What's Changed
- fix(github): tolerate null dependency manifest nodes by @kunaals in #2935
- fix(docs): Fix schema documentation errors by @kunaals in #2939
- fix(tailscale): use boolean predicates for Tailscale rules by @kunaals in #2941
- fix(gsuite): use immutable group id when listing members by @jychp in #2946
- perf(cve_metadata): batch NVD API requests with cveIds parameter by @jychp in #2945
- fix(github): Normalize GitHub PAT ontology timestamps by @kunaals in #2950
- fix(aws): stop IAM SAML provider sync from crashing on AccessDenied by @jychp in #2953
- chore: bump the minor-and-patch group with 8 updates by @dependabot[bot] in #2956
- chore: bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in #2955
- chore: bump python from
c33f0bcto2b7445fby @dependabot[bot] in #2954 - chore: bump kubernetes from 35.0.0 to 36.0.1 by @dependabot[bot] in #2957
- fix(azure): support azure-mgmt-web 11 model shape by @jychp in #2908
- feat(gcp): ingest GCP API Keys (apikeys.googleapis.com) by @jychp in #2960
- feat(rules): Reduce false positives in cloud security rules and add firewall relevancy signal by @jychp in #2958
- feat(scaleway): add instance security groups and rules by @jychp in #2952
- Add GitHub CODEOWNERS ownership evidence by @kunaals in #2940
- feat(scaleway): add object storage buckets by @jychp in #2963
- feat(scaleway): add VPC/IPAM network layer and Load Balancers by @jychp in #2965
- feat(scaleway): add Domains/DNS and Key/Secret Manager by @jychp in #2966
- Prepare azure-mgmt-storage 25.0.0 bump by @jychp in #2948
- feat(scaleway): add Kapsule (Kubernetes) and Container Registry coverage by @jychp in #2967
- feat(databricks): add intel module with workspace identity coverage by @jychp in #2968
- fix(ontology): populate _ont_source for SubImage, Crowdstrike, Azure tenants by @jychp in #2971
- feat(scaleway): add Managed Databases coverage (RDB, Redis, MongoDB) by @jychp in #2970
- feat(databricks): compute + secrets + IP access by @jychp in #2969
- fix(azure): migrate current SDK shapes by @jychp in #2978
- feat(azure,gcp): ingest Key Vault secret tags and Cloud Function labels by @jychp in #2974
- feat(tags): unify tag-shape ontology with a :Tag extra label by @jychp in #2973
- fix(gcp): scope BigQuery CMEK rule to persistent tables, aggregate by dataset by @jychp in #2979
- feat(scaleway): add Serverless + Public Gateway coverage and exposure rules by @jychp in #2975
- feat(databricks): add Unity Catalog coverage (metastore, catalogs, grants, ...) by @jychp in #2976
- feat(iam): condition-aware permission relationships for AWS and GCP (#2250, #1643, #2312) by @jychp in #2891
- feat(scaleway): complete resource coverage (SSH keys, bare-metal, file/data services, domains) by @jychp in #2981
- fix(subimage): read snake_case tenant fields from API response by @jychp in #2984
- feat(databricks): jobs + SQL, ML serving + apps + content, and Delta Sharing coverage by @jychp in #2982
- feat(ontology): finding->package/device edges and endpoint finding labels by @jychp in #2986
- feat(rules): improve CIS rule accuracy: reduce false positives and align finding cardinality (AWS/GCP/K8s) by @jychp in #2983
- feat(scaleway): IAM permissions, ontology coverage, and container code-to-cloud by @jychp in #2985
- fix(ontology): stop DNS linking cleanup from deleting provider-owned edges by @jychp in #2987
- chore: bump python from
2b7445ftoeb43ff1by @dependabot[bot] in #2990 - fix(ontology): map Scaleway Elastic Metal flexible IPs to PublicIP by @jychp in #2988
- fix(microsoft): retry transient Graph 500/502 across all calls by @jychp in #2989
- chore: bump actions/setup-python from 6.2.0 to 6.3.0 in the minor-and-patch group by @dependabot[bot] in #2991
- chore: bump the minor-and-patch group with 7 updates by @dependabot[bot] in #2992
- fix(workos): support sdk v8 organization memberships by @jychp in #2995
- chore: bump workos from 8.0.0 to 8.2.0 by @dependabot[bot] in #2993
- fix(ontology): stop mapping list-valued GCPRecordSet.data to scalar _ont_value by @jychp in #2997
- fix(gcp): don't abort BigQuery sync on invalidQuery errors by @Vansh-Sharma27 in #2972
- fix(ontology): exclude GCPRecordSet from scalar DNS _ont_value linking by @jychp in #3001
- fix(gcp): retry Cloud Run list calls on transient 5xx by @jychp in #3000
- fix(okta): retry non-JSON SDK errors across all paged requests by @jychp in #2999
- feat: workload-identity ASSUMES/RUNS_AS edges for EC2 and Azure VMs/Function Apps by @jychp in #2998
- feat(cve_metadata): derive effect_tags on CVEMetadata from CWE/CVSS by @jychp in #3003
- feat(salesforce): add Salesforce intel module for users, access, and connected apps by @jychp in #3005
- feat(ontology): add supply-chain relationship constraints by @jychp in #3008
- fix(rules): reduce false positives in GCP flow-log and AWS sync rules; index GitHub repo URLs by @jychp in #3011
- chore: bump the minor-and-patch group with 7 updates by @dependabot[bot] in #3012
- chore: bump the minor-and-patch group with 5 updates by @dependabot[bot] in #3013
- fix(subimage): read frameworks from Page[T] envelope by @jychp in #3009
- feat(databricks): account API, cloud configs, permission resolution, rules + ontology by @jychp in #2996
- feat(circleci): add CircleCI intel module by @jychp in #2921
- feat(tailscale): link devices to cloud instances by @jychp in #3010
- feat(kubernetes): model NetworkPolicy and capture container listening ports by @jychp in #3014
- feat(microsoft): add canonical credential config by @kunaals in #2944
New Contributors
- @Vansh-Sharma27 made their first contribution in #2972
Full Changelog: 0.138.1...0.139.0