d3b56be728a847954da717", size = 814203, upload-time = "2026-09-24T16:58:30.924Z" },
+    { url = "https://files.pythonhosted.org/packages/04/53/e9d6350ea753b7a72d0346fb2c8e0c589e0eb443b5041989f3b4ea52ce55/pymongo-4.18.2-cp311-cp311-win_amd64.whl", hash = "sha256:812b4ad5fe577f829cdb4e39a5601025b9cd7f2e3f8cd373cd5ab64ce78b0fb0", size = 821265, upload-time = "2026-09-24T16:58:32.479Z" },
+    { url = "https://files.pythonhosted.org/packages/7b/2a/be9693eca04bb6f53f3bdb027220a210bd429c7bf902b79538471849297e/pymongo-4.18.2-cp311-cp311-win_arm64.whl", hash = "sha256:c36cadbc3a7712575900c6f50cdf24ebe2b376b6ad643cb5df1b3dce93447eae", size = 815444, upload-time = "2026-09-24T16:58:34.212Z" },
+    { url = "https://files.pythonhosted.org/packages/10/eb/995ec978741cfc56a29223ec0806976218b95d79a516d9b719c984ead130/pymongo-4.18.2-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:78a3b324407ba7228a57f207e175efc40341c1312d1e7df2d4ad8141ff6d8e00", size = 819057, upload-time = "2026-09-24T16:58:35.844Z" },
+    { url = "https://files.pythonhosted.org/packages/40/e4/5a166bbac7f6e620cfb75b0640e793dd3ce69423a1f89cf6a0bfc588c107/pymongo-4.18.2-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:498187b5171d5efa87291b30e4cbf1e9849929c02bc436e95a3d01ff19e49f42", size = 819448, upload-time = "2026-09-24T16:58:37.221Z" },
+    { url = "https://files.pythonhosted.org/packages/c9/c8/82194d9a1387a56cac996901f92ea6a25ae817622ee32d15c986638b263f/pymongo-4.18.2-cp312-cp312-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:2c003646d3fa5db4e835483fc29018eb06d8c637cf69f676ffbb3f0734005220", size = 1039602, upload-time = "2026-09-24T16:58:38.821Z" },
+    { url = "https://files.pythonhosted.org/packages/cc/06/628f93f15f269d8a1ea20a024083e67871f722876a33992aec5525a6c6c4/pymongo-4.18.2-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:c743347143298252948e038f768ea6f71b71ef8a85b7cf0dc13b734e072f74da", size = 1050746, upload-time = "2026-09-24T16:58:40.322Z" },
+    { url = "https://files.pythonhosted.org/packages/bf/93/58ea76803128651ec9c732b59b8c1eb73d511c085c2e5786da3289d4015c/pymongo-4.18.2-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:09e6afa68001433c42925a258b57f2ceccb95c73fe8920452e147a82d90c1ae9", size = 1075681, upload-time = "2026-09-24T16:58:41.722Z" },
+    { url = "https://files.pythonhosted.org/packages/7c/6d/702ee4593420e2a8ceb169ece6394f0bb9fc2e8e8d8101e99f2468ed6d0d/pymongo-4.18.2-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:8d3445caeeb47dc64bf416dc03e0b3bfcf3b60a109dec355a563aa62c135cb33", size = 1068235, upload-time = "2026-09-24T16:58:43.228Z" },
+    { url = "https://files.pythonhosted.org/packages/a9/92/a02a4108ca4faf05bca394d65dcebc7b84b0248cff23aa89927c81a0d5dd/pymongo-4.18.2-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:ecde9e735e1f86559e0a71a5bbec671e59a35549bfd8c60968d9f032b05013de", size = 1049896, upload-time = "2026-09-24T16:58:44.914Z" },
+    { url = "https://files.pythonhosted.org/packages/6e/93/65ef17eecdd86c153f7907b2d490d85eb655d3a5eb35a8494e7e09376353/pymongo-4.18.2-cp312-cp312-win32.whl", hash = "sha256:a463c3fc072655b7fe9e9ded4601876bef7f1df98f6f3faeed07fa7f11309fff", size = 815124, upload-time = "2026-09-24T16:58:46.39Z" },
+    { url = "https://files.pythonhosted.org/packages/3c/cc/fd66aa9d8956e8269ea63b2977a7fd38fbec45795d38b8067bfafc98992f/pymongo-4.18.2-cp312-cp312-win_amd64.whl", hash = "sha256:cbb67901ba9b6334fa94643d66587a30ffe5be05061af287364e6b5f7d239dc5", size = 821996, upload-time = "2026-09-24T16:58:47.769Z" },
+    { url = "https://files.pythonhosted.org/packages/06/21/983d340cfe226c987014f1caf9568b176cbd7f25dd87536379a609e6371e/pymongo-4.18.2-cp312-cp312-win_arm64.whl", hash = "sha256:94c5e0fe9af4c05f382ae7c4addd0255a8ddcc91b3d2a6bc09b34230cb28290b", size = 815707, upload-time = "2026-09-24T16:58:49.493Z" },
 ]

 [[package]]
@@ -6332,11 +6366,11 @@ wheels = [

 [[package]]
 name = "urllib3"
-version = "2.7.0"
+version = "2.8.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/53/0c/06f8b233b8fd13b9e5ee11424ef85419ba0d8ba0b3138bf360be2ff56953/urllib3-2.7.0.tar.gz", hash = "sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c", size = 433602, upload-time = "2026-05-07T16:13:18.596Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/e3/05/b17359e1cefb4f909b5e40b1b90a496d987258916dbbf88e842c729f510e/urllib3-2.8.0.tar.gz", hash = "sha256:63bf2ead4c879426ebf22ef2a781eeb4aa3b4ae798a0435506f8687fd5bb9b63", size = 458972, upload-time = "2026-09-15T19:29:36.253Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/7f/3e/5db95bcf282c52709639744ca2a8b149baccf648e39c8cc87553df9eae0c/urllib3-2.7.0-py3-none-any.whl", hash = "sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897", size = 131087, upload-time = "2026-05-07T16:13:17.151Z" },
+    { url = "https://files.pythonhosted.org/packages/92/9d/c4e665119135114480843e7ab388fa94d8480650450e6f8e26b70d323a4c/urllib3-2.8.0-py3-none-any.whl", hash = "sha256:0cf3cae568d36aa9576b28dfb35f11328f1cb974ca7647d9475ebb86c75ac6e3", size = 135717, upload-time = "2026-09-15T19:29:34.577Z" },
 ]

 [[package]]
@@ -6566,48 +6600,50 @@ wheels = [

 [[package]]
 name = "yarl"
-version = "1.22.0"
+version = "1.25.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
    { name = "idna" },
    { name = "multidict" },
    { name = "propcache" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/57/63/0c6ebca57330cd313f6102b16dd57ffaf3ec4c83403dcb45dbd15c6f3ea1/yarl-1.22.0.tar.gz", hash = "sha256:bebf8557577d4401ba8bd9ff33906f1376c877aa78d1fe216ad01b4d6745af71", size = 187169, upload-time = "2025-10-06T14:12:55.963Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/75/16/e8be8e2fb175bbf41a0680381a319f1199fae256588241a2ac8677eafb49/yarl-1.25.1.tar.gz", hash = "sha256:03dd38de09bc213e9a8b29761eec33ee1d5318dac0e49d8af36e4d27830e23a7", size = 246245, upload-time = "2026-09-15T19:35:02.264Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/4d/27/5ab13fc84c76a0250afd3d26d5936349a35be56ce5785447d6c423b26d92/yarl-1.22.0-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:1ab72135b1f2db3fed3997d7e7dc1b80573c67138023852b6efb336a5eae6511", size = 141607, upload-time = "2025-10-06T14:09:16.298Z" },
-    { url = "https://files.pythonhosted.org/packages/6a/a1/d065d51d02dc02ce81501d476b9ed2229d9a990818332242a882d5d60340/yarl-1.22.0-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:669930400e375570189492dc8d8341301578e8493aec04aebc20d4717f899dd6", size = 94027, upload-time = "2025-10-06T14:09:17.786Z" },
-    { url = "https://files.pythonhosted.org/packages/c1/da/8da9f6a53f67b5106ffe902c6fa0164e10398d4e150d85838b82f424072a/yarl-1.22.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:792a2af6d58177ef7c19cbf0097aba92ca1b9cb3ffdd9c7470e156c8f9b5e028", size = 94963, upload-time = "2025-10-06T14:09:19.662Z" },
-    { url = "https://files.pythonhosted.org/packages/68/fe/2c1f674960c376e29cb0bec1249b117d11738db92a6ccc4a530b972648db/yarl-1.22.0-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:3ea66b1c11c9150f1372f69afb6b8116f2dd7286f38e14ea71a44eee9ec51b9d", size = 368406, upload-time = "2025-10-06T14:09:21.402Z" },
-    { url = "https://files.pythonhosted.org/packages/95/26/812a540e1c3c6418fec60e9bbd38e871eaba9545e94fa5eff8f4a8e28e1e/yarl-1.22.0-cp311-cp311-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:3e2daa88dc91870215961e96a039ec73e4937da13cf77ce17f9cad0c18df3503", size = 336581, upload-time = "2025-10-06T14:09:22.98Z" },
-    { url = "https://files.pythonhosted.org/packages/0b/f5/5777b19e26fdf98563985e481f8be3d8a39f8734147a6ebf459d0dab5a6b/yarl-1.22.0-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:ba440ae430c00eee41509353628600212112cd5018d5def7e9b05ea7ac34eb65", size = 388924, upload-time = "2025-10-06T14:09:24.655Z" },
-    { url = "https://files.pythonhosted.org/packages/86/08/24bd2477bd59c0bbd994fe1d93b126e0472e4e3df5a96a277b0a55309e89/yarl-1.22.0-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:e6438cc8f23a9c1478633d216b16104a586b9761db62bfacb6425bac0a36679e", size = 392890, upload-time = "2025-10-06T14:09:26.617Z" },
-    { url = "https://files.pythonhosted.org/packages/46/00/71b90ed48e895667ecfb1eaab27c1523ee2fa217433ed77a73b13205ca4b/yarl-1.22.0-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:4c52a6e78aef5cf47a98ef8e934755abf53953379b7d53e68b15ff4420e6683d", size = 365819, upload-time = "2025-10-06T14:09:28.544Z" },
-    { url = "https://files.pythonhosted.org/packages/30/2d/f715501cae832651d3282387c6a9236cd26bd00d0ff1e404b3dc52447884/yarl-1.22.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:3b06bcadaac49c70f4c88af4ffcfbe3dc155aab3163e75777818092478bcbbe7", size = 363601, upload-time = "2025-10-06T14:09:30.568Z" },
-    { url = "https://files.pythonhosted.org/packages/f8/f9/a678c992d78e394e7126ee0b0e4e71bd2775e4334d00a9278c06a6cce96a/yarl-1.22.0-cp311-cp311-musllinux_1_2_armv7l.whl", hash = "sha256:6944b2dc72c4d7f7052683487e3677456050ff77fcf5e6204e98caf785ad1967", size = 358072, upload-time = "2025-10-06T14:09:32.528Z" },
-    { url = "https://files.pythonhosted.org/packages/2c/d1/b49454411a60edb6fefdcad4f8e6dbba7d8019e3a508a1c5836cba6d0781/yarl-1.22.0-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:d5372ca1df0f91a86b047d1277c2aaf1edb32d78bbcefffc81b40ffd18f027ed", size = 385311, upload-time = "2025-10-06T14:09:34.634Z" },
-    { url = "https://files.pythonhosted.org/packages/87/e5/40d7a94debb8448c7771a916d1861d6609dddf7958dc381117e7ba36d9e8/yarl-1.22.0-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:51af598701f5299012b8416486b40fceef8c26fc87dc6d7d1f6fc30609ea0aa6", size = 381094, upload-time = "2025-10-06T14:09:36.268Z" },
-    { url = "https://files.pythonhosted.org/packages/35/d8/611cc282502381ad855448643e1ad0538957fc82ae83dfe7762c14069e14/yarl-1.22.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:b266bd01fedeffeeac01a79ae181719ff848a5a13ce10075adbefc8f1daee70e", size = 370944, upload-time = "2025-10-06T14:09:37.872Z" },
-    { url = "https://files.pythonhosted.org/packages/2d/df/fadd00fb1c90e1a5a8bd731fa3d3de2e165e5a3666a095b04e31b04d9cb6/yarl-1.22.0-cp311-cp311-win32.whl", hash = "sha256:a9b1ba5610a4e20f655258d5a1fdc7ebe3d837bb0e45b581398b99eb98b1f5ca", size = 81804, upload-time = "2025-10-06T14:09:39.359Z" },
-    { url = "https://files.pythonhosted.org/packages/b5/f7/149bb6f45f267cb5c074ac40c01c6b3ea6d8a620d34b337f6321928a1b4d/yarl-1.22.0-cp311-cp311-win_amd64.whl", hash = "sha256:078278b9b0b11568937d9509b589ee83ef98ed6d561dfe2020e24a9fd08eaa2b", size = 86858, upload-time = "2025-10-06T14:09:41.068Z" },
-    { url = "https://files.pythonhosted.org/packages/2b/13/88b78b93ad3f2f0b78e13bfaaa24d11cbc746e93fe76d8c06bf139615646/yarl-1.22.0-cp311-cp311-win_arm64.whl", hash = "sha256:b6a6f620cfe13ccec221fa312139135166e47ae169f8253f72a0abc0dae94376", size = 81637, upload-time = "2025-10-06T14:09:42.712Z" },
-    { url = "https://files.pythonhosted.org/packages/75/ff/46736024fee3429b80a165a732e38e5d5a238721e634ab41b040d49f8738/yarl-1.22.0-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:e340382d1afa5d32b892b3ff062436d592ec3d692aeea3bef3a5cfe11bbf8c6f", size = 142000, upload-time = "2025-10-06T14:09:44.631Z" },
-    { url = "https://files.pythonhosted.org/packages/5a/9a/b312ed670df903145598914770eb12de1bac44599549b3360acc96878df8/yarl-1.22.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:f1e09112a2c31ffe8d80be1b0988fa6a18c5d5cad92a9ffbb1c04c91bfe52ad2", size = 94338, upload-time = "2025-10-06T14:09:46.372Z" },
-    { url = "https://files.pythonhosted.org/packages/ba/f5/0601483296f09c3c65e303d60c070a5c19fcdbc72daa061e96170785bc7d/yarl-1.22.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:939fe60db294c786f6b7c2d2e121576628468f65453d86b0fe36cb52f987bd74", size = 94909, upload-time = "2025-10-06T14:09:48.648Z" },
-    { url = "https://files.pythonhosted.org/packages/60/41/9a1fe0b73dbcefce72e46cf149b0e0a67612d60bfc90fb59c2b2efdfbd86/yarl-1.22.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:e1651bf8e0398574646744c1885a41198eba53dc8a9312b954073f845c90a8df", size = 372940, upload-time = "2025-10-06T14:09:50.089Z" },
-    { url = "https://files.pythonhosted.org/packages/17/7a/795cb6dfee561961c30b800f0ed616b923a2ec6258b5def2a00bf8231334/yarl-1.22.0-cp312-cp312-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:b8a0588521a26bf92a57a1705b77b8b59044cdceccac7151bd8d229e66b8dedb", size = 345825, upload-time = "2025-10-06T14:09:52.142Z" },
-    { url = "https://files.pythonhosted.org/packages/d7/93/a58f4d596d2be2ae7bab1a5846c4d270b894958845753b2c606d666744d3/yarl-1.22.0-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:42188e6a615c1a75bcaa6e150c3fe8f3e8680471a6b10150c5f7e83f47cc34d2", size = 386705, upload-time = "2025-10-06T14:09:54.128Z" },
-    { url = "https://files.pythonhosted.org/packages/61/92/682279d0e099d0e14d7fd2e176bd04f48de1484f56546a3e1313cd6c8e7c/yarl-1.22.0-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:f6d2cb59377d99718913ad9a151030d6f83ef420a2b8f521d94609ecc106ee82", size = 396518, upload-time = "2025-10-06T14:09:55.762Z" },
-    { url = "https://files.pythonhosted.org/packages/db/0f/0d52c98b8a885aeda831224b78f3be7ec2e1aa4a62091f9f9188c3c65b56/yarl-1.22.0-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:50678a3b71c751d58d7908edc96d332af328839eea883bb554a43f539101277a", size = 377267, upload-time = "2025-10-06T14:09:57.958Z" },
-    { url = "https://files.pythonhosted.org/packages/22/42/d2685e35908cbeaa6532c1fc73e89e7f2efb5d8a7df3959ea8e37177c5a3/yarl-1.22.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:1e8fbaa7cec507aa24ea27a01456e8dd4b6fab829059b69844bd348f2d467124", size = 365797, upload-time = "2025-10-06T14:09:59.527Z" },
-    { url = "https://files.pythonhosted.org/packages/a2/83/cf8c7bcc6355631762f7d8bdab920ad09b82efa6b722999dfb05afa6cfac/yarl-1.22.0-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:433885ab5431bc3d3d4f2f9bd15bfa1614c522b0f1405d62c4f926ccd69d04fa", size = 365535, upload-time = "2025-10-06T14:10:01.139Z" },
-    { url = "https://files.pythonhosted.org/packages/25/e1/5302ff9b28f0c59cac913b91fe3f16c59a033887e57ce9ca5d41a3a94737/yarl-1.22.0-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:b790b39c7e9a4192dc2e201a282109ed2985a1ddbd5ac08dc56d0e121400a8f7", size = 382324, upload-time = "2025-10-06T14:10:02.756Z" },
-    { url = "https://files.pythonhosted.org/packages/bf/cd/4617eb60f032f19ae3a688dc990d8f0d89ee0ea378b61cac81ede3e52fae/yarl-1.22.0-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:31f0b53913220599446872d757257be5898019c85e7971599065bc55065dc99d", size = 383803, upload-time = "2025-10-06T14:10:04.552Z" },
-    { url = "https://files.pythonhosted.org/packages/59/65/afc6e62bb506a319ea67b694551dab4a7e6fb7bf604e9bd9f3e11d575fec/yarl-1.22.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:a49370e8f711daec68d09b821a34e1167792ee2d24d405cbc2387be4f158b520", size = 374220, upload-time = "2025-10-06T14:10:06.489Z" },
-    { url = "https://files.pythonhosted.org/packages/e7/3d/68bf18d50dc674b942daec86a9ba922d3113d8399b0e52b9897530442da2/yarl-1.22.0-cp312-cp312-win32.whl", hash = "sha256:70dfd4f241c04bd9239d53b17f11e6ab672b9f1420364af63e8531198e3f5fe8", size = 81589, upload-time = "2025-10-06T14:10:09.254Z" },
-    { url = "https://files.pythonhosted.org/packages/c8/9a/6ad1a9b37c2f72874f93e691b2e7ecb6137fb2b899983125db4204e47575/yarl-1.22.0-cp312-cp312-win_amd64.whl", hash = "sha256:8884d8b332a5e9b88e23f60bb166890009429391864c685e17bd73a9eda9105c", size = 87213, upload-time = "2025-10-06T14:10:11.369Z" },
-    { url = "https://files.pythonhosted.org/packages/44/c5/c21b562d1680a77634d748e30c653c3ca918beb35555cff24986fff54598/yarl-1.22.0-cp312-cp312-win_arm64.whl", hash = "sha256:ea70f61a47f3cc93bdf8b2f368ed359ef02a01ca6393916bc8ff877427181e74", size = 81330, upload-time = "2025-10-06T14:10:13.112Z" },
-    { url = "https://files.pythonhosted.org/packages/73/ae/b48f95715333080afb75a4504487cbe142cae1268afc482d06692d605ae6/yarl-1.22.0-py3-none-any.whl", hash = "sha256:1380560bdba02b6b6c90de54133c81c9f2a453dee9912fe58c1dcced1edb7cff", size = 46814, upload-time = "2025-10-06T14:12:53.872Z" },
+    { url = "https://files.pythonhosted.org/packages/83/b3/2cea721d495ca57f8f414aa4867ee263f486b274e07463158cf52f02ba7f/yarl-1.25.1-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:9d693bf4bf534e9ba3ae2780cfd577f5135629f7b5ac653490859d0b77864865", size = 143794, upload-time = "2026-09-15T19:30:26.946Z" },
+    { url = "https://files.pythonhosted.org/packages/55/e6/cd145cff8e5cf60b8b3c41fbecfa2a45028a8dec3fbc52bec03595ff3d3b/yarl-1.25.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:ab2054c5531af2a9ba7b69b8ec91e4f884420e83a8c5e579b013084cb57e5e5d", size = 103993, upload-time = "2026-09-15T19:30:28.661Z" },
+    { url = "https://files.pythonhosted.org/packages/ce/7c/fbb40fe2d53747c40aa36a9e2bd2178a202f942bda0b670f3306d4aefbce/yarl-1.25.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:564fdc7085d2245ab84f88882fdb1d6ac0723124bff6ded35bfb1c00f812630d", size = 104010, upload-time = "2026-09-15T19:30:31.069Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/0b/5a516f70641092283f57cf3670bdb75e7327bcc0dcb5038697e4dfbfd569/yarl-1.25.1-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:acae6b45d1ace09b6ba3876da43b88366ef368f73b988c7f57e14231753d4420", size = 116444, upload-time = "2026-09-15T19:30:32.894Z" },
+    { url = "https://files.pythonhosted.org/packages/b6/8a/d1a627f827b0a404ae0f5647cab0534959081cde13b0756a783469fb3b5e/yarl-1.25.1-cp311-cp311-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:1fb2a01ba8cd9c5d2c5dc1ec35e0fc951d04b4f037541d4ac090c993ce58b3d7", size = 107565, upload-time = "2026-09-15T19:30:35.188Z" },
+    { url = "https://files.pythonhosted.org/packages/aa/cf/c8e0aaec886840a6c4480fe44eaec7cd4319f79a563b79321473be79c56f/yarl-1.25.1-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:e92b6bcc741b86d67606c40d3cb9c7cc8e6c737f81e31f4a94efc204456c92e3", size = 125006, upload-time = "2026-09-15T19:30:37.1Z" },
+    { url = "https://files.pythonhosted.org/packages/50/26/0cce366d54a93cdc8342965dc7663385e4db161625cc1e8b18e786753d24/yarl-1.25.1-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:72c34ac7ad4314c19362d5ce27626dcc8429bd30bbf8c179f4234078851f9492", size = 128717, upload-time = "2026-09-15T19:30:38.904Z" },
+    { url = "https://files.pythonhosted.org/packages/95/0c/a71501bbc1a674ff72c4d6c2b75f4d9a5af819f5244c3a7558080a8802c5/yarl-1.25.1-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:d5add7b4ca7afeea91d52e4d4e4db3b1fe9885b71f07054560d8c4296b7441a2", size = 117728, upload-time = "2026-09-15T19:30:40.809Z" },
+    { url = "https://files.pythonhosted.org/packages/e7/6f/c3267ca01defeed9ed9c4ff9b17bd54915432c405945233265b707475d1c/yarl-1.25.1-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:def538065f9e4d4cf1ae164bd59aba00dfa84f03923e0de4c3788f252d6bcd17", size = 116224, upload-time = "2026-09-15T19:30:42.818Z" },
+    { url = "https://files.pythonhosted.org/packages/8f/69/fad57ee52d648431718ee0f1f68966a99c1352c3924688ffbdcc9d3fe51a/yarl-1.25.1-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:0a191bfdb30a79b98e5d175d75285f9fcb78bf0e46ba5efda042e1c72071a0de", size = 116299, upload-time = "2026-09-15T19:30:44.966Z" },
+    { url = "https://files.pythonhosted.org/packages/2a/d4/6a8c1e29f33338687ca278cba0a8fbf6525a322c2c02a9a500ccbe041152/yarl-1.25.1-cp311-cp311-musllinux_1_2_armv7l.whl", hash = "sha256:71f42c5b9a948c113bbdebfa544598321431d064ff959d32e99b1feb61d68345", size = 108625, upload-time = "2026-09-15T19:30:46.874Z" },
+    { url = "https://files.pythonhosted.org/packages/e8/d2/3a35ae791c9cb6522c106923ff25c3230d999091e5e65511bca23bbd9914/yarl-1.25.1-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:72849d892954be4d09e569b8b831ac39ce58417fedc767d4308a0fe542018a40", size = 124515, upload-time = "2026-09-15T19:30:49.082Z" },
+    { url = "https://files.pythonhosted.org/packages/be/fd/2b022109a6b4af0f7dc371cf7500af380b0d4f034010243e1b0ce218dc93/yarl-1.25.1-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:efb01a106f971cb3752856bca2318bbdf7f01bd8823779c461586cbe5ffd5258", size = 115711, upload-time = "2026-09-15T19:30:51.208Z" },
+    { url = "https://files.pythonhosted.org/packages/18/59/f7586271136c3ddb0126bbfe661844699369b76b555fe38c4efe86870b2e/yarl-1.25.1-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:a1daf47cd95a7c3a63456336bc5aaa8c86dd3a47d07ed3d0e76132ae4666a5a1", size = 122751, upload-time = "2026-09-15T19:30:53.535Z" },
+    { url = "https://files.pythonhosted.org/packages/a0/0b/07f7a2d881f7e16c385b47fc1753382600847cad305dcc7fa0c25828acf8/yarl-1.25.1-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:9489e6abf47ba37f332075a91444c7cfedb03e6ce99fbb2f116bfe1ce810da3b", size = 117983, upload-time = "2026-09-15T19:30:55.277Z" },
+    { url = "https://files.pythonhosted.org/packages/aa/9d/8cdceec66a9b940700cb45931741403f045b162afd79bcb93c41cadd0972/yarl-1.25.1-cp311-cp311-win_amd64.whl", hash = "sha256:d7306dee25b8a0e737363f347362b875094b4dc4e367311470656ae420fdbf8e", size = 102894, upload-time = "2026-09-15T19:30:57.606Z" },
+    { url = "https://files.pythonhosted.org/packages/17/f1/7ec357db1d3ad2863542d71e8fe64a126bbec17b134cd7d30951196809a5/yarl-1.25.1-cp311-cp311-win_arm64.whl", hash = "sha256:abb1384477f5901d436b5d2e5465954de46ea6098f59163d243660b5c4461d35", size = 98609, upload-time = "2026-09-15T19:30:59.705Z" },
+    { url = "https://files.pythonhosted.org/packages/75/b3/cd32ac66ae622b854c2df0ac52106dda220d361b65a64fde7d5b3684aa3f/yarl-1.25.1-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:94d7aa6debf92a1dd14cb5280b083a764169a13cfb23a452111160274ed989f4", size = 144798, upload-time = "2026-09-15T19:31:01.821Z" },
+    { url = "https://files.pythonhosted.org/packages/61/fb/a2c52a8007c2051ba74662afb112ecf3d00346af4c25e33df9d80fd14fb8/yarl-1.25.1-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:83d4a37e4b95da4d8bda930d6d35b75b4cdadbacbb4980cae290ea3100b5d51d", size = 104583, upload-time = "2026-09-15T19:31:04.05Z" },
+    { url = "https://files.pythonhosted.org/packages/be/dd/ee38aec8e09fdf957e50d4085453fbe202f56c6c3b4cf07b81cdb4f09ee9/yarl-1.25.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:e029648f9c951db30e98a7d7ec90835db88ec4b32820efe2a9bdc2287e032eb6", size = 104325, upload-time = "2026-09-15T19:31:06.338Z" },
+    { url = "https://files.pythonhosted.org/packages/1e/b3/058dbfb1857b484c9cf9cc135659f50b85ce66e03c99e44dc2f7b6161f55/yarl-1.25.1-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:4d781294bb815ecb5ea57ff6bbf8038e0a31a95fdf3e1788f66e0dc100d64b58", size = 115358, upload-time = "2026-09-15T19:31:08.593Z" },
+    { url = "https://files.pythonhosted.org/packages/db/39/29693446cf0cf6b15a0e2f75a5d40f93c56819b05b0622196f45e95b5cc0/yarl-1.25.1-cp312-cp312-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:e12c538e00e7c1b286a07061046b90e8124e6a9793efae2c70db6a4aad07faad", size = 107658, upload-time = "2026-09-15T19:31:10.802Z" },
+    { url = "https://files.pythonhosted.org/packages/86/b3/3c4dd7e1af43b931fba95e0a722737f2ea94a6d199c802585282831d7abd/yarl-1.25.1-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:7e4de3ac4adbad3d0bc7c6f4360a7dbff5de2f15e3b723be3198074e17fd9c40", size = 122660, upload-time = "2026-09-15T19:31:12.84Z" },
+    { url = "https://files.pythonhosted.org/packages/bd/b5/1b60dbc3cfc9c5712b15148c206748f2bc93953ffdbe25ea75b63dfc89c9/yarl-1.25.1-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:419f392a1da624877975709e3864dfe833af6cc7671b39318086d456e288380c", size = 126506, upload-time = "2026-09-15T19:31:15.088Z" },
+    { url = "https://files.pythonhosted.org/packages/bc/7b/ca212cbe170ac8b96e45317ecbcf9c3c3ecf0cdec98d5b088a9c4088929b/yarl-1.25.1-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:c6f117789d22dce188e5754e8bc65b7e6ebf8cb73963b9fa761f672a5883769d", size = 117050, upload-time = "2026-09-15T19:31:17.241Z" },
+    { url = "https://files.pythonhosted.org/packages/cb/c3/72b4938cdbe619ad71ac156182faef4908846b84dc3ca4dbb4c4e6f84014/yarl-1.25.1-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:80e47012e730da131c9f059c80936783f9659aae22dc31c03c0595590d11ed54", size = 114174, upload-time = "2026-09-15T19:31:19.294Z" },
+    { url = "https://files.pythonhosted.org/packages/e8/43/268717870f9ba0cc9701a95181587f6dc8c5f387aab4aeecc83158f38a79/yarl-1.25.1-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:e80f557716fd765439577131e526b8942ffc2c07bdbc5e39fa62f660ba1e963f", size = 114944, upload-time = "2026-09-15T19:31:21.414Z" },
+    { url = "https://files.pythonhosted.org/packages/da/84/baa5bf504d51fe062c4bcaf62936da97fffb43285978d0b39984824231fd/yarl-1.25.1-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:f61964f235a43738bfac50da46fc4254943a7eea3051aeb0b6fc7c992c29fadc", size = 108263, upload-time = "2026-09-15T19:31:23.388Z" },
+    { url = "https://files.pythonhosted.org/packages/a4/28/779a2ed9e0152a601a27039bed9aead3f0b79797a67e2c44bfa444622dd8/yarl-1.25.1-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:e546fe1d4a93ebc2910f0d768baff19faa09843ab3f2036a67ed6e69fae4419d", size = 122184, upload-time = "2026-09-15T19:31:25.343Z" },
+    { url = "https://files.pythonhosted.org/packages/f8/1f/118e9e5b8f07694d63fd3222e801d7782270003f1a222aa798df3f8d5933/yarl-1.25.1-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:cce0727fd5ac04d372fa9bbfde9febc2bcf209aadfcf0468e45dec72719895d1", size = 114001, upload-time = "2026-09-15T19:31:27.465Z" },
+    { url = "https://files.pythonhosted.org/packages/0f/ae/a4cf1cf372313734b17996d4007f9f73596e7a178b9485802e5494ecf484/yarl-1.25.1-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:af4ea5b37403ef4e30f3927eaed540db942bde01d8d3ff083527c0704d1c9c68", size = 120565, upload-time = "2026-09-15T19:31:29.47Z" },
+    { url = "https://files.pythonhosted.org/packages/05/79/ad94f93ca731bc9e44d321833ab96b82a4f9f5f63cf773f81a4aeea5ecc1/yarl-1.25.1-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:68782fdb4027b8d1eee25ec35e9a6db05e863b899eb0310b3a33b6c3fef55707", size = 117060, upload-time = "2026-09-15T19:31:31.367Z" },
+    { url = "https://files.pythonhosted.org/packages/bb/cc/51a7b4abf4ac593b8e7eb3794b28e5a35ae26eed8bc04787628d215af82f/yarl-1.25.1-cp312-cp312-win_amd64.whl", hash = "sha256:7d575b54cb3863ef9bc290ea4b009999d55dc237326131e4853cf33e888fee03", size = 102593, upload-time = "2026-09-15T19:31:33.329Z" },
+    { url = "https://files.pythonhosted.org/packages/9d/21/0941a6b93a58b59a1ec75e5333bf06929b671309c43c0cd201c172d9c39f/yarl-1.25.1-cp312-cp312-win_arm64.whl", hash = "sha256:bc3ac7bf569f6b64dad04dd7808c7872dae8a97df657856eac05e9b7e3614a85", size = 97697, upload-time = "2026-09-15T19:31:35.855Z" },
+    { url = "https://files.pythonhosted.org/packages/54/22/318c7980066769c6bcd9221ed2248294f5698811da099013098c670565ed/yarl-1.25.1-py3-none-any.whl", hash = "sha256:681c758b0490f9e96b78e5fa8e8dc6e648e9185bb6eaebe73183c33ea0c445f3", size = 63617, upload-time = "2026-09-15T19:34:59.616Z" },
 ]

 [[package]]
@@ -4,6 +4,133 @@ description: "New features and improvements in each Prowler release"
 rss: true
 ---

+<Update label="v5.45.0" description="October 15, 2026">
+  ### 🤖 Azure — AI Services Coverage
+
+  A new Azure AI Services service audits the Azure AI and Azure OpenAI accounts of each subscription, with nine checks across network exposure, authentication, encryption, identity, logging and content safety, all contributed by @rajeshnadiminti. Thank you!
+
+  - `aiservices_account_public_network_access_disabled`, `aiservices_account_network_acls_default_action_deny`, `aiservices_account_uses_private_endpoint` and `aiservices_account_outbound_network_restricted` cover how the account can be reached and what it can reach.
+  - `aiservices_account_local_auth_disabled` and `aiservices_account_managed_identity_enabled` cover key-based access and the account's own identity.
+  - `aiservices_account_encrypted_with_cmk` and `aiservices_account_diagnostic_logging_enabled` cover customer-managed key encryption and diagnostic logs.
+  - `aiservices_deployment_content_filter_prompt_shield_enabled` verifies that model deployments have Prompt Shields enabled in their content filter.
+
+  ### 🪪 Microsoft 365 — New Entra ID Checks
+
+  Five new Entra ID checks, all contributed by @kinomakino. Thank you!
+
+  - `entra_cross_tenant_access_default_outbound_restricted` verifies that the default cross-tenant access policy does not let every user reach every external application through B2B collaboration or B2B direct connect.
+  - `entra_policy_admin_self_service_password_reset_disabled` verifies that Self-Service Password Reset is disabled for administrators.
+  - `entra_policy_msol_powershell_blocked` verifies that the tenant authorization policy blocks the legacy MSOnline PowerShell module.
+  - `entra_app_registration_redirect_uris_secure` flags app registrations with HTTP, wildcard, malformed or `azurewebsites.net` redirect URIs.
+  - `entra_dynamic_group_member_of_rule_not_used` flags dynamic groups whose membership rule uses the `memberOf` operator, which Microsoft retires on November 3, 2026.
+
+  Explore all checks at [Prowler Hub](https://hub.prowler.com/check).
+
+  ### ☁️ OCI — Connect Tenancies Outside us-ashburn-1
+
+  OCI API key credentials now take a home region, and the credentials form in Prowler App requires it. Identity calls that validate the credentials and discover the subscribed regions used to go to `us-ashburn-1` regardless of the tenancy, so a tenancy not subscribed to that region could not connect. The home region is only used for that bootstrap; scans still audit every subscribed region.
+
+  Read more in the [Getting Started with OCI documentation](https://docs.prowler.com/user-guide/providers/oci/getting-started-oci).
+
+  ### 🛠️ Improvements and Fixes
+
+  - **AWS:** Organizations metadata is fetched from the partition of the audited account, using the region that answered the STS bootstrap, instead of the commercial `us-east-1` endpoint, which timed out in GovCloud.
+  - API Gunicorn workers are recycled after 10,000 requests, plus up to 1,000 of jitter, to cap memory growth. Both values are configurable with `GUNICORN_MAX_REQUESTS` and `GUNICORN_MAX_REQUESTS_JITTER`.
+  - The first-login redirect to the Add Provider wizard is retried on the next load when the navigation was cut short, instead of being written off after a single attempt.
+  - The AWS connect step offers to invite a teammate when the user cannot access the account credentials.
+  - **Prowler Cloud:** the Slack channel picker reads the channels the Prowler app is in before the public ones, so invited private channels show up in large workspaces, and the partial list message tells the user to invite the app to a missing channel.
+
+  ### 🔐 Security Updates
+
+  - Kubernetes kubeconfigs accept only inline credentials and known cluster fields. File-path fields, command-based authentication, `auth-provider` directives, proxy URLs and unknown keys are rejected by the API and the credentials form, and stored kubeconfigs are re-validated before each scan and connection test.
+  - IaC repository URLs that resolve to loopback, private or otherwise non-public hosts are rejected before the connection test and the scan clone, including every destination a redirect points to.
+  - CSV outputs prefix cells starting with `=`, `+`, `-`, `@`, tab or carriage return with a single quote so spreadsheet applications treat them as text, and the HTML report escapes the compliance column.
+  - `GET /api/v1/users/{id}` no longer exposes another user's memberships, roles or tenant names from tenants other than the one in the request token.
+  - API error reports sent to Sentry no longer include user identity, IP addresses, cookies, headers or request bodies.
+  - PowerShell upgraded to 7.5.12 in the SDK and API container images, bundling .NET runtime 9.0.21.
+  - Python base images upgraded to 3.12.15 in the SDK and API and to 3.13.16 in the MCP Server, and Trivy to 0.75.0, patching CVE-2026-19445, CVE-2026-19553 and the grpc-go and x/crypto CVEs bundled in Trivy.
+  - `django` upgraded to 5.2.17 in the API, patching CVE-2026-15307.
+  - `pyjwt` upgraded to 2.14.0 in the SDK, the API and the MCP Server, patching GHSA-ffc3-869f-jxw9.
+  - `pymongo` upgraded to 4.18.2 and `urllib3` to 2.8.0 in the SDK and the API, patching CVE-2026-96748, CVE-2026-96749, CVE-2026-97687 and CVE-2026-97689.
+  - `dulwich` upgraded to 1.2.9 in the SDK and the API, patching GHSA-5fqc-mrg8-w798, GHSA-8mcx-5rqc-vhmf, GHSA-8w8g-wq8h-fq33 and GHSA-cm62-gvxx-vmxx.
+  - `next` upgraded to 16.3.8 in the UI, patching a remote code execution in `next/og` (GHSA-vcvr-r3jv-pc5j) and a server-side request forgery in Image Optimization (GHSA-cjq9-62q9-8jv4).
+  - `sharp` upgraded to 0.35.5 and `proxy-addr` to 2.0.8 in the UI, patching GHSA-wq5f-xc86-pv6w and GHSA-jqcg-44mw-7w3h.
+
+  ### 🙌 External Contributors
+
+  Thank you to our community contributors for this release!
+
+  - @rajeshnadiminti: Azure AI Services service and its checks ([#12925](https://github.com/prowler-cloud/prowler/pull/12925), [#12926](https://github.com/prowler-cloud/prowler/pull/12926), [#12997](https://github.com/prowler-cloud/prowler/pull/12997))
+  - @kinomakino: Microsoft 365 `entra_cross_tenant_access_default_outbound_restricted` ([#12991](https://github.com/prowler-cloud/prowler/pull/12991)), `entra_policy_admin_self_service_password_reset_disabled` ([#12990](https://github.com/prowler-cloud/prowler/pull/12990)), `entra_policy_msol_powershell_blocked` ([#13004](https://github.com/prowler-cloud/prowler/pull/13004)), `entra_app_registration_redirect_uris_secure` ([#12993](https://github.com/prowler-cloud/prowler/pull/12993)) and `entra_dynamic_group_member_of_rule_not_used` ([#13003](https://github.com/prowler-cloud/prowler/pull/13003)) checks
+
+  See the [full release notes on GitHub](https://github.com/prowler-cloud/prowler/releases/tag/5.45.0) for the complete list of changes.
+</Update>
+
+<Update label="v5.44.0" description="September 29, 2026">
+  ### 🔁 Findings — Re-check a Resource with a Partial Scan
+
+  <Note>
+  This feature is available exclusively in **Prowler Cloud** and **Prowler Private Cloud** with a [subscription](https://prowler.com/pricing).
+  </Note>
+
+  A resource that has just been fixed can be confirmed from the Findings page without waiting for the next full scan. **Re-check resource** is available in the actions menu of every resource row and in the resource detail drawer, and a hint icon next to **Last seen** opens it directly. It launches a partial scan that runs again only the checks that last reported on that resource; its findings update when the scan completes, and every other resource keeps the results of the latest full scan. Roles need the Manage Scans permission, and a re-check is refused while the provider has a scan running or queued.
+
+  Re-checked resources that now pass drop out of the finding groups list and its drill-down instead of opening a detail panel that still reports `FAIL`. Partial scans do not change overviews or compliance until the next full scan and produce no report files, so the Scans table marks them as **Partial**, offers no report download for them, and the per-scan Compliance selector leaves them out.
+
+  Partial scans can also be launched outside the Findings page:
+
+  - **API:** `POST /api/v1/scans` accepts up to 10 resources in `resource_uids`, and scans expose `is_partial` with a `filter[is_partial]` filter.
+  - **MCP Server:** `prowler_trigger_scan` takes a `resource_uids` argument, and `prowler_list_scans` and `prowler_get_scan` return `is_partial`, with an `is_partial` filter on `prowler_list_scans`.
+  - **Lighthouse AI:** can launch a partial scan to re-check specific resources, such as confirming a remediation.
+
+  ### ☁️ AWS — Connect an Account in One Step
+
+  The Add Provider wizard connects an AWS account in a single step. The account ID is read from the role ARN (or typed when using static access keys), the role is assumed with Prowler's own credentials, and the account, its credentials and the connection test are handled by one submit. A confirmed connection goes straight to the launch step. A refused connection stays on the form with the reason the API returned, so the fields can be fixed and retried without registering the account twice.
+
+  New tenants without providers now land on this wizard on their first sign-in instead of a welcome modal, and the sidebar action reads **Add Provider** until the first provider is connected.
+
+  Read more in the [Getting Started with AWS documentation](https://docs.prowler.com/user-guide/providers/aws/getting-started-aws).
+
+  ### 🔌 Connection Tests No Longer Give Up Early
+
+  The provider connection test no longer reports `Max retries exceeded` for checks that take longer than 30 seconds, such as networks where some AWS endpoints are unreachable. The UI now waits for the full time limit of the backend task, and if that is still exhausted it shows the provider's current connection state instead of a failure.
+
+  On the SDK side, STS calls after a role assumption reuse the region that answered, so an unreachable partition region is waited on once instead of twice. The new `PROWLER_AWS_BOTO3_RETRIES_MAX_ATTEMPTS` environment variable sets the Boto3 retries for deployments that build the AWS provider without CLI flags, next to the existing timeout variables; `0` disables retries.
+
+  Read more in the [Boto3 configuration documentation](https://docs.prowler.com/user-guide/providers/aws/boto3-configuration#retries-configuration).
+
+  ### 🗄️ Self-Hosted — S3-Compatible Storage and Air-Gapped Deployments
+
+  - `DJANGO_OUTPUT_S3_AWS_ENDPOINT_URL` points scan output uploads and downloads at S3-compatible object storage such as MinIO. Previously the only way to reach it was exporting process-wide AWS environment variables, which also hijacked unrelated AWS API calls such as role assumption for AWS providers.
+  - Report downloads from a bucket with default SSE-KMS encryption no longer fail with `InvalidArgument`: when `DJANGO_OUTPUT_S3_AWS_DEFAULT_REGION` is set, download URLs are signed with Signature Version 4 for that region.
+  - Icons ship in the UI bundle instead of being fetched from `api.iconify.design`, so pages render correctly without internet access.
+  - Celery worker fatal errors are logged instead of silenced, and every long-running service in `docker-compose.yml` restarts automatically after an unexpected crash.
+
+  ### 📊 Consistent Latest Scan Across Endpoints
+
+  Every endpoint now resolves a provider's latest completed scan the same way, so overlapping scans no longer make findings, compliance and mute rules read from different scans. Providers whose latest completed scan has no `completed_at` timestamp are no longer missing from those endpoints, and resources no longer keep a stale failed findings count when a scoped or imported scan completes after a full scan.
+
+  ### 🛠️ Prowler App Fixes
+
+  - API key authentication no longer locks the key row on every request, so a heavily used key no longer serializes all its requests; `last_used_at` is updated at most once per minute.
+  - `POST /api/v1/scans` returns the new scan ID in `task_args` again.
+  - Provider deletion no longer fails when the provider has Attack Paths scans recorded on a sink that is no longer configured, such as Neptune after moving back to Neo4j.
+  - A periodic sweep drops orphaned Attack Paths temporary Neo4j databases left behind when a worker or Neo4j crashes mid-scan.
+  - **Prowler Cloud:** imported findings no longer stay stuck in `pending` when the ingestion worker picks up the job before it is committed, and a failed enqueue marks the ingestion as failed.
+  - **Prowler Cloud:** the Lighthouse AI connection check reports a network failure as one, naming the endpoint it could not reach, instead of hitting a time limit that looked the same as a bad key.
+  - **Prowler Cloud:** the finding groups endpoints no longer query Manual Pass triages once per finding, and skip that overlay for tenants with no active Manual Pass.
+  - The Findings page renders a skeleton at once and streams the table before the filters, and the **Finding Group** options load when the dropdown opens.
+  - Mute rule creation errors show the API error message instead of the raw response body.
+  - The sidebar no longer throws a hydration error on full page loads for users who last used the chat mode.
+
+  ### 🔐 Security Updates
+
+  - `DELETE /api/v1/tasks/{id}` requires the permission of the operation that queued the task and rejects provider deletions, and `GET /api/v1/tasks` hides tasks of providers outside the role's visibility.
+  - The UI E2E workflow receives its AWS credentials through environment variables instead of template expansion.
+
+  See the [full release notes on GitHub](https://github.com/prowler-cloud/prowler/releases/tag/5.44.0) for the complete list of changes.
+</Update>
+
 <Update label="v5.43.0" description="September 21, 2026">
  ### 🏛️ Compliance — FedRAMP 20x Consolidated Rules 2026

@@ -128,8 +128,8 @@ To update the environment file:
 Edit the `.env` file and change version values:

 ```env
-PROWLER_UI_VERSION="5.43.0"
-PROWLER_API_VERSION="5.43.0"
+PROWLER_UI_VERSION="5.44.0"
+PROWLER_API_VERSION="5.44.0"
 ```

 <Note>
@@ -2,54 +2,337 @@
 title: "AWS Marketplace"
 ---

-This section contains the instructions to subscribe to **Prowler Cloud** through the **AWS Marketplace**.
+This page explains how to subscribe to **Prowler Cloud** through the **AWS Marketplace**, how to activate the subscription in Prowler Cloud, how billing works, and how to fix the errors you may hit on the way.

-## How to Subscribe
+## Plans

-To get to the **Prowler Cloud** product listing in the AWS Marketplace, and click the `View purchase options` button:
+Prowler Cloud has two listings in the AWS Marketplace. Both give you the same product. They differ in how you commit and how you pay.

-1. Use this link to be taken directly to the [Prowler Cloud Marketplace Listing](https://aws.amazon.com/marketplace/pp/prodview-6ochhig5kxpok):
+A **provider** is a cloud account you connect to Prowler Cloud: an AWS account, an Azure subscription, a GCP project, a Kubernetes cluster, and so on.

-    ![](/images/aws-marketplace/marketplace-listing.png)
+| | Monthly (pay as you go) | Annual (billed annually) |
+| --- | --- | --- |
+| Listing | [Prowler Cloud $99/provider per month (Pay as You Go)](https://aws.amazon.com/marketplace/pp/prodview-nmbvelz746oyk) | [Prowler Cloud $79/provider per month (Billed Annually)](https://aws.amazon.com/marketplace/pp/prodview-wwehsmzui25ri) |
+| Billing | Monthly, per connected provider | Once, at checkout, for the full 12 months |
+| Commitment | None. Cancel anytime. | 12 months for the number of providers you choose during checkout on AWS. |
+| Resources beyond the included amount | Billed per resource | Billed per resource, at the annual rate |
+| Providers beyond your commitment | Not applicable | Billed monthly at the pay-as-you-go rate |

-2. Then, scroll down to the "Purchase Details" section and click the `Subscribe` button:
+For prices, included resources and per-resource rates, see the [Prowler Cloud pricing page](https://prowler.com/pricing/).

-    ![](/images/aws-marketplace/marketplace-subscribe.png)
+## Before You Subscribe

-## Set Up Your Account
+- **One AWS account pays for the whole organization.** Subscribe from a single AWS account. You then connect as many providers as you need, from any cloud, inside Prowler Cloud. You do not subscribe again for each AWS account you scan.
+- **Decide which Prowler Cloud organization will pay.** Activation links the AWS purchase to the organization you are signed in to. If you belong to several organizations, switch to the right one before you activate. See [Activate the Subscription in Prowler Cloud](#activate-the-subscription-in-prowler-cloud).
+- **Annual plan: decide the provider count first.** AWS asks for it during checkout, and AWS charges the full year at that moment. Providers you add beyond that count are billed monthly at the pay-as-you-go rate. AWS may not let you cancel an annual contract yourself from the console. See [Cancel the Subscription](#cancel-the-subscription) before you commit.
+- **Cancel any card-billed subscription first.** An organization already billed by credit card cannot switch to AWS Marketplace billing until that subscription is cancelled. This prevents double charges.

-After you have subscribed to the **Prowler Cloud** product, you will need to set up your **Prowler Cloud** account:
+## Subscribe on AWS Marketplace

-1. Click the `Set up your account` button:
+<Steps>
+  <Step title="Open the listing">
+    Sign in to the AWS account that will pay, open the listing for the plan you want, and click **View purchase options**.

-    ![](/images/aws-marketplace/marketplace-message.png)
+    <Tabs>
+      <Tab title="Monthly">
+        Open [Prowler Cloud $99/provider per month (Pay as You Go)](https://aws.amazon.com/marketplace/pp/prodview-nmbvelz746oyk).

-2. You will be redirected to **Prowler Cloud Sign In** page. You can sign in with an existing account or sign up with a new account:
+        <Frame>
+          <img src="/images/aws-marketplace/listing-monthly.png" alt="Monthly Prowler Cloud listing on AWS Marketplace with the View purchase options button highlighted" />
+        </Frame>
+      </Tab>
+      <Tab title="Annual">
+        Open [Prowler Cloud $79/provider per month (Billed Annually)](https://aws.amazon.com/marketplace/pp/prodview-wwehsmzui25ri).

-    ![](/images/aws-marketplace/marketplace-sign-up.png)
+        <Frame>
+          <img src="/images/aws-marketplace/listing-annual.png" alt="Annual Prowler Cloud listing on AWS Marketplace with the View purchase options button highlighted" />
+        </Frame>
+      </Tab>
+    </Tabs>
+  </Step>

-3. Once you have successfully authenticated, you should be automatically redirected to the **Prowler Cloud** [Billing](https://cloud.prowler.com/billing) page where you should now see that your account has the `AWS Marketplace Subscription` badge.
+  <Step title="Review the purchase and subscribe">
+    <Tabs>
+      <Tab title="Monthly">
+        Scroll to **Purchase details** and click **Subscribe**. There is no upfront charge. AWS bills your usage at the end of each month.

-    ![](/images/aws-marketplace/marketplace-my-account.png)
+        <Frame>
+          <img src="/images/aws-marketplace/purchase-monthly.png" alt="Purchase details for the monthly listing with the Subscribe button highlighted" />
+        </Frame>
+      </Tab>
+      <Tab title="Annual">
+        Under **Pricing details**, select the **providers** dimension and enter the **Number of units**. One unit is one provider for the 12-month term. Review the **Contract total**, then click **Subscribe** at the bottom of the page. AWS charges the full year now.

-If you have any issues signing up, please contact us at support@prowler.com.
+        <Frame>
+          <img src="/images/aws-marketplace/purchase-annual.png" alt="Purchase options for the annual listing showing the contract details, the providers dimension and the Number of units table" />
+        </Frame>

+        **Auto-renewal** is on by default. Leave it on to have AWS renew the contract for another 12 months at the end date, or choose **Do not automatically renew this contract**. You can change this from **Manage subscriptions** any time before the renewal date.
+      </Tab>
+    </Tabs>
+  </Step>

-## Billing
+  <Step title="Click Set up your account">
+    AWS confirms the purchase and shows a **Set up your account** button. Click it. AWS sends your browser to Prowler Cloud with a setup link.

-You will be charged monthly based on resources scanned and monitored depending on usage in **Prowler Cloud**. For more information on billing, please see the [Prowler Cloud Pricing FAQ](https://prowler.com/pricing/).
+    <Frame>
+      <img src="/images/aws-marketplace/set-up-your-account.png" alt="AWS Marketplace purchase confirmation banner with the Set up your account button" />
+    </Frame>

-**Note:** Your **Prowler Cloud** bills can be seen at [AWS Billing](https://us-east-1.console.aws.amazon.com/billing/home#/bills).
+    <Note>
+    The setup link expires quickly: AWS documents roughly one hour, and never more than four. If the link expires, you close the tab, or need to start over, return to [Manage subscriptions](https://console.aws.amazon.com/marketplace/subscriptions) in the AWS Marketplace console, open **Prowler Cloud**, and click **Set up your account** again to get a fresh link.
+    </Note>
+  </Step>
+</Steps>

-## Subscription
+## Activate the Subscription in Prowler Cloud

-If you subscribe to Prowler Cloud through the AWS Marketplace it is not necessary to subscribe from different AWS accounts to use Prowler Cloud for those accounts.
+Nothing is linked until you confirm it in Prowler Cloud. The purchase is safe on the AWS side while you complete these steps.

-In Prowler Cloud you only need to subscribe from one of your AWS accounts through the AWS Marketplace and add multiple provider accounts once you are in the Prowler Cloud console. We will send usage metrics to the AWS Marketplace regardless of the number of accounts you add in our platform, so the AWS Marketplace will bill you based on those usage metrics.
+<Steps>
+  <Step title="Sign in or create your account">
+    Prowler Cloud shows the sign-in page with a banner that reads "To finish setting up your AWS Marketplace subscription, sign in or register if you don't have an account yet."
+
+    <Frame>
+      <img src="/images/aws-marketplace/sign-in-marketplace.png" alt="Prowler Cloud sign-in page with the AWS Marketplace banner" />
+    </Frame>
+
+    If you do not have an account yet, click **Sign up**. The purchase carries over once you sign in with the new account.
+
+    <Frame>
+      <img src="/images/aws-marketplace/sign-up-marketplace.png" alt="Prowler Cloud sign-up page with the AWS Marketplace banner" />
+    </Frame>
+  </Step>
+
+  <Step title="Check the organization and activate">
+    The billing page shows a card titled **Activate your AWS Marketplace subscription**. It names the organization the purchase will be linked to.
+
+    <Frame>
+      <img src="/images/aws-marketplace/activate-confirm.png" alt="Activation card naming the organization, with the Activate subscription button and the Continue to billing without activating link" />
+    </Frame>
+
+    <Warning>
+    Read the organization name before you click. Activation is a billing decision: charges for that organization go to the AWS account you subscribed with. If it is not the organization you want to pay for, switch organizations first, then come back to the billing page.
+    </Warning>
+
+    Click **Activate subscription**. Prowler Cloud links the purchase and activates the subscription. Two short status messages appear while it works: "Linking your AWS Marketplace purchase…" and "Activating your subscription…".
+
+    <Frame>
+      <img src="/images/aws-marketplace/activate-working.png" alt="Activation card showing the Activating your subscription progress message" />
+    </Frame>
+
+    **Continue to billing without activating** discards the setup link and leaves the organization unchanged. Use it only if you landed in the wrong organization. To activate later, get a fresh link from the AWS Marketplace console as described above.
+  </Step>
+
+  <Step title="Confirm the subscription is active">
+    The billing page now states that you subscribed through AWS Marketplace, shows the AWS account that pays, and links to your subscription in the AWS Marketplace console.
+
+    <Frame>
+      <img src="/images/aws-marketplace/billing-subscribed.png" alt="Prowler Cloud billing page for an AWS Marketplace subscription, showing the paying AWS account and the link to the AWS Marketplace console" />
+    </Frame>
+
+    There is no payment method, invoice history, or cancel button on this page. AWS handles all of that.
+  </Step>
+</Steps>
+
+If something goes wrong during activation, see [Activation errors](#activation-errors).
+
+## After Activation
+
+- Add providers from the **Providers** page in Prowler Cloud. Every provider you add is covered by the same AWS subscription, whatever cloud it belongs to.
+- All charges come from AWS. Find them under **Amazon Web Services, Inc. - Marketplace** in [AWS Billing](https://console.aws.amazon.com/billing/home#/bills).
+
+<Frame>
+  <img src="/images/aws-marketplace/marketplace-billing.png" alt="AWS Billing page showing the Amazon Web Services, Inc. - Marketplace line" />
+</Frame>
+
+### Monthly
+
+AWS bills you at the end of each month for the providers connected and the resources scanned in Prowler Cloud during that month.
+
+### Annual
+
+AWS charges the full 12-month subscription once, at checkout. The providers covered by your commitment cost nothing more during the year. Your monthly AWS bill only includes usage beyond the commitment: extra providers at the pay-as-you-go rate, and resources beyond the included amount at the annual plan's per-resource rate.
+
+If auto-renewal is on, AWS renews the contract for another 12 months at the end date and charges the new term the same way. Turn it off from **Manage subscriptions** before the renewal date if you do not want that.
+
+## Cancel the Subscription
+
+There is no cancel button in Prowler Cloud for AWS Marketplace subscriptions. How you cancel depends on the plan, following the [AWS Marketplace cancellation rules](https://docs.aws.amazon.com/marketplace/latest/buyerguide/cancel-subscription.html).
+
+### Monthly
+
+Cancel from the AWS Marketplace console at any time:
+
+1. Open [Manage subscriptions](https://console.aws.amazon.com/marketplace/subscriptions) and open **Prowler Cloud**.
+2. Under **Active agreements**, select the agreement and click **View details**.
+3. Open the **Actions** menu and choose **Cancel subscription**.
+4. Type `confirm` and choose **Yes, cancel subscription**.
+
+<Frame>
+  <img src="/images/aws-marketplace/aws-manage-subscriptions.png" alt="Prowler Cloud agreement page in the AWS Marketplace console with the Actions menu open on Cancel subscription" />
+</Frame>
+
+Cancelling stops future charges. Usage accrued before the cancellation still appears on your next AWS bill.
+
+### Annual
+
+Open the agreement from [Manage subscriptions](https://console.aws.amazon.com/marketplace/subscriptions) first. If the **Actions** menu shows **Cancel subscription**, follow the monthly steps above. If it does not, AWS does not allow self-service cancellation for that contract:
+
+- **Within 48 hours of purchase**, contact AWS Customer Service. AWS can cancel the contract and refund the full amount, but only if you ask for the refund.
+- **After 48 hours**, contact [support@prowler.com](mailto:support@prowler.com). Prowler starts the cancellation request through AWS Marketplace and you approve it in the AWS Marketplace console. A refund is not automatic. Ask for it when you request the cancellation.
+
+See [Refunds and cancellations in AWS Marketplace](https://docs.aws.amazon.com/marketplace/latest/buyerguide/buyer-refunds.html) for the AWS side of the process.
+
+### What happens after cancellation
+
+Once AWS ends the subscription, Prowler Cloud pauses scans for the organization. Providers, findings and scan history stay readable. A **Subscription required** card in the sidebar, labeled **Subscription cancelled**, explains it: "Scans are paused and your assessment data remains available. Subscribe again to continue scanning." The billing page shows the plan selection page.
+
+<Frame>
+  <img src="/images/aws-marketplace/billing-cancelled.png" alt="Prowler Cloud after an AWS Marketplace cancellation, showing the Subscription cancelled card in the sidebar and the plan selection page" />
+</Frame>
+
+To subscribe again from the same AWS account into the same Prowler Cloud organization, subscribe from the listing and activate as before.
+
+<Warning>
+Deleting your Prowler Cloud organization does not cancel the AWS subscription. AWS keeps charging the agreement until you cancel it as described above.
+</Warning>

 ## Troubleshooting

-### SEPA Payment Method Issues
+### Activation errors
+
+Each error appears on the Prowler Cloud billing page with the title below. Your AWS purchase is never lost by any of them. **Continue to billing** closes the message without activating.
+
+<AccordionGroup>
+  <Accordion title="Your AWS Marketplace link has expired">
+    AWS no longer accepts the setup link, usually because it timed out. AWS documents roughly one hour of validity, and never more than four.
+
+    Open **Manage subscriptions** in the AWS Marketplace console, open **Prowler Cloud**, and click **Set up your account** to get a fresh link.
+
+    <Frame>
+      <img src="/images/aws-marketplace/error-token-expired.png" alt="Error notice: Your AWS Marketplace link has expired" />
+    </Frame>
+  </Accordion>
+
+  <Accordion title="This AWS Marketplace product is not supported yet">
+    The purchase went through on AWS, but this listing is not enabled for activation in Prowler Cloud. You see this when you subscribed to an earlier Prowler Cloud listing instead of one of the [two current plans](#plans).
+
+    Contact [support@prowler.com](mailto:support@prowler.com) with the AWS account you subscribed with. Click **Try again** once support confirms.
+
+    <Frame>
+      <img src="/images/aws-marketplace/error-product-not-supported.png" alt="Error notice: This AWS Marketplace product is not supported yet" />
+    </Frame>
+  </Accordion>
+
+  <Accordion title="This AWS subscription is already linked">
+    The purchase cannot be linked to the organization you are signed in to. The message shows the reason reported for this purchase:
+
+    - **"This AWS Marketplace subscription is no longer active."** The subscription was cancelled on AWS. Subscribe again from the listing. If you see this seconds after a new purchase, AWS may still be registering it: wait a minute, go back to **Manage subscriptions**, and click **Set up your account** again.
+    - **"This AWS Marketplace purchase is already linked to another Prowler account."** AWS identifies a purchase by AWS account and product, so one AWS account backs one Prowler Cloud organization per plan. Sign in to the organization that already holds it, or subscribe from a different AWS account.
+    - **"This account is already linked to another active AWS Marketplace purchase."** This organization already has an active AWS Marketplace subscription. Cancel that subscription in the AWS Marketplace console before activating a new one.
+
+    If none of these applies, contact [support@prowler.com](mailto:support@prowler.com).
+
+    <Frame>
+      <img src="/images/aws-marketplace/error-agreement-in-use.png" alt="Error notice: This AWS subscription is already linked, with the reason shown below the message" />
+    </Frame>
+  </Accordion>
+
+  <Accordion title="Your purchase is still being linked">
+    Another request is linking the same purchase, usually a second click or a second tab. Wait a moment and click **Try again**.
+
+    <Frame>
+      <img src="/images/aws-marketplace/error-link-in-progress.png" alt="Error notice: Your purchase is still being linked" />
+    </Frame>
+  </Accordion>
+
+  <Accordion title="You already have an active subscription">
+    This organization is billed by credit card. Cancel that subscription first, so you are never charged twice. Then open **Manage subscriptions** in the AWS Marketplace console and click **Set up your account** again.
+
+    <Frame>
+      <img src="/images/aws-marketplace/error-billing-provider-conflict.png" alt="Error notice: You already have an active subscription" />
+    </Frame>
+  </Accordion>
+
+  <Accordion title="This AWS purchase is billed under another organization">
+    AWS Marketplace billing for this AWS account and plan is already set up in a different Prowler Cloud organization. This also happens after you delete the organization that held the subscription and subscribe again from a new one.
+
+    Sign in to the organization that holds the billing and restart the setup from **Manage subscriptions** in the AWS Marketplace console. If that organization no longer exists, contact [support@prowler.com](mailto:support@prowler.com) so they can release the billing link.
+  </Accordion>
+
+  <Accordion title="We could not find your AWS purchase">
+    Prowler Cloud received no purchase to activate. Open **Manage subscriptions** in the AWS Marketplace console and click **Set up your account** to start again.
+
+    <Frame>
+      <img src="/images/aws-marketplace/error-no-agreement.png" alt="Error notice: We could not find your AWS purchase" />
+    </Frame>
+  </Accordion>
+
+  <Accordion title="We could not reach AWS Marketplace">
+    A temporary problem talking to AWS. Click **Try again**. If it keeps failing, contact [support@prowler.com](mailto:support@prowler.com) and include the detail text shown under the message.
+
+    <Frame>
+      <img src="/images/aws-marketplace/error-resolve-failed.png" alt="Error notice: We could not reach AWS Marketplace" />
+    </Frame>
+  </Accordion>
+
+  <Accordion title="We could not activate your subscription">
+    The purchase was linked but the activation did not complete. Click **Try again**. If it keeps failing, contact [support@prowler.com](mailto:support@prowler.com) and include the detail text shown under the message.
+
+    <Frame>
+      <img src="/images/aws-marketplace/error-subscribe-failed.png" alt="Error notice: We could not activate your subscription" />
+    </Frame>
+  </Accordion>
+
+  <Accordion title="Please sign in again">
+    Your Prowler Cloud session expired before the activation finished. Click **Sign in again** and pick up where you left off. The setup link stays valid during its expiry window.
+
+    <Frame>
+      <img src="/images/aws-marketplace/error-unauthorized.png" alt="Error notice: Please sign in again" />
+    </Frame>
+  </Accordion>
+
+  <Accordion title="We could not read your AWS purchase">
+    The setup link arrived damaged. Open **Manage subscriptions** in the AWS Marketplace console and click **Set up your account** to get a fresh one.
+
+    <Frame>
+      <img src="/images/aws-marketplace/error-invalid-input.png" alt="Error notice: We could not read your AWS purchase" />
+    </Frame>
+  </Accordion>
+</AccordionGroup>
+
+### Errors before the sign-in page
+
+If the redirect from AWS itself fails, Prowler Cloud shows a plain page instead of the app. Each page links back to Prowler Cloud billing and to your AWS Marketplace subscriptions.
+
+<AccordionGroup>
+  <Accordion title="We couldn't verify this request">
+    The setup page only accepts the redirect from AWS Marketplace. You reach it by opening the setup URL directly or from a bookmark. Start again from **Set up your account** in the AWS Marketplace console.
+
+    <Frame>
+      <img src="/images/aws-marketplace/fulfillment-error-verify.png" alt="Error page: We couldn't verify this request" />
+    </Frame>
+  </Accordion>
+
+  <Accordion title="We couldn't read your AWS purchase">
+    The redirect arrived without a valid setup token. Start again from **Set up your account** in the AWS Marketplace console.
+
+    <Frame>
+      <img src="/images/aws-marketplace/fulfillment-error-read.png" alt="Error page: We couldn't read your AWS purchase" />
+    </Frame>
+  </Accordion>
+
+  <Accordion title="Something went wrong">
+    Prowler Cloud could not process the redirect. Your purchase is safe. Wait a moment, then start again from **Set up your account** in the AWS Marketplace console. Contact [support@prowler.com](mailto:support@prowler.com) if it happens again.
+
+    <Frame>
+      <img src="/images/aws-marketplace/fulfillment-error-generic.png" alt="Error page: Something went wrong" />
+    </Frame>
+  </Accordion>
+</AccordionGroup>
+
+### SEPA payment method issues

 If AWS Marketplace notifies that payment failed due to an issue with the payment method, this typically occurs when a SEPA bank account is set as the default payment method. AWS Marketplace does not support SEPA bank accounts for product subscriptions, even when the account includes valid alternative payment methods. This is because AWS Marketplace invoices are issued by AWS Inc., a US entity. SEPA accounts do not recognize these invoices as valid, causing subscription failures.

@@ -73,10 +356,14 @@ The AWS Marketplace team acknowledges this limitation: "We apologize for these a

 </Note>

-### Credit and Debit Card Storage Restrictions (AISPL Customers in India)
+### Credit and debit card storage restrictions (AISPL customers in India)

 AWS Marketplace no longer supports payments using credit or debit cards stored on file for Amazon Internet Services Private Limited (AISPL) customers. This restriction stems from Reserve Bank of India (RBI) regulations regarding payment aggregators, which prohibit the storage of card data. As explained in [this AWS blog post](https://aws.amazon.com/blogs/awsmarketplace/restriction-on-credit-and-debit-card-purchases-for-aispl-customers-using-aws-marketplace/):

 > AWS Marketplace can no longer support payments using credit or debit cards stored on file. [The Reserve Bank of India (RBI) has issued a notice regarding regulation of payment aggregators](https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=11822&Mode=0), which restricts the storage of card data. If you are currently using credit or debit card as your default payment instrument, your ability to use AWS Marketplace products will be restricted. However, you can switch your default payment instrument to Pay By Invoice to avoid disruption or restore your original experience.

 To maintain uninterrupted access to AWS Marketplace products, change the default payment instrument from stored card data to Pay By Invoice billing.
+
+## Support
+
+If you get stuck at any step, contact [support@prowler.com](mailto:support@prowler.com) and include the AWS account you subscribed with and the exact error title you see.
@@ -11,3 +11,28 @@ Prowler's Infrastructure as Code (IaC) provider enables you to scan local or rem
    - [**GitHub Username and Personal Access Token (PAT)**](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#creating-a-personal-access-token-classic)
    - [**GitHub OAuth App Token**](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#creating-a-fine-grained-personal-access-token)
    - [**Git URL**](https://git-scm.com/docs/git-clone#_git_urls)
+
+### Private Repository Hosts
+
+**Prowler CLI scans a repository on an internal network with no extra configuration.** On the CLI the operator supplies the repository URL themselves, so there is nothing to defend against and the check below does not apply.
+
+**Prowler App rejects a repository URL that resolves to a non-public address**, as an SSRF defense. There the URL arrives from a tenant and the worker must not be used to reach the internal network it runs in. The check covers both the connection test and the scan clone. To scan a self-hosted GitLab, Gitea or Bitbucket from Prowler App, declare the trusted ranges:
+
+```console
+PROWLER_ALLOWED_PRIVATE_NETWORKS="10.20.0.0/16,192.168.65.254/32"
+```
+
+The value is a comma-separated list of IPs and CIDRs. A resolved address inside an allowlisted range is permitted; every other non-public address stays blocked, so link-local (`169.254.169.254`), loopback and the rest of the internal network remain protected. Malformed entries are rejected, and a non-empty allowlist is logged as a relaxed security control.
+
+The scan runs in the worker, not the API, so the variable has to reach the worker:
+
+- **Docker Compose**: set it in the root `.env`; it reaches the worker through the shared environment file.
+- **Helm**: add it under `api.djangoConfig`, which is rendered into the API ConfigMap that the worker inherits through `envFrom`.
+
+```yaml
+api:
+  djangoConfig:
+    PROWLER_ALLOWED_PRIVATE_NETWORKS: "10.20.0.0/16"
+```
+
+Setting it only on the API container has no effect. The same variable applies to the Kubernetes and OpenStack providers. The Image provider has its own, `PROWLER_IMAGE_PROVIDER_ALLOWED_PRIVATE_NETWORKS`.
@@ -24,7 +24,7 @@ title: 'Getting Started with Kubernetes'
 For Kubernetes, Prowler Cloud uses a `kubeconfig` file to authenticate. Paste the contents of your `kubeconfig` file into the `Kubeconfig content` field.

 <Note>
-Kubeconfigs that use `users[].user.exec` authentication are not supported in Prowler Cloud or Prowler Local Server. For security reasons, Prowler Cloud does not run commands declared by uploaded kubeconfigs. Use kubeconfig credentials that do not rely on `exec` authentication, such as the ServiceAccount token flow documented below.
+Only inline kubeconfig credentials are supported: `token`, `username`/`password`, or `client-certificate-data` with `client-key-data` for users, and `certificate-authority-data` for clusters. Kubeconfigs that reference external files (`tokenFile`, `client-certificate`, `client-key`, `certificate-authority`), run commands (`exec`, `cmd-path`), use `auth-provider` directives, set a proxy URL, or include unsupported user or cluster fields are rejected. Impersonation fields (`as`, `as-uid`, `as-groups`, `as-user-extra`) are accepted but not applied, so Prowler connects with the identity of the user credentials. Use inline credentials such as the ServiceAccount token flow documented below.
 </Note>

 By default, the `kubeconfig` file is located at `~/.kube/config`.
@@ -96,6 +96,8 @@ If you are adding an **EKS**, **GKE**, **AKS** or external cluster, follow these
    kubectl config set-context <CONTEXT_NAME> --user=prowler-sa
    ```

+    Prowler validates the entire kubeconfig file and requires it to contain only the ServiceAccount user and its cluster entry with certificate-authority-data; remove any exec entries from EKS, GKE, or AKS or Prowler will reject the file.
+
    Replace `<SA_TOKEN>` with the generated token and `<CONTEXT_NAME>` with your KubeConfig Context Name of your EKS, GKE or AKS cluster.

 4. Add the modified `kubeconfig` in Prowler Cloud and test the connection.
@@ -12,7 +12,7 @@ The following steps apply to Prowler Cloud and Prowler Local Server.
 1. Sign in to the [OCI Console](https://cloud.oracle.com/) and open **Tenancy Details** to copy the Tenancy OCID.
 2. Go to **Identity & Security** → **Users**, select the principal that owns the API key, and copy the **User OCID**.
 3. Generate or locate the API key fingerprint and private key for that user. Follow the [Config File Authentication steps](/user-guide/providers/oci/authentication#config-file-authentication-manual-api-key-setup) to create or rotate the key pair and copy the fingerprint.
-4. Note the **Region** identifier to scan (for example, `us-ashburn-1`).
+4. In **Tenancy Details**, note the **Home Region** identifier (for example, `me-abudhabi-1`). Any other region the tenancy is subscribed to also works.

 ### Step 2: Access Prowler Cloud
 1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler Local Server](/user-guide/tutorials/prowler-app).
@@ -26,12 +26,18 @@ Prowler Cloud connects to OCI with API key credentials. Provide:

 - **User OCID** for the API key owner
 - **Fingerprint** of the API key
- **Region** (for example, `us-ashburn-1`)
+- **Home Region**: select it from the list (for example, `me-abudhabi-1`)
 - **Private Key Content** (paste the full PEM value)
 - **Passphrase (Optional)** if the private key is encrypted

 Select **Next**, then **Launch Scan** to validate the connection and start the first OCI scan. The private key content is encoded for secure transmission.

+<Note>
+The home region is used only to validate the credentials and discover the regions the tenancy is subscribed to. It does not limit the scan: Prowler audits every subscribed region. OCI Identity and Access Management (IAM) only answers in subscribed regions, so a tenancy that is not subscribed to the selected region cannot be validated.
+</Note>
+
+Providers created without a region keep using `us-ashburn-1` for validation. If such a provider fails with `401 NotAuthenticated`, update its credentials and select the home region.
+
 ![Add OCI API Key Credentials](./images/oci-add-api-key-credentials.png)

 ---
@@ -334,6 +340,11 @@ prowler oci \

 #### Region Issues

+**Error: "OCI credential validation failed" with `401 NotAuthenticated` on `get_tenancy`**
+- The tenancy is not subscribed to the region used for validation (by default `us-ashburn-1`)
+- In Prowler Cloud or Prowler Local Server, update the provider credentials and select the tenancy home region
+- In Prowler CLI, set `region` in `~/.oci/config` to the home region. All subscribed regions are still scanned; `--region` also works but limits the scan to that region
+
 **Error: "Invalid region"**
 - Check available regions: `prowler oci --list-regions`
 - Verify your tenancy is subscribed to the region
@@ -27,7 +27,7 @@ This guide covers the Slack integration in Prowler Cloud and Prowler Private Clo
 When connected and configured:

 1. A Slack workspace is approved once through Slack's app install flow, and Prowler stores the resulting credential encrypted.
-2. Prowler reads the channels it can post to: the workspace's public channels, plus the private channels the Prowler app has been invited to.
+2. Prowler reads the channels it can post to: first the channels the Prowler app is already in, public or private, then the rest of the workspace's public channels.
 3. Several of those channels are selected and saved as the integration's authorized channels.
 4. The connection check verifies the credential and every authorized channel, and posts a one-time confirmation message to each channel it has not confirmed yet.
 5. Features that deliver to Slack, such as [Alerts](/user-guide/tutorials/prowler-alerts), choose their destinations from the confirmed channels.
@@ -98,7 +98,7 @@ Declining the consent screen creates nothing. Prowler reports that the workspace

 Prowler posts to the channels authorized on the integration. Several channels can be authorized at once, and once the connection check has confirmed them they are the pool every consumer of the integration draws from: an [Alert](/user-guide/tutorials/prowler-alerts) picks its Slack destinations from the confirmed channels, never from the whole workspace.

-1. Open the **Destination channels** selection. It lists the workspace's public channels, plus the private channels the Prowler app has been invited to, each marked **Private**.
+1. Open the **Destination channels** selection. It lists the channels the Prowler app is already in, including the private channels it has been invited to, each marked **Private**, followed by the rest of the workspace's public channels.

    ![Destination channels selection listing public channels and an invited private channel marked Private](/images/prowler-app/slack/channel-picker.png)

@@ -109,7 +109,7 @@ Prowler validates the selection against Slack and derives each channel name itse

 If the selection reports that no channels are available, the workspace exposes nothing Prowler can see. Create a public channel, or invite `@Prowler Cloud` to a private one, then click **Refresh channels**.

-A workspace can hold more channels than Prowler reads in one go. When that happens, the selection says so and lists what was read: every listed channel is usable, and a channel missing from a partial list is not necessarily one `@Prowler Cloud` has to be invited to. Only listed channels can be selected: **Refresh channels** repeats the same bounded read rather than reading further, and the selection's search filters what was already read, so neither surfaces a channel the read left out.
+A workspace can hold more public channels than Prowler reads in one go. When that happens, the selection says so and lists what was read: every listed channel is usable, and the channels `@Prowler Cloud` is already in are always among them, because they are read first. Only listed channels can be selected: **Refresh channels** repeats the same bounded read rather than reading further, and the selection's search filters what was already read, so neither surfaces a public channel the read left out. To make such a channel selectable, invite `@Prowler Cloud` to it and click **Refresh channels**.

 Saving a new selection replaces the authorized set: channels left out of it stop being authorized, and channels added to it are authorized but not yet confirmed. Changing which channels are in the set also resets the integration's connection state, so the check runs again over the new set — reordering the same channels does not. Saving an empty selection leaves the integration with no authorized channels, and **Test connection** cannot be run again until at least one channel is authorized.

@@ -93,6 +93,10 @@ After adding your cloud account credentials, click the `Check connection` button
 For a single AWS account, Prowler tests the connection as part of the `Connect account` step, so the wizard moves straight to launching the scan.
 </Note>

+<Note>
+To delegate the AWS connection, select `I don't have access, invite a teammate` on the same step when you cannot create the IAM role or do not have the account credentials. Prowler App sends the invitation to the tenant and shows the link to share. Prowler Cloud also emails it. This option is available to users who can manage the account.
+</Note>
+
 ## Step 6: Scan Started
 After the connection check succeeds, save the provider and start your first scan with the `Launch Scan` button. The `Scans` section shows the scan in progress:

@@ -4,6 +4,15 @@ All notable changes to the **Prowler MCP Server** are documented in this file.

 <!-- changelog: release notes start -->

+## [0.12.3] (Prowler v5.45.0)
+
+### 🔐 Security
+
+- `pyjwt` from 2.13.0 to 2.14.0, patching GHSA-ffc3-869f-jxw9 [(#12911)](https://github.com/prowler-cloud/prowler/pull/12911)
+- Python from 3.13.14 to 3.13.16 in the MCP container image, patching CVE-2026-19445 and CVE-2026-19553 [(#13009)](https://github.com/prowler-cloud/prowler/pull/13009)
+
+---
+
 ## [0.12.2] (Prowler v5.43.0)

 ### 🔐 Security
@@ -25,34 +25,20 @@ RUN --mount=type=cache,target=/root/.cache/uv \
 # =============================================================================
 # Final stage - Minimal runtime environment
 # =============================================================================
-FROM python:3.13.14-alpine3.23@sha256:9fdbf2e3e82628351513560b121e2ee6ce31cac212be9e070c5a5e2769fb5e76
+FROM python:3.13.16-alpine3.23@sha256:07b20c774a247152e74f622034c1482495d299e070eec620ddff13e01264290b

 LABEL maintainer="https://github.com/prowler-cloud"

-# High CVEs fixed in Alpine 3.23 but not yet in the pinned base image:
-#   sqlite-libs 3.53.4-r0  CVE-2026-11822, CVE-2026-11824  (image ships 3.51.2-r0)
-#   libcrypto3/libssl3 3.5.8-r0  CVE-2026-14456            (image ships 3.5.7-r0)
-#   libuuid 2.41.6-r1  CVE-2026-53612, -53613, -53614, -76642, -78408, -78410
-#     (image ships 2.41.4-r0; -78408 is the one that needs -r1 rather than -r0)
-# The base image pins python 3.13.14, which has not been rebuilt since those
-# packages were published, so the upgrade is taken here rather than by moving
-# the pin -- the newest published python:3.13-alpine3.23 carries the same
-# vulnerable versions. libcrypto3 and libssl3 are both built from openssl and
-# are flagged separately, so both are named.
-# `>=` rather than `=`: Alpine keeps only the newest build of a package in a
-# branch's index, so an exact pin breaks this build the day one of these is
-# superseded. Drop an entry once the base image ships that version or later.
-RUN apk add --no-cache --upgrade \
-    "sqlite-libs>=3.53.4-r0" \
-    "libcrypto3>=3.5.8-r0" \
-    "libssl3>=3.5.8-r0" \
-    "libuuid>=2.41.6-r1"
-
 # Create non-root user for security
 # Using specific UID/GID for consistency across environments
 RUN addgroup -g 1001 prowler && \
    adduser -D -u 1001 -G prowler prowler

+# pip is build-only; the entrypoint runs the venv directly.
+RUN rm -rf /usr/local/lib/python3.13/site-packages/pip \
+    /usr/local/lib/python3.13/site-packages/pip-*.dist-info \
+    /usr/local/bin/pip /usr/local/bin/pip3 /usr/local/bin/pip3.13
+
 WORKDIR /app
 USER prowler

@@ -0,0 +1 @@
+certifi from 2026.4.22 to 2026.10.19 in the MCP Server container image, dropping the emSign root CAs whose intermediate keys were compromised
@@ -81,5 +81,6 @@ constraint-dependencies = [
  "cryptography==50.0.0",
  "joserfc==1.6.8",
  "mcp==1.28.1",
+  "pyjwt==2.14.0",
  "python-multipart==0.0.30"
 ]
@@ -1,5 +1,5 @@
 version = 1
-revision = 3
+revision = 2
 requires-python = ">=3.12"
 resolution-markers = [
    "python_full_version >= '3.14' and sys_platform == 'win32'",
@@ -13,6 +13,7 @@ constraints = [
    { name = "cryptography", specifier = "==50.0.0" },
    { name = "joserfc", specifier = "==1.6.8" },
    { name = "mcp", specifier = "==1.28.1" },
+    { name = "pyjwt", specifier = "==2.14.0" },
    { name = "python-multipart", specifier = "==0.0.30" },
 ]

@@ -128,11 +129,11 @@ wheels = [

 [[package]]
 name = "certifi"
-version = "2026.4.22"
+version = "2026.10.19"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/25/ee/6caf7a40c36a1220410afe15a1cc64993a1f864871f698c0f93acb72842a/certifi-2026.4.22.tar.gz", hash = "sha256:8d455352a37b71bf76a79caa83a3d6c25afee4a385d632127b6afb3963f1c580", size = 137077, upload-time = "2026-04-22T11:26:11.191Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/a6/bd/1436c50cc46699de0230fbaacc1d1de7bfec413176099949e9d5112e88f2/certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae", size = 137598, upload-time = "2026-10-20T02:24:16.604Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/22/30/7cd8fdcdfbc5b869528b079bfb76dcdf6056b1a2097a662e5e8c04f42965/certifi-2026.4.22-py3-none-any.whl", hash = "sha256:3cb2210c8f88ba2318d29b0388d1023c8492ff72ecdde4ebdaddbb13a31b1c4a", size = 135707, upload-time = "2026-04-22T11:26:09.372Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b", size = 136464, upload-time = "2026-10-20T02:24:15.072Z" },
 ]

 [[package]]
@@ -977,11 +978,11 @@ wheels = [

 [[package]]
 name = "pyjwt"
-version = "2.13.0"
+version = "2.14.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/3b/81/58d0ac84e1ef3a3843791d6954d94c0b33d526c75eeb1efbce9d0a4c4077/pyjwt-2.13.0.tar.gz", hash = "sha256:41571c89ca91598c79e8ef18a2d07367d4810fbbd6f637794879baf1b7703423", size = 107515, upload-time = "2026-05-21T19:54:36.618Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/af/c3/8a3b59c25070cc61dc517fbdfa5dc0904670c96f605cc69759dc09166b99/pyjwt-2.14.0.tar.gz", hash = "sha256:77283c83fb56ecf566a886c757a714bc83668e38156de2cce8263302f42e0b86", size = 113177, upload-time = "2026-09-11T13:11:54.638Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/a3/5e/ecf12fdb62546d64385c158514e9b2b671f7832108ef2ecd2020ce0af2d1/pyjwt-2.13.0-py3-none-any.whl", hash = "sha256:66adcc2aff09b3f1bbd95fc1e1577df8ac8723c978552fd43304c8a290ac5728", size = 31274, upload-time = "2026-05-21T19:54:35.362Z" },
+    { url = "https://files.pythonhosted.org/packages/9c/97/672cb32ce0dfea44b740cb7b4f97038463b9cf7c0ead1aacf595572851d6/pyjwt-2.14.0-py3-none-any.whl", hash = "sha256:ad0cef71c756a56e74863c2919cf0985f72decbcfcb550ee2f422e7c62b5eedc", size = 32896, upload-time = "2026-09-11T13:11:53.409Z" },
 ]

 [package.optional-dependencies]
@@ -1292,8 +1293,8 @@ name = "secretstorage"
 version = "3.5.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
-    { name = "cryptography" },
-    { name = "jeepney" },
+    { name = "cryptography", marker = "sys_platform != 'win32'" },
+    { name = "jeepney", marker = "sys_platform != 'win32'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/1c/03/e834bcd866f2f8a49a85eaff47340affa3bfa391ee9912a952a1faa68c7b/secretstorage-3.5.0.tar.gz", hash = "sha256:f04b8e4689cbce351744d5537bf6b1329c6fc68f91fa666f60a380edddcd11be", size = 19884, upload-time = "2025-11-23T19:02:53.191Z" }
 wheels = [
@@ -4,6 +4,54 @@ All notable changes to the **Prowler SDK** are documented in this file.

 <!-- changelog: release notes start -->

+## [5.45.0] (Prowler v5.45.0)
+
+### 🚀 Added
+
+- Azure AI Services service for Azure provider, including the `aiservices_account_public_network_access_disabled`, `aiservices_account_local_auth_disabled`, and `aiservices_account_encrypted_with_cmk` checks [(#12925)](https://github.com/prowler-cloud/prowler/pull/12925)
+- `aiservices_account_uses_private_endpoint`, `aiservices_account_outbound_network_restricted`, `aiservices_account_managed_identity_enabled`, and `aiservices_account_diagnostic_logging_enabled` checks for Azure provider [(#12926)](https://github.com/prowler-cloud/prowler/pull/12926)
+- `entra_policy_admin_self_service_password_reset_disabled` check for M365 provider, verifying that Self-Service Password Reset is disabled for administrators [(#12990)](https://github.com/prowler-cloud/prowler/pull/12990)
+- `entra_cross_tenant_access_default_outbound_restricted` check for M365 provider, verifying that default cross-tenant access does not let all users reach all external applications through B2B collaboration or B2B direct connect [(#12991)](https://github.com/prowler-cloud/prowler/pull/12991)
+- `entra_app_registration_redirect_uris_secure` check for M365 provider, flagging app registrations with HTTP, wildcard, malformed or `azurewebsites.net` redirect URIs [(#12993)](https://github.com/prowler-cloud/prowler/pull/12993)
+- `aiservices_account_network_acls_default_action_deny` and `aiservices_deployment_content_filter_prompt_shield_enabled` checks for Azure provider [(#12997)](https://github.com/prowler-cloud/prowler/pull/12997)
+- `entra_dynamic_group_member_of_rule_not_used` check for M365 provider, flagging dynamic groups whose membership rule uses the `memberOf` operator that Microsoft retires on November 3, 2026 [(#13003)](https://github.com/prowler-cloud/prowler/pull/13003)
+- `entra_policy_msol_powershell_blocked` check for M365 provider, verifying that the tenant authorization policy blocks the legacy MSOnline PowerShell module [(#13004)](https://github.com/prowler-cloud/prowler/pull/13004)
+
+### 🐞 Fixed
+
+- OCI API key credentials accept a home region to bootstrap identity calls, so tenancies not subscribed to us-ashburn-1 can connect [(#12865)](https://github.com/prowler-cloud/prowler/pull/12865)
+- AWS Organizations metadata is fetched from the partition of the audited account, using the region that answered the STS bootstrap, instead of the commercial `us-east-1` endpoint a session without a region resolves to, which timed out in GovCloud [(#12988)](https://github.com/prowler-cloud/prowler/pull/12988)
+
+### 🔐 Security
+
+- `pyjwt` from 2.13.0 to 2.14.0, patching GHSA-ffc3-869f-jxw9 [(#12911)](https://github.com/prowler-cloud/prowler/pull/12911)
+- `dulwich` from 1.2.5 to 1.2.9, patching GHSA-5fqc-mrg8-w798, GHSA-8mcx-5rqc-vhmf, GHSA-8w8g-wq8h-fq33 and GHSA-cm62-gvxx-vmxx [(#12953)](https://github.com/prowler-cloud/prowler/pull/12953)
+- `urllib3` from 2.7.0 to 2.8.0, patching CVE-2026-97687 and CVE-2026-97689 [(#12953)](https://github.com/prowler-cloud/prowler/pull/12953)
+- `pymongo` from 4.15.1 to 4.18.2, patching CVE-2026-96748 and CVE-2026-96749 [(#12955)](https://github.com/prowler-cloud/prowler/pull/12955)
+- IaC repository URLs resolving to loopback, private or otherwise non-public hosts rejected before both the connection test and the scan clone, including every destination a redirect points to, with raw errors no longer echoed to the caller or the logs [(#12960)](https://github.com/prowler-cloud/prowler/pull/12960)
+- HTML report compliance column is now escaped, so framework names and requirement IDs containing markup are shown as text instead of being rendered by the browser [(#12963)](https://github.com/prowler-cloud/prowler/pull/12963)
+- CSV outputs (findings, compliance and AWS quick inventory) prefix cells starting with `=`, `+`, `-`, `@`, tab or carriage return with a single quote so spreadsheet applications treat them as text instead of formulas; signed numbers such as `-1` are left untouched [(#12963)](https://github.com/prowler-cloud/prowler/pull/12963)
+- Python base image from 3.12.13 to 3.12.15 and Trivy from 0.74.0 to 0.75.0 in the SDK container image, patching CVE-2026-19445, CVE-2026-19553 and the grpc-go and x/crypto CVEs bundled in Trivy [(#13009)](https://github.com/prowler-cloud/prowler/pull/13009)
+- PowerShell from 7.5.11 to 7.5.12 in the SDK container image, bundling .NET runtime 9.0.21 [(#13037)](https://github.com/prowler-cloud/prowler/pull/13037)
+
+---
+
+## [5.44.0] (Prowler v5.44.0)
+
+### 🚀 Added
+
+- `PROWLER_AWS_BOTO3_RETRIES_MAX_ATTEMPTS` environment variable to set the Boto3 retries for deployments without CLI flags [(#12870)](https://github.com/prowler-cloud/prowler/pull/12870)
+
+### 🐞 Fixed
+
+- STS calls after role assumption use the answering region, avoiding a second wait for an unreachable partition region [(#12870)](https://github.com/prowler-cloud/prowler/pull/12870)
+
+### 🔐 Security
+
+- Pass the E2E AWS credentials to the UI E2E workflow through environment variables instead of template expansion [(#12864)](https://github.com/prowler-cloud/prowler/pull/12864)
+
+---
+
 ## [5.43.0] (Prowler v5.43.0)

 ### 🚀 Added
@@ -1,6 +1,7 @@
 #!/usr/bin/env python3
 # -*- coding: utf-8 -*-

+import os
 import sys
 import tempfile
 from os import environ
@@ -55,6 +56,7 @@ from prowler.lib.check.custom_checks_metadata import (
 from prowler.lib.check.models import CheckMetadata
 from prowler.lib.cli.parser import ProwlerArgumentParser
 from prowler.lib.logger import logger, set_logging_config
+from prowler.lib.network.ssrf import SKIP_OUTBOUND_CHECK_ENV
 from prowler.lib.outputs.asff.asff import ASFF
 from prowler.lib.outputs.compliance.asd_essential_eight.asd_essential_eight_aws import (
    ASDEssentialEightAWS,
@@ -236,6 +238,11 @@ def _send_ocsf_to_cloud(file_path: str) -> dict | None:


 def prowler():
+    # On the CLI the operator supplies the target themselves, so the outbound host
+    # check defends nothing and would refuse their own private network. setdefault,
+    # so an operator who set the variable explicitly keeps their choice.
+    os.environ.setdefault(SKIP_OUTBOUND_CHECK_ENV, "true")
+
    # Parse Arguments
    # Refactor(CLI)
    parser = ProwlerArgumentParser()
@@ -1 +0,0 @@
-`PROWLER_AWS_BOTO3_RETRIES_MAX_ATTEMPTS` environment variable to set the Boto3 retries for deployments without CLI flags
@@ -1 +0,0 @@
-STS calls after role assumption use the answering region, avoiding a second wait for an unreachable partition region
Author	SHA1	Message	Date
Prowler BotandPedro Martín	327d76541f	fix(container): patch Pillow, certifi, uv, aiohttp and Trivy CVEs (#13110 ) Co-authored-by: Pedro Martín <pedromarting3@gmail.com>	2026-10-21 17:00:23 +02:00
Prowler BotandPedro Martín	e9503ff3f1	fix(api): scope metadata endpoints to role provider groups (#13094 ) Co-authored-by: Pedro Martín <pedromarting3@gmail.com>	2026-10-20 08:05:35 +02:00
Prowler BotandPedro Martín	c9a5177623	fix(api): wrap long account IDs in PDF report cover table (#13067 ) Co-authored-by: Pedro Martín <pedromarting3@gmail.com>	2026-10-16 10:42:39 +02:00
Prowler BotandPedro Martín	c90252bbe5	fix(container): bump Trivy to 0.76.0 in SDK and API images (#13066 ) Co-authored-by: Pedro Martín <pedromarting3@gmail.com>	2026-10-16 10:04:41 +02:00
Prowler Botandprowler-bot	1230c17c38	chore(release): Bump versions to v5.45.1 (#13055 ) Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com>	2026-10-15 13:27:30 +02:00
Pedro Martín	bffc8844c1	fix(api): pin Redoc to 2.5.1 so the docs render (#13054 )	2026-10-15 12:04:24 +02:00
Prowler Botandprowler-bot	54354d71cd	chore(api): Update prowler dependency to v5.45 for release 5.45.0 (#13051 ) Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com>	2026-10-15 11:33:43 +02:00
Prowler Botandprowler-bot	9b56a3b657	chore(changelog): v5.45.0 (#13049 ) Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com>	2026-10-15 11:12:38 +02:00
Pedro Martín	f70b648cde	chore(changelog): v5.45.0 highlights (#13048 )	2026-10-15 11:05:49 +02:00
César Arroba	1f8ca695e8	fix(api): recycle gunicorn workers to cap memory growth (#13047 )	2026-10-15 09:36:33 +02:00
Pepe Fagoagaandcoderabbitai[bot]	d8a4e98850	docs: new listings for the AWS Marketplace (#12948 ) Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>	2026-10-14 23:08:32 +02:00
Pedro Martín	d9b53b2637	fix(iac): block SSRF in repository connection test (#12960 )	2026-10-14 16:25:13 +02:00
Pedro Martín	a4d07678b4	fix(outputs): neutralise injection in CSV and HTML reports (#12963 )	2026-10-14 13:55:43 +02:00
Alejandro Bailo	64c19b3db6	fix(ui): show Registry subscription and setup prompts (#13038 )	2026-10-14 13:51:08 +02:00
Rajesh NadimintiandRubén De la Torre Vico	286ae6c7cf	feat(azure): add aiservices network ACL and prompt shield checks (#12997 ) Co-authored-by: Rubén De la Torre Vico <98956809+puchy22@users.noreply.github.com>	2026-10-14 10:55:27 +02:00
Pedro Martín	8e67f0251c	fix(ui): point Slack partial list to inviting the app (#13036 )	2026-10-14 10:32:12 +02:00
Rajesh NadimintiandRubén De la Torre Vico	3c50cec509	feat(azure): add aiservices private endpoint, outbound, identity and logging checks (#12926 ) Co-authored-by: Rubén De la Torre Vico <98956809+puchy22@users.noreply.github.com>	2026-10-14 10:26:16 +02:00
Pedro Martín	fbb22834f7	fix(container): bump PowerShell to 7.5.12 in SDK and API (#13037 )	2026-10-14 10:09:18 +02:00
Pedro Martín	165b62a730	ci(sdk): run Huawei Cloud tests in sdk-tests (#13035 )	2026-10-14 09:22:30 +02:00
Rajesh Nadimintiandpedrooot	8b814b7643	feat(azure): add aiservices service with network, local auth and CMK checks (#12925 ) Co-authored-by: pedrooot <pedromarting3@gmail.com>	2026-10-14 09:03:25 +02:00
Pepe Fagoaga	22468c1443	ci(trufflehog): scan full history and pin scanner image (#13032 )	2026-10-14 07:53:25 +02:00
Joaquín Molina Kinomakino kinomakino Claude Opus 5.5 Pedro Martín	a36991f60e	feat(m365): add entra_cross_tenant_access_default_outbound_restricted check (#12991 ) Co-authored-by: kinomakino <3662588+kinomakino@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Pedro Martín <pedromarting3@gmail.com>	2026-10-13 16:25:42 +02:00
Joaquín Molina Kinomakino kinomakino Claude Opus 5.5 Pedro Martín	dd63fa960b	feat(m365): add entra_policy_admin_self_service_password_reset_disabled check (#12990 ) Co-authored-by: kinomakino <3662588+kinomakino@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Pedro Martín <pedromarting3@gmail.com>	2026-10-13 15:59:20 +02:00
Joaquín Molina Kinomakino kinomakino Claude Opus 5.5 Pedro Martín	80c4113879	feat(m365): add entra_dynamic_group_member_of_rule_not_used check (#13003 ) Co-authored-by: kinomakino <3662588+kinomakino@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Pedro Martín <pedromarting3@gmail.com>	2026-10-13 15:59:01 +02:00
Joaquín Molina Kinomakino kinomakino Claude Opus 5.5 Pedro Martín	c438858dbd	feat(m365): add entra_app_registration_redirect_uris_secure check (#12993 ) Co-authored-by: kinomakino <3662588+kinomakino@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Pedro Martín <pedromarting3@gmail.com>	2026-10-13 15:42:21 +02:00
Joaquín Molina Kinomakino kinomakino Claude Opus 5.5 Pedro Martín	f606a3c195	feat(m365): add entra_policy_msol_powershell_blocked check (#13004 ) Co-authored-by: kinomakino <3662588+kinomakino@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Pedro Martín <pedromarting3@gmail.com>	2026-10-13 15:22:01 +02:00
Pedro Martín	c599a9cf1d	fix(container): suppress Trivy HTTP/2 SETTINGS DoS CVE (#13028 )	2026-10-13 11:55:48 +02:00
Pedro Martín	61d2cc55c4	fix(container): patch Trivy and MCP base image CVEs (#13009 )	2026-10-09 18:17:48 +02:00
Pedro Martín	859a846147	fix(api): scope user memberships and roles to tenant (#12965 )	2026-10-09 13:04:11 +02:00
Alejandro Bailo	d8bdc8553f	fix(ui): show registry provider logos and capitalize registry labels (#12985 )	2026-10-08 18:16:08 +02:00
Pedro Martínandalejandrobailo	f44ea4b6fa	fix(api): require inline kubeconfig credentials (#12952 ) Co-authored-by: alejandrobailo <alejandrobailo94@gmail.com>	2026-10-08 18:15:10 +02:00
César Arroba	27c4113d29	fix(aws): query Organizations in the audited partition (#12988 )	2026-10-08 15:57:58 +02:00
Alejandro Bailo	cf688e3fa1	fix(ui): bump Next.js to 16.3.8 to patch the image optimization SSRF advisory (#12987 )	2026-10-08 15:17:59 +02:00
César Arroba	92216f1597	ci(release): auto-create minor release branch and lift freeze on publish Create the minor release branch automatically in the release preparation workflow, check versions before creating it, match the version literally, and lift the release freeze when the release is published.	2026-10-08 12:47:38 +02:00
Alejandro Bailo	b5a709664d	fix(ui): show only the chosen registry credential variant (#12966 )	2026-10-07 16:35:20 +02:00
Alejandro Bailo	9d8060adc5	test(ui): stabilize invite-teammate roles-unavailable test (#12973 )	2026-10-07 16:14:23 +02:00
StylusFrost	f1e822f7df	chore(trivy): suppress @modelcontextprotocol/sdk CVE-2026-104850 (#12967 )	2026-10-07 12:27:44 +02:00
StylusFrost	22bc834c09	chore(grype): suppress zlib CVE-2026-85091 until base images ship the fix (#12970 )	2026-10-07 12:16:04 +02:00
StylusFrost	3f893176ba	fix(ui): bump sharp to 0.35.5 to patch the librsvg advisory (#12968 )	2026-10-07 11:48:19 +02:00
César Arroba	d38e04dd3e	chore(github): move code ownership from platform to engineering (#12958 )	2026-10-06 10:42:52 +02:00
Pedro Martín	7ccdf7c0e6	fix(deps): patch pymongo CVEs and ignore proxy-addr (#12955 )	2026-10-06 10:34:58 +02:00
Alejandro Bailo	bee60c5471	fix(ui): stop reporting client-aborted RSC streams to Sentry (#12956 )	2026-10-06 10:23:07 +02:00
Alejandro Bailo	f850199645	fix(ui): pin proxy-addr to 2.0.8 to patch the IP spoofing advisory (#12957 )	2026-10-06 10:10:17 +02:00
Pedro Martín	0321a4f167	fix(deps): patch Django, urllib3 and dulwich CVEs (#12953 )	2026-10-06 08:48:54 +02:00
Alejandro Bailo	383a9bf903	fix(ui): bump Next.js to 16.3.6 to patch the next/og RCE advisory (#12922 )	2026-10-01 11:54:44 +02:00
Alejandro Bailo	4605d9a770	feat(ui): invite a teammate from the AWS connect step (#12917 )	2026-10-01 09:50:10 +02:00
César Arroba	f0da33f451	revert(api): release providers blocked by scans whose worker died (#12915 )	2026-09-30 13:00:50 +02:00
Alejandro Bailo	a44a725507	fix(ui): retry the first-run redirect until the add-provider wizard opens (#12914 )	2026-09-30 12:34:52 +02:00
César Arroba	b8ca30400b	fix(api): stop sending personal data to Sentry (#12912 )	2026-09-30 12:28:42 +02:00
César Arroba	a006525e78	fix(api): release providers blocked by scans whose worker died (#12899 )	2026-09-30 11:09:21 +02:00
Pedro Martín	ed510e217d	chore(deps): bump pyjwt to 2.14.0 for osv-scanner (#12911 )	2026-09-30 10:21:11 +02:00
Alejandro Bailo	04511f339e	test(ui): stabilize attack-paths refit integration test (#12896 )	2026-09-29 18:42:19 +02:00
Pedro Martín	f418b32c81	fix(oci): use home region for identity bootstrap (#12865 )	2026-09-29 17:50:54 +02:00
Pedro Martín	65fb146e76	chore(trivy): suppress fast-uri CVE-2026-84292 (#12907 )	2026-09-29 17:04:46 +02:00
Prowler Botandprowler-bot	5ea363d582	chore(release): Bump versions to v5.45.0 (#12905 ) Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com>	2026-09-29 16:31:16 +02:00
Prowler Botandprowler-bot	3ec379a75a	chore(changelog): v5.44.0 (#12900 ) Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com>	2026-09-29 13:32:41 +02:00
Pedro Martín	ea020ed46e	chore(changelog): v5.44.0 highlights (#12897 )	2026-09-29 13:32:13 +02:00
				`@@ -0,0 +1 @@`
				`Pillow from 12.3.0 to 13.0.0, certifi to 2026.10.19, aiohttp to 3.14.5 with yarl 1.25.1, uv to 0.13.4 and Trivy to 0.76.1 in the API container image, patching the Pillow JPEG decoder heap overflow, the compromised emSign root CAs bundled in certifi and uv, the aiohttp resource exhaustion advisories and the Go 1.27.2 stdlib CVE in the Trivy binary`
				`@@ -0,0 +1 @@`
				`Trivy from 0.75.0 to 0.76.0 in the API container image, built with Go 1.27.2 and x/net 0.60.0, patching the HTTP/2 and TLS CVEs bundled in Trivy 0.75.0`
				`@@ -1 +0,0 @@`
				API key authentication no longer locks the key row on every request and now throttles `last_used_at` updates to once per 60 seconds, preventing a hot key from serializing all its requests onto a single locked row
				`@@ -1 +0,0 @@`
				`Adds a periodic sweep that drops orphaned Attack Paths temp Neo4j scan databases left behind when a worker or Neo4j crashes mid-scan, before they accumulate unbounded`
				`@@ -1 +0,0 @@`
				`Resources no longer keep a stale failed findings count forever when a scoped or imported scan for the same provider completes after a full scan, which used to make the full scan skip its own cleanup`
				`@@ -1 +0,0 @@`
				Providers whose most recent completed scan has no `completed_at` timestamp are no longer missing from every endpoint that reports a provider's latest scan, which now falls back to scan creation order instead of skipping the provider
				`@@ -1 +0,0 @@`
				`Unify how every endpoint resolves a provider latest completed scan, so overlapping scans no longer make findings, compliance and mute rules read from different scans`
				`@@ -0,0 +1 @@`
				`GET /resources/metadata`, `GET /resources/metadata/latest`, `GET /findings/metadata` and `GET /findings/metadata/latest` now honour the provider groups of the caller role instead of aggregating every provider in the tenant
				`@@ -0,0 +1 @@`
				`Compliance report PDF cover table wraps every value, so long account IDs such as OCI tenancy OCIDs no longer overflow their cell`