fix(api): fail migrations fast when blocked on a lock

Set lock_timeout on the migration session so a metadata-only migration blocked waiting for ACCESS EXCLUSIVE on a busy table fails loudly instead of queueing every later reader behind it. Configurable via DJANGO_MIGRATION_LOCK_TIMEOUT (default 5s, 0 disables it).
2026-10-04 10:14:20 +00:00 · 2026-07-15 18:49:48 +02:00
2798 changed files with 26616 additions and 243559 deletions
@@ -72,8 +72,8 @@ NEO4J_APOC_IMPORT_FILE_ENABLED=false
 NEO4J_APOC_IMPORT_FILE_USE_NEO4J_CONFIG=true
 NEO4J_APOC_TRIGGER_ENABLED=false
 NEO4J_DBMS_CONNECTOR_BOLT_LISTEN_ADDRESS=0.0.0.0:7687
-# Attack Paths graph settings
-ATTACK_PATHS_GRAPH_MUTATION_BATCH_SIZE=1000
+# Neo4j Prowler settings
+ATTACK_PATHS_BATCH_SIZE=1000
 ATTACK_PATHS_SERVICE_UNAVAILABLE_MAX_RETRIES=3
 ATTACK_PATHS_READ_QUERY_TIMEOUT_SECONDS=30
 ATTACK_PATHS_MAX_CUSTOM_QUERY_NODES=250
@@ -110,27 +110,11 @@ DJANGO_OUTPUT_S3_AWS_SECRET_ACCESS_KEY=""
 DJANGO_OUTPUT_S3_AWS_SESSION_TOKEN=""

 # The AWS region where your S3 bucket is located (e.g., "us-east-1")
-# Required if the bucket uses SSE-KMS: download URLs are then signed with SigV4, which
-# is scoped to this region, so it must match the bucket's
 DJANGO_OUTPUT_S3_AWS_DEFAULT_REGION=""

 # The name of the S3 bucket where scan output should be stored
 DJANGO_OUTPUT_S3_AWS_OUTPUT_BUCKET=""

-# The storage endpoint the API and Celery workers use to upload and list scan output
-# (e.g. "http://minio:9000"). Leave empty on AWS S3. Set it when scan output is stored on
-# S3-compatible object storage such as MinIO instead of real S3.
-# If set without DJANGO_OUTPUT_S3_AWS_PUBLIC_ENDPOINT_URL below, report download URLs are
-# signed against this internal host, and a browser outside the container network cannot open them.
-DJANGO_OUTPUT_S3_AWS_ENDPOINT_URL=""
-
-# The storage address the browser can reach, used only to sign report download URLs
-# (e.g. "https://storage.example.com"). Leave empty on AWS S3. Set it when storage is
-# only reachable inside the container network, such as MinIO on "http://minio:9000".
-# The reverse proxy in front of it must forward the Host header unchanged: SigV4 signs
-# Host, so rewriting it to the internal name invalidates the signature.
-DJANGO_OUTPUT_S3_AWS_PUBLIC_ENDPOINT_URL=""
-
 # Django settings
 DJANGO_ALLOWED_HOSTS=localhost,127.0.0.1,prowler-api
 DJANGO_BIND_ADDRESS=0.0.0.0
@@ -174,7 +158,7 @@ SENTRY_RELEASE=local
 # REO_DEV_CLIENT_ID=

 #### Prowler release version ####
-NEXT_PUBLIC_PROWLER_RELEASE_VERSION=v5.44.1
+NEXT_PUBLIC_PROWLER_RELEASE_VERSION=v5.35.0

 # Social login credentials
 SOCIAL_GOOGLE_OAUTH_CALLBACK_URL="${AUTH_URL}/api/auth/callback/google"
@@ -1,23 +1,23 @@
 # SDK
-/* @prowler-cloud/engineering
-/prowler/ @prowler-cloud/engineering
-/tests/ @prowler-cloud/engineering
-/dashboard/ @prowler-cloud/engineering
-/docs/ @prowler-cloud/engineering
-/examples/ @prowler-cloud/engineering
-/util/ @prowler-cloud/engineering
-/contrib/ @prowler-cloud/engineering
-/permissions/ @prowler-cloud/engineering
-/codecov.yml @prowler-cloud/engineering
+/* @prowler-cloud/detection-remediation
+/prowler/ @prowler-cloud/detection-remediation
+/tests/ @prowler-cloud/detection-remediation
+/dashboard/ @prowler-cloud/detection-remediation
+/docs/ @prowler-cloud/detection-remediation
+/examples/ @prowler-cloud/detection-remediation
+/util/ @prowler-cloud/detection-remediation
+/contrib/ @prowler-cloud/detection-remediation
+/permissions/ @prowler-cloud/detection-remediation
+/codecov.yml @prowler-cloud/detection-remediation @prowler-cloud/api

 # API
-/api/ @prowler-cloud/engineering
+/api/ @prowler-cloud/api

 # UI
-/ui/ @prowler-cloud/engineering
+/ui/ @prowler-cloud/ui

 # AI
-/mcp_server/ @prowler-cloud/engineering
+/mcp_server/ @prowler-cloud/detection-remediation

 # Platform
 /.github/ @prowler-cloud/platform
@@ -1,6 +0,0 @@
-# Generated by gh-aw and marked DO NOT EDIT. It uses concurrency options newer than
-# actionlint knows, so the findings are about actionlint's schema, not our workflows.
-paths:
-  .github/workflows/**/*.lock.yml:
-    ignore:
-      - '.*'
@@ -1,179 +0,0 @@
-name: 'Container Security Scan with Grype'
-description: 'Scans container images for vulnerabilities using Grype and reports results'
-author: 'Prowler'
-
-inputs:
-  image-name:
-    description: 'Container image name to scan'
-    required: true
-  image-tag:
-    description: 'Container image tag to scan'
-    required: true
-    default: ${{ github.sha }}
-  fail-on-severity:
-    description: 'Fail the build on findings at this severity or above: critical, high, or none'
-    required: false
-    default: 'high'
-  upload-sarif:
-    description: 'Upload results to GitHub Security tab'
-    required: false
-    default: 'true'
-  create-pr-comment:
-    description: 'Create a comment on the PR with scan results'
-    required: false
-    default: 'true'
-  artifact-retention-days:
-    description: 'Days to retain the Grype report artifact'
-    required: false
-    default: '2'
-
-outputs:
-  critical-count:
-    description: 'Number of critical vulnerabilities found'
-    value: ${{ steps.security-check.outputs.critical }}
-  high-count:
-    description: 'Number of high vulnerabilities found'
-    value: ${{ steps.security-check.outputs.high }}
-  total-count:
-    description: 'Total number of vulnerabilities found'
-    value: ${{ steps.security-check.outputs.total }}
-
-runs:
-  using: 'composite'
-  steps:
-    - name: Run Grype vulnerability scan (JSON)
-      uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0
-      with:
-        image: ${{ inputs.image-name }}:${{ inputs.image-tag }}
-        output-format: 'json'
-        output-file: 'grype-report.json'
-        fail-build: 'false'
-        by-cve: 'true' # Report CVE ids rather than GHSA, so findings line up with Trivy's
-        only-fixed: 'true' # A finding with no available fix is not actionable, so it must not gate
-        cache-db: 'true'
-        grype-version: 'v0.116.1'
-
-    - name: Run Grype vulnerability scan (SARIF)
-      if: inputs.upload-sarif == 'true' && github.event_name == 'push'
-      uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0
-      with:
-        image: ${{ inputs.image-name }}:${{ inputs.image-tag }}
-        output-format: 'sarif'
-        output-file: 'grype-results.sarif'
-        fail-build: 'false'
-        severity-cutoff: 'high'
-        by-cve: 'true'
-        only-fixed: 'true' # A finding with no available fix is not actionable, so it must not gate
-        cache-db: 'true'
-        grype-version: 'v0.116.1'
-
-    - name: Upload Grype results to GitHub Security tab
-      if: inputs.upload-sarif == 'true' && github.event_name == 'push'
-      uses: github/codeql-action/upload-sarif@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.30.5
-      with:
-        sarif_file: 'grype-results.sarif'
-        category: 'grype-container'
-
-    - name: Upload Grype report artifact
-      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-      if: always()
-      with:
-        name: grype-scan-report-${{ inputs.image-name }}-${{ inputs.image-tag }}
-        path: grype-report.json
-        retention-days: ${{ inputs.artifact-retention-days }}
-
-    - name: Generate security summary
-      id: security-check
-      shell: bash
-      run: |
-        CRITICAL=$(jq '[.matches[]? | select(.vulnerability.severity=="Critical")] | length' grype-report.json)
-        HIGH=$(jq '[.matches[]? | select(.vulnerability.severity=="High")] | length' grype-report.json)
-        TOTAL=$(jq '[.matches[]?] | length' grype-report.json)
-
-        echo "critical=$CRITICAL" >> $GITHUB_OUTPUT
-        echo "high=$HIGH" >> $GITHUB_OUTPUT
-        echo "total=$TOTAL" >> $GITHUB_OUTPUT
-
-        echo "### 🔎 Container Security Scan (Grype)" >> $GITHUB_STEP_SUMMARY
-        echo "" >> $GITHUB_STEP_SUMMARY
-        echo "**Image:** \`${INPUTS_IMAGE_NAME}:${INPUTS_IMAGE_TAG}\`" >> $GITHUB_STEP_SUMMARY
-        echo "" >> $GITHUB_STEP_SUMMARY
-        echo "- 🔴 Critical: $CRITICAL" >> $GITHUB_STEP_SUMMARY
-        echo "- 🟠 High: $HIGH" >> $GITHUB_STEP_SUMMARY
-        echo "- **Total**: $TOTAL" >> $GITHUB_STEP_SUMMARY
-        echo "" >> $GITHUB_STEP_SUMMARY
-        echo "Reported alongside Trivy, not instead of it. Counts differ by design." >> $GITHUB_STEP_SUMMARY
-      env:
-        INPUTS_IMAGE_NAME: ${{ inputs.image-name }}
-        INPUTS_IMAGE_TAG: ${{ inputs.image-tag }}
-
-    # Before the gate, so the comment is there to explain a failure rather than absent because of it
-    - name: Comment scan results on PR
-      if: >-
-        inputs.create-pr-comment == 'true'
-        && github.event_name == 'pull_request'
-        && github.event.pull_request.head.repo.full_name == github.repository
-      uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-      env:
-        IMAGE_NAME: ${{ inputs.image-name }}
-        GITHUB_SHA: ${{ inputs.image-tag }}
-        CUTOFF: ${{ inputs.fail-on-severity }}
-      with:
-        script: |
-          const comment = require('./.github/scripts/grype-pr-comment.js');
-
-          // Unique identifier to find our comment
-          const marker = `<!-- grype-scan-comment:${process.env.IMAGE_NAME} -->`;
-          const body = marker + '\n' + comment;
-
-          const { data: comments } = await github.rest.issues.listComments({
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            issue_number: context.issue.number,
-          });
-
-          const existingComment = comments.find(c => c.body?.includes(marker));
-
-          if (existingComment) {
-            await github.rest.issues.updateComment({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              comment_id: existingComment.id,
-              body: body
-            });
-            console.log('✅ Updated existing Grype scan comment');
-          } else {
-            await github.rest.issues.createComment({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-              body: body
-            });
-            console.log('✅ Created new Grype scan comment');
-          }
-
-    - name: Check for blocking vulnerabilities
-      if: inputs.fail-on-severity != 'none'
-      shell: bash
-      run: |
-        if [ "$CUTOFF" = "critical" ]; then
-          BLOCKING=$CRITICAL
-          SEVERITIES='["Critical"]'
-        else
-          BLOCKING=$((CRITICAL + HIGH))
-          SEVERITIES='["Critical","High"]'
-        fi
-
-        if [ "$BLOCKING" -gt 0 ]; then
-          echo "::error::Found $BLOCKING vulnerabilities at severity ${CUTOFF} or above ($CRITICAL critical, $HIGH high)"
-          echo "::warning::Update the package, or add it to .grype.yaml with a reason if nothing can be done"
-          jq -r --argjson severities "$SEVERITIES" \
-            '.matches[] | select(.vulnerability.severity | IN($severities[]))
-             | "  \(.vulnerability.severity)\t\(.vulnerability.id)\t\(.artifact.name) \(.artifact.version)"' \
-            grype-report.json | sort -u
-          exit 1
-        fi
-      env:
-        CUTOFF: ${{ inputs.fail-on-severity }}
-        CRITICAL: ${{ steps.security-check.outputs.critical }}
-        HIGH: ${{ steps.security-check.outputs.high }}
@@ -46,17 +46,6 @@ runs:
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: |
-        if grep -q "prowler-cloud/prowler" uv.lock; then
-          :
-        else
-          status=$?
-          if [ "$status" -ne 1 ]; then
-            echo "::error::grep failed reading uv.lock (exit code $status)."
-            exit "$status"
-          fi
-          echo "No prowler-cloud/prowler entry in uv.lock, nothing to update."
-          exit 0
-        fi
        LATEST_COMMIT=$(curl -sf --retry 3 --retry-all-errors --retry-delay 2 --retry-max-time 60 \
          -H "Authorization: Bearer ${GITHUB_TOKEN}" \
          -H "Accept: application/vnd.github+json" \
@@ -77,17 +66,6 @@ runs:
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: |
-        if grep -q "prowler-cloud/prowler" uv.lock; then
-          :
-        else
-          status=$?
-          if [ "$status" -ne 1 ]; then
-            echo "::error::grep failed reading uv.lock (exit code $status)."
-            exit "$status"
-          fi
-          echo "No prowler-cloud/prowler entry in uv.lock, nothing to update."
-          exit 0
-        fi
        LATEST_COMMIT=$(curl -sf --retry 3 --retry-all-errors --retry-delay 2 --retry-max-time 60 \
          -H "Authorization: Bearer ${GITHUB_TOKEN}" \
          -H "Accept: application/vnd.github+json" \
@@ -14,10 +14,10 @@ inputs:
    description: 'Severities to scan for (comma-separated)'
    required: false
    default: 'CRITICAL,HIGH,MEDIUM,LOW'
-  fail-on-severity:
-    description: 'Fail the build on findings at this severity or above: critical, high, or none'
+  fail-on-critical:
+    description: 'Fail the build if critical vulnerabilities are found'
    required: false
-    default: 'high'
+    default: 'false'
  upload-sarif:
    description: 'Upload results to GitHub Security tab'
    required: false
@@ -54,7 +54,7 @@ runs:
          trivy-db-${{ runner.os }}-

    - name: Run Trivy vulnerability scan (JSON)
-      uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+      uses: aquasecurity/trivy-action@e368e328979b113139d6f9068e03accaed98a518 # 0.34.1
      with:
        image-ref: ${{ inputs.image-name }}:${{ inputs.image-tag }}
        format: 'json'
@@ -62,16 +62,12 @@ runs:
        severity: ${{ inputs.severity }}
        exit-code: '0'
        scanners: 'vuln'
-        ignore-unfixed: 'true' # A finding with no available fix is not actionable, so it must not gate
        timeout: '5m'
-        version: 'v0.74.0'
-      # Not trivyignores: that input drops the .yaml extension Trivy parses by.
-      env:
-        TRIVY_IGNOREFILE: '.trivyignore.yaml'
+        version: 'v0.71.2'

    - name: Run Trivy vulnerability scan (SARIF)
      if: inputs.upload-sarif == 'true' && github.event_name == 'push'
-      uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+      uses: aquasecurity/trivy-action@e368e328979b113139d6f9068e03accaed98a518 # 0.34.1
      with:
        image-ref: ${{ inputs.image-name }}:${{ inputs.image-tag }}
        format: 'sarif'
@@ -79,12 +75,8 @@ runs:
        severity: 'CRITICAL,HIGH'
        exit-code: '0'
        scanners: 'vuln'
-        ignore-unfixed: 'true' # A finding with no available fix is not actionable, so it must not gate
        timeout: '5m'
-        version: 'v0.74.0'
-      # Not trivyignores: that input drops the .yaml extension Trivy parses by.
-      env:
-        TRIVY_IGNOREFILE: '.trivyignore.yaml'
+        version: 'v0.71.2'

    - name: Upload Trivy results to GitHub Security tab
      if: inputs.upload-sarif == 'true' && github.event_name == 'push'
@@ -171,28 +163,13 @@ runs:
            console.log('✅ Created new Trivy scan comment');
          }

-    - name: Check for blocking vulnerabilities
-      if: inputs.fail-on-severity != 'none'
+    - name: Check for critical vulnerabilities
+      if: inputs.fail-on-critical == 'true' && steps.security-check.outputs.critical != '0'
      shell: bash
      run: |
-        if [ "$CUTOFF" = "critical" ]; then
-          BLOCKING=$CRITICAL
-          SEVERITIES='["CRITICAL"]'
-        else
-          BLOCKING=$((CRITICAL + HIGH))
-          SEVERITIES='["CRITICAL","HIGH"]'
-        fi
+        echo "::error::Found ${STEPS_SECURITY_CHECK_OUTPUTS_CRITICAL} critical vulnerabilities"
+        echo "::warning::Please update packages or use a different base image"
+        exit 1

-        if [ "$BLOCKING" -gt 0 ]; then
-          echo "::error::Found $BLOCKING vulnerabilities at severity ${CUTOFF} or above ($CRITICAL critical, $HIGH high)"
-          echo "::warning::Update the package, or add it to .trivyignore.yaml with a reason if nothing can be done"
-          jq -r --argjson severities "$SEVERITIES" \
-            '.Results[]?.Vulnerabilities[]? | select(.Severity | IN($severities[]))
-             | "  \(.Severity)\t\(.VulnerabilityID)\t\(.PkgName) \(.InstalledVersion)"' \
-            trivy-report.json | sort -u
-          exit 1
-        fi
      env:
-        CUTOFF: ${{ inputs.fail-on-severity }}
-        CRITICAL: ${{ steps.security-check.outputs.critical }}
-        HIGH: ${{ steps.security-check.outputs.high }}
+        STEPS_SECURITY_CHECK_OUTPUTS_CRITICAL: ${{ steps.security-check.outputs.critical }}
@@ -199,7 +199,7 @@ You MUST structure your response using this EXACT format. Do NOT include anythin

 ### For Check Logic Bug

-```markdown
+```
 ### AI Assessment [Experimental]: Check Logic Bug

 **Component**: {component from issue template}
@@ -297,7 +297,7 @@ Write tests FIRST (TDD). The skills contain all testing conventions and patterns

 ### For Bug (non-check)

-```markdown
+```
 ### AI Assessment [Experimental]: Bug

 **Component**: {CLI/SDK | API | UI | Dashboard | MCP Server | Other}
@@ -378,7 +378,7 @@ Write tests FIRST (TDD). The skills contain all testing conventions and patterns

 ### For Already Fixed

-```markdown
+```
 ### AI Assessment [Experimental]: Already Fixed

 **Component**: {component}
@@ -401,7 +401,7 @@ Upgrade to the latest version. Close the issue as resolved.

 ### For Feature Request

-```markdown
+```
 ### AI Assessment [Experimental]: Feature Request

 **Component**: {component}
@@ -419,7 +419,7 @@ Upgrade to the latest version. Close the issue as resolved.

 ### For Not a Bug

-```markdown
+```
 ### AI Assessment [Experimental]: Not a Bug

 **Component**: {component}
@@ -440,7 +440,7 @@ Upgrade to the latest version. Close the issue as resolved.

 ### For Needs More Information

-```markdown
+```
 ### AI Assessment [Experimental]: Needs More Information

 **Component**: {component or "Unknown"}
@@ -52,16 +52,6 @@ provider/alibabacloud:
      - any-glob-to-any-file: "prowler/providers/alibabacloud/**"
      - any-glob-to-any-file: "tests/providers/alibabacloud/**"

-provider/huaweicloud:
-  - changed-files:
-      - any-glob-to-any-file: "prowler/providers/huaweicloud/**"
-      - any-glob-to-any-file: "tests/providers/huaweicloud/**"
-
-provider/image:
-  - changed-files:
-      - any-glob-to-any-file: "prowler/providers/image/**"
-      - any-glob-to-any-file: "tests/providers/image/**"
-
 provider/cloudflare:
  - changed-files:
      - any-glob-to-any-file: "prowler/providers/cloudflare/**"
@@ -92,11 +82,6 @@ provider/linode:
      - any-glob-to-any-file: "prowler/providers/linode/**"
      - any-glob-to-any-file: "tests/providers/linode/**"

-provider/stackit:
-  - changed-files:
-      - any-glob-to-any-file: "prowler/providers/stackit/**"
-      - any-glob-to-any-file: "tests/providers/stackit/**"
-
 github_actions:
  - changed-files:
      - any-glob-to-any-file: ".github/workflows/*"
@@ -1,100 +0,0 @@
-const fs = require('fs');
-
-// Configuration from environment variables
-const REPORT_FILE = process.env.GRYPE_REPORT_FILE || 'grype-report.json';
-const IMAGE_NAME = process.env.IMAGE_NAME || 'container-image';
-const GITHUB_SHA = process.env.GITHUB_SHA || 'unknown';
-const GITHUB_REPOSITORY = process.env.GITHUB_REPOSITORY || '';
-const GITHUB_RUN_ID = process.env.GITHUB_RUN_ID || '';
-const CUTOFF = process.env.CUTOFF || 'high';
-
-// A cutoff of 'critical' blocks only on critical; anything else blocks on high and above
-const blocking = CUTOFF === 'critical' ? ['Critical'] : ['Critical', 'High'];
-
-const report = JSON.parse(fs.readFileSync(REPORT_FILE, 'utf-8'));
-const matches = Array.isArray(report.matches) ? report.matches : [];
-const ignored = Array.isArray(report.ignoredMatches) ? report.ignoredMatches : [];
-
-const counts = { Critical: 0, High: 0, Medium: 0, Low: 0, Negligible: 0, Unknown: 0 };
-const blockers = new Map();
-
-for (const match of matches) {
-    const severity = match.vulnerability.severity;
-    if (counts[severity] !== undefined) {
-        counts[severity]++;
-    }
-    if (blocking.includes(severity)) {
-        const artifact = match.artifact;
-        const fixedIn = (match.vulnerability.fix && match.vulnerability.fix.versions || []).join(', ');
-        // Same CVE can match several install paths of one package; collapse them
-        blockers.set(`${match.vulnerability.id}|${artifact.name}`, {
-            id: match.vulnerability.id,
-            severity,
-            name: artifact.name,
-            version: artifact.version,
-            fixedIn
-        });
-    }
-}
-
-const ignoredBlocking = ignored.filter(m => blocking.includes(m.vulnerability.severity)).length;
-const shortSha = GITHUB_SHA.substring(0, 7);
-const timestamp = new Date().toISOString().replace('T', ' ').substring(0, 19) + ' UTC';
-
-const severityConfig = {
-    Critical: { icon: '🔴', label: 'Critical' },
-    High: { icon: '🟠', label: 'High' },
-    Medium: { icon: '🟡', label: 'Medium' },
-    Low: { icon: '🔵', label: 'Low' }
-};
-
-let comment = '## 🔎 Container Security Scan (Grype)\n\n';
-comment += `**Image:** \`${IMAGE_NAME}:${shortSha}\`\n`;
-comment += `**Last scan:** ${timestamp}\n\n`;
-
-if (blockers.size === 0) {
-    comment += '### ✅ Nothing Blocking\n\n';
-    comment += `No findings at **${blocking.join(' or ').toLowerCase()}** severity.\n`;
-} else {
-    comment += `### ⚠️ ${blockers.size} Finding(s) Blocking This PR\n\n`;
-    comment += '| Severity | CVE | Package | Installed | Fixed in |\n';
-    comment += '|---|---|---|---|---|\n';
-
-    const order = { Critical: 0, High: 1 };
-    const rows = [...blockers.values()].sort((a, b) =>
-        (order[a.severity] - order[b.severity]) || a.name.localeCompare(b.name));
-
-    for (const row of rows) {
-        const config = severityConfig[row.severity];
-        comment += `| ${config.icon} ${config.label} | \`${row.id}\` | \`${row.name}\` | ${row.version} | ${row.fixedIn || '—'} |\n`;
-    }
-
-    comment += '\n**What to do:**\n';
-    comment += '- Upgrade the package to the version in the "Fixed in" column.\n';
-    comment += '- If it is pinned by another dependency, or the fix is otherwise out of reach, add it to `.grype.yaml` **with the reason**.\n';
-    comment += '- Findings with no published fix never appear here: the scan runs with `only-fixed`, so it reports only what can actually be acted on.\n';
-}
-
-const otherCounts = Object.entries(counts)
-    .filter(([severity, count]) => !blocking.includes(severity) && count > 0)
-    .map(([severity, count]) => `${severity.toLowerCase()}: ${count}`);
-
-if (otherCounts.length > 0) {
-    comment += `\nNot blocking at this cutoff — ${otherCounts.join(', ')}.\n`;
-}
-
-if (ignoredBlocking > 0) {
-    comment += `\n${ignoredBlocking} finding(s) excluded by \`.grype.yaml\`, each with a documented reason.\n`;
-}
-
-comment += '\n---\n';
-comment += '📋 **Resources:**\n';
-
-if (GITHUB_REPOSITORY && GITHUB_RUN_ID) {
-    comment += `- [Download full report](https://github.com/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}) (see artifacts)\n`;
-}
-
-comment += '- [View in Security tab](https://github.com/' + (GITHUB_REPOSITORY || 'repository') + '/security/code-scanning)\n';
-comment += '- Scanned with [Grype](https://github.com/anchore/grype), alongside Trivy\n';
-
-module.exports = comment;
@@ -51,8 +51,7 @@ STDERR="$(mktemp)"
 trap 'rm -f "${STDERR}"' EXIT

 set +e
-# ${a[@]+...} guard: an empty array trips `set -u` on bash before 4.4.
-OUTPUT="$(osv-scanner scan source ${SCAN_ARGS[@]+"${SCAN_ARGS[@]}"} --format=json "$@" 2>"${STDERR}")"
+OUTPUT="$(osv-scanner scan source "${SCAN_ARGS[@]}" --format=json "$@" 2>"${STDERR}")"
 RC=$?
 set -e

@@ -101,8 +100,6 @@ FINDINGS="$(printf '%s' "${OUTPUT}" | jq --argjson sevs "${SEVERITY_JSON}" '
  ]
 ')"

-# jq exits 0 with no output on empty stdin, but non-zero on malformed JSON.
-# Let the failure abort under set -e rather than reporting zero findings.
 COUNT="$(printf '%s' "${FINDINGS}" | jq 'length')"

 # Write the findings JSON to OSV_REPORT_FILE so callers (e.g. the composite
@@ -111,7 +108,7 @@ if [ -n "${OSV_REPORT_FILE:-}" ]; then
  printf '%s' "${FINDINGS}" > "${OSV_REPORT_FILE}"
 fi

-if [ "${COUNT:-0}" -gt 0 ]; then
+if [ "${COUNT}" -gt 0 ]; then
  echo "osv-scanner: ${COUNT} finding(s) at severity ${SEVERITY_LEVELS}"
  printf '%s' "${FINDINGS}" | jq -r '
    .[] | "  [\(.severity)\(if .score then " \(.score)" else "" end)] \(.id) \(.ecosystem)/\(.package)@\(.version) — \(.summary // "(no summary)")"
@@ -8,11 +8,11 @@ These JSON templates are used with the `slackapi/slack-github-action` using the

 ### Available Templates

-#### Container Releases
+**Container Releases**
 - `container-release-started.json`: Simple one-line notification when container push starts
 - `container-release-completed.json`: Simple one-line notification when container release completes

-#### Deployments
+**Deployments**
 - `deployment-started.json`: Deployment start notification with Block Kit formatting
 - `deployment-completed.json`: Deployment completion notification (updates the start message)

@@ -416,17 +416,17 @@ For deployments that start with one message and update it with the final status:
 ### Container Release (Simple One-Line)

 **Start message:**
-```text
+```
 API container release 4.5.0 push started... View run
 ```

 **Completion message (success):**
-```text
+```
 [✓] API container release 4.5.0 push completed successfully! View run
 ```

 **Completion message (failure):**
-```text
+```
 [✗] API container release 4.5.0 push failed View run
 ```

@@ -249,7 +249,6 @@ modules:
      - ui/tests/profile/**
      - ui/tests/lighthouse/**
      - ui/tests/home/**
-      - ui/tests/navigation/**
      - ui/tests/attack-paths/**

  - name: api-serializers
@@ -276,7 +275,6 @@ modules:
      - ui/tests/profile/**
      - ui/tests/lighthouse/**
      - ui/tests/home/**
-      - ui/tests/navigation/**
      - ui/tests/attack-paths/**

  - name: api-filters
@@ -434,14 +432,6 @@ modules:
    e2e:
      - ui/tests/lighthouse/**

-  - name: ui-navigation
-    match:
-      - ui/components/layout/**
-      - ui/tests/navigation/**
-    tests: []
-    e2e:
-      - ui/tests/navigation/**
-
  - name: ui-overview
    match:
      - ui/components/overview/**
@@ -451,17 +441,6 @@ modules:
    e2e:
      - ui/tests/home/**

-  - name: ui-registry
-    match:
-      - ui/actions/registry/**
-      - ui/app/**/registry/**
-      - ui/components/registry/**
-      - ui/lib/registry/**
-      - ui/tests/registry/**
-    tests: []
-    e2e:
-      - ui/tests/registry/**
-
  - name: ui-shadcn
    match:
      - ui/components/shadcn/**
@@ -485,7 +464,6 @@ modules:
      - ui/tests/profile/**
      - ui/tests/lighthouse/**
      - ui/tests/home/**
-      - ui/tests/navigation/**
      - ui/tests/attack-paths/**

  - name: ui-attack-paths
@@ -42,7 +42,6 @@ jobs:
    timeout-minutes: 5
    outputs:
      short-sha: ${{ steps.set-short-sha.outputs.short-sha }}
-      created: ${{ steps.set-short-sha.outputs.created }}
    permissions:
      contents: read
    steps:
@@ -53,9 +52,7 @@ jobs:

      - name: Calculate short SHA
        id: set-short-sha
-        run: |
-          echo "short-sha=${GITHUB_SHA::7}" >> "${GITHUB_OUTPUT}"
-          echo "created=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "${GITHUB_OUTPUT}"
+        run: echo "short-sha=${GITHUB_SHA::7}" >> $GITHUB_OUTPUT

  notify-release-started:
    if: github.repository == 'prowler-cloud/prowler' && (github.event_name == 'release' || github.event_name == 'workflow_dispatch')
@@ -162,20 +159,9 @@ jobs:
        with:
          context: ${{ env.WORKING_DIRECTORY }}
          push: true
-          sbom: true
-          # max, not the default min: min records little beyond the build ref.
-          provenance: mode=max
          platforms: ${{ matrix.platform }}
          tags: |
            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ needs.setup.outputs.short-sha }}-${{ matrix.arch }}
-          labels: |
-            org.opencontainers.image.title=Prowler Local Server API
-            org.opencontainers.image.description=API for Prowler Local Server (Django/DRF)
-            org.opencontainers.image.vendor=ProwlerPro, Inc.
-            org.opencontainers.image.source=https://github.com/${{ github.repository }}
-            org.opencontainers.image.revision=${{ github.sha }}
-            org.opencontainers.image.created=${{ needs.setup.outputs.created }}
-            ${{ (github.event_name == 'release' || github.event_name == 'workflow_dispatch') && format('org.opencontainers.image.version={0}', env.RELEASE_TAG) || '' }}
          cache-from: type=gha,scope=${{ matrix.arch }}
          cache-to: type=gha,mode=${{ github.event_name == 'pull_request' && 'min' || 'max' }},scope=${{ matrix.arch }}

@@ -193,12 +179,12 @@ jobs:
        with:
          egress-policy: block
          allowed-endpoints: >
-            auth.docker.io:443
            github.com:443
+            release-assets.githubusercontent.com:443
+            registry-1.docker.io:443
+            auth.docker.io:443
            production.cloudflare.docker.com:443
            production.cloudfront.docker.com:443
-            registry-1.docker.io:443
-            release-assets.githubusercontent.com:443
      - name: Login to DockerHub
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
        with:
@@ -210,9 +196,9 @@ jobs:
        run: |
          docker buildx imagetools create \
            -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ env.LATEST_TAG }} \
-            -t "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}" \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64" \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64"
+            -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA} \
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64 \
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64
        env:
          NEEDS_SETUP_OUTPUTS_SHORT_SHA: ${{ needs.setup.outputs.short-sha }}

@@ -220,10 +206,10 @@ jobs:
        if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
        run: |
          docker buildx imagetools create \
-            -t "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${RELEASE_TAG}" \
+            -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${RELEASE_TAG} \
            -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ env.STABLE_TAG }} \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64" \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64"
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64 \
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64
        env:
          NEEDS_SETUP_OUTPUTS_SHORT_SHA: ${{ needs.setup.outputs.short-sha }}

@@ -263,9 +249,9 @@ jobs:
        id: outcome
        run: |
          if [[ "${NEEDS_CONTAINER_BUILD_PUSH_RESULT}" == "success" && "${NEEDS_CREATE_MANIFEST_RESULT}" == "success" ]]; then
-            echo "outcome=success" >> "$GITHUB_OUTPUT"
+            echo "outcome=success" >> $GITHUB_OUTPUT
          else
-            echo "outcome=failure" >> "$GITHUB_OUTPUT"
+            echo "outcome=failure" >> $GITHUB_OUTPUT
          fi
        env:
          NEEDS_CONTAINER_BUILD_PUSH_RESULT: ${{ needs.container-build-push.result }}
@@ -81,10 +81,6 @@ jobs:
            auth.docker.io:443
            production.cloudflare.docker.com:443
            production.cloudfront.docker.com:443
-            raw.githubusercontent.com:443
-            objects.githubusercontent.com:443
-            grype.anchore.io:443
-            get.anchore.io:443
            debian.map.fastlydns.net:80
            release-assets.githubusercontent.com:443
            objects.githubusercontent.com:443
@@ -109,13 +105,7 @@ jobs:
        id: check-changes
        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
        with:
-          files: |
-            api/**
-            .trivyignore.yaml
-            .github/actions/trivy-scan/**
-            .github/actions/grype-scan/**
-            .grype.yaml
-            .github/scripts/grype-pr-comment.js
+          files: api/**
          files_ignore: |
            api/docs/**
            api/README.md
@@ -123,15 +113,6 @@ jobs:
            api/changelog.d/**
            api/AGENTS.md

-      # api-container-build-push.yml resolves the SDK pin to the branch tip
-      # before building, so match it here and scan what ships. Push only: PRs
-      # stay deterministic against the committed lock.
-      - name: Refresh prowler SDK pin to current branch tip
-        if: steps.check-changes.outputs.any_changed == 'true' && github.event_name == 'push'
-        run: |
-          pip install --no-cache-dir "uv==0.11.14"
-          (cd api && uv lock --upgrade-package prowler)
-
      - name: Set up Docker Buildx
        if: steps.check-changes.outputs.any_changed == 'true'
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
@@ -153,13 +134,5 @@ jobs:
        with:
          image-name: ${{ env.IMAGE_NAME }}
          image-tag: ${{ github.sha }}
-          fail-on-severity: 'high'
-          severity: 'CRITICAL,HIGH'
-
-      - name: Scan container with Grype
-        if: steps.check-changes.outputs.any_changed == 'true'
-        uses: ./.github/actions/grype-scan
-        with:
-          image-name: ${{ env.IMAGE_NAME }}
-          image-tag: ${{ github.sha }}
-          fail-on-severity: 'high'
+          fail-on-critical: 'true'
+          severity: 'CRITICAL'
@@ -107,7 +107,6 @@ jobs:
          files: |
            api/**
            .github/workflows/api-tests.yml
-            codecov.yml
          files_ignore: |
            api/docs/**
            api/README.md
@@ -39,7 +39,7 @@ jobs:

      - name: Check labels
        id: label_check
-        uses: agilepathway/label-checker@c324842522fbd012e4f590afe3b4e591301322ed # v1.6.66
+        uses: agilepathway/label-checker@c3d16ad512e7cea5961df85ff2486bb774caf3c5 # v1.6.65
        with:
          allow_failure: true
          prefix_mode: true
@@ -1,63 +0,0 @@
-name: 'CI: Actionlint'
-
-on:
-  push:
-    branches:
-      - 'master'
-  pull_request:
-    branches:
-      - 'master'
-  schedule:
-    - cron: '45 06 * * *'
-  workflow_dispatch:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-permissions: {}
-
-jobs:
-  actionlint:
-    if: github.repository == 'prowler-cloud/prowler'
-    name: GitHub Actions Schema Check
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: read
-
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: block
-          allowed-endpoints: >
-            github.com:443
-            api.github.com:443
-            auth.docker.io:443
-            registry-1.docker.io:443
-            production.cloudflare.docker.com:443
-            production.cloudfront.docker.com:443
-
-      - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-        with:
-          # zizmor: ignore[artipacked]
-          persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
-
-      # Always runs so it always reports; the lint is skipped when nothing changed.
-      - name: Check for workflow changes
-        id: check-changes
-        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
-        with:
-          files: .github/**
-
-      # SC2129 is style only: it suggests grouping consecutive redirects.
-      - name: Run actionlint
-        if: steps.check-changes.outputs.any_changed == 'true'
-        env:
-          SHELLCHECK_OPTS: '-e SC2129'
-        run: |
-          docker run --rm -v "$PWD:/repo" --workdir /repo -e SHELLCHECK_OPTS \
-            rhysd/actionlint:1.7.12@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667 \
-            -color
@@ -32,7 +32,7 @@ jobs:
          ISSUE_NUMBER: ${{ github.event.issue.number }}
        run: |
          echo "Removing 'status/awaiting-response' label from #$ISSUE_NUMBER"
-          gh api "/repos/${{ github.repository }}/issues/$ISSUE_NUMBER/labels/status%2Fawaiting-response" \
+          gh api /repos/${{ github.repository }}/issues/$ISSUE_NUMBER/labels/status%2Fawaiting-response \
            -X DELETE

      - name: Add 'status/waiting-for-revision' label
@@ -41,6 +41,6 @@ jobs:
          ISSUE_NUMBER: ${{ github.event.issue.number }}
        run: |
          echo "Adding 'status/waiting-for-revision' label to #$ISSUE_NUMBER"
-          gh api "/repos/${{ github.repository }}/issues/$ISSUE_NUMBER/labels" \
+          gh api /repos/${{ github.repository }}/issues/$ISSUE_NUMBER/labels \
            -X POST \
            -f labels[]='status/waiting-for-revision'
@@ -61,7 +61,6 @@ jobs:
            api.github.com:443
            github.com:443
            objects.githubusercontent.com:443
-            release-assets.githubusercontent.com:443
            pypi.org:443
            files.pythonhosted.org:443

@@ -1,92 +0,0 @@
-name: 'Tools: Sync Docker Hub Descriptions'
-
-on:
-  push:
-    branches:
-      - 'master'
-    paths:
-      - 'docs/dockerhub/README.md'
-      - '.github/workflows/dockerhub-descriptions.yml'
-  workflow_dispatch:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: false
-
-env:
-  OVERVIEW_FILE: docs/dockerhub/README.md
-
-permissions: {}
-
-jobs:
-  prowlercloud:
-    if: github.repository == 'prowler-cloud/prowler' && github.ref == 'refs/heads/master'
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: read
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - repository: prowlercloud/prowler
-            short_description: 'Prowler CLI: the Open Cloud Security tool for AWS, Azure, Google Cloud, Kubernetes, M365 and GitHub'
-          - repository: prowlercloud/prowler-api
-            short_description: 'Prowler Local Server - API: the JSON API and Task Runner components of Prowler'
-          - repository: prowlercloud/prowler-ui
-            short_description: 'Prowler Local Server - UI: the web interface to run Prowler scans and explore findings'
-          - repository: prowlercloud/prowler-mcp
-            short_description: 'Prowler MCP: the interface for agents, including IDE plugins and agent integrations'
-
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: block
-          allowed-endpoints: >
-            github.com:443
-            hub.docker.com:443
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
-      - name: Update Docker Hub description for ${{ matrix.repository }}
-        uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-          repository: ${{ matrix.repository }}
-          short-description: ${{ matrix.short_description }}
-          readme-filepath: ${{ env.OVERVIEW_FILE }}
-
-  toniblyx:
-    if: github.repository == 'prowler-cloud/prowler' && github.ref == 'refs/heads/master'
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: read
-
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: block
-          allowed-endpoints: >
-            github.com:443
-            hub.docker.com:443
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
-      - name: Update Docker Hub description for toniblyx/prowler
-        uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0
-        with:
-          username: ${{ secrets.TONIBLYX_DOCKERHUB_USERNAME }}
-          password: ${{ secrets.TONIBLYX_DOCKERHUB_PASSWORD }}
-          repository: toniblyx/prowler
-          short-description: 'Prowler CLI (legacy repository, mirrors prowlercloud/prowler)'
-          readme-filepath: ${{ env.OVERVIEW_FILE }}
@@ -38,19 +38,16 @@ jobs:
      - name: Set up Helm
        uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0

-      - name: Set chart version and appVersion from release tag
+      - name: Set appVersion from release tag
        run: |
-          # Strip any leading "v" so the chart version is valid SemVer 2.
-          RELEASE_TAG="${GITHUB_EVENT_RELEASE_TAG_NAME#v}"
-          echo "Setting chart version and appVersion to ${RELEASE_TAG}"
-          # Publish an immutable chart version per release instead of the static
-          # 0.0.1 in source, so every release is a distinct, addressable artifact.
-          yq -i ".version = \"${RELEASE_TAG}\" | .appVersion = \"${RELEASE_TAG}\"" ${{ env.CHART_PATH }}/Chart.yaml
+          RELEASE_TAG="${GITHUB_EVENT_RELEASE_TAG_NAME}"
+          echo "Setting appVersion to ${RELEASE_TAG}"
+          sed -i "s/^appVersion:.*/appVersion: \"${RELEASE_TAG}\"/" ${{ env.CHART_PATH }}/Chart.yaml
        env:
          GITHUB_EVENT_RELEASE_TAG_NAME: ${{ github.event.release.tag_name }}

      - name: Login to GHCR
-        run: echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io -u "${GITHUB_ACTOR}" --password-stdin
+        run: echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io -u ${GITHUB_ACTOR} --password-stdin

      - name: Update chart dependencies
        run: helm dependency update ${{ env.CHART_PATH }}
@@ -85,10 +85,10 @@ jobs:

          # Check if author is in the org members list
          if printf '%s\n' "${ORG_MEMBERS[@]}" | grep -q "^${AUTHOR}$"; then
-            echo "is_member=true" >> "$GITHUB_OUTPUT"
+            echo "is_member=true" >> $GITHUB_OUTPUT
            echo "$AUTHOR is an organization member"
          else
-            echo "is_member=false" >> "$GITHUB_OUTPUT"
+            echo "is_member=false" >> $GITHUB_OUTPUT
            echo "$AUTHOR is not an organization member"
          fi

@@ -55,10 +55,6 @@ jobs:
        # Pin must match .pre-commit-config.yaml so prek and CI behave identically.
        # pnpm dlx doesn't accept --ignore-scripts as a flag; the env var
        # disables postinstall scripts on transitives the same way.
-        #
-        # Files come from `git ls-files` because markdownlint doesn't traverse
-        # dot-directories, so `.github/**/*.md` went unlinted.
-        # `.markdownlintignore` still applies to the listed paths.
        env:
          pnpm_config_ignore_scripts: 'true'
-        run: git ls-files -z '*.md' | xargs -0 -r pnpm dlx markdownlint-cli@0.45.0 --
+        run: pnpm dlx markdownlint-cli@0.45.0 '**/*.md'
@@ -41,7 +41,6 @@ jobs:
    timeout-minutes: 5
    outputs:
      short-sha: ${{ steps.set-short-sha.outputs.short-sha }}
-      created: ${{ steps.set-short-sha.outputs.created }}
    permissions:
      contents: read
    steps:
@@ -52,9 +51,7 @@ jobs:

      - name: Calculate short SHA
        id: set-short-sha
-        run: |
-          echo "short-sha=${GITHUB_SHA::7}" >> "${GITHUB_OUTPUT}"
-          echo "created=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "${GITHUB_OUTPUT}"
+        run: echo "short-sha=${GITHUB_SHA::7}" >> $GITHUB_OUTPUT

  notify-release-started:
    if: github.repository == 'prowler-cloud/prowler' && (github.event_name == 'release' || github.event_name == 'workflow_dispatch')
@@ -113,17 +110,15 @@ jobs:
        with:
          egress-policy: block
          allowed-endpoints: >
-            auth.docker.io:443
-            dl-cdn.alpinelinux.org:443
-            dualstack.j.sni.global.fastly.net:443
-            files.pythonhosted.org:443
-            ghcr.io:443
            github.com:443
-            pkg-containers.githubusercontent.com:443
+            registry-1.docker.io:443
+            auth.docker.io:443
            production.cloudflare.docker.com:443
            production.cloudfront.docker.com:443
+            ghcr.io:443
+            pkg-containers.githubusercontent.com:443
+            files.pythonhosted.org:443
            pypi.org:443
-            registry-1.docker.io:443

      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -146,20 +141,17 @@ jobs:
        with:
          context: ${{ env.WORKING_DIRECTORY }}
          push: true
-          sbom: true
-          # max, not the default min: min records little beyond the build ref.
-          provenance: mode=max
          platforms: ${{ matrix.platform }}
          tags: |
            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ needs.setup.outputs.short-sha }}-${{ matrix.arch }}
          labels: |
-            org.opencontainers.image.title=Prowler MCP
+            org.opencontainers.image.title=Prowler MCP Server
            org.opencontainers.image.description=Model Context Protocol server for Prowler
            org.opencontainers.image.vendor=ProwlerPro, Inc.
            org.opencontainers.image.source=https://github.com/${{ github.repository }}
            org.opencontainers.image.revision=${{ github.sha }}
-            org.opencontainers.image.created=${{ needs.setup.outputs.created }}
-            ${{ (github.event_name == 'release' || github.event_name == 'workflow_dispatch') && format('org.opencontainers.image.version={0}', env.RELEASE_TAG) || '' }}
+            org.opencontainers.image.created=${{ github.event_name == 'release' && github.event.release.published_at || github.event.head_commit.timestamp }}
+            ${{ github.event_name == 'release' && format('org.opencontainers.image.version={0}', env.RELEASE_TAG) || '' }}
          cache-from: type=gha,scope=${{ matrix.arch }}
          cache-to: type=gha,mode=${{ github.event_name == 'pull_request' && 'min' || 'max' }},scope=${{ matrix.arch }}

@@ -177,11 +169,11 @@ jobs:
        with:
          egress-policy: block
          allowed-endpoints: >
+            registry-1.docker.io:443
            auth.docker.io:443
-            github.com:443
            production.cloudflare.docker.com:443
            production.cloudfront.docker.com:443
-            registry-1.docker.io:443
+            github.com:443
            release-assets.githubusercontent.com:443

      - name: Login to DockerHub
@@ -195,9 +187,9 @@ jobs:
        run: |
          docker buildx imagetools create \
            -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ env.LATEST_TAG }} \
-            -t "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}" \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64" \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64"
+            -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA} \
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64 \
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64
        env:
          NEEDS_SETUP_OUTPUTS_SHORT_SHA: ${{ needs.setup.outputs.short-sha }}

@@ -205,10 +197,10 @@ jobs:
        if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
        run: |
          docker buildx imagetools create \
-            -t "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${RELEASE_TAG}" \
+            -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${RELEASE_TAG} \
            -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ env.STABLE_TAG }} \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64" \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64"
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64 \
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64
        env:
          NEEDS_SETUP_OUTPUTS_SHORT_SHA: ${{ needs.setup.outputs.short-sha }}

@@ -248,9 +240,9 @@ jobs:
        id: outcome
        run: |
          if [[ "${NEEDS_CONTAINER_BUILD_PUSH_RESULT}" == "success" && "${NEEDS_CREATE_MANIFEST_RESULT}" == "success" ]]; then
-            echo "outcome=success" >> "$GITHUB_OUTPUT"
+            echo "outcome=success" >> $GITHUB_OUTPUT
          else
-            echo "outcome=failure" >> "$GITHUB_OUTPUT"
+            echo "outcome=failure" >> $GITHUB_OUTPUT
          fi
        env:
          NEEDS_CONTAINER_BUILD_PUSH_RESULT: ${{ needs.container-build-push.result }}
@@ -81,17 +81,12 @@ jobs:
            pkg-containers.githubusercontent.com:443
            files.pythonhosted.org:443
            pypi.org:443
-            dl-cdn.alpinelinux.org:443
-            dualstack.j.sni.global.fastly.net:443
            api.github.com:443
            mirror.gcr.io:443
            check.trivy.dev:443
            get.trivy.dev:443
            release-assets.githubusercontent.com:443
            objects.githubusercontent.com:443
-            raw.githubusercontent.com:443
-            grype.anchore.io:443
-            get.anchore.io:443

      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -103,13 +98,7 @@ jobs:
        id: check-changes
        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
        with:
-          files: |
-            mcp_server/**
-            .trivyignore.yaml
-            .github/actions/trivy-scan/**
-            .github/actions/grype-scan/**
-            .grype.yaml
-            .github/scripts/grype-pr-comment.js
+          files: mcp_server/**
          files_ignore: |
            mcp_server/README.md
            mcp_server/CHANGELOG.md
@@ -136,13 +125,5 @@ jobs:
        with:
          image-name: ${{ env.IMAGE_NAME }}
          image-tag: ${{ github.sha }}
-          fail-on-severity: 'high'
-          severity: 'CRITICAL,HIGH'
-
-      - name: Scan MCP container with Grype
-        if: steps.check-changes.outputs.any_changed == 'true'
-        uses: ./.github/actions/grype-scan
-        with:
-          image-name: ${{ env.IMAGE_NAME }}
-          image-tag: ${{ github.sha }}
-          fail-on-severity: 'high'
+          fail-on-critical: 'true'
+          severity: 'CRITICAL'
@@ -113,7 +113,7 @@ jobs:

      - name: Publish prowler-mcp package to PyPI
        if: steps.pypi-check.outputs.skip != 'true'
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
        with:
          packages-dir: ${{ env.WORKING_DIRECTORY }}/dist/
          print-hash: true
@@ -1,99 +0,0 @@
-name: 'MCP: Tests'
-
-on:
-  push:
-    branches:
-      - 'master'
-      - 'v5.*'
-  pull_request:
-    branches:
-      - 'master'
-      - 'v5.*'
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-env:
-  MCP_WORKING_DIR: ./mcp_server
-
-permissions: {}
-
-jobs:
-  mcp-tests:
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    permissions:
-      contents: read
-    strategy:
-      matrix:
-        # requires-python is >=3.12 while the shipped image is 3.13; testing both
-        # is what keeps that floor honest.
-        python-version:
-          - '3.12'
-          - '3.13'
-    defaults:
-      run:
-        working-directory: ./mcp_server
-
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: block
-          # hub.prowler.com and raw.githubusercontent.com are deliberately absent:
-          # the suite mocks every outbound call, so a real one must fail the job.
-          # The sentry.io entry is not the test suite: the Codecov uploader sends
-          # its own telemetry there, so api-tests.yml and sdk-tests.yml allow it too.
-          allowed-endpoints: >
-            github.com:443
-            pypi.org:443
-            files.pythonhosted.org:443
-            cli.codecov.io:443
-            keybase.io:443
-            ingest.codecov.io:443
-            o26192.ingest.us.sentry.io:443
-            storage.googleapis.com:443
-            api.github.com:443
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          # zizmor: ignore[artipacked]
-          persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
-
-      - name: Check for MCP server changes
-        id: check-changes
-        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
-        with:
-          files: |
-            mcp_server/**
-            .github/workflows/mcp-tests.yml
-            codecov.yml
-          files_ignore: |
-            mcp_server/README.md
-            mcp_server/CHANGELOG.md
-            mcp_server/changelog.d/**
-            mcp_server/AGENTS.md
-            mcp_server/Dockerfile
-            mcp_server/.dockerignore
-            mcp_server/entrypoint.sh
-
-      - name: Setup Python with uv
-        if: steps.check-changes.outputs.any_changed == 'true'
-        uses: ./.github/actions/setup-python-uv
-        with:
-          python-version: ${{ matrix.python-version }}
-          working-directory: ./mcp_server
-
-      - name: Run tests with pytest
-        if: steps.check-changes.outputs.any_changed == 'true'
-        run: uv run pytest --cov=./prowler_mcp_server --cov-report=xml tests
-
-      - name: Upload coverage reports to Codecov
-        if: steps.check-changes.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-        with:
-          flags: mcp
@@ -35,7 +35,6 @@ jobs:
            api.github.com:443
            github.com:443
            objects.githubusercontent.com:443
-            release-assets.githubusercontent.com:443
            pypi.org:443
            files.pythonhosted.org:443

@@ -130,6 +129,7 @@ jobs:
          handwritten_changelogs=""

          all_changed=$(echo "${STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES}" | tr ' ' '\n')
+          added=$(echo "${STEPS_CHANGED_FILES_OUTPUTS_ADDED_FILES}" | tr ' ' '\n')
          added_or_renamed=$(printf '%s\n%s' "${STEPS_CHANGED_FILES_OUTPUTS_ADDED_FILES}" "${STEPS_CHANGED_FILES_OUTPUTS_RENAMED_FILES}" | tr ' ' '\n')
          added_modified_or_renamed=$(printf '%s\n%s\n%s' "${STEPS_CHANGED_FILES_OUTPUTS_ADDED_FILES}" "${STEPS_CHANGED_FILES_OUTPUTS_MODIFIED_FILES}" "${STEPS_CHANGED_FILES_OUTPUTS_RENAMED_FILES}" | tr ' ' '\n')

@@ -111,7 +111,7 @@ jobs:
            done

            if [ -n "$found_in" ]; then
-              found_in="${found_in%, }"
+              found_in=$(echo "$found_in" | sed 's/, $//')
              MAPPED="${MAPPED}- \`${check_id}\` (\`${provider}\`): ${found_in}"$'\n'
            else
              UNMAPPED="${UNMAPPED}- \`${check_id}\` (\`${provider}\`)"$'\n'
@@ -74,15 +74,15 @@ jobs:
          done <<< "$STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES"

          if [ "$HAS_CONFLICTS" = true ]; then
-            echo "has_conflicts=true" >> "$GITHUB_OUTPUT"
+            echo "has_conflicts=true" >> $GITHUB_OUTPUT
            {
              echo "conflict_files<<EOF"
              echo "$CONFLICT_FILES"
              echo "EOF"
-            } >> "$GITHUB_OUTPUT"
+            } >> $GITHUB_OUTPUT
            echo "Conflict markers detected"
          else
-            echo "has_conflicts=false" >> "$GITHUB_OUTPUT"
+            echo "has_conflicts=false" >> $GITHUB_OUTPUT
            echo "No conflict markers found in changed files"
          fi
        env:
@@ -36,7 +36,7 @@ jobs:
        id: vars
        run: |
          SHORT_SHA="${GITHUB_EVENT_PULL_REQUEST_MERGE_COMMIT_SHA}"
-          echo "short_sha=${SHORT_SHA::7}" >> "$GITHUB_OUTPUT"
+          echo "short_sha=${SHORT_SHA::7}" >> $GITHUB_OUTPUT
        env:
          GITHUB_EVENT_PULL_REQUEST_MERGE_COMMIT_SHA: ${{ github.event.pull_request.merge_commit_sha }}

@@ -46,7 +46,6 @@ jobs:
          token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }}
          repository: ${{ secrets.CLOUD_DISPATCH }}
          event-type: prowler-pull-request-merged
-          # repository_dispatch caps client_payload at 10 properties; this is exactly at the cap.
          client-payload: |
            {
              "PROWLER_COMMIT_SHA": "${{ github.event.pull_request.merge_commit_sha }}",
@@ -55,8 +54,8 @@ jobs:
              "PROWLER_PR_TITLE": ${{ toJson(github.event.pull_request.title) }},
              "PROWLER_PR_LABELS": ${{ toJson(github.event.pull_request.labels.*.name) }},
              "PROWLER_PR_BODY": ${{ toJson(github.event.pull_request.body) }},
+              "PROWLER_PR_URL": ${{ toJson(github.event.pull_request.html_url) }},
              "PROWLER_PR_MERGED_BY": "${{ github.event.pull_request.merged_by.login }}",
-              "PROWLER_PR_STACK_NUMBER": "${{ github.event.pull_request.stack.number }}",
-              "PROWLER_PR_STACK_POSITION": "${{ github.event.pull_request.stack.position }}",
-              "PROWLER_PR_STACK_SIZE": "${{ github.event.pull_request.stack.size }}"
+              "PROWLER_PR_BASE_BRANCH": ${{ toJson(github.event.pull_request.base.ref) }},
+              "PROWLER_PR_HEAD_BRANCH": ${{ toJson(github.event.pull_request.head.ref) }}
            }
@@ -25,7 +25,6 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
-      actions: write
      contents: write
      pull-requests: write
    steps:
@@ -34,12 +33,6 @@ jobs:
      with:
        egress-policy: audit

-    - name: Enable release freeze
-      env:
-        GH_TOKEN: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }}
-      run: |
-        gh variable set RELEASE_FREEZE --body true --repo "${GITHUB_REPOSITORY}"
-
    - name: Checkout repository
      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      with:
@@ -77,7 +70,7 @@ jobs:

          echo "Prowler version: $PROWLER_VERSION"
          echo "Branch name: $BRANCH_NAME"
-          echo "Is minor release: $([ "$PATCH_VERSION" -eq 0 ] && echo 'true' || echo 'false')"
+          echo "Is minor release: $([ $PATCH_VERSION -eq 0 ] && echo 'true' || echo 'false')"
        else
          echo "Invalid version syntax: '$PROWLER_VERSION' (must be N.N.N)" >&2
          exit 1
@@ -107,8 +100,7 @@ jobs:
          if [ -f "$changelog_file" ]; then
            # Extract version that matches this Prowler release
            # Format: ## [version] (Prowler X.Y.Z) or ## [vversion] (Prowler vX.Y.Z)
-            local version
-            version=$(grep '^## \[' "$changelog_file" | grep "(Prowler v\?${prowler_version})" | head -1 | sed 's/^## \[\(.*\)\].*/\1/' | sed 's/^v//' | tr -d '[:space:]')
+            local version=$(grep '^## \[' "$changelog_file" | grep "(Prowler v\?${prowler_version})" | head -1 | sed 's/^## \[\(.*\)\].*/\1/' | sed 's/^v//' | tr -d '[:space:]')
            echo "$version"
          else
            echo ""
@@ -179,55 +171,55 @@ jobs:

        # Determine if components have changes for this specific release
        if [ -n "$SDK_VERSION" ]; then
-          echo "HAS_SDK_CHANGES=true" >> "$GITHUB_ENV"
+          echo "HAS_SDK_CHANGES=true" >> $GITHUB_ENV
          HAS_SDK_CHANGES="true"
          echo "✓ SDK changes detected - version: $SDK_VERSION"
          extract_changelog "prowler/CHANGELOG.md" "$SDK_VERSION" "prowler_changelog.md"
        else
-          echo "HAS_SDK_CHANGES=false" >> "$GITHUB_ENV"
+          echo "HAS_SDK_CHANGES=false" >> $GITHUB_ENV
          HAS_SDK_CHANGES="false"
          echo "ℹ No SDK changes for this release"
          touch "prowler_changelog.md"
        fi

        if [ -n "$API_VERSION" ]; then
-          echo "HAS_API_CHANGES=true" >> "$GITHUB_ENV"
+          echo "HAS_API_CHANGES=true" >> $GITHUB_ENV
          HAS_API_CHANGES="true"
          echo "✓ API changes detected - version: $API_VERSION"
          extract_changelog "api/CHANGELOG.md" "$API_VERSION" "api_changelog.md"
        else
-          echo "HAS_API_CHANGES=false" >> "$GITHUB_ENV"
+          echo "HAS_API_CHANGES=false" >> $GITHUB_ENV
          HAS_API_CHANGES="false"
          echo "ℹ No API changes for this release"
          touch "api_changelog.md"
        fi

        if [ -n "$UI_VERSION" ]; then
-          echo "HAS_UI_CHANGES=true" >> "$GITHUB_ENV"
+          echo "HAS_UI_CHANGES=true" >> $GITHUB_ENV
          HAS_UI_CHANGES="true"
          echo "✓ UI changes detected - version: $UI_VERSION"
          extract_changelog "ui/CHANGELOG.md" "$UI_VERSION" "ui_changelog.md"
        else
-          echo "HAS_UI_CHANGES=false" >> "$GITHUB_ENV"
+          echo "HAS_UI_CHANGES=false" >> $GITHUB_ENV
          HAS_UI_CHANGES="false"
          echo "ℹ No UI changes for this release"
          touch "ui_changelog.md"
        fi

        if [ -n "$MCP_VERSION" ]; then
-          echo "HAS_MCP_CHANGES=true" >> "$GITHUB_ENV"
+          echo "HAS_MCP_CHANGES=true" >> $GITHUB_ENV
          HAS_MCP_CHANGES="true"
          echo "✓ MCP changes detected - version: $MCP_VERSION"
          extract_changelog "mcp_server/CHANGELOG.md" "$MCP_VERSION" "mcp_changelog.md"
        else
-          echo "HAS_MCP_CHANGES=false" >> "$GITHUB_ENV"
+          echo "HAS_MCP_CHANGES=false" >> $GITHUB_ENV
          HAS_MCP_CHANGES="false"
          echo "ℹ No MCP changes for this release"
          touch "mcp_changelog.md"
        fi

        # Combine changelogs in order: UI, API, SDK, MCP
-        : > combined_changelog.md
+        > combined_changelog.md

        if [ "$HAS_UI_CHANGES" = "true" ] && [ -s "ui_changelog.md" ]; then
          echo "## UI" >> combined_changelog.md
@@ -390,4 +382,3 @@ jobs:
      if: always()
      run: |
        rm -f prowler_changelog.md api_changelog.md ui_changelog.md mcp_changelog.md combined_changelog.md
-
@@ -1,45 +0,0 @@
-name: 'Tools: Release Freeze Gate'
-
-on:
-  pull_request:
-    branches:
-      - 'master'
-    types:
-      - opened
-      - synchronize
-      - reopened
-      - ready_for_review
-  merge_group:
-    branches:
-      - 'master'
-    types:
-      - checks_requested
-  workflow_dispatch:
-
-permissions: {}
-
-jobs:
-  release-freeze-gate:
-    name: release-freeze-gate
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-
-      - name: Check release freeze status
-        env:
-          RELEASE_FREEZE: ${{ vars.RELEASE_FREEZE }}
-        run: |
-          case "${RELEASE_FREEZE}" in
-            true|TRUE|True)
-              echo "::error::Release freeze is active. Merges to master are temporarily blocked."
-              echo "Set the RELEASE_FREEZE repository variable to false when the release is complete."
-              exit 1
-              ;;
-            *)
-              echo "Release freeze is not active."
-              ;;
-          esac
@@ -54,7 +54,6 @@ jobs:
    timeout-minutes: 5
    outputs:
      prowler_version: ${{ steps.get-prowler-version.outputs.prowler_version }}
-      created: ${{ steps.get-prowler-version.outputs.created }}
      latest_tag: ${{ steps.get-prowler-version.outputs.latest_tag }}
      stable_tag: ${{ steps.get-prowler-version.outputs.stable_tag }}
    permissions:
@@ -65,9 +64,9 @@ jobs:
        with:
          egress-policy: block
          allowed-endpoints: >
-            files.pythonhosted.org:443
            github.com:443
            pypi.org:443
+            files.pythonhosted.org:443

      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -87,7 +86,6 @@ jobs:
          fi
          echo "latest_tag=latest" >> "${GITHUB_OUTPUT}"
          echo "stable_tag=stable" >> "${GITHUB_OUTPUT}"
-          echo "created=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "${GITHUB_OUTPUT}"

  notify-release-started:
    if: github.repository == 'prowler-cloud/prowler' && (github.event_name == 'release' || github.event_name == 'workflow_dispatch')
@@ -148,24 +146,24 @@ jobs:
        with:
          egress-policy: block
          allowed-endpoints: >
-            _http._tcp.deb.debian.org:443
-            aka.ms:443
            api.ecr-public.us-east-1.amazonaws.com:443
-            auth.docker.io:443
-            cdn.powershellgallery.com:443
-            debian.map.fastlydns.net:80
-            files.pythonhosted.org:443
-            github.com:443
-            powershellinfraartifacts-gkhedzdeaghdezhr.z01.azurefd.net:443
-            production.cloudflare.docker.com:443
-            production.cloudfront.docker.com:443
            public.ecr.aws:443
-            pypi.org:443
-            registry-1.docker.io:443
-            release-assets.githubusercontent.com:443
            sts.amazonaws.com:443
            sts.us-east-1.amazonaws.com:443
+            registry-1.docker.io:443
+            production.cloudflare.docker.com:443
+            production.cloudfront.docker.com:443
+            auth.docker.io:443
+            debian.map.fastlydns.net:80
+            github.com:443
+            release-assets.githubusercontent.com:443
+            pypi.org:443
+            files.pythonhosted.org:443
            www.powershellgallery.com:443
+            aka.ms:443
+            cdn.powershellgallery.com:443
+            _http._tcp.deb.debian.org:443
+            powershellinfraartifacts-gkhedzdeaghdezhr.z01.azurefd.net:443

      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -200,20 +198,9 @@ jobs:
          context: .
          file: ${{ env.DOCKERFILE_PATH }}
          push: true
-          sbom: true
-          # max, not the default min: min records little beyond the build ref.
-          provenance: mode=max
          platforms: ${{ matrix.platform }}
          tags: |
            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ needs.setup.outputs.latest_tag }}-${{ matrix.arch }}
-          labels: |
-            org.opencontainers.image.title=Prowler CLI
-            org.opencontainers.image.description=Open Source security tool for cloud security assessments, audits, incident response, continuous monitoring, hardening and forensics readiness
-            org.opencontainers.image.vendor=ProwlerPro, Inc.
-            org.opencontainers.image.source=https://github.com/${{ github.repository }}
-            org.opencontainers.image.revision=${{ github.sha }}
-            org.opencontainers.image.created=${{ needs.setup.outputs.created }}
-            org.opencontainers.image.version=${{ needs.setup.outputs.prowler_version }}
          cache-from: type=gha,scope=${{ matrix.arch }}
          cache-to: type=gha,mode=${{ github.event_name == 'pull_request' && 'min' || 'max' }},scope=${{ matrix.arch }}

@@ -232,14 +219,14 @@ jobs:
        with:
          egress-policy: block
          allowed-endpoints: >
-            api.ecr-public.us-east-1.amazonaws.com:443
+            registry-1.docker.io:443
            auth.docker.io:443
-            github.com:443
+            public.ecr.aws:443
            production.cloudflare.docker.com:443
            production.cloudfront.docker.com:443
-            public.ecr.aws:443
-            registry-1.docker.io:443
+            github.com:443
            release-assets.githubusercontent.com:443
+            api.ecr-public.us-east-1.amazonaws.com:443
            sts.amazonaws.com:443
            sts.us-east-1.amazonaws.com:443

@@ -265,10 +252,10 @@ jobs:
        if: github.event_name == 'push'
        run: |
          docker buildx imagetools create \
-            -t "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG}" \
-            -t "${{ secrets.PUBLIC_ECR_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG}" \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG}-amd64" \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG}-arm64"
+            -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG} \
+            -t ${{ secrets.PUBLIC_ECR_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG} \
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG}-amd64 \
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG}-arm64
        env:
          NEEDS_SETUP_OUTPUTS_LATEST_TAG: ${{ needs.setup.outputs.latest_tag }}

@@ -276,12 +263,12 @@ jobs:
        if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
        run: |
          docker buildx imagetools create \
-            -t "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_PROWLER_VERSION}" \
-            -t "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_STABLE_TAG}" \
-            -t "${{ secrets.PUBLIC_ECR_REPOSITORY }}/${{ env.IMAGE_NAME }}:${NEEDS_SETUP_OUTPUTS_PROWLER_VERSION}" \
-            -t "${{ secrets.PUBLIC_ECR_REPOSITORY }}/${{ env.IMAGE_NAME }}:${NEEDS_SETUP_OUTPUTS_STABLE_TAG}" \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG}-amd64" \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG}-arm64"
+            -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_PROWLER_VERSION} \
+            -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_STABLE_TAG} \
+            -t ${{ secrets.PUBLIC_ECR_REPOSITORY }}/${{ env.IMAGE_NAME }}:${NEEDS_SETUP_OUTPUTS_PROWLER_VERSION} \
+            -t ${{ secrets.PUBLIC_ECR_REPOSITORY }}/${{ env.IMAGE_NAME }}:${NEEDS_SETUP_OUTPUTS_STABLE_TAG} \
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG}-amd64 \
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG}-arm64
        env:
          NEEDS_SETUP_OUTPUTS_PROWLER_VERSION: ${{ needs.setup.outputs.prowler_version }}
          NEEDS_SETUP_OUTPUTS_STABLE_TAG: ${{ needs.setup.outputs.stable_tag }}
@@ -306,7 +293,7 @@ jobs:
        if: needs.setup.outputs.latest_tag == 'latest' && (github.event_name == 'release' || github.event_name == 'workflow_dispatch')
        run: |
          docker buildx imagetools create \
-            -t "${{ env.TONIBLYX_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_PROWLER_VERSION}" \
+            -t ${{ env.TONIBLYX_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_PROWLER_VERSION} \
            -t ${{ env.TONIBLYX_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:stable \
            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:stable
        env:
@@ -356,9 +343,9 @@ jobs:
        id: outcome
        run: |
          if [[ "${NEEDS_CONTAINER_BUILD_PUSH_RESULT}" == "success" && "${NEEDS_CREATE_MANIFEST_RESULT}" == "success" ]]; then
-            echo "outcome=success" >> "$GITHUB_OUTPUT"
+            echo "outcome=success" >> $GITHUB_OUTPUT
          else
-            echo "outcome=failure" >> "$GITHUB_OUTPUT"
+            echo "outcome=failure" >> $GITHUB_OUTPUT
          fi
        env:
          NEEDS_CONTAINER_BUILD_PUSH_RESULT: ${{ needs.container-build-push.result }}
@@ -10,7 +10,6 @@ on:
      - 'Dockerfile*'
      - 'pyproject.toml'
      - 'uv.lock'
-      - '.trivyignore.yaml'
      - '.github/workflows/sdk-container-checks.yml'
  pull_request:
    branches:
@@ -84,10 +83,6 @@ jobs:
            api.github.com:443
            mirror.gcr.io:443
            check.trivy.dev:443
-            raw.githubusercontent.com:443
-            objects.githubusercontent.com:443
-            grype.anchore.io:443
-            get.anchore.io:443
            debian.map.fastlydns.net:80
            release-assets.githubusercontent.com:443
            objects.githubusercontent.com:443
@@ -117,12 +112,7 @@ jobs:
            Dockerfile*
            pyproject.toml
            uv.lock
-            .trivyignore.yaml
            .github/workflows/sdk-container-checks.yml
-            .github/actions/trivy-scan/**
-            .github/actions/grype-scan/**
-            .grype.yaml
-            .github/scripts/grype-pr-comment.js
          files_ignore: |
            prowler/CHANGELOG.md
            prowler/changelog.d/**
@@ -149,13 +139,5 @@ jobs:
        with:
          image-name: ${{ env.IMAGE_NAME }}
          image-tag: ${{ github.sha }}
-          fail-on-severity: 'high'
-          severity: 'CRITICAL,HIGH'
-
-      - name: Scan SDK container with Grype
-        if: steps.check-changes.outputs.any_changed == 'true'
-        uses: ./.github/actions/grype-scan
-        with:
-          image-name: ${{ env.IMAGE_NAME }}
-          image-tag: ${{ github.sha }}
-          fail-on-severity: 'high'
+          fail-on-critical: 'true'
+          severity: 'CRITICAL'
@@ -1,196 +0,0 @@
-name: 'SDK: Package Checks'
-
-# Rehearses the PyPI release on every packaging change and once a week, from the
-# consumer's side. Two incidents this guards against:
-#
-# - 5.38.0 shipped an unsatisfiable Requires-Dist (cryptography==50.0.0 while
-#   alibabacloud-tea-openapi and pyopenssl cap it below 49). A [tool.uv] override hid
-#   the conflict inside the repo; pip could not install the wheel and silently
-#   resolved `pip install prowler` to 5.37.1 for a week.
-# - 5.39.0 never published: an unpinned build backend started emitting core metadata
-#   2.5 and the twine bundled in the publish action rejected it.
-#
-# Both were only detectable at release time because nothing built and installed the
-# artifact earlier. The weekly run also catches releases yanked from PyPI after we
-# pinned them (zstd 1.5.7.3, "buggy - not thread safe", sat in uv.lock for months).
-
-on:
-  push:
-    branches:
-      - 'master'
-      - 'v5.*'
-  pull_request:
-    branches:
-      - 'master'
-      - 'v5.*'
-  schedule:
-    # Monday 06:00 UTC. Yanks and upstream releases happen without a commit here.
-    - cron: '0 6 * * 1'
-  workflow_dispatch:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-permissions: {}
-
-env:
-  # Must equal the twine bundled in the pypa/gh-action-pypi-publish pin used by
-  # sdk-pypi-release.yml (requirements/runtime.txt in that repo at the pinned tag).
-  # A metadata check that passes here must pass there.
-  TWINE_VERSION: '7.0.0'
-
-jobs:
-  changes:
-    if: github.repository == 'prowler-cloud/prowler'
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    permissions:
-      contents: read
-    outputs:
-      # Scheduled and manual runs always execute; pushes and PRs only when a packaging
-      # input changed. Jobs skipped this way still report success to branch protection.
-      run: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || steps.filter.outputs.any_changed == 'true' }}
-
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: block
-          allowed-endpoints: >
-            github.com:443
-            api.github.com:443
-
-      - name: Checkout repository
-        if: github.event_name == 'push' || github.event_name == 'pull_request'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          # zizmor: ignore[artipacked]
-          persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
-
-      - name: Detect packaging changes
-        if: github.event_name == 'push' || github.event_name == 'pull_request'
-        id: filter
-        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
-        with:
-          files: |
-            pyproject.toml
-            uv.lock
-            README.md
-            util/replicate_pypi_package.py
-            util/check_yanked_pins.py
-            api/pyproject.toml
-            api/uv.lock
-            mcp_server/pyproject.toml
-            mcp_server/uv.lock
-            .github/workflows/sdk-package-checks.yml
-            .github/workflows/sdk-pypi-release.yml
-            .github/actions/setup-python-uv/**
-
-  install-from-wheel:
-    needs: changes
-    if: needs.changes.outputs.run == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    permissions:
-      contents: read
-    strategy:
-      fail-fast: false
-      matrix:
-        python-version:
-          - '3.10'
-          - '3.11'
-          - '3.12'
-          - '3.13'
-        package:
-          - 'prowler'
-        include:
-          # prowler-cloud is the same tree renamed by util/replicate_pypi_package.py;
-          # one Python is enough to prove the rename and its build still work.
-          - python-version: '3.12'
-            package: 'prowler-cloud'
-
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: block
-          allowed-endpoints: >
-            github.com:443
-            api.github.com:443
-            release-assets.githubusercontent.com:443
-            pypi.org:443
-            files.pythonhosted.org:443
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
-      - name: Setup Python with uv
-        uses: ./.github/actions/setup-python-uv
-        with:
-          python-version: ${{ matrix.python-version }}
-          install-dependencies: 'false'
-
-      - name: Rename package to prowler-cloud
-        if: matrix.package == 'prowler-cloud'
-        run: |
-          pip install --no-cache-dir toml
-          python util/replicate_pypi_package.py
-
-      - name: Build sdist and wheel
-        run: uv build
-
-      - name: Check metadata with the release workflow's twine
-        run: uvx --from "twine==${TWINE_VERSION}" twine check --strict dist/*
-
-      - name: Install the wheel with pip into a clean virtualenv
-        # Plain pip, --isolated, from outside the repo: consumers never see [tool.uv]
-        # override-dependencies or constraint-dependencies, so neither does this step.
-        run: |
-          python -m venv "${RUNNER_TEMP}/consumer"
-          "${RUNNER_TEMP}/consumer/bin/python" -m pip install --quiet --upgrade pip
-          cd "${RUNNER_TEMP}"
-          "${RUNNER_TEMP}/consumer/bin/python" -m pip install --isolated --no-cache-dir "${GITHUB_WORKSPACE}"/dist/*.whl
-
-      - name: Smoke test the installed CLI
-        run: |
-          cd "${RUNNER_TEMP}"
-          "${RUNNER_TEMP}/consumer/bin/prowler" --version
-          # Loads every AWS check module from the installed wheel: catches files missing
-          # from the package. grep fails the step if the summary line never appears.
-          "${RUNNER_TEMP}/consumer/bin/prowler" aws --list-checks | grep 'available checks'
-
-  pinned-releases-not-yanked:
-    needs: changes
-    if: needs.changes.outputs.run == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: read
-
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: block
-          allowed-endpoints: >
-            github.com:443
-            api.github.com:443
-            release-assets.githubusercontent.com:443
-            pypi.org:443
-            files.pythonhosted.org:443
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
-      - name: Set up Python
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
-        with:
-          python-version: '3.12'
-
-      - name: Check every pinned and locked release against PyPI
-        run: python util/check_yanked_pins.py . api mcp_server
@@ -84,18 +84,8 @@ jobs:
      - name: Build Prowler package
        run: uv build

-      - name: Verify the wheel installs with pip
-        # Same check as "SDK: Package Checks", repeated on the exact artifact about to be
-        # published. Plain pip, --isolated, from outside the repo: an unsatisfiable
-        # Requires-Dist fails here instead of on users' machines (5.38.0 shipped one).
-        run: |
-          python -m venv "${RUNNER_TEMP}/consumer"
-          "${RUNNER_TEMP}/consumer/bin/python" -m pip install --quiet --upgrade pip
-          cd "${RUNNER_TEMP}"
-          "${RUNNER_TEMP}/consumer/bin/python" -m pip install --isolated --no-cache-dir --dry-run "${GITHUB_WORKSPACE}"/dist/*.whl
-
      - name: Publish Prowler package to PyPI
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
        with:
          print-hash: true

@@ -138,17 +128,7 @@ jobs:
      - name: Build prowler-cloud package
        run: uv build

-      - name: Verify the wheel installs with pip
-        # Same check as "SDK: Package Checks", repeated on the exact artifact about to be
-        # published. Plain pip, --isolated, from outside the repo: an unsatisfiable
-        # Requires-Dist fails here instead of on users' machines (5.38.0 shipped one).
-        run: |
-          python -m venv "${RUNNER_TEMP}/consumer"
-          "${RUNNER_TEMP}/consumer/bin/python" -m pip install --quiet --upgrade pip
-          cd "${RUNNER_TEMP}"
-          "${RUNNER_TEMP}/consumer/bin/python" -m pip install --isolated --no-cache-dir --dry-run "${GITHUB_WORKSPACE}"/dist/*.whl
-
      - name: Publish prowler-cloud package to PyPI
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
        with:
          print-hash: true
@@ -44,10 +44,7 @@ jobs:
          cache: 'pip'

      - name: Install dependencies
-        # Pinned to the versions in pyproject.toml: the ISO partitions region
-        # data comes from the endpoints.json bundled with botocore, so the
-        # botocore version is itself a data source and must be deterministic
-        run: pip install boto3==1.40.61 botocore==1.40.61
+        run: pip install boto3

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
@@ -76,7 +76,7 @@ jobs:

            ### Changes

-            This PR updates the `OCI_COMMERCIAL_REGIONS` dictionary in `prowler/providers/oraclecloud/config.py` and the matching list in `ui/lib/provider-credentials/oci-regions.ts` with the latest regions fetched from the OCI Identity API (`list_regions()`).
+            This PR updates the `OCI_COMMERCIAL_REGIONS` dictionary in `prowler/providers/oraclecloud/config.py` with the latest regions fetched from the OCI Identity API (`list_regions()`).

            - Government regions (`OCI_GOVERNMENT_REGIONS`) are preserved unchanged
            - DOD regions (`OCI_US_DOD_REGIONS`) are preserved unchanged
@@ -216,8 +216,7 @@ jobs:
          elif [ -z "${STEPS_AWS_SERVICES_OUTPUTS_SERVICE_PATHS}" ]; then
            echo "No AWS service paths detected; skipping AWS tests."
          else
-            read -ra service_paths <<< "${STEPS_AWS_SERVICES_OUTPUTS_SERVICE_PATHS}"
-            uv run pytest -n auto --cov=./prowler/providers/aws --cov-report=xml:aws_coverage.xml "${service_paths[@]}"
+            uv run pytest -n auto --cov=./prowler/providers/aws --cov-report=xml:aws_coverage.xml ${STEPS_AWS_SERVICES_OUTPUTS_SERVICE_PATHS}
          fi
        env:
          STEPS_AWS_SERVICES_OUTPUTS_RUN_ALL: ${{ steps.aws-services.outputs.run_all }}
@@ -57,7 +57,6 @@ jobs:
          egress-policy: block
          allowed-endpoints: >
            github.com:443
-            release-assets.githubusercontent.com:443
            pypi.org:443
            files.pythonhosted.org:443

@@ -85,8 +84,7 @@ jobs:
          echo "Changed files:"
          echo "${STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES}" | tr ' ' '\n'
          echo ""
-          read -ra changed <<< "${STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES}"
-          python .github/scripts/test-impact.py "${changed[@]}"
+          python .github/scripts/test-impact.py ${STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES}
        env:
          STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }}

@@ -94,21 +92,21 @@ jobs:
        id: set-flags
        run: |
          if [[ -n "${STEPS_IMPACT_OUTPUTS_SDK_TESTS}" ]]; then
-            echo "has-sdk-tests=true" >> "$GITHUB_OUTPUT"
+            echo "has-sdk-tests=true" >> $GITHUB_OUTPUT
          else
-            echo "has-sdk-tests=false" >> "$GITHUB_OUTPUT"
+            echo "has-sdk-tests=false" >> $GITHUB_OUTPUT
          fi

          if [[ -n "${STEPS_IMPACT_OUTPUTS_API_TESTS}" ]]; then
-            echo "has-api-tests=true" >> "$GITHUB_OUTPUT"
+            echo "has-api-tests=true" >> $GITHUB_OUTPUT
          else
-            echo "has-api-tests=false" >> "$GITHUB_OUTPUT"
+            echo "has-api-tests=false" >> $GITHUB_OUTPUT
          fi

          if [[ -n "${STEPS_IMPACT_OUTPUTS_UI_E2E}" ]]; then
-            echo "has-ui-e2e=true" >> "$GITHUB_OUTPUT"
+            echo "has-ui-e2e=true" >> $GITHUB_OUTPUT
          else
-            echo "has-ui-e2e=false" >> "$GITHUB_OUTPUT"
+            echo "has-ui-e2e=false" >> $GITHUB_OUTPUT
          fi
        env:
          STEPS_IMPACT_OUTPUTS_SDK_TESTS: ${{ steps.impact.outputs.sdk-tests }}
@@ -117,22 +115,22 @@ jobs:

      - name: Summary
        run: |
-          echo "## Test Impact Analysis" >> "$GITHUB_STEP_SUMMARY"
-          echo "" >> "$GITHUB_STEP_SUMMARY"
+          echo "## Test Impact Analysis" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY

          if [[ "${STEPS_IMPACT_OUTPUTS_RUN_ALL}" == "true" ]]; then
-            echo "🚨 **Critical path changed - running ALL tests**" >> "$GITHUB_STEP_SUMMARY"
+            echo "🚨 **Critical path changed - running ALL tests**" >> $GITHUB_STEP_SUMMARY
          else
-            echo "### Affected Modules" >> "$GITHUB_STEP_SUMMARY"
-            echo "\`${STEPS_IMPACT_OUTPUTS_MODULES}\`" >> "$GITHUB_STEP_SUMMARY"
-            echo "" >> "$GITHUB_STEP_SUMMARY"
+            echo "### Affected Modules" >> $GITHUB_STEP_SUMMARY
+            echo "\`${STEPS_IMPACT_OUTPUTS_MODULES}\`" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY

-            echo "### Tests to Run" >> "$GITHUB_STEP_SUMMARY"
-            echo "| Category | Paths |" >> "$GITHUB_STEP_SUMMARY"
-            echo "|----------|-------|" >> "$GITHUB_STEP_SUMMARY"
-            echo "| SDK Tests | \`${STEPS_IMPACT_OUTPUTS_SDK_TESTS:-none}\` |" >> "$GITHUB_STEP_SUMMARY"
-            echo "| API Tests | \`${STEPS_IMPACT_OUTPUTS_API_TESTS:-none}\` |" >> "$GITHUB_STEP_SUMMARY"
-            echo "| UI E2E | \`${STEPS_IMPACT_OUTPUTS_UI_E2E:-none}\` |" >> "$GITHUB_STEP_SUMMARY"
+            echo "### Tests to Run" >> $GITHUB_STEP_SUMMARY
+            echo "| Category | Paths |" >> $GITHUB_STEP_SUMMARY
+            echo "|----------|-------|" >> $GITHUB_STEP_SUMMARY
+            echo "| SDK Tests | \`${STEPS_IMPACT_OUTPUTS_SDK_TESTS:-none}\` |" >> $GITHUB_STEP_SUMMARY
+            echo "| API Tests | \`${STEPS_IMPACT_OUTPUTS_API_TESTS:-none}\` |" >> $GITHUB_STEP_SUMMARY
+            echo "| UI E2E | \`${STEPS_IMPACT_OUTPUTS_UI_E2E:-none}\` |" >> $GITHUB_STEP_SUMMARY
          fi

        env:
@@ -41,20 +41,17 @@ jobs:
    timeout-minutes: 5
    outputs:
      short-sha: ${{ steps.set-short-sha.outputs.short-sha }}
-      created: ${{ steps.set-short-sha.outputs.created }}
    permissions:
      contents: read
    steps:
-      - name: Harden Runner
+      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
-          egress-policy: block
+          egress-policy: audit

      - name: Calculate short SHA
        id: set-short-sha
-        run: |
-          echo "short-sha=${GITHUB_SHA::7}" >> "${GITHUB_OUTPUT}"
-          echo "created=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "${GITHUB_OUTPUT}"
+        run: echo "short-sha=${GITHUB_SHA::7}" >> $GITHUB_OUTPUT

  notify-release-started:
    if: github.repository == 'prowler-cloud/prowler' && (github.event_name == 'release' || github.event_name == 'workflow_dispatch')
@@ -114,15 +111,15 @@ jobs:
        with:
          egress-policy: block
          allowed-endpoints: >
+            registry-1.docker.io:443
+            production.cloudflare.docker.com:443
+            production.cloudfront.docker.com:443
            auth.docker.io:443
+            registry.npmjs.org:443
            dl-cdn.alpinelinux.org:443
            fonts.googleapis.com:443
            fonts.gstatic.com:443
            github.com:443
-            production.cloudflare.docker.com:443
-            production.cloudfront.docker.com:443
-            registry-1.docker.io:443
-            registry.npmjs.org:443

      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -147,20 +144,9 @@ jobs:
          build-args: |
            NEXT_PUBLIC_PROWLER_RELEASE_VERSION=${{ (github.event_name == 'release' || github.event_name == 'workflow_dispatch') && format('v{0}', env.RELEASE_TAG) || needs.setup.outputs.short-sha }}
          push: true
-          sbom: true
-          # max, not the default min: min records little beyond the build ref.
-          provenance: mode=max
          platforms: ${{ matrix.platform }}
          tags: |
            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ needs.setup.outputs.short-sha }}-${{ matrix.arch }}
-          labels: |
-            org.opencontainers.image.title=Prowler Local Server UI
-            org.opencontainers.image.description=Web UI for Prowler Local Server (Next.js)
-            org.opencontainers.image.vendor=ProwlerPro, Inc.
-            org.opencontainers.image.source=https://github.com/${{ github.repository }}
-            org.opencontainers.image.revision=${{ github.sha }}
-            org.opencontainers.image.created=${{ needs.setup.outputs.created }}
-            ${{ (github.event_name == 'release' || github.event_name == 'workflow_dispatch') && format('org.opencontainers.image.version={0}', env.RELEASE_TAG) || '' }}
          cache-from: type=gha,scope=${{ matrix.arch }}
          cache-to: type=gha,mode=${{ github.event_name == 'pull_request' && 'min' || 'max' }},scope=${{ matrix.arch }}

@@ -178,12 +164,12 @@ jobs:
        with:
          egress-policy: block
          allowed-endpoints: >
-            auth.docker.io:443
            github.com:443
+            release-assets.githubusercontent.com:443
+            registry-1.docker.io:443
+            auth.docker.io:443
            production.cloudflare.docker.com:443
            production.cloudfront.docker.com:443
-            registry-1.docker.io:443
-            release-assets.githubusercontent.com:443

      - name: Login to DockerHub
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
@@ -196,9 +182,9 @@ jobs:
        run: |
          docker buildx imagetools create \
            -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ env.LATEST_TAG }} \
-            -t "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}" \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64" \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64"
+            -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA} \
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64 \
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64
        env:
          NEEDS_SETUP_OUTPUTS_SHORT_SHA: ${{ needs.setup.outputs.short-sha }}

@@ -206,10 +192,10 @@ jobs:
        if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
        run: |
          docker buildx imagetools create \
-            -t "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${RELEASE_TAG}" \
+            -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${RELEASE_TAG} \
            -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ env.STABLE_TAG }} \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64" \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64"
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64 \
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64
        env:
          NEEDS_SETUP_OUTPUTS_SHORT_SHA: ${{ needs.setup.outputs.short-sha }}

@@ -249,9 +235,9 @@ jobs:
        id: outcome
        run: |
          if [[ "${NEEDS_CONTAINER_BUILD_PUSH_RESULT}" == "success" && "${NEEDS_CREATE_MANIFEST_RESULT}" == "success" ]]; then
-            echo "outcome=success" >> "$GITHUB_OUTPUT"
+            echo "outcome=success" >> $GITHUB_OUTPUT
          else
-            echo "outcome=failure" >> "$GITHUB_OUTPUT"
+            echo "outcome=failure" >> $GITHUB_OUTPUT
          fi
        env:
          NEEDS_CONTAINER_BUILD_PUSH_RESULT: ${{ needs.container-build-push.result }}
@@ -88,9 +88,6 @@ jobs:
            get.trivy.dev:443
            release-assets.githubusercontent.com:443
            objects.githubusercontent.com:443
-            raw.githubusercontent.com:443
-            grype.anchore.io:443
-            get.anchore.io:443

      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -102,13 +99,7 @@ jobs:
        id: check-changes
        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
        with:
-          files: |
-            ui/**
-            .trivyignore.yaml
-            .github/actions/trivy-scan/**
-            .github/actions/grype-scan/**
-            .grype.yaml
-            .github/scripts/grype-pr-comment.js
+          files: ui/**
          files_ignore: |
            ui/CHANGELOG.md
            ui/changelog.d/**
@@ -139,13 +130,5 @@ jobs:
        with:
          image-name: ${{ env.IMAGE_NAME }}
          image-tag: ${{ github.sha }}
-          fail-on-severity: 'high'
-          severity: 'CRITICAL,HIGH'
-
-      - name: Scan UI container with Grype
-        if: steps.check-changes.outputs.any_changed == 'true'
-        uses: ./.github/actions/grype-scan
-        with:
-          image-name: ${{ env.IMAGE_NAME }}
-          image-tag: ${{ github.sha }}
-          fail-on-severity: 'high'
+          fail-on-critical: 'true'
+          severity: 'CRITICAL'
@@ -10,13 +10,12 @@ on:
      - master
      - "v5.*"
    paths:
-      - ".github/workflows/ui-e2e-tests-v2.yml"
-      - ".github/workflows/test-impact-analysis.yml"
-      - ".github/test-impact.yml"
-      - "ui/**"
-      - "api/**" # API changes can affect UI E2E
-      - "!ui/CHANGELOG.md"
-      - "!api/CHANGELOG.md"
+      - '.github/workflows/ui-e2e-tests-v2.yml'
+      - '.github/test-impact.yml'
+      - 'ui/**'
+      - 'api/**'  # API changes can affect UI E2E
+      - '!ui/CHANGELOG.md'
+      - '!api/CHANGELOG.md'

 concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -37,15 +36,14 @@ jobs:
    needs: impact-analysis
    if: |
      github.repository == 'prowler-cloud/prowler' &&
-      (github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false) &&
      (needs.impact-analysis.outputs.has-ui-e2e == 'true' || needs.impact-analysis.outputs.run-all == 'true')
    runs-on: ubuntu-latest
    env:
-      AUTH_SECRET: "fallback-ci-secret-for-testing"
+      AUTH_SECRET: 'fallback-ci-secret-for-testing'
      AUTH_TRUST_HOST: true
-      NEXTAUTH_URL: "http://localhost:3000"
-      AUTH_URL: "http://localhost:3000"
-      UI_API_BASE_URL: "http://localhost:8080/api/v1"
+      NEXTAUTH_URL: 'http://localhost:3000'
+      AUTH_URL: 'http://localhost:3000'
+      UI_API_BASE_URL: 'http://localhost:8080/api/v1'
      E2E_ADMIN_USER: ${{ secrets.E2E_ADMIN_USER }}
      E2E_ADMIN_PASSWORD: ${{ secrets.E2E_ADMIN_PASSWORD }}
      E2E_AWS_PROVIDER_ACCOUNT_ID: ${{ secrets.E2E_AWS_PROVIDER_ACCOUNT_ID }}
@@ -61,7 +59,7 @@ jobs:
      E2E_M365_SECRET_ID: ${{ secrets.E2E_M365_SECRET_ID }}
      E2E_M365_TENANT_ID: ${{ secrets.E2E_M365_TENANT_ID }}
      E2E_M365_CERTIFICATE_CONTENT: ${{ secrets.E2E_M365_CERTIFICATE_CONTENT }}
-      E2E_KUBERNETES_CONTEXT: "kind-kind"
+      E2E_KUBERNETES_CONTEXT: 'kind-kind'
      E2E_KUBERNETES_KUBECONFIG_PATH: /home/runner/.kube/config
      E2E_GCP_BASE64_SERVICE_ACCOUNT_KEY: ${{ secrets.E2E_GCP_BASE64_SERVICE_ACCOUNT_KEY }}
      E2E_GCP_PROJECT_ID: ${{ secrets.E2E_GCP_PROJECT_ID }}
@@ -109,115 +107,17 @@ jobs:

      - name: Show test scope
        run: |
-          echo "## E2E Test Scope" >> "$GITHUB_STEP_SUMMARY"
+          echo "## E2E Test Scope" >> $GITHUB_STEP_SUMMARY
          if [[ "${RUN_ALL_TESTS}" == "true" ]]; then
-            echo "Running **ALL** E2E tests (critical path changed)" >> "$GITHUB_STEP_SUMMARY"
+            echo "Running **ALL** E2E tests (critical path changed)" >> $GITHUB_STEP_SUMMARY
          else
-            echo "Running tests matching: \`${E2E_TEST_PATHS}\`" >> "$GITHUB_STEP_SUMMARY"
+            echo "Running tests matching: \`${E2E_TEST_PATHS}\`" >> $GITHUB_STEP_SUMMARY
          fi
          echo ""
-          echo "Affected modules: \`${NEEDS_IMPACT_ANALYSIS_OUTPUTS_MODULES}\`" >> "$GITHUB_STEP_SUMMARY"
+          echo "Affected modules: \`${NEEDS_IMPACT_ANALYSIS_OUTPUTS_MODULES}\`" >> $GITHUB_STEP_SUMMARY
        env:
          NEEDS_IMPACT_ANALYSIS_OUTPUTS_MODULES: ${{ needs.impact-analysis.outputs.modules }}

-      - name: Validate E2E prerequisites
-        shell: bash
-        run: |
-          declare -A required=()
-
-          suite_selected() {
-            [[ "${RUN_ALL_TESTS}" == "true" ]] ||
-              [[ " ${E2E_TEST_PATHS} " == *"ui/tests/$1/"* ]]
-          }
-
-          require_vars() {
-            local variable
-            for variable in "$@"; do
-              required["${variable}"]=1
-            done
-          }
-
-          if suite_selected auth || suite_selected providers ||
-            suite_selected invitations || suite_selected scans ||
-            suite_selected navigation; then
-            require_vars E2E_ADMIN_USER E2E_ADMIN_PASSWORD
-          fi
-
-          if suite_selected sign-up; then
-            require_vars E2E_NEW_USER_PASSWORD
-          fi
-
-          if suite_selected invitations; then
-            require_vars E2E_NEW_USER_PASSWORD E2E_ORGANIZATION_ID
-          fi
-
-          if suite_selected scans; then
-            require_vars \
-              E2E_AWS_PROVIDER_ACCOUNT_ID \
-              E2E_AWS_PROVIDER_ACCESS_KEY \
-              E2E_AWS_PROVIDER_SECRET_KEY
-          fi
-
-          if suite_selected providers; then
-            require_vars \
-              E2E_AWS_PROVIDER_ACCOUNT_ID \
-              E2E_AWS_PROVIDER_ACCESS_KEY \
-              E2E_AWS_PROVIDER_SECRET_KEY \
-              E2E_AWS_PROVIDER_ROLE_ARN \
-              E2E_AZURE_SUBSCRIPTION_ID \
-              E2E_AZURE_CLIENT_ID \
-              E2E_AZURE_SECRET_ID \
-              E2E_AZURE_TENANT_ID \
-              E2E_M365_DOMAIN_ID \
-              E2E_M365_CLIENT_ID \
-              E2E_M365_SECRET_ID \
-              E2E_M365_TENANT_ID \
-              E2E_M365_CERTIFICATE_CONTENT \
-              E2E_GCP_BASE64_SERVICE_ACCOUNT_KEY \
-              E2E_GCP_PROJECT_ID \
-              E2E_GITHUB_APP_ID \
-              E2E_GITHUB_BASE64_APP_PRIVATE_KEY \
-              E2E_GITHUB_USERNAME \
-              E2E_GITHUB_PERSONAL_ACCESS_TOKEN \
-              E2E_GITHUB_ORGANIZATION \
-              E2E_GITHUB_ORGANIZATION_ACCESS_TOKEN \
-              E2E_OCI_TENANCY_ID \
-              E2E_OCI_USER_ID \
-              E2E_OCI_FINGERPRINT \
-              E2E_OCI_KEY_CONTENT \
-              E2E_ALIBABACLOUD_ACCOUNT_ID \
-              E2E_ALIBABACLOUD_ACCESS_KEY_ID \
-              E2E_ALIBABACLOUD_ACCESS_KEY_SECRET \
-              E2E_ALIBABACLOUD_ROLE_ARN \
-              E2E_OKTA_DOMAIN \
-              E2E_OKTA_CLIENT_ID \
-              E2E_OKTA_BASE64_PRIVATE_KEY \
-              E2E_GOOGLEWORKSPACE_CUSTOMER_ID \
-              E2E_GOOGLEWORKSPACE_SERVICE_ACCOUNT_JSON \
-              E2E_GOOGLEWORKSPACE_DELEGATED_USER \
-              E2E_VERCEL_TEAM_ID \
-              E2E_VERCEL_API_TOKEN
-          fi
-
-          missing=()
-          if (( ${#required[@]} > 0 )); then
-            while IFS= read -r variable; do
-              [[ -z "${!variable:-}" ]] && missing+=("${variable}")
-            done < <(printf '%s\n' "${!required[@]}" | sort)
-          fi
-
-          if (( ${#missing[@]} > 0 )); then
-            echo "Missing required E2E variables:"
-            printf ' - %s\n' "${missing[@]}"
-            {
-              echo "## Missing E2E prerequisites"
-              printf -- "- \`%s\`\n" "${missing[@]}"
-            } >> "${GITHUB_STEP_SUMMARY}"
-            exit 1
-          fi
-
-          echo "E2E prerequisite preflight passed."
-
      - name: Create k8s Kind Cluster
        uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1
        with:
@@ -234,12 +134,12 @@ jobs:
          yq -i '.services.worker.networks = ["kind","default"]' docker-compose.yml

      - name: Fix API data directory permissions
-        run: docker run --rm -v "$(pwd)/_data/api:/data" alpine chown -R 1000:1000 /data
+        run: docker run --rm -v $(pwd)/_data/api:/data alpine chown -R 1000:1000 /data

      - name: Add AWS credentials for testing
        run: |
-          echo "AWS_ACCESS_KEY_ID=${E2E_AWS_PROVIDER_ACCESS_KEY}" >> .env
-          echo "AWS_SECRET_ACCESS_KEY=${E2E_AWS_PROVIDER_SECRET_KEY}" >> .env
+          echo "AWS_ACCESS_KEY_ID=${{ secrets.E2E_AWS_PROVIDER_ACCESS_KEY }}" >> .env
+          echo "AWS_SECRET_ACCESS_KEY=${{ secrets.E2E_AWS_PROVIDER_SECRET_KEY }}" >> .env

      - name: Build API image from current code
        # docker-compose.yml references prowlercloud/prowler-api:latest from the registry,
@@ -268,7 +168,7 @@ jobs:
          timeout=150
          elapsed=0
          while [ $elapsed -lt $timeout ]; do
-            if curl -s "${UI_API_BASE_URL}/docs" >/dev/null 2>&1; then
+            if curl -s ${UI_API_BASE_URL}/docs >/dev/null 2>&1; then
              echo "Prowler API is ready!"
              exit 0
            fi
@@ -293,7 +193,7 @@ jobs:
      - name: Setup Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
-          node-version-file: "ui/.nvmrc"
+          node-version-file: 'ui/.nvmrc'

      - name: Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
@@ -302,7 +202,7 @@ jobs:
          run_install: false

      - name: Get pnpm store directory
-        run: echo "STORE_PATH=$(pnpm store path --silent)" >> "$GITHUB_ENV"
+        run: echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV

      - name: Setup pnpm and Next.js cache
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
@@ -338,59 +238,59 @@ jobs:
        if: steps.playwright-cache.outputs.cache-hit != 'true'
        run: pnpm run test:e2e:install

-      - name: Run standard E2E tests
-        id: standard-e2e
+      - name: Run E2E tests
        working-directory: ./ui
        run: |
          if [[ "${RUN_ALL_TESTS}" == "true" ]]; then
-            echo "Running all standard E2E tests..."
+            echo "Running ALL E2E tests..."
            pnpm run test:e2e
          else
-            echo "Running targeted standard E2E tests: ${E2E_TEST_PATHS}"
+            echo "Running targeted E2E tests: ${E2E_TEST_PATHS}"
+            # Convert glob patterns to playwright test paths
+            # e.g., "ui/tests/providers/**" -> "tests/providers"
            TEST_PATHS="${E2E_TEST_PATHS}"
+            # Remove ui/ prefix and convert ** to empty (playwright handles recursion)
            TEST_PATHS=$(echo "$TEST_PATHS" | sed 's|ui/||g' | sed 's|\*\*||g' | tr ' ' '\n' | sort -u)
-            TEST_PATHS=$(echo "$TEST_PATHS" | grep -vE '^tests/(setups|registry)/' || true)
-
+            # Drop auth setup helpers (not runnable test suites)
+            TEST_PATHS=$(echo "$TEST_PATHS" | grep -v '^tests/setups/')
+            # Safety net: if bare "tests/" appears (from broad patterns like ui/tests/**),
+            # expand to specific subdirs to avoid Playwright discovering setup files
            if echo "$TEST_PATHS" | grep -qx 'tests/'; then
+              echo "Expanding bare 'tests/' to specific subdirs (excluding setups)..."
              SPECIFIC_DIRS=""
              for dir in tests/*/; do
-                [[ "$dir" == "tests/setups/" || "$dir" == "tests/registry/" ]] && continue
+                [[ "$dir" == "tests/setups/" ]] && continue
                SPECIFIC_DIRS="${SPECIFIC_DIRS}${dir}"$'\n'
              done
-              TEST_PATHS=$(echo "$TEST_PATHS" | grep -vx 'tests/' || true)
+              # Replace "tests/" with specific dirs, keep other paths
+              TEST_PATHS=$(echo "$TEST_PATHS" | grep -vx 'tests/')
              TEST_PATHS="${TEST_PATHS}"$'\n'"${SPECIFIC_DIRS}"
              TEST_PATHS=$(echo "$TEST_PATHS" | grep -v '^$' | sort -u)
            fi
-
+            if [[ -z "$TEST_PATHS" ]]; then
+              echo "No runnable E2E test paths after filtering setups"
+              exit 0
+            fi
+            # Filter out directories that don't contain any test files
            VALID_PATHS=""
-            while IFS= read -r path; do
-              [[ -z "$path" ]] && continue
-              if find "$path" -name '*.spec.ts' -o -name '*.test.ts' 2>/dev/null | head -1 | grep -q .; then
-                VALID_PATHS="${VALID_PATHS}${path}"$'\n'
+            while IFS= read -r p; do
+              [[ -z "$p" ]] && continue
+              if find "$p" -name '*.spec.ts' -o -name '*.test.ts' 2>/dev/null | head -1 | grep -q .; then
+                VALID_PATHS="${VALID_PATHS}${p}"$'\n'
              else
-                echo "Skipping empty test directory: $path"
+                echo "Skipping empty test directory: $p"
              fi
            done <<< "$TEST_PATHS"
            VALID_PATHS=$(echo "$VALID_PATHS" | grep -v '^$' || true)
-
-            if [[ -n "$VALID_PATHS" ]]; then
-              TEST_PATHS=$(echo "$VALID_PATHS" | tr '\n' ' ')
-              echo "Resolved standard test paths: $TEST_PATHS"
-              read -ra test_paths <<< "$TEST_PATHS"
-              pnpm exec playwright test "${test_paths[@]}"
-            else
-              echo "No standard E2E test paths selected."
+            if [[ -z "$VALID_PATHS" ]]; then
+              echo "No test files found in any resolved paths — skipping E2E"
+              exit 0
            fi
+            TEST_PATHS=$(echo "$VALID_PATHS" | tr '\n' ' ')
+            echo "Resolved test paths: $TEST_PATHS"
+            pnpm exec playwright test $TEST_PATHS
          fi

-      - name: Run Registry fixture E2E tests
-        if: |
-          !cancelled() &&
-          (steps.standard-e2e.outcome == 'success' || steps.standard-e2e.outcome == 'failure') &&
-          (env.RUN_ALL_TESTS == 'true' || contains(format(' {0} ', env.E2E_TEST_PATHS), ' ui/tests/registry/'))
-        working-directory: ./ui
-        run: pnpm run test:e2e:registry
-
      - name: Upload test reports
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        if: failure()
@@ -404,29 +304,6 @@ jobs:
        run: |
          docker compose down -v || true

-  # Fork pull requests cannot access the secrets required by the E2E suites.
-  fork-e2e-unavailable:
-    needs: impact-analysis
-    if: |
-      github.repository == 'prowler-cloud/prowler' &&
-      github.event_name == 'pull_request' &&
-      github.event.pull_request.head.repo.fork == true &&
-      (needs.impact-analysis.outputs.has-ui-e2e == 'true' || needs.impact-analysis.outputs.run-all == 'true')
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-
-      - name: Report unavailable E2E tests
-        run: |
-          echo "## E2E Tests Skipped" >> "$GITHUB_STEP_SUMMARY"
-          echo "" >> "$GITHUB_STEP_SUMMARY"
-          echo "UI E2E tests require repository secrets and cannot run for fork pull requests." >> "$GITHUB_STEP_SUMMARY"
-
  # Skip job - provides clear feedback when no E2E tests needed
  skip-e2e:
    needs: impact-analysis
@@ -445,12 +322,12 @@ jobs:

      - name: No E2E tests needed
        run: |
-          echo "## E2E Tests Skipped" >> "$GITHUB_STEP_SUMMARY"
-          echo "" >> "$GITHUB_STEP_SUMMARY"
-          echo "No UI E2E tests needed for this change." >> "$GITHUB_STEP_SUMMARY"
-          echo "" >> "$GITHUB_STEP_SUMMARY"
-          echo "Affected modules: \`${NEEDS_IMPACT_ANALYSIS_OUTPUTS_MODULES}\`" >> "$GITHUB_STEP_SUMMARY"
-          echo "" >> "$GITHUB_STEP_SUMMARY"
-          echo "To run all tests, modify a file in a critical path (e.g., \`ui/lib/**\`)." >> "$GITHUB_STEP_SUMMARY"
+          echo "## E2E Tests Skipped" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "No UI E2E tests needed for this change." >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "Affected modules: \`${NEEDS_IMPACT_ANALYSIS_OUTPUTS_MODULES}\`" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "To run all tests, modify a file in a critical path (e.g., \`ui/lib/**\`)." >> $GITHUB_STEP_SUMMARY
        env:
          NEEDS_IMPACT_ANALYSIS_OUTPUTS_MODULES: ${{ needs.impact-analysis.outputs.modules }}
@@ -113,7 +113,7 @@ jobs:
      - name: Get pnpm store directory
        if: steps.check-changes.outputs.any_changed == 'true'
        shell: bash
-        run: echo "STORE_PATH=$(pnpm store path --silent)" >> "$GITHUB_ENV"
+        run: echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV

      - name: Setup pnpm and Next.js cache
        if: steps.check-changes.outputs.any_changed == 'true'
@@ -157,8 +157,7 @@ jobs:
          echo "${STEPS_CHANGED_SOURCE_OUTPUTS_ALL_CHANGED_FILES}"
          # Convert space-separated to vitest related format (remove ui/ prefix for relative paths)
          CHANGED_FILES=$(echo "${STEPS_CHANGED_SOURCE_OUTPUTS_ALL_CHANGED_FILES}" | tr ' ' '\n' | sed 's|^ui/||' | tr '\n' ' ')
-          read -ra changed <<< "$CHANGED_FILES"
-          pnpm exec vitest related "${changed[@]}" --run --project unit
+          pnpm exec vitest related $CHANGED_FILES --run --project unit
        env:
          STEPS_CHANGED_SOURCE_OUTPUTS_ALL_CHANGED_FILES: ${{ steps.changed-source.outputs.all_changed_files }}

@@ -182,9 +181,9 @@ jobs:
        if: steps.check-changes.outputs.any_changed == 'true' && steps.playwright-cache.outputs.cache-hit != 'true'
        run: pnpm exec playwright install chromium

-      - name: Run integration tests
+      - name: Run browser tests
        if: steps.check-changes.outputs.any_changed == 'true'
-        run: pnpm run test:integration
+        run: pnpm run test:browser

      - name: Build application
        if: steps.check-changes.outputs.any_changed == 'true'
@@ -173,5 +173,3 @@ GEMINI.md
 # Docker
 docker-compose.override.yml
 docker-compose-dev.override.yml
-# Local Pi runtime state
-.atl/
@@ -1,128 +0,0 @@
-# Findings excluded from the Grype gate, each with a reason.
-# Anything not listed here blocks the pull request at critical or high severity.
-# Pairs are explicit: a new CVE against an already-listed package still blocks.
-#
-# Every entry below has a published fix we cannot take. Findings with no fix at all are
-# not listed: the scan runs with only-fixed, so they never reach the gate.
-
-ignore:
-
-  # Modules compiled into the Trivy binary we ship.
-  # Only a Trivy rebuild by its vendor can change these; the version is pinned in our Dockerfile.
-  # CVE-2026-71556 is the same temporary exception documented in .trivyignore.yaml:
-  # Trivy 0.73.0 still embeds go-git 5.19.1, while the 5.19.2 fix is merged only on
-  # Trivy main. Remove this entry with the Trivy exception by 2026-09-15.
-  # https://github.com/aquasecurity/trivy/blob/v0.73.0/go.mod#L46
-  # https://github.com/aquasecurity/trivy/commit/a2edba9a03987ba0d2ebc8212c1a9a1e6979497b
-  - vulnerability: CVE-2026-71556
-    package:
-      name: github.com/go-git/go-git/v5
-  # CVE-2026-84304 is the same temporary exception documented in .trivyignore.yaml:
-  # Trivy 0.74.0 still embeds grpc 1.82.1, while the 1.83.1 fix is not in any release.
-  # Prowler only runs `trivy image` / `trivy fs`, never client/server mode, so no gRPC
-  # endpoint exists in the image. Pinned to the embedded version so the rule stops
-  # matching on its own once Trivy bumps grpc. Remove with the Trivy exception by 2026-10-15.
-  # https://github.com/aquasecurity/trivy/pull/11176
-  - vulnerability: CVE-2026-84304
-    package:
-      name: google.golang.org/grpc
-      version: v1.82.1
-  # CVE-2026-84445 is the same temporary exception documented in .trivyignore.yaml:
-  # Trivy 0.74.0 still embeds grpc 1.82.1, while the 1.82.2 / 1.83.2 fix is not in any
-  # release. The panic needs a gRPC server built with `xds.NewGRPCServer()`; Prowler only
-  # runs `trivy image` / `trivy fs`, so the image serves no gRPC at all. Pinned to the
-  # embedded version so the rule stops matching on its own once Trivy bumps grpc. Remove
-  # with the Trivy exception by 2026-10-15.
-  # https://github.com/advisories/GHSA-2v4p-qf9q-27wj
-  - vulnerability: CVE-2026-84445
-    package:
-      name: google.golang.org/grpc
-      version: v1.82.1
-  # CVE-2026-56855 / CVE-2026-78662 are the same temporary exception documented in
-  # .trivyignore.yaml: Trivy 0.74.0 still embeds golang.org/x/crypto v0.55.0, while the
-  # 0.56.0 fix (published 2026-09-02) hasn't reached any Trivy release, or even Trivy
-  # main, yet. Pinned to the embedded version so the rule stops matching on its own once
-  # Trivy bumps it. Remove with the Trivy exception by 2026-10-15.
-  - vulnerability: CVE-2026-56855
-    package:
-      name: golang.org/x/crypto
-      version: v0.55.0
-  - vulnerability: CVE-2026-78662
-    package:
-      name: golang.org/x/crypto
-      version: v0.55.0
-  - vulnerability: CVE-2026-56852
-    package:
-      name: golang.org/x/text
-  - vulnerability: GHSA-hrxh-6v49-42gf
-    package:
-      name: google.golang.org/grpc
-  - vulnerability: CVE-2026-50151
-    package:
-      name: oras.land/oras-go/v2
-
-  # Shipped inside the PowerShell tarball, in its bundled MicrosoftTeams module.
-  # Not a dependency we declare, and not one we can upgrade independently.
-  - vulnerability: CVE-2026-26127
-    package:
-      name: Microsoft.Bcl.Memory
-
-  # The .NET runtime bundled inside the PowerShell tarball the Dockerfile pins.
-  # CVE-2026-62901 is the same temporary exception documented in .trivyignore.yaml:
-  # fixed in .NET 9.0.19 / 10.0.11 (2026-08-11), but no published PowerShell release
-  # ships a patched runtime yet (7.5.9 bundles 9.0.18; 7.6.4 bundles 10.0.x < 10.0.11).
-  # pwsh runs only local M365 module cmdlets; nothing listens for inbound WebSocket
-  # connections. Remove with the Trivy exception by 2026-09-15.
-  - vulnerability: CVE-2026-62901
-    package:
-      name: Microsoft.NETCore.App.Runtime.linux-x64
-  - vulnerability: CVE-2026-62901
-    package:
-      name: Microsoft.NETCore.App.Runtime.linux-arm64
-
-
-  # The CPython interpreter, compiled into the official base image.
-  # TEMPORARY, unlike the entries above: moving to Python 3.13 clears seven of these, and
-  # that is a runtime upgrade pending its own evaluation. The remaining three need 3.15 and
-  # are unfixable either way -- the MCP image already runs 3.13.14 and still reports them.
-  - vulnerability: CVE-2026-11940
-    package:
-      name: python
-  - vulnerability: CVE-2026-11972
-    package:
-      name: python
-  - vulnerability: CVE-2026-15308
-    package:
-      name: python
-  - vulnerability: CVE-2026-3298
-    package:
-      name: python
-  - vulnerability: CVE-2026-3644
-    package:
-      name: python
-  - vulnerability: CVE-2026-4224
-    package:
-      name: python
-  - vulnerability: CVE-2026-4786
-    package:
-      name: python
-  - vulnerability: CVE-2026-6100
-    package:
-      name: python
-  - vulnerability: CVE-2026-7210
-    package:
-      name: python
-  - vulnerability: CVE-2026-9669
-    package:
-      name: python
-  # CVE-2026-82049 (tarfile data/tar filter bypass via a hard link to a symlink) has no
-  # fixed CPython release on any branch: the fix is merged on main and 3.13 only, and the
-  # 3.12 backport is still open. Grype records 3.14.0b1 as the fix, so only-fixed does not
-  # drop it, yet python:3.12.14-slim-trixie reports it too. Prowler never extracts tar
-  # archives to disk: the ECR image inspection reads members in memory with extractfile().
-  # Remove once the base image ships a 3.12 release that includes the backport.
-  # https://github.com/python/cpython/issues/157190
-  # https://github.com/python/cpython/pull/157454
-  - vulnerability: CVE-2026-82049
-    package:
-      name: python
@@ -47,14 +47,6 @@ repos:
        priority: 20

  ## GITHUB ACTIONS
-  - repo: https://github.com/rhysd/actionlint
-    rev: v1.7.12
-    hooks:
-      - id: actionlint
-        # SC2129 only suggests grouping consecutive redirects; not worth restructuring for.
-        args: ['-shellcheck=-e SC2129']
-        priority: 30
-
  - repo: https://github.com/zizmorcore/zizmor-pre-commit
    rev: v1.24.1
    hooks:
@@ -0,0 +1,109 @@
+# Trivy ignore file for prowlercloud/prowler SDK container image.
+# Each entry below documents (a) the affected package and why it ships in the
+# image, (b) why the CVE is not exploitable in Prowler's runtime, and (c) the
+# upstream fix status. Entries carry an expiry so they auto-force re-review.
+# Entries are scoped per-package so suppressions cannot drift onto unrelated
+# packages that may be assigned the same CVE in the future.
+#
+# Scanned by: .github/actions/trivy-scan via .github/workflows/sdk-container-checks.yml
+
+# CVE-2026-42496 — perl-archive-tar path traversal via crafted symlinks.
+# CVE-2026-8376  — perl heap buffer overflow when compiling regex.
+# Packages: perl, perl-base, perl-modules-5.36, libperl5.36.
+# Why ignored: perl-base is part of Debian's "Essential: yes" set; it cannot be
+# removed without breaking dpkg. The Prowler SDK does not invoke perl at runtime;
+# neither vulnerable code path (Archive::Tar parsing or regex compilation of
+# attacker-controlled input) is reachable from Prowler. No Debian bookworm fix
+# is available yet.
+CVE-2026-42496 pkg:perl exp:2026-08-15
+CVE-2026-42496 pkg:perl-base exp:2026-08-15
+CVE-2026-42496 pkg:perl-modules-5.36 exp:2026-08-15
+CVE-2026-42496 pkg:libperl5.36 exp:2026-08-15
+CVE-2026-8376 pkg:perl exp:2026-08-15
+CVE-2026-8376 pkg:perl-base exp:2026-08-15
+CVE-2026-8376 pkg:perl-modules-5.36 exp:2026-08-15
+CVE-2026-8376 pkg:libperl5.36 exp:2026-08-15
+
+# CVE-2026-13221 - Perl regex trie overflow.
+# Packages: perl, perl-base, perl-modules-5.36, libperl5.36.
+# Why ignored: upstream confirms Perl 5.36.0 is not affected; the regression
+# was introduced after this version. Debian currently marks bookworm as
+# vulnerable, which causes Trivy to report a false positive.
+# Ref: https://github.com/Perl/perl5/issues/23388
+CVE-2026-13221 pkg:perl exp:2026-08-15
+CVE-2026-13221 pkg:perl-base exp:2026-08-15
+CVE-2026-13221 pkg:perl-modules-5.36 exp:2026-08-15
+CVE-2026-13221 pkg:libperl5.36 exp:2026-08-15
+
+# CVE-2025-7458 — SQLite integer overflow.
+# Package: libsqlite3-0.
+# Why ignored: transitive dependency of CPython's stdlib sqlite3 module. The
+# Prowler SDK does not open user-supplied SQLite databases; SQLite usage is
+# internal and bounded. No Debian bookworm fix is available.
+CVE-2025-7458 pkg:libsqlite3-0 exp:2026-08-15
+
+# CVE-2026-43185 — Linux kernel ksmbd signedness bug.
+# Package: linux-libc-dev.
+# Why ignored: linux-libc-dev ships kernel headers for build-time compilation,
+# not a running kernel. Containers execute against the host kernel, so these
+# headers are inert at runtime. The upstream fix landed in kernel 7.0-rc2 and
+# has not been backported to Debian's 6.1 LTS line.
+CVE-2026-43185 pkg:linux-libc-dev exp:2026-08-15
+
+# CVE-2023-45853 — zlib MiniZip integer overflow / heap overflow in
+# zipOpenNewFileInZip4_64.
+# Packages: zlib1g, zlib1g-dev.
+# Why ignored: Debian Security Tracker status for bookworm is <ignored>, with
+# the published rationale "contrib/minizip not built and src:zlib not producing
+# binary packages" — i.e. the vulnerable symbol is not present in the libz.so
+# shipped by Debian. Real-not-affected, not unpatched. Upstream fix is in
+# zlib 1.3.1, available in Debian trixie (13); migrating the base image would
+# clear it fully.
+# Ref: https://security-tracker.debian.org/tracker/CVE-2023-45853
+CVE-2023-45853 pkg:zlib1g exp:2026-08-15
+CVE-2023-45853 pkg:zlib1g-dev exp:2026-08-15
+
+# CVE-2026-55200 — libssh2 out-of-bounds write in ssh2_transport_read() due to
+# an unchecked packet_length field in transport.c (heap corruption, possible RCE).
+# Package: libssh2-1.
+# Why ignored: libssh2-1 is pulled in only as a transitive dependency of libcurl4
+# (installed in the SDK Dockerfile for the networking/PowerShell stack). The
+# vulnerable path is reached exclusively when libssh2 acts as an SSH/SCP/SFTP
+# client parsing transport packets from a server. Prowler never uses libcurl's
+# SSH/SCP/SFTP transports; it talks to cloud provider HTTPS endpoints only, so the
+# affected code is unreachable at runtime. Fixed upstream in libssh2 commit
+# 97acf3df (PR #2052); no Debian bookworm fix is available yet.
+# Ref: https://security-tracker.debian.org/tracker/CVE-2026-55200
+CVE-2026-55200 pkg:libssh2-1 exp:2026-08-15
+
+# --- API container image (api/Dockerfile) ---
+# The entries below are specific to the Prowler API image, which ships
+# PowerShell and additional build tooling on top of the same bookworm base.
+
+# CVE-2026-7210 — CPython/Expat hash-flooding denial of service in
+# `xml.parsers.expat` and `xml.etree.ElementTree`.
+# Packages: the Debian system Python 3.11 (python3.11*, libpython3.11*).
+# Why ignored: the API runs under the Python 3.12 interpreter shipped in its
+# `.venv`; the system `python3.11` is only present because `python3-dev` is
+# pulled in to compile native extensions (xmlsec, lxml) and is never executed
+# at runtime. The vulnerable path requires parsing attacker-controlled XML with
+# the affected interpreter, which Prowler does not do with the system Python.
+# Full mitigation also needs libexpat >= 2.8.0; no Debian bookworm fix yet.
+CVE-2026-7210 pkg:python3.11 exp:2026-08-15
+CVE-2026-7210 pkg:python3.11-dev exp:2026-08-15
+CVE-2026-7210 pkg:python3.11-minimal exp:2026-08-15
+CVE-2026-7210 pkg:libpython3.11 exp:2026-08-15
+CVE-2026-7210 pkg:libpython3.11-dev exp:2026-08-15
+CVE-2026-7210 pkg:libpython3.11-minimal exp:2026-08-15
+CVE-2026-7210 pkg:libpython3.11-stdlib exp:2026-08-15
+
+# CVE-2026-33278 — Unbound DNSSEC validator use-after-free (DoS, possible RCE).
+# CVE-2026-42960 — Unbound DNS cache poisoning via promiscuous additional records.
+# Package: libunbound8.
+# Why ignored: libunbound8 is a transitive apt dependency of the TLS/networking
+# stack (GnuTLS DANE support); only the shared library ships in the image. Both
+# vulnerabilities require operating a live Unbound recursive DNSSEC validator
+# that processes attacker-influenced DNS responses. Prowler never starts an
+# Unbound resolver, so neither code path is reachable. No Debian bookworm fix yet.
+CVE-2026-33278 pkg:libunbound8 exp:2026-08-15
+CVE-2026-42960 pkg:libunbound8 exp:2026-08-15
@@ -1,212 +0,0 @@
-# Trivy suppressions for the prowlercloud/prowler SDK and API container images.
-#
-# This file replaces the classic .trivyignore, which parsed only the CVE id: the
-# `pkg:` selector written on each line was documentation and the entry suppressed
-# its CVE across every package in the image. The `purls` field below is honoured,
-# so each entry is scoped to the package it names. Verified against Trivy 0.71.2:
-# an entry given the wrong purl leaves the finding reported, where the classic
-# format suppressed it.
-#
-# `expired_at` forces re-review. Keep the dates staggered.
-#
-# The four entries below are currently redundant: the scan runs with ignore-unfixed,
-# and none of them has a published fix, so they never reach the gate either way. They
-# are kept because the reasoning is what justifies accepting them, and because they
-# apply again the moment any of them gains a fix we do not take.
-#
-# perl-base is Debian "Essential: yes". Trivy spreads src:perl CVEs across every
-# binary package built from that source, so perl-base is flagged for modules only
-# perl-modules-* ships. Neither image installs those, and nothing in either
-# invokes perl.
-#
-# Why these four are accepted rather than fixed (reviewed 2026-07-31):
-#
-#   1. No fix exists. All four report no fixed version on perl-base 5.40.1-6.
-#      Debian marks CVE-2026-42496 "fix_deferred" and the other three "affected".
-#      A newer base image, apt upgrade, or a newer Debian release changes nothing.
-#   2. The package cannot be removed. "Essential: yes" means removal needs
-#      dpkg --force-remove-essential, which breaks apt for anything built
-#      downstream from these images.
-#   3. Changing base distribution was evaluated and rejected. Alpine drops perl
-#      entirely, but PowerShell publishes no linux-musl-arm64 build in any
-#      release, so M365 scanning would break on arm64 -- which is what we run in
-#      production. Wolfi keeps glibc and drops perl, but pinnable versioned tags
-#      are a paid tier, so builds would not be reproducibly pinnable.
-#
-# Not-invoked claim verified by sweeping both images for files with a perl
-# shebang, shell/python callers of perl, ELF binaries containing "perl", and
-# .pl/.pm files or perl subprocess calls anywhere in site-packages. The only
-# consumers found are dpkg/debconf/adduser/pam tooling, none of which runs at
-# runtime, plus one build-time script inside the ExchangeOnlineManagement
-# PowerShell module that is never invoked.
-
-vulnerabilities:
-  # Archive::Tar path traversal. Not installed: `perl -MArchive::Tar -e1` cannot locate it.
-  - id: CVE-2026-42496
-    purls:
-      - "pkg:deb/debian/perl-base"
-    expired_at: 2027-01-31
-
-  # Storable integer overflow. Not installed: `perl -MStorable -e1` cannot locate it.
-  - id: CVE-2026-57433
-    purls:
-      - "pkg:deb/debian/perl-base"
-    expired_at: 2027-01-31
-
-  # Regex heap overflow on 32-bit builds only; both published arches are 64-bit.
-  - id: CVE-2026-8376
-    purls:
-      - "pkg:deb/debian/perl-base"
-    expired_at: 2027-01-31
-
-  # Regex trie bug giving silently wrong matches above 65535 alternation branches.
-  # perl 5.40.1 is in range, so this rests on nothing invoking perl. Short expiry
-  # to force a re-look. Ref: https://github.com/Perl/perl5/issues/23388
-  - id: CVE-2026-13221
-    purls:
-      - "pkg:deb/debian/perl-base"
-    expired_at: 2026-11-30
-
-  # Declared in the SPDX manifest that ships inside PowerShell's MicrosoftTeams module
-  # (Modules/MicrosoftTeams/8.0.0/_manifest/spdx_2.2/manifest.spdx.json). Trivy reads that
-  # SBOM and reports what it declares, which is not the same as what the image contains:
-  # there is no Node runtime and no node_modules anywhere in the image, and the .NET
-  # assemblies target net472, a Windows-only framework. Nothing here is reachable, and none
-  # of it is a dependency we declare -- only Microsoft can change the module's contents.
-  - id: CVE-2020-0606
-    purls:
-      - "pkg:nuget/Microsoft.WindowsDesktop.App.Ref"
-    expired_at: 2027-01-31
-  - id: CVE-2019-0820
-    purls:
-      - "pkg:nuget/System.Text.RegularExpressions"
-    expired_at: 2027-01-31
-  - id: CVE-2026-47302
-    purls:
-      - "pkg:nuget/System.Security.Cryptography.Xml"
-    expired_at: 2027-01-31
-  - id: CVE-2026-47304
-    purls:
-      - "pkg:nuget/System.Security.Cryptography.Xml"
-    expired_at: 2027-01-31
-  - id: CVE-2026-50525
-    purls:
-      - "pkg:nuget/System.Security.Cryptography.Xml"
-    expired_at: 2027-01-31
-  - id: CVE-2026-50527
-    purls:
-      - "pkg:nuget/System.Security.Cryptography.Xml"
-    expired_at: 2027-01-31
-  - id: CVE-2026-50648
-    purls:
-      - "pkg:nuget/System.Security.Cryptography.Xml"
-    expired_at: 2027-01-31
-  - id: CVE-2026-13676
-    purls:
-      - "pkg:npm/fast-uri"
-    expired_at: 2027-01-31
-  - id: CVE-2026-16221
-    purls:
-      - "pkg:npm/fast-uri"
-    expired_at: 2027-01-31
-  - id: CVE-2026-18446
-    purls:
-      - "pkg:npm/fast-uri"
-    expired_at: 2027-01-31
-  - id: CVE-2026-75899
-    purls:
-      - "pkg:npm/fast-uri"
-    expired_at: 2027-01-31
-  - id: CVE-2026-75975
-    purls:
-      - "pkg:npm/fast-uri"
-    expired_at: 2027-01-31
-  - id: CVE-2026-76172
-    purls:
-      - "pkg:npm/fast-uri"
-    expired_at: 2027-01-31
-  - id: CVE-2026-75931
-    purls:
-      - "pkg:npm/fast-uri"
-    expired_at: 2027-01-31
-  - id: CVE-2026-84292
-    purls:
-      - "pkg:npm/fast-uri"
-    expired_at: 2027-01-31
-  - id: CVE-2026-69192
-    purls:
-      - "pkg:npm/ip-address"
-    expired_at: 2027-01-31
-
-  # CVE-2026-84304 is a DoS in grpc-go <= 1.83.0: a peer fragments a gRPC stream into
-  # millions of tiny HTTP/2 DATA frames until the receiver runs out of heap. Fixed in
-  # 1.83.1 (published 2026-09-01). Trivy 0.74.0, the latest published release and the
-  # version the images ship, pins 1.82.1 as an indirect dependency:
-  # https://github.com/aquasecurity/trivy/blob/v0.74.0/go.mod
-  # Upstream bump still open: https://github.com/aquasecurity/trivy/pull/11176
-  # Trivy only speaks gRPC in client/server mode (`trivy server`, `--server`). Prowler
-  # invokes it exclusively as `trivy image` and `trivy fs` on a local path, so no gRPC
-  # listener or connection ever exists in the image and the affected path is not
-  # reachable. Remove this temporary suppression as soon as a Trivy release pins
-  # grpc >= 1.83.1.
-  - id: CVE-2026-84304
-    purls:
-      - "pkg:golang/google.golang.org/grpc"
-    expired_at: 2026-10-15
-
-  # CVE-2026-84445 is a DoS in grpc-go servers built with `xds.NewGRPCServer()`: a request
-  # carrying neither `:authority` nor `Host` reaches the xDS routing interceptor, which
-  # indexes an empty slice of authorities and panics. The per-RPC goroutine does not
-  # recover, so the whole server process dies. Fixed in 1.82.2 and 1.83.2 (published
-  # 2026-09-08). Trivy 0.74.0, the latest published release and the version the images
-  # ship, pins 1.82.1 as an indirect dependency:
-  # https://github.com/aquasecurity/trivy/blob/v0.74.0/go.mod
-  # Trivy main already carries 1.83.2, but no published release includes it yet.
-  # The reachability argument is the one made for CVE-2026-84304 above, only narrower:
-  # this panic needs an xDS-managed gRPC server. Prowler invokes Trivy exclusively as
-  # `trivy image` and `trivy fs` on a local path, never `trivy server`, so the image runs
-  # no gRPC server at all, xDS or otherwise. Remove this temporary suppression as soon as
-  # a Trivy release pins grpc >= 1.83.2.
-  # https://github.com/advisories/GHSA-2v4p-qf9q-27wj
-  - id: CVE-2026-84445
-    purls:
-      - "pkg:golang/google.golang.org/grpc@v1.82.1"
-    expired_at: 2026-10-15
-
-  # CVE-2026-56855 and CVE-2026-78662 are DoS deadlocks in x/crypto/ssh: a malicious peer
-  # can flood or misuse channel messages (RFC 4254) to block the whole connection.
-  # Fixed in golang.org/x/crypto v0.56.0 (published 2026-09-02). Trivy 0.74.0, the latest
-  # published release and the version the images ship, still pins v0.55.0, and Trivy main
-  # has not bumped it either:
-  # https://github.com/aquasecurity/trivy/blob/v0.74.0/go.mod
-  # x/crypto/ssh is pulled in transitively through go-git's ssh transport, the same
-  # dependency chain as the CVE-2026-71556 entry above. Prowler invokes Trivy only with
-  # `fs` on an existing local path or with `image`; it never asks Trivy to clone over SSH
-  # or to run `trivy server`, so no SSH connection -- as client or server -- ever exists in
-  # the image and the affected code path is not reachable. Remove this temporary
-  # suppression as soon as a fixed Trivy release is available.
-  - id: CVE-2026-56855
-    purls:
-      - "pkg:golang/golang.org/x/crypto@v0.55.0"
-    expired_at: 2026-10-15
-  - id: CVE-2026-78662
-    purls:
-      - "pkg:golang/golang.org/x/crypto@v0.55.0"
-    expired_at: 2026-10-15
-
-  - id: CVE-2026-56852
-    purls:
-      - "pkg:golang/golang.org/x/text"
-    expired_at: 2026-12-31
-  - id: GHSA-hrxh-6v49-42gf
-    purls:
-      - "pkg:golang/google.golang.org/grpc"
-    expired_at: 2026-12-31
-  - id: CVE-2026-50151
-    purls:
-      - "pkg:golang/oras.land/oras-go/v2"
-    expired_at: 2026-12-31
-  - id: CVE-2026-50163
-    purls:
-      - "pkg:golang/oras.land/oras-go/v2"
-    expired_at: 2026-12-31
@@ -62,7 +62,6 @@ When performing these actions, ALWAYS invoke the corresponding skill FIRST:
 | Action | Skill |
 |--------|-------|
 | Add changelog entry for a PR or feature | `prowler-changelog` |
-| Adding ConfigRequirements guardrails to compliance requirements | `prowler-compliance` |
 | Adding DRF pagination or permissions | `django-drf` |
 | Adding a compliance output formatter (per-provider class + table dispatcher) | `prowler-compliance` |
 | Adding indexes or constraints to database tables | `django-migration-psql` |
@@ -85,7 +84,6 @@ When performing these actions, ALWAYS invoke the corresponding skill FIRST:
 | Creating ViewSets, serializers, or filters in api/ | `django-drf` |
 | Creating Zod schemas | `zod-4` |
 | Creating a git commit | `prowler-commit` |
-| Creating a universal (multi-provider) compliance framework | `prowler-compliance` |
 | Creating new checks | `prowler-sdk-check` |
 | Creating new skills | `skill-creator` |
 | Creating or reviewing Django migrations | `django-migration-psql` |
@@ -1,46 +1,23 @@
-FROM python:3.12.13-slim-trixie@sha256:57cd7c3a7a273101a6485ba99423ee568157882804b1124b4dd04266317710de AS build
+FROM python:3.12.13-slim-bookworm@sha256:8a7e7cc04fd3e2bd787f7f24e22d5d119aa590d429b50c95dfe12b3abe52f48b AS build

 LABEL maintainer="https://github.com/prowler-cloud/prowler"
 LABEL org.opencontainers.image.source="https://github.com/prowler-cloud/prowler"

-ARG POWERSHELL_VERSION=7.5.11
+ARG POWERSHELL_VERSION=7.5.0
 ENV POWERSHELL_VERSION=${POWERSHELL_VERSION}
 # Opt out of PowerShell telemetry (Application Insights -> dc.services.visualstudio.com)
 ENV POWERSHELL_TELEMETRY_OPTOUT=1

-ARG TRIVY_VERSION=0.74.0
+ARG TRIVY_VERSION=0.71.2
 ENV TRIVY_VERSION=${TRIVY_VERSION}

 ARG ZIZMOR_VERSION=1.24.1
 ENV ZIZMOR_VERSION=${ZIZMOR_VERSION}

-# Pinned here, not fetched with the artefact: a compromised release ships its own checksum.
-ARG TRIVY_SHA256_AMD64=2ae6fe3ee734b7fdf11335663e18c75ea12dccc76062f09f164a3b0f8be4371a
-ARG TRIVY_SHA256_ARM64=b94ce1976bbf3c15b514b605ee88be7c6d94a29be2302847ff01cb794d47aad5
-ARG POWERSHELL_SHA256_AMD64=82a8b13d92b0f3ae48e56cf2f3f7961679371736ca90145ca71617c2913ba9d8
-ARG POWERSHELL_SHA256_ARM64=830ebda118c731ece3fa7e6b7e8573a21346387cbbca5b2f5e3b9bfe24f96672
-ARG ZIZMOR_SHA256_AMD64=a8000f3c683319a523d3b20df0e75457ba591f049cfcbfa98966631b56733c03
-ARG ZIZMOR_SHA256_ARM64=d66e37ef8a375fb07939c630ebf9709a6e0f20242bdc3faf672a7ed97e0b768d
-
-# High CVEs fixed in Debian trixie but not yet in the pinned base image:
-#   openssl/libssl3t64/openssl-provider-legacy 3.5.7-1~deb13u2  CVE-2026-14456,
-#   -14457, -18798, -54874, -63072, -63073, -63074, -63075, -63076, -75803
-#   libsqlite3-0 3.46.1-7+deb13u2  CVE-2026-11822, -11824
-#   gzip 1.13-1+deb13u1  CVE-2026-41992
-#   perl-base 5.40.1-6+deb13u1  CVE-2026-42497, -48962, -57432
-#   libssh2-1t64 1.11.1-1+deb13u2  CVE-2026-58050
-#   libpcre2-8-0 10.46-1~deb13u2  CVE-2026-86145, -89161
-# Taken as a targeted --only-upgrade rather than by moving the digest: the newest
-# published python:3.12-slim-trixie carries the same vulnerable versions. The three
-# openssl packages are flagged separately, so all are named.
-# Drop each one once the base image ships its fixed version.
 # hadolint ignore=DL3008
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    wget libicu76 libunwind8 libssl3 libcurl4 ca-certificates apt-transport-https gnupg \
+    wget libicu72 libunwind8 libssl3 libcurl4 ca-certificates apt-transport-https gnupg \
    build-essential pkg-config libzstd-dev zlib1g-dev \
-    && apt-get install -y --no-install-recommends --only-upgrade \
-       util-linux libssl3t64 openssl openssl-provider-legacy \
-       libsqlite3-0 gzip perl-base libssh2-1t64 libpcre2-8-0 \
    && rm -rf /var/lib/apt/lists/*

 # Install PowerShell
@@ -52,9 +29,6 @@ RUN ARCH=$(uname -m) && \
    else \
        echo "Unsupported architecture: $ARCH" && exit 1 ; \
    fi && \
-    if [ "$ARCH" = "x86_64" ]; then EXPECT="$POWERSHELL_SHA256_AMD64" ; else EXPECT="$POWERSHELL_SHA256_ARM64" ; fi && \
-    echo "$EXPECT  /tmp/powershell.tar.gz" > /tmp/powershell.sha256 && \
-    sha256sum -c /tmp/powershell.sha256 && rm /tmp/powershell.sha256 && \
    mkdir -p /opt/microsoft/powershell/7 && \
    tar zxf /tmp/powershell.tar.gz -C /opt/microsoft/powershell/7 && \
    chmod +x /opt/microsoft/powershell/7/pwsh && \
@@ -71,9 +45,6 @@ RUN ARCH=$(uname -m) && \
        echo "Unsupported architecture for Trivy: $ARCH" && exit 1 ; \
    fi && \
    wget --progress=dot:giga "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_${TRIVY_ARCH}.tar.gz" -O /tmp/trivy.tar.gz && \
-    if [ "$ARCH" = "x86_64" ]; then EXPECT="$TRIVY_SHA256_AMD64" ; else EXPECT="$TRIVY_SHA256_ARM64" ; fi && \
-    echo "$EXPECT  /tmp/trivy.tar.gz" > /tmp/trivy.sha256 && \
-    sha256sum -c /tmp/trivy.sha256 && rm /tmp/trivy.sha256 && \
    tar zxf /tmp/trivy.tar.gz -C /tmp && \
    mv /tmp/trivy /usr/local/bin/trivy && \
    chmod +x /usr/local/bin/trivy && \
@@ -92,9 +63,6 @@ RUN ARCH=$(uname -m) && \
        echo "Unsupported architecture for zizmor: $ARCH" && exit 1 ; \
    fi && \
    wget --progress=dot:giga "https://github.com/zizmorcore/zizmor/releases/download/v${ZIZMOR_VERSION}/zizmor-${ZIZMOR_ARCH}.tar.gz" -O /tmp/zizmor.tar.gz && \
-    if [ "$ARCH" = "x86_64" ]; then EXPECT="$ZIZMOR_SHA256_AMD64" ; else EXPECT="$ZIZMOR_SHA256_ARM64" ; fi && \
-    echo "$EXPECT  /tmp/zizmor.tar.gz" > /tmp/zizmor.sha256 && \
-    sha256sum -c /tmp/zizmor.sha256 && rm /tmp/zizmor.sha256 && \
    mkdir -p /tmp/zizmor-extract && \
    tar zxf /tmp/zizmor.tar.gz -C /tmp/zizmor-extract && \
    mv /tmp/zizmor-extract/zizmor /usr/local/bin/zizmor && \
@@ -121,7 +89,7 @@ ENV HOME='/home/prowler'
 ENV PATH="${HOME}/.local/bin:${PATH}"
 #hadolint ignore=DL3013
 RUN pip install --no-cache-dir --upgrade pip && \
-    pip install --no-cache-dir uv==0.12.0
+    pip install --no-cache-dir uv==0.11.14

 RUN uv sync --locked --compile-bytecode && \
    rm -rf ~/.cache/uv
@@ -137,9 +105,6 @@ RUN apt-get purge -y --auto-remove \
    pkg-config \
    libzstd-dev \
    zlib1g-dev \
-    wget \
-    gnupg \
-    apt-transport-https \
    && rm -rf /var/lib/apt/lists/*

 USER prowler
@@ -148,15 +113,5 @@ USER prowler
 RUN pip uninstall dash-html-components -y && \
    pip uninstall dash-core-components -y

-USER root
-
-# pip is build-only; the entrypoint runs the venv directly.
-RUN rm -rf /usr/local/lib/python3.12/site-packages/pip \
-    /usr/local/lib/python3.12/site-packages/pip-*.dist-info \
-    /home/prowler/.local/lib/python3.12/site-packages/pip \
-    /home/prowler/.local/lib/python3.12/site-packages/pip-*.dist-info \
-    /usr/local/bin/pip /usr/local/bin/pip3 /usr/local/bin/pip3.12 \
-    /home/prowler/.local/bin/pip /home/prowler/.local/bin/pip3 /home/prowler/.local/bin/pip3.12
-
 USER prowler
 ENTRYPOINT ["/home/prowler/.venv/bin/prowler"]
@@ -34,9 +34,6 @@ test:   ## Test with pytest
 	rm -rf .coverage && \
 	pytest -n auto -vvv -s --cov=./prowler --cov-report=xml tests

-test-mcp: ## Test MCP server with pytest (mirrors CI)
-	cd mcp_server && uv run pytest --cov=./prowler_mcp_server --cov-report=term-missing tests
-
 coverage: ## Show Test Coverage
 	coverage run --skip-covered -m pytest -v && \
 	coverage report -m && \
@@ -6,10 +6,7 @@
  <b><i>Prowler</b> is the Open Cloud Security Platform trusted by thousands to automate security and compliance in any cloud environment. With thousands of ready-to-use checks and compliance frameworks, Prowler delivers real-time, customizable monitoring and seamless integrations, making cloud security simple, scalable, and cost-effective for organizations of any size.
 </p>
 <p align="center">
-<b>The Agentic Cloud Defender</i></b>
-</p>
-<p align="center">
-<a href="https://cloud.prowler.com/sign-up">Try Prowler Cloud</a>
+<b>Secure ANY cloud at AI Speed at <a href="https://prowler.com">prowler.com</i></b>
 </p>

 <p align="center">
@@ -59,7 +56,7 @@ Prowler includes hundreds of built-in controls to ensure compliance with standar

 ## Prowler Cloud & Prowler Local Server

-[Prowler Cloud](https://cloud.prowler.com/sign-up) and Prowler Local Server, its self-hosted open-source version, are web applications that simplify running Prowler across your cloud provider accounts. They provide a user-friendly interface to visualize the results and streamline your security assessments.
+[Prowler Cloud](https://cloud.prowler.com/) and Prowler Local Server, its self-hosted open-source version, are web applications that simplify running Prowler across your cloud provider accounts. They provide a user-friendly interface to visualize the results and streamline your security assessments.

 ![Prowler Cloud](docs/images/products/overview.png)
 ![Risk Pipeline](docs/images/products/risk-pipeline.png)
@@ -126,28 +123,27 @@ Every AWS provider scan will enqueue an Attack Paths ingestion job automatically

 | Provider | Checks | Services | [Compliance Frameworks](https://docs.prowler.com/user-guide/compliance/tutorials/compliance) | [Categories](https://docs.prowler.com/user-guide/cli/tutorials/misc#categories) | Support | Interface |
 |---|---|---|---|---|---|---|
-| AWS | 662 | 86 | 50 | 19 | Official | UI, API, CLI |
-| Azure | 191 | 22 | 25 | 16 | Official | UI, API, CLI |
-| GCP | 110 | 20 | 22 | 12 | Official | UI, API, CLI |
-| Kubernetes | 92 | 7 | 11 | 11 | Official | UI, API, CLI |
+| AWS | 615 | 86 | 47 | 19 | Official | UI, API, CLI |
+| Azure | 190 | 22 | 21 | 16 | Official | UI, API, CLI |
+| GCP | 109 | 20 | 19 | 12 | Official | UI, API, CLI |
+| Kubernetes | 90 | 7 | 8 | 11 | Official | UI, API, CLI |
 | GitHub | 24 | 3 | 2 | 5 | Official | UI, API, CLI |
-| M365 | 144 | 10 | 9 | 10 | Official | UI, API, CLI |
+| M365 | 109 | 10 | 6 | 10 | Official | UI, API, CLI |
 | OCI | 52 | 14 | 5 | 10 | Official | UI, API, CLI |
 | Alibaba Cloud | 63 | 9 | 6 | 9 | Official | UI, API, CLI |
 | Cloudflare | 29 | 3 | 2 | 5 | Official | UI, API, CLI |
 | IaC | [See `trivy` docs.](https://trivy.dev/latest/docs/coverage/iac/) | N/A | N/A | N/A | Official | UI, API, CLI |
 | MongoDB Atlas | 10 | 3 | 1 | 8 | Official | UI, API, CLI |
 | LLM | [See `promptfoo` docs.](https://www.promptfoo.dev/docs/red-team/plugins/) | N/A | N/A | N/A | Official | CLI |
-| Image | N/A | N/A | N/A | N/A | Official | UI, API, CLI |
-| Google Workspace | 65 | 11 | 4 | 6 | Official | UI, API, CLI |
+| Image | N/A | N/A | N/A | N/A | Official | CLI, API |
+| Google Workspace | 65 | 11 | 3 | 6 | Official | UI, API, CLI |
 | OpenStack | 34 | 5 | 1 | 9 | Official | UI, API, CLI |
 | Vercel | 26 | 6 | 1 | 8 | Official | UI, API, CLI |
 | Okta | 29 | 8 | 2 | 2 | Official | UI, API, CLI |
 | Linode [Contact us](https://prowler.com/contact) | 10 | 3 | 1 | 4 | Unofficial | CLI |
-| Huawei Cloud [Contact us](https://prowler.com/contact) | 25 | 10 | 1 | 6 | Unofficial | CLI |
 | E2E Networks [Contact us](https://prowler.com/contact) | 27 | 6 | 0 | 2 | Unofficial | CLI |
 | Scaleway [Contact us](https://prowler.com/contact) | 1 | 1 | 1 | 1 | Unofficial | CLI |
-| StackIT [Contact us](https://prowler.com/contact) | 8 | 2 | 1 | 3 | Unofficial | CLI |
+| StackIT [Contact us](https://prowler.com/contact) | 7 | 2 | 1 | 3 | Unofficial | CLI |
 | NHN | 6 | 2 | 2 | 0 | Unofficial | CLI |

 > [!Note]
@@ -59,9 +59,5 @@ DJANGO_GITHUB_OAUTH_CLIENT_ID=""
 DJANGO_GITHUB_OAUTH_CLIENT_SECRET=""
 DJANGO_GITHUB_OAUTH_CALLBACK_URL=""

-# Public base URL of the Prowler UI, used to link Jira issues back to findings.
-# Leave empty to omit the link.
-DJANGO_UI_BASE_URL=""
-
 # Deletion Task Batch Size
 DJANGO_DELETION_BATCH_SIZE=5000
@@ -4,188 +4,6 @@ All notable changes to the **Prowler API** are documented in this file.

 <!-- changelog: release notes start -->

-## [1.44.0] (Prowler v5.43.0)
-
-### 🐞 Fixed
-
- Report download URLs can be signed against a browser-reachable storage host via `DJANGO_OUTPUT_S3_AWS_PUBLIC_ENDPOINT_URL`, so downloads complete on deployments where storage is only reachable inside the container network [(#12552)](https://github.com/prowler-cloud/prowler/pull/12552)
- A scan report download no longer fails with a server error when `DJANGO_OUTPUT_S3_AWS_DEFAULT_REGION` is unset, which is common on storage with no meaningful region [(#12552)](https://github.com/prowler-cloud/prowler/pull/12552)
- Lapsed pending invitations are reported as expired and no longer block a new invitation for the same email [(#12831)](https://github.com/prowler-cloud/prowler/pull/12831)
-
-### 🔐 Security
-
- `libsqlite3-0`, `gzip`, `perl-base` and `libpcre2-8-0` upgraded in the API container image, patching high Debian CVEs [(#12804)](https://github.com/prowler-cloud/prowler/pull/12804)
- PowerShell from 7.5.9 to 7.5.11 in the API container image, bundling .NET runtime 9.0.20 and patching CVE-2026-62901 [(#12811)](https://github.com/prowler-cloud/prowler/pull/12811)
- Bumped `anyio` to 4.14.2 to resolve CVE-2026-63374 [(#12848)](https://github.com/prowler-cloud/prowler/pull/12848)
-
---
-
-## [1.43.0] (Prowler v5.42.0)
-
-### 🔄 Changed
-
- Speed up compliance overview ingestion by reading ThreatScore mappings from the compliance template instead of each finding, generating time-ordered `uuid7` row ids and grouping inserted rows by framework and requirement [(#12738)](https://github.com/prowler-cloud/prowler/pull/12738)
-
---
-
-## [1.42.0] (Prowler v5.41.0)
-
-### 🚀 Added
-
- Jira issues created from Prowler Cloud now carry the `prowler`, `prowler-<provider>`, `prowler-<severity>`, `prowler-<check-id>`, and `prowler-finding-<finding-uid>` labels, a link back to the finding when `DJANGO_UI_BASE_URL` is configured, and the tenant name [(#12540)](https://github.com/prowler-cloud/prowler/pull/12540)
-
-### 🐞 Fixed
-
- `POST /api/v1/mute-rules` now updates only each affected provider's latest completed scan and future scans, preventing historical reaggregation from flooding Celery queues [(#12681)](https://github.com/prowler-cloud/prowler/pull/12681)
-
---
-
-## [1.41.0] (Prowler v5.40.0)
-
-### 🐞 Fixed
-
- `FINDINGS_TABLE_PARTITION_MAX_AGE_MONTHS` is now applied in months instead of days, and negative values are rejected [(#12580)](https://github.com/prowler-cloud/prowler/pull/12580)
-
-### 🔐 Security
-
- `sqlparse` upgraded to 0.6.0, patching CVE-2026-54284, CVE-2026-59893, and CVE-2026-71491 [(#12509)](https://github.com/prowler-cloud/prowler/pull/12509)
- `openssl`, `libssl3t64` and `openssl-provider-legacy` upgraded to 3.5.7-1~deb13u2 in the API container image, patching ten high OpenSSL CVEs [(#12549)](https://github.com/prowler-cloud/prowler/pull/12549)
-
---
-
-## [1.40.1] (Prowler v5.39.1)
-
-### 🔄 Changed
-
- Bump alibabacloud-tea-openapi to 0.4.6, oci to 2.184.1 and pyopenssl to 26.4.0 to match the SDK; the cryptography override now names its actual blockers (azure-cli-core pins msal below 1.37, workos 8.3.0 requires cryptography 48) [(#12477)](https://github.com/prowler-cloud/prowler/pull/12477)
-
-### 🐞 Fixed
-
- Pin zstd to 1.5.7.2; 1.5.7.3 was yanked from PyPI as not thread safe [(#12477)](https://github.com/prowler-cloud/prowler/pull/12477)
-
-### 🔐 Security
-
- Trivy from v0.72.0 to v0.73.0 in the container image, fixing HIGH CVE-2026-46600 in the bundled `golang.org/x/net` [(#12445)](https://github.com/prowler-cloud/prowler/pull/12445)
- Trivy v0.74.0 and Debian util-linux 2.41.5-0+deb13u1 in the API container image, patching Go standard library vulnerabilities and CVE-2026-53615 [(#12470)](https://github.com/prowler-cloud/prowler/pull/12470)
-
---
-
-## [1.40.0] (Prowler v5.39.0)
-
-### 🔄 Changed
-
- `GET /api/v1/users/me` membership relationships identify the active tenant with `meta.active` for JWT and API key authentication [(#12388)](https://github.com/prowler-cloud/prowler/pull/12388)
-
-### 🐞 Fixed
-
- Tenant deletion no longer leaves memberships partially removed when exclusive-user cleanup fails [(#12379)](https://github.com/prowler-cloud/prowler/pull/12379)
- `/api/v1/accounts/saml/{organization_slug}/acs/` rejects non-POST requests before SAML response processing [(#12393)](https://github.com/prowler-cloud/prowler/pull/12393)
- Social login derives a valid user name when identity providers omit the profile name [(#12413)](https://github.com/prowler-cloud/prowler/pull/12413)
-
---
-
-## [1.39.0] (Prowler v5.38.0)
-
-### 🚀 Added
-
- Attack Paths adds 20 AWS privilege-escalation detection queries from pathfinding.cloud, covering service PassRole escalations (Batch, Braket, Cognito Identity, ECS, EMR, EMR Serverless, GameLift, Glue, EC2 Image Builder, Kinesis Analytics, HealthOmics, EventBridge Scheduler, SSM, Step Functions), CodeDeploy and Step Functions existing-resource abuse, role permissions-boundary removal with role assumption, and IAM Identity Center permission-set policy injection [(#12237)](https://github.com/prowler-cloud/prowler/pull/12237)
- Attack Paths query metadata now carries an outcome (Code execution, Privilege escalation, Public exposure, or Resource inventory), exposed on the queries endpoint so the graph can show a terminal outcome node [(#12344)](https://github.com/prowler-cloud/prowler/pull/12344)
- Container images now ship an SBOM and build provenance as OCI attestations [(#12352)](https://github.com/prowler-cloud/prowler/pull/12352)
-
-### 🔄 Changed
-
- Pin the container vulnerability scanner to Trivy v0.72.0, matching prowler-registry and partner-portal [(#12346)](https://github.com/prowler-cloud/prowler/pull/12346)
-
-### 🐞 Fixed
-
- Compliance report output directory failures are now logged with the exception attached and fingerprinted by `errno` in Sentry, so `ENOSPC`, `ENOENT` and `EACCES` no longer share a single issue [(#12142)](https://github.com/prowler-cloud/prowler/pull/12142)
- Restored the SDK dependency to `@master` now that the dependency bumps have landed there, and regenerated the lock. The API image no longer builds against a temporary integration branch [(#12309)](https://github.com/prowler-cloud/prowler/pull/12309)
-
-### 🔐 Security
-
- The API container image now verifies the checksum of every third-party binary it downloads (PowerShell, Trivy, zizmor) before installing it [(#12334)](https://github.com/prowler-cloud/prowler/pull/12334)
- Upgrade aiohttp to 3.14.3 to pick up the fix for CVE-2026-69244 [(#12340)](https://github.com/prowler-cloud/prowler/pull/12340)
- Upgrade cryptography to 50.0.0, closing CVE-2026-69247 and CVE-2026-69249 [(#12356)](https://github.com/prowler-cloud/prowler/pull/12356)
-
---
-
-## [1.38.1] (Prowler v5.37.1)
-
-### 🐞 Fixed
-
- Entra Conditional Access guest-user checks no longer report false FAILs in M365 scans: microsoft-kiota packages overridden to 1.9.10 so `guestOrExternalUserTypes` (a flags enum Graph serializes as a comma-separated string) deserializes correctly instead of returning an empty list [(#12315)](https://github.com/prowler-cloud/prowler/pull/12315)
-
-### 🔐 Security
-
- The API container image now builds on Debian 13 (trixie), taking its critical CVE count from 18 to 4 [(#12311)](https://github.com/prowler-cloud/prowler/pull/12311)
- Bumped PowerShell, Trivy and uv in the API container image, clearing 14 high-severity CVEs [(#12311)](https://github.com/prowler-cloud/prowler/pull/12311)
- Bumped `workos` and `pyopenssl` so the API can move to `cryptography` 48.0.1 [(#12311)](https://github.com/prowler-cloud/prowler/pull/12311)
- Removed `gnupg` and `apt-transport-https` from the API container image [(#12311)](https://github.com/prowler-cloud/prowler/pull/12311)
- The API container image no longer ships `git`; removing it also dropped `perl`, `perl-modules`, `libperl` and `liberror-perl`, clearing 12 critical CVEs. Only `perl-base` remains, which Debian marks Essential and cannot be removed [(#12311)](https://github.com/prowler-cloud/prowler/pull/12311)
- Removed `pip` from the API container image, clearing two high-severity CVEs in the vendored copies of `setuptools` and `msgpack` [(#12311)](https://github.com/prowler-cloud/prowler/pull/12311)
- Bumped `pillow` to 12.3.0, `httplib2` to 0.32.0 and `pyasn1` to 0.6.4 to resolve known CVEs [(#12311)](https://github.com/prowler-cloud/prowler/pull/12311)
-
---
-
-## [1.38.0] (Prowler v5.37.0)
-
-### 🚀 Added
-
- Attack Paths: four AWS privilege-escalation detection queries from pathfinding.cloud: cross-account role trust (STS-002), wildcard role trust (STS-003), user permissions-boundary removal (IAM-022), and IAM Identity Center permission-set escalation (SSO-001) [(#11460)](https://github.com/prowler-cloud/prowler/pull/11460)
-
-### 🐞 Fixed
-
- Attack Paths IAM privilege-escalation queries no longer build an all-nodes × all-resource-items cartesian product, fixing runtime errors and timeouts on accounts with many IAM roles, users, or groups [(#12136)](https://github.com/prowler-cloud/prowler/pull/12136)
- `task_args` serialization no longer returns HTTP 500 errors when Celery truncates stored task keyword arguments [(#12165)](https://github.com/prowler-cloud/prowler/pull/12165)
- Attack Paths predefined queries on migrated graphs are now scoped with the provider label, letting the graph database seed from its label index instead of a global label scan and preventing query timeouts on Neptune [(#12167)](https://github.com/prowler-cloud/prowler/pull/12167)
- Authentication with an API key whose owning user was deleted now returns `401` instead of an unhandled `AttributeError`, and user deletion now revokes the user's API keys across all their tenants [(#12210)](https://github.com/prowler-cloud/prowler/pull/12210)
- AWS Security Hub integrations now persist successful connection checks during finding delivery so their connection status and last checked timestamp stay current [(#12212)](https://github.com/prowler-cloud/prowler/pull/12212)
- SAML users without a `userType` attribute and without an existing role in the SAML tenant now receive a least-privilege `read_only` fallback role; a numeric suffix is used when that name belongs to a role with different permissions [(#12223)](https://github.com/prowler-cloud/prowler/pull/12223)
- Social signups create users and authentication records in one database transaction, preventing incomplete accounts when provisioning fails [(#12245)](https://github.com/prowler-cloud/prowler/pull/12245)
- Requesting integrations with a sparse fieldset that leaves out `configuration` no longer returns HTTP 500 errors when the tenant has a Jira integration [(#12261)](https://github.com/prowler-cloud/prowler/pull/12261)
-
-### 🔐 Security
-
- Provider deletion and connection checks, scan creation, provider secrets, provider groups, and daily schedules now respect role provider-group visibility [(#12216)](https://github.com/prowler-cloud/prowler/pull/12216)
-
---
-
-## [1.37.0] (Prowler v5.36.0)
-
-### 🔄 Changed
-
- OCI provider secrets no longer require `region`; legacy `region` input is accepted for backwards compatibility but ignored before storing or scanning [(#11741)](https://github.com/prowler-cloud/prowler/pull/11741)
- Compliance overview ingest now runs in a single transaction per scan with a configurable `COPY` batch size (`DJANGO_COMPLIANCE_COPY_BATCH_SIZE`, default 2000), reducing write pressure on the database [(#11875)](https://github.com/prowler-cloud/prowler/pull/11875)
-
-### 🐞 Fixed
-
- Scan findings now recover resources missing from the in-memory cache after resource pre-resolution, preventing valid findings from being skipped [(#12002)](https://github.com/prowler-cloud/prowler/pull/12002)
- Tenant-wide integrations that are not attached to any provider, such as Jira, are now visible and manageable by roles with `manage_integrations` and without unlimited visibility [(#12060)](https://github.com/prowler-cloud/prowler/pull/12060)
- Output generation now removes the scan's temporary output directory before writing, so a re-run of the task for the same scan (e.g. broker redelivery after a worker is killed mid-run) no longer appends to the previous run's files and duplicates finding rows in the exported CSV and other outputs [(#12097)](https://github.com/prowler-cloud/prowler/pull/12097)
-
-### 🔐 Security
-
- Integration responses no longer disclose providers outside the visibility of the role, including the resources sideloaded through `?include=providers` [(#12060)](https://github.com/prowler-cloud/prowler/pull/12060)
- Integration connection checks, Jira issue type lookups and Jira dispatches now resolve the integration through the provider visibility of the role instead of the whole tenant [(#12060)](https://github.com/prowler-cloud/prowler/pull/12060)
- Roles without unlimited visibility can no longer attach an integration to providers they cannot see, nor edit or delete an integration bound to them [(#12060)](https://github.com/prowler-cloud/prowler/pull/12060)
- Kubernetes kubeconfig validation now rejects legacy `auth-provider.config.cmd-path` command authentication in Prowler Cloud/API [(#12091)](https://github.com/prowler-cloud/prowler/pull/12091)
-
---
-
-## [1.36.0] (Prowler v5.35.0)
-
-### 🐞 Fixed
-
- `attack-paths-scan-perform` Celery tasks now use the configurable long-task time limits instead of the six-hour defaults [(#12009)](https://github.com/prowler-cloud/prowler/pull/12009)
- Attack Paths scans handle provider deletion races cleanly, detect stale tasks after 16 hours, use backend-specific graph synchronization batches, and report exhausted Neptune write retries with the original database error [(#12019)](https://github.com/prowler-cloud/prowler/pull/12019)
-
-### 🔐 Security
-
- Jira integration credentials only accept bare Atlassian site names containing letters, numbers, and hyphens [(#12012)](https://github.com/prowler-cloud/prowler/pull/12012)
- Social account linking requires a verified matching email from both the identity provider and the existing user account without sending account connection notifications [(#12013)](https://github.com/prowler-cloud/prowler/pull/12013)
-
---
-
 ## [1.35.0] (Prowler v5.34.0)

 ### 🐞 Fixed
@@ -1,43 +1,23 @@
-FROM python:3.12.13-slim-trixie@sha256:57cd7c3a7a273101a6485ba99423ee568157882804b1124b4dd04266317710de AS build
+FROM python:3.12.13-slim-bookworm@sha256:8a7e7cc04fd3e2bd787f7f24e22d5d119aa590d429b50c95dfe12b3abe52f48b AS build

 LABEL maintainer="https://github.com/prowler-cloud/api"

-ARG POWERSHELL_VERSION=7.5.11
+ARG POWERSHELL_VERSION=7.5.0
 ENV POWERSHELL_VERSION=${POWERSHELL_VERSION}
 # Opt out of PowerShell telemetry (Application Insights -> dc.services.visualstudio.com)
 ENV POWERSHELL_TELEMETRY_OPTOUT=1

-ARG TRIVY_VERSION=0.74.0
+ARG TRIVY_VERSION=0.71.2
 ENV TRIVY_VERSION=${TRIVY_VERSION}

 ARG ZIZMOR_VERSION=1.24.1
 ENV ZIZMOR_VERSION=${ZIZMOR_VERSION}

-# Pinned here, not fetched with the artefact: a compromised release ships its own checksum.
-ARG TRIVY_SHA256_AMD64=2ae6fe3ee734b7fdf11335663e18c75ea12dccc76062f09f164a3b0f8be4371a
-ARG TRIVY_SHA256_ARM64=b94ce1976bbf3c15b514b605ee88be7c6d94a29be2302847ff01cb794d47aad5
-ARG POWERSHELL_SHA256_AMD64=82a8b13d92b0f3ae48e56cf2f3f7961679371736ca90145ca71617c2913ba9d8
-ARG POWERSHELL_SHA256_ARM64=830ebda118c731ece3fa7e6b7e8573a21346387cbbca5b2f5e3b9bfe24f96672
-ARG ZIZMOR_SHA256_AMD64=a8000f3c683319a523d3b20df0e75457ba591f049cfcbfa98966631b56733c03
-ARG ZIZMOR_SHA256_ARM64=d66e37ef8a375fb07939c630ebf9709a6e0f20242bdc3faf672a7ed97e0b768d
-
-# High CVEs fixed in Debian trixie but not yet in the pinned base image:
-#   openssl/libssl3t64/openssl-provider-legacy 3.5.7-1~deb13u2  CVE-2026-14456,
-#   -14457, -18798, -54874, -63072, -63073, -63074, -63075, -63076, -75803
-#   libsqlite3-0 3.46.1-7+deb13u2  CVE-2026-11822, -11824
-#   gzip 1.13-1+deb13u1  CVE-2026-41992
-#   perl-base 5.40.1-6+deb13u1  CVE-2026-42497, -48962, -57432
-#   libssh2-1t64 1.11.1-1+deb13u2  CVE-2026-58050
-#   libpcre2-8-0 10.46-1~deb13u2  CVE-2026-86145, -89161
-# Taken as a targeted --only-upgrade rather than by moving the digest: the newest
-# published python:3.12-slim-trixie carries the same vulnerable versions. The three
-# openssl packages are flagged separately, so all are named.
-# Drop each one once the base image ships its fixed version.
 # hadolint ignore=DL3008
 RUN apt-get update && apt-get install -y --no-install-recommends \
    wget \
    git \
-    libicu76 \
+    libicu72 \
    gcc \
    g++ \
    make \
@@ -48,9 +28,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
    libtool \
    libxslt1-dev \
    python3-dev \
-    && apt-get install -y --no-install-recommends --only-upgrade \
-       util-linux libssl3t64 openssl openssl-provider-legacy \
-       libsqlite3-0 gzip perl-base libssh2-1t64 libpcre2-8-0 \
+    git \
    && rm -rf /var/lib/apt/lists/*

 # Install PowerShell
@@ -62,9 +40,6 @@ RUN ARCH=$(uname -m) && \
    else \
        echo "Unsupported architecture: $ARCH" && exit 1 ; \
    fi && \
-    if [ "$ARCH" = "x86_64" ]; then EXPECT="$POWERSHELL_SHA256_AMD64" ; else EXPECT="$POWERSHELL_SHA256_ARM64" ; fi && \
-    echo "$EXPECT  /tmp/powershell.tar.gz" > /tmp/powershell.sha256 && \
-    sha256sum -c /tmp/powershell.sha256 && rm /tmp/powershell.sha256 && \
    mkdir -p /opt/microsoft/powershell/7 && \
    tar zxf /tmp/powershell.tar.gz -C /opt/microsoft/powershell/7 && \
    chmod +x /opt/microsoft/powershell/7/pwsh && \
@@ -81,9 +56,6 @@ RUN ARCH=$(uname -m) && \
        echo "Unsupported architecture for Trivy: $ARCH" && exit 1 ; \
    fi && \
    wget --progress=dot:giga "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_${TRIVY_ARCH}.tar.gz" -O /tmp/trivy.tar.gz && \
-    if [ "$ARCH" = "x86_64" ]; then EXPECT="$TRIVY_SHA256_AMD64" ; else EXPECT="$TRIVY_SHA256_ARM64" ; fi && \
-    echo "$EXPECT  /tmp/trivy.tar.gz" > /tmp/trivy.sha256 && \
-    sha256sum -c /tmp/trivy.sha256 && rm /tmp/trivy.sha256 && \
    tar zxf /tmp/trivy.tar.gz -C /tmp && \
    mv /tmp/trivy /usr/local/bin/trivy && \
    chmod +x /usr/local/bin/trivy && \
@@ -102,9 +74,6 @@ RUN ARCH=$(uname -m) && \
        echo "Unsupported architecture for zizmor: $ARCH" && exit 1 ; \
    fi && \
    wget --progress=dot:giga "https://github.com/zizmorcore/zizmor/releases/download/v${ZIZMOR_VERSION}/zizmor-${ZIZMOR_ARCH}.tar.gz" -O /tmp/zizmor.tar.gz && \
-    if [ "$ARCH" = "x86_64" ]; then EXPECT="$ZIZMOR_SHA256_AMD64" ; else EXPECT="$ZIZMOR_SHA256_ARM64" ; fi && \
-    echo "$EXPECT  /tmp/zizmor.tar.gz" > /tmp/zizmor.sha256 && \
-    sha256sum -c /tmp/zizmor.sha256 && rm /tmp/zizmor.sha256 && \
    mkdir -p /tmp/zizmor-extract && \
    tar zxf /tmp/zizmor.tar.gz -C /tmp/zizmor-extract && \
    mv /tmp/zizmor-extract/zizmor /usr/local/bin/zizmor && \
@@ -125,7 +94,7 @@ RUN mkdir -p /tmp/prowler_api_output
 COPY --chown=prowler:prowler pyproject.toml uv.lock ./

 RUN pip install --no-cache-dir --upgrade pip && \
-    pip install --no-cache-dir uv==0.12.0
+    pip install --no-cache-dir uv==0.11.14

 ENV PATH="/home/prowler/.local/bin:$PATH"

@@ -133,41 +102,24 @@ ENV PATH="/home/prowler/.local/bin:$PATH"
 RUN uv sync --locked --no-install-project && \
    rm -rf ~/.cache/uv

-# Invoked as a module so the base image's Python minor version is not baked
-# into a site-packages path.
-RUN .venv/bin/python -m prowler.providers.m365.lib.powershell.m365_powershell
+RUN .venv/bin/python .venv/lib/python3.12/site-packages/prowler/providers/m365/lib/powershell/m365_powershell.py

 USER root

 # Remove build-only packages from the final image after Python dependencies are installed.
-# git is only needed by uv sync for the `prowler @ git+...` dependency; purging it drops perl too.
-# wget stays: the compose healthcheck shells out to it.
 RUN apt-get purge -y --auto-remove \
    gcc \
    g++ \
-    git \
    make \
    libxml2-dev \
    libxmlsec1-dev \
    libxmlsec1-openssl \
-    libxmlsec1t64 \
-    libxmlsec1t64-openssl \
    pkg-config \
    libtool \
    libxslt1-dev \
    python3-dev \
-    gnupg \
-    apt-transport-https \
    && rm -rf /var/lib/apt/lists/*

-# pip is build-only; the entrypoint runs uv against the prepared venv. uv stays.
-RUN rm -rf /usr/local/lib/python3.12/site-packages/pip \
-    /usr/local/lib/python3.12/site-packages/pip-*.dist-info \
-    /home/prowler/.local/lib/python3.12/site-packages/pip \
-    /home/prowler/.local/lib/python3.12/site-packages/pip-*.dist-info \
-    /usr/local/bin/pip /usr/local/bin/pip3 /usr/local/bin/pip3.12 \
-    /home/prowler/.local/bin/pip /home/prowler/.local/bin/pip3 /home/prowler/.local/bin/pip3.12
-
 USER prowler

 COPY --chown=prowler:prowler src/backend/ ./backend/
@@ -1 +0,0 @@
-API key authentication no longer locks the key row on every request and now throttles `last_used_at` updates to once per 60 seconds, preventing a hot key from serializing all its requests onto a single locked row
@@ -1 +0,0 @@
-Adds a periodic sweep that drops orphaned Attack Paths temp Neo4j scan databases left behind when a worker or Neo4j crashes mid-scan, before they accumulate unbounded
@@ -1 +0,0 @@
-Resources no longer keep a stale failed findings count forever when a scoped or imported scan for the same provider completes after a full scan, which used to make the full scan skip its own cleanup
@@ -1 +0,0 @@
-Providers whose most recent completed scan has no `completed_at` timestamp are no longer missing from every endpoint that reports a provider's latest scan, which now falls back to scan creation order instead of skipping the provider
@@ -1 +0,0 @@
-Unify how every endpoint resolves a provider latest completed scan, so overlapping scans no longer make findings, compliance and mute rules read from different scans
@@ -0,0 +1 @@
+Database migrations now give up after a few seconds when another query holds the table lock, instead of stalling every request that touches that table
@@ -1 +0,0 @@
-OCI provider secrets keep the region as home region for credential validation and scans, instead of always using us-ashburn-1
@@ -1 +0,0 @@
-Provider deletion no longer fails when the provider has Attack Paths scans recorded on a sink that is no longer configured, such as Neptune after moving back to Neo4j
@@ -1 +0,0 @@
-`pyjwt` from 2.13.0 to 2.14.0, patching GHSA-ffc3-869f-jxw9
@@ -1 +0,0 @@
-Scan output uploads and downloads can now target S3-compatible object storage such as MinIO directly via `DJANGO_OUTPUT_S3_AWS_ENDPOINT_URL`, instead of relying on process-wide AWS environment variables that also hijacked unrelated AWS API calls
@@ -1 +0,0 @@
-Scan report downloads from an S3 bucket with default SSE-KMS encryption no longer fail with an `InvalidArgument` error: when `DJANGO_OUTPUT_S3_AWS_DEFAULT_REGION` is set, presigned download URLs are signed with AWS Signature Version 4 for that region
@@ -1 +0,0 @@
-`POST /api/v1/scans` again returns the new scan id in the response `task_args`, which had been empty since the scan broker publish moved to transaction commit
@@ -1 +0,0 @@
-`DELETE /api/v1/tasks/{id}` requires the permission of the operation that queued the task and rejects provider deletions, and `GET /api/v1/tasks` hides tasks of providers outside the visibility of the role
@@ -1 +0,0 @@
-Celery loggers are now declared explicitly in `custom_logging.py` so fatal worker errors are no longer silenced by `disable_existing_loggers=True`. All long-running services in `docker-compose.yml` now have `restart: unless-stopped` so containers recover automatically after unexpected crashes.
@@ -45,7 +45,7 @@ dependencies = [
  "gunicorn==26.0.0",
  "uvloop==0.22.1",
  "lxml==6.1.0",
-  "prowler @ git+https://github.com/prowler-cloud/prowler.git@v5.44",
+  "prowler @ git+https://github.com/prowler-cloud/prowler.git@master",
  "psycopg2-binary==2.9.9",
  "pytest-celery[redis] (==1.3.0)",
  "sentry-sdk[django] (==2.56.0)",
@@ -61,9 +61,9 @@ dependencies = [
  "cartography (==0.138.1)",
  "gevent (==25.9.1)",
  "werkzeug (==3.1.7)",
-  "sqlparse (==0.6.0)",
+  "sqlparse (==0.5.5)",
  "fonttools (==4.62.1)",
-  "uvicorn-worker (==0.4.0)"
+  "uvicorn-worker (==0.4.0)",
 ]
 description = "Prowler's API (Django/DRF)"
 license = "Apache-2.0"
@@ -71,7 +71,7 @@ name = "prowler-api"
 package-mode = false
 # Needed for the SDK compatibility
 requires-python = ">=3.11,<3.13"
-version = "1.45.1"
+version = "1.36.0"

 # Shared ruff baseline (kept in sync with mcp_server/pyproject.toml).
 # target-version tracks this project's lowest supported Python.
@@ -92,7 +92,6 @@ extend-select = [

 [tool.uv]
 # Transitive pins matching master to avoid silent drift; bump deliberately.
-# workos is api-only; pyopenssl matches master (PROWLER-2310).
 constraint-dependencies = [
  "about-time==4.2.1",
  "adal==1.2.7",
@@ -100,7 +99,7 @@ constraint-dependencies = [
  "aiobotocore==2.25.1",
  "aiofiles==24.1.0",
  "aiohappyeyeballs==2.6.1",
-  "aiohttp==3.14.3",
+  "aiohttp==3.14.0",
  "aioitertools==0.13.0",
  "aiosignal==1.4.0",
  "alibabacloud-actiontrail20200706==2.4.1",
@@ -129,7 +128,7 @@ constraint-dependencies = [
  "alibabacloud-sls20201230==5.9.0",
  "alibabacloud-sts20150401==1.1.6",
  "alibabacloud-tea==0.4.3",
-  "alibabacloud-tea-openapi==0.4.6",
+  "alibabacloud-tea-openapi==0.4.4",
  "alibabacloud-tea-util==0.3.14",
  "alibabacloud-tea-xml==0.0.3",
  "alibabacloud-vpc20160428==6.13.0",
@@ -137,7 +136,7 @@ constraint-dependencies = [
  "aliyun-log-fastpb==0.2.0",
  "amqp==5.3.1",
  "annotated-types==0.7.0",
-  "anyio==4.14.2",
+  "anyio==4.12.1",
  "applicationinsights==0.11.10",
  "apscheduler==3.11.2",
  "argcomplete==3.5.3",
@@ -211,9 +210,9 @@ constraint-dependencies = [
  "coverage==7.5.4",
  "cron-descriptor==1.4.5",
  "crowdstrike-falconpy==1.6.0",
-  "cryptography==50.0.0",
+  "cryptography==46.0.7",
  "cycler==0.12.1",
-  "darabonba-core==1.0.8",
+  "darabonba-core==1.0.5",
  "dash==3.1.1",
  "dash-bootstrap-components==2.0.3",
  "debugpy==1.8.20",
@@ -278,7 +277,7 @@ constraint-dependencies = [
  "h2==4.3.0",
  "hpack==4.1.0",
  "httpcore==1.0.9",
-  "httplib2==0.32.0",
+  "httplib2==0.31.2",
  "httpx==0.28.1",
  "humanfriendly==10.0",
  "hyperframe==6.1.0",
@@ -315,13 +314,13 @@ constraint-dependencies = [
  "matplotlib==3.10.8",
  "mccabe==0.7.0",
  "mdurl==0.1.2",
-  "microsoft-kiota-abstractions==1.9.10",
-  "microsoft-kiota-authentication-azure==1.9.10",
-  "microsoft-kiota-http==1.9.10",
-  "microsoft-kiota-serialization-form==1.9.10",
-  "microsoft-kiota-serialization-json==1.9.10",
-  "microsoft-kiota-serialization-multipart==1.9.10",
-  "microsoft-kiota-serialization-text==1.9.10",
+  "microsoft-kiota-abstractions==1.9.9",
+  "microsoft-kiota-authentication-azure==1.9.9",
+  "microsoft-kiota-http==1.9.9",
+  "microsoft-kiota-serialization-form==1.9.9",
+  "microsoft-kiota-serialization-json==1.9.9",
+  "microsoft-kiota-serialization-multipart==1.9.9",
+  "microsoft-kiota-serialization-text==1.9.9",
  "microsoft-security-utilities-secret-masker==1.0.0b4",
  "msal==1.35.0b1",
  "msal-extensions==1.2.0",
@@ -338,7 +337,7 @@ constraint-dependencies = [
  "nltk==3.9.4",
  "numpy==2.2.6",
  "oauthlib==3.3.1",
-  "oci==2.184.1",
+  "oci==2.169.0",
  "openai==1.109.1",
  "openstacksdk==4.2.0",
  "opentelemetry-api==1.39.1",
@@ -350,7 +349,7 @@ constraint-dependencies = [
  "pagerduty==6.1.0",
  "pandas==2.2.3",
  "pbr==7.0.3",
-  "pillow==12.3.0",
+  "pillow==12.2.0",
  "pkginfo==1.12.1.2",
  "platformdirs==4.5.1",
  "plotly==6.5.2",
@@ -366,8 +365,8 @@ constraint-dependencies = [
  "psycopg2-binary==2.9.9",
  "py-deviceid==0.1.1",
  "py-iam-expand==0.3.0",
-  "py-ocsf-models==0.10.0",
-  "pyasn1==0.6.4",
+  "py-ocsf-models==0.8.1",
+  "pyasn1==0.6.3",
  "pyasn1-modules==0.4.2",
  "pycodestyle==2.14.0",
  "pycparser==3.0",
@@ -375,11 +374,11 @@ constraint-dependencies = [
  "pydantic-core==2.41.5",
  "pygithub==2.8.0",
  "pygments==2.20.0",
-  "pyjwt==2.14.0",
+  "pyjwt==2.13.0",
  "pylint==3.2.5",
  "pymsalruntime==0.18.1",
  "pynacl==1.6.2",
-  "pyopenssl==26.4.0",
+  "pyopenssl==26.0.0",
  "pyparsing==3.3.2",
  "pyreadline3==3.5.4",
  "pysocks==1.7.1",
@@ -423,7 +422,7 @@ constraint-dependencies = [
  "six==1.17.0",
  "slack-sdk==3.39.0",
  "sniffio==1.3.1",
-  "sqlparse==0.6.0",
+  "sqlparse==0.5.5",
  "statsd==4.0.1",
  "std-uritemplate==2.0.8",
  "stevedore==5.6.0",
@@ -448,7 +447,7 @@ constraint-dependencies = [
  "wcwidth==0.5.3",
  "websocket-client==1.9.0",
  "werkzeug==3.1.7",
-  "workos==8.3.0",
+  "workos==6.0.8",
  "wrapt==1.17.3",
  "xlsxwriter==3.2.9",
  "xmlsec==1.3.17",
@@ -457,7 +456,7 @@ constraint-dependencies = [
  "zipp==3.23.0",
  "zope-event==6.1",
  "zope-interface==8.2",
-  "zstd==1.5.7.2"
+  "zstd==1.5.7.3"
 ]
 # prowler@master needs okta==3.4.2, but cartography 0.138.1 requires okta<1.0.0.
 # Attack Paths does not ingest Okta today, so override the Cartography
@@ -467,38 +466,22 @@ constraint-dependencies = [
 # 0.138.1 requires azure-mgmt-containerservice>=41.0.0. Attack Paths does not
 # ingest Azure today, so override the Cartography dependency to the Prowler pin.
 #
-# prowler@master hard-pins the microsoft-kiota packages in [project.dependencies].
-# microsoft-kiota-serialization-json 1.9.10 fixes get_collection_of_enum_values
-# returning [] for flags enums serialized as CSV strings (microsoft/kiota-python#515),
-# which broke the Entra Conditional Access guest-user checks; the kiota packages
-# release in lockstep and 1.9.10 requires microsoft-kiota-abstractions>=1.9.10, which
-# a constraint cannot satisfy against the SDK's hard pins, so override the whole set
-# to 1.9.10 until the SDK bump propagates to the pinned master rev.
+# prowler@master hard-pins microsoft-kiota-abstractions==1.9.2 in [project.dependencies].
+# The microsoft-kiota-http security bump to 1.9.9 (GHSA-7j59-v9qr-6fq9) requires
+# microsoft-kiota-abstractions>=1.9.9, which a constraint cannot satisfy against the
+# SDK's hard pin; override it to the patched, kiota-aligned version.
 #
 # prowler@master hard-pins dulwich==0.23.0 and pyjwt==2.12.1 in [project.dependencies].
-# dulwich 1.2.5 patches GHSA-897w-fcg9-f6xj (arbitrary file write) and pyjwt 2.14.0
-# patches GHSA-ffc3-869f-jxw9 (HMAC/PEM key-confusion); a constraint cannot satisfy these
+# dulwich 1.2.5 patches GHSA-897w-fcg9-f6xj (arbitrary file write) and pyjwt 2.13.0
+# patches PYSEC-2026-179 (HMAC/JWK key-confusion); a constraint cannot satisfy these
 # against the SDK's hard pins, so override them to the patched versions until the SDK
 # bump propagates to the pinned master rev. pyjwt keeps the [crypto] extra because an
 # override replaces the whole requirement; bare pyjwt would drop it from the consumers
 # that request pyjwt[crypto] and leave cryptography (needed for RS256) only transitive.
 override-dependencies = [
  "okta==3.4.2",
-  # prowler requires cryptography==50.0.0. Two api-only dependencies still cap it below
-  # 49 and cannot move yet: msal, pinned exactly by azure-cli-core (2.83.0 -> 1.35.0b1,
-  # 2.89.1 -> 1.36.0, both <49; cartography needs azure-cli-core), and workos 8.3.0
-  # (~=48.0; workos 10.1.1+ needs ~=50.0 and is a separate SDK upgrade). This api is
-  # deployed from this lock with `uv sync --locked`, so the override applies to what runs.
-  # Remove when azure-cli-core pins msal>=1.37.0 and workos is on 10.x.
-  "cryptography==50.0.0",
  "azure-mgmt-containerservice==34.1.0",
-  "microsoft-kiota-abstractions==1.9.10",
-  "microsoft-kiota-authentication-azure==1.9.10",
-  "microsoft-kiota-http==1.9.10",
-  "microsoft-kiota-serialization-form==1.9.10",
-  "microsoft-kiota-serialization-json==1.9.10",
-  "microsoft-kiota-serialization-multipart==1.9.10",
-  "microsoft-kiota-serialization-text==1.9.10",
+  "microsoft-kiota-abstractions==1.9.9",
  "dulwich==1.2.5",
-  "pyjwt[crypto]==2.14.0"
+  "pyjwt[crypto]==2.13.0"
 ]
@@ -1,7 +1,5 @@
-from allauth.account.models import EmailAddress
-from allauth.core.exceptions import ImmediateHttpResponse
 from allauth.socialaccount.adapter import DefaultSocialAccountAdapter
-from api.db_router import MainRouter, write_db_alias
+from api.db_router import MainRouter
 from api.db_utils import rls_transaction
 from api.models import (
    Membership,
@@ -12,37 +10,10 @@ from api.models import (
    UserRoleRelationship,
 )
 from api.utils import accept_invitation_for_user
-from django.core.exceptions import ValidationError
 from django.db import transaction
-from django.http import HttpResponseForbidden


 class ProwlerSocialAccountAdapter(DefaultSocialAccountAdapter):
-    @staticmethod
-    def _get_social_account_name(extra_data: dict, email: str) -> str:
-        name_field = User._meta.get_field("name")
-        for value in (
-            extra_data.get("name"),
-            extra_data.get("login"),
-            extra_data.get("username"),
-            email,
-        ):
-            if not isinstance(value, str):
-                continue
-
-            candidate = value.strip()[: name_field.max_length].rstrip()
-            if not candidate:
-                continue
-
-            try:
-                name_field.run_validators(candidate)
-            except ValidationError:
-                continue
-
-            return candidate
-
-        raise ValueError("Social account does not provide a valid user identity.")
-
    @staticmethod
    def get_user_by_email(email: str):
        try:
@@ -67,13 +38,8 @@ class ProwlerSocialAccountAdapter(DefaultSocialAccountAdapter):
        return None

    def pre_social_login(self, request, sociallogin):
-        # The provider account is already bound, so no email-based linking is needed.
-        if sociallogin.account.pk:
-            return
-
-        # Prefer the normalized email populated by allauth. GitHub can return the
-        # primary email separately from the profile stored in extra_data.
-        email = sociallogin.user.email or sociallogin.account.extra_data.get("email")
+        # Link existing accounts with the same email address
+        email = sociallogin.account.extra_data.get("email")
        if sociallogin.provider.id == "saml":
            # For SAML, the asserted NameID email cannot be trusted on its own:
            # any tenant can claim any email domain in its SAML configuration. To
@@ -114,17 +80,6 @@ class ProwlerSocialAccountAdapter(DefaultSocialAccountAdapter):
        if email:
            existing_user = self.get_user_by_email(email)
            if existing_user:
-                email_is_verified = EmailAddress.objects.filter(
-                    user=existing_user,
-                    email__iexact=email,
-                    verified=True,
-                ).exists()
-                provider_verified_email = any(
-                    address.verified and address.email.casefold() == email.casefold()
-                    for address in sociallogin.email_addresses
-                )
-                if not email_is_verified or not provider_verified_email:
-                    raise ImmediateHttpResponse(HttpResponseForbidden())
                sociallogin.connect(request, existing_user)

    def save_user(self, request, sociallogin, form=None):
@@ -133,17 +88,17 @@ class ProwlerSocialAccountAdapter(DefaultSocialAccountAdapter):
        and is about to be saved to the DB for the first time.
        """
        with transaction.atomic(using=MainRouter.admin_db):
-            # Allauth saves the user without an explicit alias. Route that save
-            # through admin so every signup record shares this transaction.
-            with write_db_alias(MainRouter.admin_db):
-                user = super().save_user(request, sociallogin, form)
+            user = super().save_user(request, sociallogin, form)
            provider = sociallogin.provider.id
            extra = sociallogin.account.extra_data

            if provider != "saml":
                # Handle other providers (e.g., GitHub, Google)
-                user.name = self._get_social_account_name(extra, user.email)
                user.save(using=MainRouter.admin_db)
+                social_account_name = extra.get("name")
+                if social_account_name:
+                    user.name = social_account_name
+                    user.save(using=MainRouter.admin_db)

                invitation_token = self._get_invitation_token(request)
                if invitation_token:
@@ -1,6 +1,5 @@
 from api.attack_paths.queries import (
    AttackPathsQueryDefinition,
-    AttackPathsQueryOutcome,
    AttackPathsQueryParameterDefinition,
    get_queries_for_provider,
    get_query_by_id,
@@ -8,7 +7,6 @@ from api.attack_paths.queries import (

 __all__ = [
    "AttackPathsQueryDefinition",
-    "AttackPathsQueryOutcome",
    "AttackPathsQueryParameterDefinition",
    "get_queries_for_provider",
    "get_query_by_id",
@@ -27,7 +27,6 @@ from django.conf import (
 MAX_CUSTOM_QUERY_NODES = env.int("ATTACK_PATHS_MAX_CUSTOM_QUERY_NODES", default=250)

 TEMP_DB_PREFIX = "db-tmp-scan-"
-DATABASE_NOT_FOUND_CODE = "Neo.ClientError.Database.DatabaseNotFound"


 # Exceptions
@@ -45,10 +44,6 @@ class GraphDatabaseQueryException(Exception):
        return self.message


-class NeptuneWriteRetryExhaustedException(GraphDatabaseQueryException):
-    pass
-
-
 class WriteQueryNotAllowedException(GraphDatabaseQueryException):
    pass

@@ -207,11 +202,6 @@ def drop_database(database: str) -> None:
    sink_module.get_backend().drop_database(database)


-def list_databases() -> list[str]:
-    """List database names on the ingest cluster. Temp scan DBs always live here."""
-    return ingest.list_databases()
-
-
 def drop_subgraph(database: str, provider_id: str) -> int:
    return sink_module.get_backend().drop_subgraph(database, provider_id)

@@ -13,7 +13,6 @@ from api.attack_paths.ingest.driver import (
    get_session,
    get_uri,
    init_driver,
-    list_databases,
    run_cypher,
 )

@@ -26,6 +25,5 @@ __all__ = [
    "get_session",
    "get_uri",
    "init_driver",
-    "list_databases",
    "run_cypher",
 ]
@@ -165,14 +165,6 @@ def drop_database(database: str) -> None:
        session.run(f"DROP DATABASE `{database}` IF EXISTS DESTROY DATA")


-def list_databases() -> list[str]:
-    """List every database name on the Neo4j temp-database cluster."""
-    # A cluster returns one row per hosting server, so dedupe on name
-    with get_session() as session:
-        result = session.run("SHOW DATABASES YIELD name RETURN DISTINCT name")
-        return [record["name"] for record in result]
-
-
 def clear_cache(database: str) -> None:
    """Best-effort cache clear for a Neo4j database."""
    from api.attack_paths.database import GraphDatabaseQueryException
@@ -4,13 +4,11 @@ from api.attack_paths.queries.registry import (
 )
 from api.attack_paths.queries.types import (
    AttackPathsQueryDefinition,
-    AttackPathsQueryOutcome,
    AttackPathsQueryParameterDefinition,
 )

 __all__ = [
    "AttackPathsQueryDefinition",
-    "AttackPathsQueryOutcome",
    "AttackPathsQueryParameterDefinition",
    "get_queries_for_provider",
    "get_query_by_id",
@@ -1,38 +1,4 @@
 from dataclasses import dataclass, field
-from enum import Enum
-
-
-@dataclass(frozen=True)
-class AttackPathsQueryOutcomeMeta:
-    """Display metadata for an outcome kind.
-
-    `label` and `partial` are properties of the outcome *kind*, not of an
-    individual query, so they live here once and every query just references a
-    kind. `partial` marks a latent/posture outcome (e.g. inventory) that the UI
-    renders as a marker rather than a full realized outcome.
-    """
-
-    kind: str
-    label: str
-    partial: bool = False
-
-
-class AttackPathsQueryOutcome(Enum):
-    """The terminal impact an attack-path query leads to.
-
-    Set per query and exposed by the API so the UI can render the graph's
-    terminal outcome node. The taxonomy is shared with Prowler Hub's attack-path
-    diagram (whose terminal labels match these values).
-    """
-
-    CODE_EXECUTION = AttackPathsQueryOutcomeMeta("code_execution", "Code execution")
-    PRIVILEGE_ESCALATION = AttackPathsQueryOutcomeMeta(
-        "privilege_escalation", "Privilege escalation"
-    )
-    PUBLIC_EXPOSURE = AttackPathsQueryOutcomeMeta("public_exposure", "Public exposure")
-    RESOURCE_INVENTORY = AttackPathsQueryOutcomeMeta(
-        "resource_inventory", "Resource inventory", partial=True
-    )


@dataclass
@@ -70,5 +36,4 @@ class AttackPathsQueryDefinition:
    provider: str
    cypher: str
    attribution: AttackPathsQueryAttribution | None = None
-    outcome: AttackPathsQueryOutcome | None = None
    parameters: list[AttackPathsQueryParameterDefinition] = field(default_factory=list)
@@ -10,28 +10,6 @@ import neo4j.exceptions
 logger = logging.getLogger(__name__)


-class RetryExhaustedError(Exception):
-    def __init__(
-        self,
-        *,
-        retry_context: str,
-        method_name: str,
-        attempts: int,
-        elapsed_seconds: float,
-        last_error: Exception,
-    ) -> None:
-        self.retry_context = retry_context
-        self.method_name = method_name
-        self.attempts = attempts
-        self.elapsed_seconds = elapsed_seconds
-        self.last_error = last_error
-        last_message = getattr(last_error, "message", None) or str(last_error)
-        super().__init__(
-            f"{retry_context} {method_name} failed after {attempts} attempts over "
-            f"{elapsed_seconds:.3f}s. Last error: {last_message}"
-        )
-
-
 class RetryableSession:
    """Wrapper around ``neo4j.Session`` with a refreshable retry policy."""

@@ -41,13 +19,11 @@ class RetryableSession:
        max_retries: int,
        retry_if: Callable[[Exception], bool] | None = None,
        initial_retry_delay_seconds: float = 0,
-        retry_context: str | None = None,
    ) -> None:
        self._session_factory = session_factory
        self._max_retries = max(0, max_retries)
        self._retry_if = retry_if
        self._initial_retry_delay_seconds = max(0.0, initial_retry_delay_seconds)
-        self._retry_context = retry_context
        self._session = self._session_factory()

    def close(self) -> None:
@@ -78,7 +54,6 @@ class RetryableSession:
    def _call_with_retry(self, method_name: str, *args: Any, **kwargs: Any) -> Any:
        attempt = 0
        last_exc: Exception | None = None
-        started_at = time.monotonic()

        while attempt <= self._max_retries:
            try:
@@ -93,38 +68,17 @@ class RetryableSession:
                attempt += 1

                if attempt > self._max_retries:
-                    if self._retry_context is not None:
-                        raise RetryExhaustedError(
-                            retry_context=self._retry_context,
-                            method_name=method_name,
-                            attempts=attempt,
-                            elapsed_seconds=time.monotonic() - started_at,
-                            last_error=exc,
-                        ) from exc
                    raise

                delay = self._retry_delay(attempt)
-                if self._retry_context is not None:
-                    error_message = getattr(exc, "message", None) or str(exc)
-                    logger.warning(
-                        "%s %s failed with %s: %s; retry %s/%s in %.3fs",
-                        self._retry_context,
-                        method_name,
-                        type(exc).__name__,
-                        error_message,
-                        attempt,
-                        self._max_retries,
-                        delay,
-                    )
-                else:
-                    logger.warning(
-                        "Graph session %s failed with %s; retry %s/%s in %.3fs",
-                        method_name,
-                        type(exc).__name__,
-                        attempt,
-                        self._max_retries,
-                        delay,
-                    )
+                logger.warning(
+                    "Graph session %s failed with %s; retry %s/%s in %.3fs",
+                    method_name,
+                    type(exc).__name__,
+                    attempt,
+                    self._max_retries,
+                    delay,
+                )
                self._refresh_session()
                if delay:
                    time.sleep(delay)
@@ -15,8 +15,6 @@ class SinkDatabase(Protocol):
    has a single graph, and isolation is label-based).
    """

-    sync_batch_size: int
-
    def init(self) -> None: ...

    def close(self) -> None: ...
@@ -54,8 +54,6 @@ DATABASE_NOT_FOUND_CODE = "Neo.ClientError.Database.DatabaseNotFound"
 class Neo4jSink(SinkDatabase):
    """Neo4j-backed sink. Multi-database cluster; tenant isolation is physical."""

-    sync_batch_size = env.int("ATTACK_PATHS_NEO4J_SYNC_BATCH_SIZE", default=1000)
-
    def __init__(self) -> None:
        self._driver: neo4j.Driver | None = None
        self._lock = threading.Lock()
@@ -205,7 +203,7 @@ class Neo4jSink(SinkDatabase):
        """
        from api.attack_paths.database import GraphDatabaseQueryException
        from tasks.jobs.attack_paths.config import (
-            GRAPH_MUTATION_BATCH_SIZE,
+            BATCH_SIZE,
            PROVIDER_RESOURCE_LABEL,
            get_provider_label,
        )
@@ -253,7 +251,7 @@ class Neo4jSink(SinkDatabase):
                        total_key="rels",
                        deleted_key="deleted_rels",
                        initial_total=deleted_relationships,
-                        batch_size=GRAPH_MUTATION_BATCH_SIZE,
+                        batch_size=BATCH_SIZE,
                        drop_t0=drop_t0,
                    )
                    relationship_batches += phase_batches
@@ -272,7 +270,7 @@ class Neo4jSink(SinkDatabase):
                    total_key="nodes",
                    deleted_key="deleted_nodes",
                    initial_total=0,
-                    batch_size=GRAPH_MUTATION_BATCH_SIZE,
+                    batch_size=BATCH_SIZE,
                    drop_t0=drop_t0,
                )

@@ -25,7 +25,7 @@ from urllib.parse import urlsplit

 import neo4j
 import neo4j.exceptions
-from api.attack_paths.retryable_session import RetryableSession, RetryExhaustedError
+from api.attack_paths.retryable_session import RetryableSession
 from api.attack_paths.sink.base import SinkDatabase
 from api.attack_paths.sink.drop import (
    NODE_DELETE_QUERY_TEMPLATE,
@@ -85,8 +85,6 @@ def _is_retryable_write_error(exc: Exception) -> bool:
 class NeptuneSink(SinkDatabase):
    """Neptune-backed sink. Single database; isolation is label-based."""

-    sync_batch_size = env.int("ATTACK_PATHS_NEPTUNE_SYNC_BATCH_SIZE", default=500)
-
    def __init__(self) -> None:
        self._writer: neo4j.Driver | None = None
        self._reader: neo4j.Driver | None = None
@@ -208,7 +206,6 @@ class NeptuneSink(SinkDatabase):
        from api.attack_paths.database import (
            ClientStatementException,
            GraphDatabaseQueryException,
-            NeptuneWriteRetryExhaustedException,
            WriteQueryNotAllowedException,
        )

@@ -230,17 +227,9 @@ class NeptuneSink(SinkDatabase):
                initial_retry_delay_seconds=(
                    NEPTUNE_WRITE_RETRY_DELAY_SECONDS if is_write_session else 0
                ),
-                retry_context="Neptune write" if is_write_session else None,
            )
            yield session_wrapper

-        except RetryExhaustedError as exc:
-            last_error = exc.last_error
-            raise NeptuneWriteRetryExhaustedException(
-                message=str(exc),
-                code=getattr(last_error, "code", None),
-            ) from last_error
-
        except neo4j.exceptions.Neo4jError as exc:
            if (
                default_access_mode == neo4j.READ_ACCESS
@@ -302,7 +291,7 @@ class NeptuneSink(SinkDatabase):
        graph's branching factor.
        """
        from tasks.jobs.attack_paths.config import (
-            GRAPH_MUTATION_BATCH_SIZE,
+            BATCH_SIZE,
            PROVIDER_RESOURCE_LABEL,
            get_provider_label,
        )
@@ -341,7 +330,7 @@ class NeptuneSink(SinkDatabase):
                    total_key="rels",
                    deleted_key="deleted_rels",
                    initial_total=deleted_relationships,
-                    batch_size=GRAPH_MUTATION_BATCH_SIZE,
+                    batch_size=BATCH_SIZE,
                    drop_t0=drop_t0,
                )
                relationship_batches += phase_batches
@@ -360,7 +349,7 @@ class NeptuneSink(SinkDatabase):
                total_key="nodes",
                deleted_key="deleted_nodes",
                initial_total=0,
-                batch_size=GRAPH_MUTATION_BATCH_SIZE,
+                batch_size=BATCH_SIZE,
                drop_t0=drop_t0,
            )

@@ -115,26 +115,7 @@ def execute_query(
        # TODO: drop after Neptune cutover
        # Route reads by the scan row's recorded sink, not by current settings.
        backend = sink_module.get_backend_for_scan(scan)
-
-        cypher = definition.cypher
-        # Every synced node carries a `_Provider_{uuid}` isolation label (the
-        # sync labels the whole provider subgraph). Injecting it into the
-        # predefined query's node patterns gives the planner a selective label
-        # index to seed from instead of a global label scan (`:AWSRole` across
-        # every tenant), which on Neptune is the difference between a sub-second
-        # plan and a query that times out. The custom-query path relies on this
-        # same injection.
-        #
-        # Restrict it to migrated scans: that catalog runs on the Neptune sink
-        # where the plan blowup happens, while the pre-cutover legacy catalog
-        # runs on the old sink and is dropped after the cutover, so leave it
-        # byte-for-byte unchanged. This only affects the query plan, not
-        # isolation - `_serialize_graph` already label-filters both catalogs.
-        # TODO: drop the is_migrated guard after Neptune cutover
-        if scan.is_migrated:
-            cypher = inject_provider_label(cypher, provider_id)
-
-        graph = backend.execute_read_query(database_name, cypher, parameters)
+        graph = backend.execute_read_query(database_name, definition.cypher, parameters)
        return _serialize_graph(graph, provider_id)

    except graph_database.WriteQueryNotAllowedException:
@@ -1,5 +1,3 @@
-import logging
-from datetime import timedelta
 from math import isfinite
 from uuid import UUID

@@ -7,7 +5,6 @@ from api.db_router import MainRouter
 from api.models import TenantAPIKey, TenantAPIKeyManager
 from cryptography.fernet import InvalidToken
 from django.core.exceptions import ObjectDoesNotExist
-from django.db.models import Q
 from django.utils import timezone
 from drf_simple_apikey.backends import APIKeyAuthentication as BaseAPIKeyAuth
 from drf_simple_apikey.crypto import get_crypto
@@ -17,19 +14,6 @@ from rest_framework.exceptions import AuthenticationFailed
 from rest_framework.request import Request
 from rest_framework_simplejwt.authentication import JWTAuthentication

-logger = logging.getLogger(__name__)
-
-# Writing on every request makes all requests of a busy key contend on one row
-API_KEY_LAST_USED_AT_THROTTLE_SECONDS = 60
-
-
-class OrphanedAPIKeyError(Exception):
-    """Raised when an API key outlived the user that owns it.
-
-    The revocation is written by a plain `update()` before this is raised, so it is
-    already persisted by the time `authenticate` catches it and rejects the request.
-    """
-

 class TenantAPIKeyAuthentication(BaseAPIKeyAuth):
    model = TenantAPIKey
@@ -40,14 +24,10 @@ class TenantAPIKeyAuthentication(BaseAPIKeyAuth):
    def _authenticate_credentials(self, request, key):
        """
        Override to use admin connection, bypassing RLS during authentication.
-
-        Returns the validated API key row from a single read. `authenticate` builds
-        the auth claims from that same row instead of looking it up again, so a key
-        revoked or orphaned right after validation can't still authenticate.
        """
        try:
            payload = self.key_crypto.decrypt(key)
-        except (ValueError, InvalidToken):
+        except ValueError:
            raise AuthenticationFailed("Invalid API Key.")

        if not isinstance(payload, dict):
@@ -72,36 +52,13 @@ class TenantAPIKeyAuthentication(BaseAPIKeyAuth):
            raise AuthenticationFailed("API Key has already expired.")

        try:
-            # Loading `entity` in the same query keeps a user deleted after this read
-            # from turning the later `api_key.entity` access into a 500
-            api_key = (
-                self.model.objects.using(MainRouter.admin_db)
-                .select_related("entity")
-                .get(id=api_key_pk)
-            )
+            api_key = self.model.objects.using(MainRouter.admin_db).get(id=api_key_pk)
        except ObjectDoesNotExist:
            raise AuthenticationFailed("No entity matching this api key.")

        if api_key.revoked:
            raise AuthenticationFailed("This API Key has been revoked.")

-        # `entity` is nullable and `on_delete=SET_NULL` leaves the key behind when its
-        # owner is deleted, so a key can outlive its user. Reject it here: further down
-        # the authentication would return `None` as the authenticated user, which blows
-        # up while building the auth dict and surfaces as a 500 instead of a 401.
-        # Revoke it as well, so it stops showing up as active and later attempts fail
-        # the `revoked` check above like any other revoked key.
-        if api_key.entity_id is None:
-            self.model.objects.using(MainRouter.admin_db).filter(
-                id=api_key.id, revoked=False
-            ).update(revoked=True)
-            logger.warning(
-                "Revoked orphaned API key: prefix=%s tenant=%s",
-                api_key.prefix,
-                api_key.tenant_id,
-            )
-            raise OrphanedAPIKeyError
-
        client_ip = request.META.get(package_settings.IP_ADDRESS_HEADER)
        if api_key.blacklisted_ips and client_ip in api_key.blacklisted_ips:
            raise AuthenticationFailed("Access denied from blacklisted IP.")
@@ -109,7 +66,7 @@ class TenantAPIKeyAuthentication(BaseAPIKeyAuth):
        if api_key.whitelisted_ips and client_ip not in api_key.whitelisted_ips:
            raise AuthenticationFailed("Access restricted to specific IP addresses.")

-        return api_key
+        return api_key.entity, key

    def authenticate(self, request: Request):
        prefixed_key = self.get_key(request)
@@ -121,38 +78,36 @@ class TenantAPIKeyAuthentication(BaseAPIKeyAuth):
            raise AuthenticationFailed("Invalid API Key.")

        try:
-            api_key = self._authenticate_credentials(request, key)
-        except OrphanedAPIKeyError:
-            raise AuthenticationFailed("No entity matching this api key.")
-
-        # The prefix used to be checked by the second lookup
-        if api_key.prefix != prefix:
+            entity, _ = self._authenticate_credentials(request, key)
+        except InvalidToken:
            raise AuthenticationFailed("Invalid API Key.")

-        self._throttled_touch_last_used_at(api_key)
+        # Get the API key instance to update last_used_at and retrieve tenant info
+        # We need to decrypt again to get the pk (already validated by _authenticate_credentials)
+        payload = self.key_crypto.decrypt(key)
+        api_key_pk = payload["_pk"]
+
+        # Convert string UUID back to UUID object for lookup
+        if isinstance(api_key_pk, str):
+            api_key_pk = UUID(api_key_pk)
+
+        try:
+            api_key_instance = TenantAPIKey.objects.using(MainRouter.admin_db).get(
+                id=api_key_pk, prefix=prefix
+            )
+        except TenantAPIKey.DoesNotExist:
+            raise AuthenticationFailed("Invalid API Key.")
+
+        # Update last_used_at
+        api_key_instance.last_used_at = timezone.now()
+        api_key_instance.save(update_fields=["last_used_at"], using=MainRouter.admin_db)

-        entity = api_key.entity
        return entity, {
-            "tenant_id": str(api_key.tenant_id),
-            "sub": str(entity.id),
-            "api_key_prefix": api_key.prefix,
+            "tenant_id": str(api_key_instance.tenant_id),
+            "sub": str(api_key_instance.entity.id),
+            "api_key_prefix": prefix,
        }

-    @staticmethod
-    def _throttled_touch_last_used_at(api_key: TenantAPIKey) -> None:
-        """Write `last_used_at` at most once per throttle interval, without locking the row."""
-        now = timezone.now()
-        stale_before = now - timedelta(seconds=API_KEY_LAST_USED_AT_THROTTLE_SECONDS)
-
-        if api_key.last_used_at is not None and api_key.last_used_at >= stale_before:
-            return
-
-        TenantAPIKey.objects.using(MainRouter.admin_db).filter(
-            id=api_key.id, revoked=False
-        ).filter(
-            Q(last_used_at__isnull=True) | Q(last_used_at__lt=stale_before)
-        ).update(last_used_at=now)
-

 class CombinedJWTOrAPIKeyAuthentication(BaseAuthentication):
    jwt_auth = JWTAuthentication()
@@ -3,10 +3,9 @@ from api.db_router import MainRouter, reset_read_db_alias, set_read_db_alias
 from api.db_utils import POSTGRES_USER_VAR, rls_transaction
 from api.filters import CustomDjangoFilterBackend
 from api.models import Role, UserRoleRelationship
-from api.rbac.permissions import HasPermissions, get_role
+from api.rbac.permissions import HasPermissions
 from django.conf import settings
 from django.db import transaction
-from django.utils.functional import cached_property
 from rest_framework import permissions
 from rest_framework.exceptions import NotAuthenticated
 from rest_framework.filters import SearchFilter
@@ -101,11 +100,6 @@ class BaseRLSViewSet(BaseViewSet):
        context["tenant_id"] = self.request.tenant_id
        return context

-    @cached_property
-    def user_role(self):
-        """Role of the requesting user in the active tenant, resolved once per request."""
-        return get_role(self.request.user, self.request.tenant_id)
-

 class BaseTenantViewset(BaseViewSet):
    def dispatch(self, request, *args, **kwargs):
@@ -1,40 +0,0 @@
-import ast
-import json
-from typing import Any
-
-_UNPARSED = object()
-
-
-def decode_celery_field(value: Any, default: Any) -> Any:
-    """Decode a Celery result field and require JSON-serializable output."""
-    decoded = value
-    for _ in range(2):
-        if not isinstance(decoded, str):
-            break
-
-        text = decoded.strip()
-        if not text:
-            decoded = default
-            break
-
-        parsed = _UNPARSED
-        for parser in (json.loads, ast.literal_eval):
-            try:
-                parsed = parser(text)
-                break
-            except (TypeError, ValueError, SyntaxError):
-                continue
-
-        if parsed is _UNPARSED:
-            raise ValueError("Unable to decode Celery result field")
-        decoded = parsed
-
-    decoded = default if decoded is None else decoded
-    try:
-        json.dumps(decoded, allow_nan=False)
-    except (TypeError, ValueError) as error:
-        raise ValueError(
-            "Decoded Celery result field is not JSON serializable"
-        ) from error
-
-    return decoded
@@ -1,4 +1,3 @@
-from contextlib import contextmanager
 from contextvars import ContextVar

 from django.conf import settings
@@ -6,7 +5,6 @@ from django.conf import settings
 ALLOWED_APPS = ("django", "socialaccount", "account", "authtoken", "silk")

 _read_db_alias = ContextVar("read_db_alias", default=None)
-_write_db_alias = ContextVar("write_db_alias", default=None)


 def set_read_db_alias(alias: str | None):
@@ -24,30 +22,6 @@ def reset_read_db_alias(token) -> None:
        _read_db_alias.reset(token)


-def set_write_db_alias(alias: str | None):
-    if not alias:
-        return None
-    return _write_db_alias.set(alias)
-
-
-def get_write_db_alias() -> str | None:
-    return _write_db_alias.get()
-
-
-def reset_write_db_alias(token) -> None:
-    if token is not None:
-        _write_db_alias.reset(token)
-
-
-@contextmanager
-def write_db_alias(alias: str | None):
-    token = set_write_db_alias(alias)
-    try:
-        yield
-    finally:
-        reset_write_db_alias(token)
-
-
 class MainRouter:
    default_db = "default"
    admin_db = "admin"
@@ -69,9 +43,6 @@ class MainRouter:
        model_table_name = model._meta.db_table
        if any(model_table_name.startswith(f"{app}_") for app in ALLOWED_APPS):
            return self.admin_db
-        write_alias = get_write_db_alias()
-        if write_alias:
-            return write_alias
        return None

    def allow_migrate(self, db, app_label, model_name=None, **hints):  # noqa: F841
@@ -409,7 +409,7 @@ def batch_delete(tenant_id, queryset, batch_size=settings.DJANGO_DELETION_BATCH_

    Args:
        tenant_id (str): Tenant ID the queryset belongs to.
-        queryset: The queryset of objects to delete.
+        queryset (QuerySet): The queryset of objects to delete.
        batch_size (int): The number of objects to delete in each batch.

    Returns:
@@ -1,13 +1,12 @@
 import uuid
 from functools import wraps

-from api.attack_paths.database import GraphDatabaseQueryException
 from api.db_router import READ_REPLICA_ALIAS
 from api.db_utils import POSTGRES_TENANT_VAR, SET_CONFIG_QUERY, rls_transaction
 from api.exceptions import ProviderDeletedException
-from api.models import Membership, Provider, Scan, Tenant
+from api.models import Provider, Scan
 from django.core.exceptions import ObjectDoesNotExist
-from django.db import DEFAULT_DB_ALIAS, DatabaseError, connection, transaction
+from django.db import DatabaseError, connection, transaction
 from rest_framework_json_api.serializers import ValidationError


@@ -76,11 +75,9 @@ def handle_provider_deletion(func):
    """
    Decorator that raises `ProviderDeletedException` if provider was deleted during execution.

-    Catches `ObjectDoesNotExist`, `DatabaseError` (including `IntegrityError`), and
-    `GraphDatabaseQueryException`, checks if provider still exists, and raises
-    `ProviderDeletedException` if not. Graph database errors also check whether the
-    tenant still exists and has memberships. Otherwise, re-raises the original
-    exception.
+    Catches `ObjectDoesNotExist` and `DatabaseError` (including `IntegrityError`), checks if
+    provider still exists, and raises `ProviderDeletedException` if not. Otherwise,
+    re-raises original exception.

    Requires `tenant_id` and `provider_id` in kwargs.

@@ -95,16 +92,11 @@ def handle_provider_deletion(func):
    def wrapper(*args, **kwargs):
        try:
            return func(*args, **kwargs)
-        except (ObjectDoesNotExist, DatabaseError, GraphDatabaseQueryException) as exc:
+        except (ObjectDoesNotExist, DatabaseError):
            tenant_id = kwargs.get("tenant_id")
            provider_id = kwargs.get("provider_id")
-            database_alias = (
-                DEFAULT_DB_ALIAS
-                if isinstance(exc, GraphDatabaseQueryException)
-                else READ_REPLICA_ALIAS
-            )

-            with rls_transaction(tenant_id, using=database_alias):
+            with rls_transaction(tenant_id, using=READ_REPLICA_ALIAS):
                if provider_id is None:
                    scan_id = kwargs.get("scan_id")
                    if scan_id is None:
@@ -121,13 +113,6 @@ def handle_provider_deletion(func):
                    raise ProviderDeletedException(
                        f"Provider '{provider_id}' was deleted during the scan"
                    ) from None
-                if isinstance(exc, GraphDatabaseQueryException) and (
-                    not Tenant.objects.filter(pk=tenant_id).exists()
-                    or not Membership.objects.filter(tenant_id=tenant_id).exists()
-                ):
-                    raise ProviderDeletedException(
-                        f"Tenant '{tenant_id}' was deleted during the scan"
-                    ) from None
            raise

    return wrapper
@@ -1439,20 +1439,8 @@ class InvitationFilter(FilterSet):
    inserted_at = DateFilter(field_name="inserted_at", lookup_expr="date")
    updated_at = DateFilter(field_name="updated_at", lookup_expr="date")
    expires_at = DateFilter(field_name="expires_at", lookup_expr="date")
-    state = ChoiceFilter(choices=Invitation.State.choices, method="filter_state")
-    state__in = ChoiceInFilter(
-        choices=Invitation.State.choices, lookup_expr="in", method="filter_state_in"
-    )
-
-    def filter_state(self, queryset, name, value):
-        return self.filter_state_in(queryset, name, [value])
-
-    def filter_state_in(self, queryset, name, value):
-        lapsed = Invitation.lapsed_q()
-        query = Q(state__in=value) & ~lapsed
-        if Invitation.State.EXPIRED in value:
-            query |= lapsed
-        return queryset.filter(query)
+    state = ChoiceFilter(choices=Invitation.State.choices)
+    state__in = ChoiceInFilter(choices=Invitation.State.choices, lookup_expr="in")

    class Meta:
        model = Invitation
@@ -0,0 +1,28 @@
+from config.env import env
+from django.core.management.commands.migrate import Command as MigrateCommand
+from django.db import connections
+
+# Any value Postgres accepts for lock_timeout ("5s", "500ms", ...). "0" disables
+# it, the escape hatch for a release whose DDL is expected to wait.
+MIGRATION_LOCK_TIMEOUT = env.str("DJANGO_MIGRATION_LOCK_TIMEOUT", default="5s")
+
+SET_LOCK_TIMEOUT_QUERY = "SELECT set_config('lock_timeout', %s, FALSE);"
+
+
+class Command(MigrateCommand):
+    help = (
+        f"{MigrateCommand.help} Applies lock_timeout to the migration session so DDL "
+        "blocked on a lock fails instead of queueing every later reader behind it."
+    )
+
+    def handle(self, *args, **options):
+        connection = connections[options["database"]]
+
+        # is_local=FALSE keeps the setting alive across each migration's own
+        # transaction. Unlike the RLS tenant variable this is safe to leave on the
+        # session: migrate owns its connection for the life of the process and
+        # never returns it to a pool.
+        with connection.cursor() as cursor:
+            cursor.execute(SET_LOCK_TIMEOUT_QUERY, [MIGRATION_LOCK_TIMEOUT])
+
+        return super().handle(*args, **options)
@@ -1,116 +0,0 @@
-import uuid
-
-import api.rls
-import django.db.models.deletion
-from django.conf import settings
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-    dependencies = [
-        ("api", "0097_attack_paths_scan_db_defaults"),
-        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
-    ]
-
-    operations = [
-        migrations.CreateModel(
-            name="TenantOnboardingProfile",
-            fields=[
-                (
-                    "id",
-                    models.UUIDField(
-                        default=uuid.uuid4,
-                        editable=False,
-                        primary_key=True,
-                        serialize=False,
-                    ),
-                ),
-                ("inserted_at", models.DateTimeField(auto_now_add=True)),
-                (
-                    "declared_cloud_accounts",
-                    models.CharField(
-                        blank=True,
-                        choices=[
-                            ("1", "1"),
-                            ("2-10", "2-10"),
-                            ("11-50", "11-50"),
-                            ("51-200", "51-200"),
-                            ("200+", "200+"),
-                        ],
-                        max_length=16,
-                        null=True,
-                    ),
-                ),
-                (
-                    "declared_role",
-                    models.CharField(
-                        blank=True,
-                        choices=[
-                            ("security", "Security"),
-                            ("devops_platform", "DevOps / Platform"),
-                            ("developer", "Developer"),
-                            ("compliance_grc", "Compliance / GRC"),
-                            ("other", "Other"),
-                        ],
-                        max_length=32,
-                        null=True,
-                    ),
-                ),
-                (
-                    "declared_seniority",
-                    models.CharField(
-                        blank=True,
-                        choices=[
-                            ("practitioner", "Practitioner / IC"),
-                            ("lead", "Team lead / Manager"),
-                            ("director", "Director / Head of"),
-                            ("executive", "VP / C-level"),
-                            ("founder", "Founder / Owner"),
-                        ],
-                        max_length=32,
-                        null=True,
-                    ),
-                ),
-                ("skipped", models.BooleanField(default=False)),
-                (
-                    "submitted_by",
-                    models.ForeignKey(
-                        blank=True,
-                        null=True,
-                        on_delete=django.db.models.deletion.SET_NULL,
-                        related_name="tenant_onboarding_profiles",
-                        related_query_name="tenant_onboarding_profile",
-                        to=settings.AUTH_USER_MODEL,
-                    ),
-                ),
-                (
-                    "tenant",
-                    models.ForeignKey(
-                        on_delete=django.db.models.deletion.CASCADE, to="api.tenant"
-                    ),
-                ),
-            ],
-            options={
-                "db_table": "tenant_onboarding_profiles",
-                "abstract": False,
-            },
-        ),
-        migrations.AddConstraint(
-            model_name="tenantonboardingprofile",
-            constraint=models.UniqueConstraint(
-                fields=("tenant_id",), name="unique_tenant_onboarding_profile"
-            ),
-        ),
-        migrations.AddConstraint(
-            model_name="tenantonboardingprofile",
-            # `statements` written out explicitly: RowLevelSecurityConstraint
-            # .deconstruct() does not serialize it, so an autogenerated
-            # migration falls back to ["SELECT"] and leaves the table without
-            # INSERT/UPDATE/DELETE policies.
-            constraint=api.rls.RowLevelSecurityConstraint(
-                "tenant_id",
-                name="rls_on_tenantonboardingprofile",
-                statements=["SELECT", "INSERT", "UPDATE", "DELETE"],
-            ),
-        ),
-    ]
@@ -1,15 +0,0 @@
-from django.db import migrations
-
-
-class Migration(migrations.Migration):
-    # The onboarding profile step was reverted after 0098 had been merged, so
-    # the table goes away through a new migration rather than by deleting 0098.
-    dependencies = [
-        ("api", "0098_tenant_onboarding_profile"),
-    ]
-
-    operations = [
-        migrations.DeleteModel(
-            name="TenantOnboardingProfile",
-        ),
-    ]
@@ -1,48 +0,0 @@
-from django.db import migrations
-
-TASK_NAME = "attack-paths-reap-orphaned-tmp-databases"
-INTERVAL_HOURS = 6
-
-
-def create_periodic_task(apps, schema_editor):
-    IntervalSchedule = apps.get_model("django_celery_beat", "IntervalSchedule")
-    PeriodicTask = apps.get_model("django_celery_beat", "PeriodicTask")
-
-    schedule, _ = IntervalSchedule.objects.get_or_create(
-        every=INTERVAL_HOURS,
-        period="hours",
-    )
-
-    PeriodicTask.objects.update_or_create(
-        name=TASK_NAME,
-        defaults={
-            "task": TASK_NAME,
-            "interval": schedule,
-            "enabled": True,
-        },
-    )
-
-
-def delete_periodic_task(apps, schema_editor):
-    IntervalSchedule = apps.get_model("django_celery_beat", "IntervalSchedule")
-    PeriodicTask = apps.get_model("django_celery_beat", "PeriodicTask")
-
-    PeriodicTask.objects.filter(name=TASK_NAME).delete()
-
-    # Clean up the schedule if no other task references it
-    IntervalSchedule.objects.filter(
-        every=INTERVAL_HOURS,
-        period="hours",
-        periodictask__isnull=True,
-    ).delete()
-
-
-class Migration(migrations.Migration):
-    dependencies = [
-        ("api", "0099_delete_tenant_onboarding_profile"),
-        ("django_celery_beat", "0019_alter_periodictasks_options"),
-    ]
-
-    operations = [
-        migrations.RunPython(create_periodic_task, delete_periodic_task),
-    ]
@@ -617,66 +617,9 @@ class Task(RowLevelSecurityProtectedModel):
        resource_name = "tasks"


-class ScanQuerySet(models.QuerySet):
-    """Shared selectors for "the latest scan of a provider".
-
-    The queryset must already be scoped by the caller: manager, tenant, RBAC,
-    providers and database alias.
-    """
-
-    # How "which completed scan is the provider's current one" is ordered.
-    LATEST_ORDER_BY = (
-        models.F("completed_at").desc(nulls_last=True),
-        models.F("inserted_at").desc(),
-        models.F("id").desc(),
-    )
-
-    def _eligible_for_latest(self) -> "ScanQuerySet":
-        """Restrict to the scans that may be a provider's latest.
-
-        Returns:
-            ScanQuerySet: The completed scans.
-        """
-        return self.filter(state=StateChoices.COMPLETED)
-
-    def latest_per_provider(self) -> "ScanQuerySet":
-        """Pick each provider's latest scan with `DISTINCT ON (provider_id)`.
-
-        Returns:
-            ScanQuerySet: One scan per provider, the latest one.
-        """
-        return (
-            self._eligible_for_latest()
-            .order_by("provider_id", *self.LATEST_ORDER_BY)
-            .distinct("provider_id")
-        )
-
-    def latest_ids_per_provider(self) -> list[UUID]:
-        """Evaluate `latest_per_provider` and return the scan ids.
-
-        The ids are materialised so callers can pass them as a literal `IN`
-        list; as a subquery Postgres misestimates the row count and picks a
-        slow nested loop.
-
-        Returns:
-            list[UUID]: The id of each provider's latest scan.
-        """
-        return list(self.latest_per_provider().values_list("id", flat=True))
-
-    def latest_first(self) -> "ScanQuerySet":
-        """Order eligible scans newest first, without deduplicating per provider.
-
-        Expects the queryset to be already filtered to a single provider.
-
-        Returns:
-            ScanQuerySet: The eligible scans, latest first.
-        """
-        return self._eligible_for_latest().order_by(*self.LATEST_ORDER_BY)
-
-
 class Scan(RowLevelSecurityProtectedModel):
-    objects = ActiveProviderManager.from_queryset(ScanQuerySet)()
-    all_objects = ScanQuerySet.as_manager()
+    objects = ActiveProviderManager()
+    all_objects = models.Manager()

    _SCOPING_SCANNER_ARG_KEYS_CACHE: tuple[str, ...] | None = None

@@ -783,12 +726,6 @@ class Scan(RowLevelSecurityProtectedModel):
                name="scans_prov_state_ins_desc_idx",
            ),
            # TODO This might replace `scans_prov_state_ins_desc_idx` completely. Review usage
-            # Since `ScanQuerySet`, no code path reads a provider's
-            # completed scans by `-inserted_at`. The only query left that
-            # matches this index (and `scans_prov_state_ins_desc_idx` above)
-            # is `GET /scans?filter[provider]=…&filter[state]=completed` with
-            # the default sort. Both are candidates to drop in a follow-up
-            # once production `pg_stat_user_indexes.idx_scan` confirms it.
            models.Index(
                fields=["tenant_id", "provider_id", "-inserted_at"],
                condition=Q(state=StateChoices.COMPLETED),
@@ -1443,15 +1380,6 @@ class Invitation(RowLevelSecurityProtectedModel):
            self.email = self.email.strip().lower()
        super().save(*args, **kwargs)

-    @classmethod
-    def lapsed_q(cls):
-        """Pending invitations whose expiry date has already passed."""
-        return Q(state=cls.State.PENDING, expires_at__lte=datetime.now(UTC))
-
-    @property
-    def is_lapsed(self):
-        return self.state == self.State.PENDING and self.expires_at <= datetime.now(UTC)
-
    class Meta(RowLevelSecurityProtectedModel.Meta):
        db_table = "invitations"

@@ -6,7 +6,6 @@ from api.rls import RowLevelSecurityConstraint
 from api.uuid_utils import datetime_to_uuid7
 from dateutil.relativedelta import relativedelta
 from django.conf import settings
-from django.core.exceptions import ImproperlyConfigured
 from psqlextra.partitioning import (
    PostgresPartitioningError,
    PostgresPartitioningManager,
@@ -154,17 +153,10 @@ class PostgresUUIDv7PartitioningStrategy(PostgresRangePartitioningStrategy):
        )


-def relative_months_or_none(value):
-    # A negative value would set the cutoff in the future and delete every
-    # partition, so it is rejected rather than silently ignored.
-    if value is not None and value < 0:
-        raise ImproperlyConfigured(
-            "FINDINGS_TABLE_PARTITION_MAX_AGE_MONTHS must not be negative; "
-            "leave it unset or use 0 to keep partitions indefinitely"
-        )
-    if not value:
+def relative_days_or_none(value):
+    if value is None:
        return None
-    return relativedelta(months=value)
+    return relativedelta(days=value)


 #
@@ -181,7 +173,7 @@ manager = PostgresPartitioningManager(
                    months=settings.FINDINGS_TABLE_PARTITION_MONTHS
                ),
                count=settings.FINDINGS_TABLE_PARTITION_COUNT,
-                max_age=relative_months_or_none(
+                max_age=relative_days_or_none(
                    settings.FINDINGS_TABLE_PARTITION_MAX_AGE_MONTHS
                ),
                name_format="%Y_%b",
@@ -197,7 +189,7 @@ manager = PostgresPartitioningManager(
                    months=settings.FINDINGS_TABLE_PARTITION_MONTHS
                ),
                count=settings.FINDINGS_TABLE_PARTITION_COUNT,
-                max_age=relative_months_or_none(
+                max_age=relative_days_or_none(
                    settings.FINDINGS_TABLE_PARTITION_MAX_AGE_MONTHS
                ),
                name_format="%Y_%b",
@@ -1,8 +1,8 @@
 from enum import Enum

 from api.db_router import MainRouter
-from api.models import Integration, Provider, Role, Task, User
-from django.db.models import Q, QuerySet
+from api.models import Provider, Role, User
+from django.db.models import QuerySet
 from rest_framework.exceptions import PermissionDenied
 from rest_framework.permissions import BasePermission

@@ -17,50 +17,6 @@ class Permissions(Enum):
    UNLIMITED_VISIBILITY = "unlimited_visibility"


-# Revoking a task needs the permission of the operation that queued it.
-# None and unmapped names are not revocable; a revoked provider deletion
-# would leave the provider soft-deleted with nothing re-queuing the cleanup.
-TASK_REVOKE_PERMISSIONS: dict[str, list[Permissions] | None] = {
-    "provider-connection-check": [Permissions.MANAGE_PROVIDERS],
-    "provider-deletion": None,
-    "integration-connection-check": [Permissions.MANAGE_INTEGRATIONS],
-    "integration-s3": [Permissions.MANAGE_INTEGRATIONS],
-    "integration-security-hub": [Permissions.MANAGE_INTEGRATIONS],
-    "integration-jira": [Permissions.MANAGE_INTEGRATIONS],
-    "scan-perform": [Permissions.MANAGE_SCANS],
-    "scan-perform-scheduled": [Permissions.MANAGE_SCANS],
-    "scan-compliance-overviews": [Permissions.MANAGE_SCANS],
-    "scan-compliance-reports": [Permissions.MANAGE_SCANS],
-    "scan-finding-group-summaries": [Permissions.MANAGE_SCANS],
-    "scan-report": [Permissions.MANAGE_SCANS],
-    "attack-paths-scan-perform": [Permissions.MANAGE_SCANS],
-    "findings-mute-latest-scans": [Permissions.MANAGE_SCANS],
-    "lighthouse-connection-check": [],
-    "lighthouse-provider-connection-check": [],
-    "lighthouse-provider-models-refresh": [],
-}
-
-
-def get_user_roles(user: User, tenant_id: str) -> list[Role]:
-    """Return every role assigned to the user in the tenant."""
-    return list(
-        User.objects.using(MainRouter.admin_db)
-        .get(id=user.id)
-        .roles.using(MainRouter.admin_db)
-        .filter(tenant_id=tenant_id)
-    )
-
-
-def roles_have_permissions(
-    roles: list[Role], required_permissions: list[Permissions]
-) -> bool:
-    """Return True when every required permission is granted by at least one role."""
-    return all(
-        any(getattr(role, permission.value, False) for role in roles)
-        for permission in required_permissions
-    )
-
-
 class HasPermissions(BasePermission):
    """
    Custom permission to check if the user's role has the required permissions.
@@ -78,11 +34,19 @@ class HasPermissions(BasePermission):
        if not tenant_id:
            return False

-        user_roles = get_user_roles(request.user, tenant_id)
+        user_roles = list(
+            User.objects.using(MainRouter.admin_db)
+            .get(id=request.user.id)
+            .roles.using(MainRouter.admin_db)
+            .filter(tenant_id=tenant_id)
+        )
        if not user_roles:
            return False

-        return roles_have_permissions(user_roles, required_permissions)
+        return all(
+            any(getattr(role, permission.value, False) for role in user_roles)
+            for permission in required_permissions
+        )


 def get_role(user: User, tenant_id: str) -> Role:
@@ -119,51 +83,3 @@ def get_providers(role: Role) -> QuerySet[Provider]:
    return Provider.objects.filter(
        tenant_id=tenant_id, provider_groups__in=provider_groups
    ).distinct()
-
-
-def get_tasks(role: Role) -> QuerySet[Task]:
-    """Return the tasks visible to the role: tenant-wide ones and those of its providers."""
-    queryset = Task.objects.filter(tenant_id=role.tenant_id)
-    if role.unlimited_visibility:
-        return queryset
-
-    # Task has no provider FK, so match provider ids inside the stored kwargs.
-    # all_objects keeps a soft-deleted provider visible to its own groups, so the
-    # role that queued its deletion can still follow the task.
-    hidden = Q()
-    for provider_id in (
-        Provider.all_objects.filter(tenant_id=role.tenant_id)
-        .exclude(provider_groups__in=role.provider_groups.all())
-        .values_list("id", flat=True)
-    ):
-        hidden |= Q(task_runner_task__task_kwargs__contains=str(provider_id))
-    return queryset.exclude(hidden) if hidden else queryset
-
-
-def get_integrations(
-    role: Role, providers: QuerySet[Provider] | None = None
-) -> QuerySet[Integration]:
-    """
-    Return a distinct queryset of Integrations visible to the given role.
-
-    Integrations with no providers attached are tenant-wide, as is always the case for
-    Jira, and stay visible regardless of the provider visibility of the role. Integrations
-    attached to providers are only visible when the role can access at least one of them.
-
-    Args:
-        role: A Role instance.
-        providers: Optional queryset of the providers accessible by the role, to reuse
-            an already resolved `get_providers(role)` result within the same request.
-
-    Returns:
-        A QuerySet of Integration objects visible to the role.
-    """
-    queryset = Integration.objects.filter(tenant_id=role.tenant_id)
-    if role.unlimited_visibility:
-        return queryset
-
-    if providers is None:
-        providers = get_providers(role)
-    return queryset.filter(
-        Q(providers__isnull=True) | Q(providers__in=providers)
-    ).distinct()
@@ -1,4 +1,3 @@
-from api.db_router import MainRouter
 from api.db_utils import delete_related_daily_task
 from api.models import (
    LighthouseProviderConfiguration,
@@ -48,15 +47,8 @@ def revoke_user_api_keys(sender, instance, **kwargs):  # noqa: F841

    The entity field will be set to NULL by on_delete=SET_NULL,
    but we explicitly revoke the keys to prevent further use.
-
-    The update runs on the admin connection because `api_keys` is RLS protected and its
-    policy denies every row when `api.tenant_id` is unset. Users are deleted through the
-    admin connection and may belong to several tenants, so going through the default
-    connection would silently revoke nothing, or only the keys of the active tenant.
    """
-    TenantAPIKey.objects.using(MainRouter.admin_db).filter(entity=instance).update(
-        revoked=True
-    )
+    TenantAPIKey.objects.filter(entity=instance).update(revoked=True)


@receiver(post_delete, sender=Membership)
@@ -66,12 +58,8 @@ def revoke_membership_api_keys(sender, instance, **kwargs):  # noqa: F841

    When a membership is deleted, all API keys created by that user
    in that tenant should be revoked to prevent further access.
-
-    Uses the admin connection for the same reason as `revoke_user_api_keys`: the RLS
-    policy on `api_keys` denies every row when `api.tenant_id` is unset, which is the
-    case when the membership is removed as a cascade of a user deletion.
    """
-    TenantAPIKey.objects.using(MainRouter.admin_db).filter(
+    TenantAPIKey.objects.filter(
        entity_id=instance.user_id, tenant_id=instance.tenant_id
    ).update(revoked=True)

--- a/Show More
+++ b/Show More
				`@@ -1 +0,0 @@`
				API key authentication no longer locks the key row on every request and now throttles `last_used_at` updates to once per 60 seconds, preventing a hot key from serializing all its requests onto a single locked row
				`@@ -1 +0,0 @@`
				`Adds a periodic sweep that drops orphaned Attack Paths temp Neo4j scan databases left behind when a worker or Neo4j crashes mid-scan, before they accumulate unbounded`
				`@@ -1 +0,0 @@`
				`Resources no longer keep a stale failed findings count forever when a scoped or imported scan for the same provider completes after a full scan, which used to make the full scan skip its own cleanup`
				`@@ -1 +0,0 @@`
				Providers whose most recent completed scan has no `completed_at` timestamp are no longer missing from every endpoint that reports a provider's latest scan, which now falls back to scan creation order instead of skipping the provider
				`@@ -1 +0,0 @@`
				`Unify how every endpoint resolves a provider latest completed scan, so overlapping scans no longer make findings, compliance and mute rules read from different scans`
				`@@ -0,0 +1 @@`
				`Database migrations now give up after a few seconds when another query holds the table lock, instead of stalling every request that touches that table`
				`@@ -1 +0,0 @@`
				`OCI provider secrets keep the region as home region for credential validation and scans, instead of always using us-ashburn-1`
				`@@ -1 +0,0 @@`
				`Provider deletion no longer fails when the provider has Attack Paths scans recorded on a sink that is no longer configured, such as Neptune after moving back to Neo4j`
				`@@ -1 +0,0 @@`
				`pyjwt` from 2.13.0 to 2.14.0, patching GHSA-ffc3-869f-jxw9
				`@@ -1 +0,0 @@`
				Scan output uploads and downloads can now target S3-compatible object storage such as MinIO directly via `DJANGO_OUTPUT_S3_AWS_ENDPOINT_URL`, instead of relying on process-wide AWS environment variables that also hijacked unrelated AWS API calls