What's Changed
- feat(ontology): materialize (:ComputeService)-[:RUNS_IMAGE]->(:Image) inventory by @jychp in #3054
- feat(ontology): normalize state/status/severity ont* fields to canonical enums by @jychp in #3056
- feat(ontology): wire AWS Inspector & Semgrep findings into the CVE ontology by @jychp in #3055
- docs(aws): document glue:GetConnections permission gap by @jychp in #3060
- feat(rules): declare an affected-node anchor (asset_label) on every Fact by @jychp in #3065
- fix(ontology): normalize Inspector and Semgrep CVE severity by @jychp in #3066
- fix(exposure): single-own LoadBalancer->Container edge in AWS, decouple direct exposure by @jychp in #3067
- chore: bump pyasn1 from 0.6.2 to 0.6.4 by @dependabot[bot] in #3068
- chore: bump types-requests from 2.33.0.20260518 to 2.33.0.20260712 by @dependabot[bot] in #3073
- chore: bump httplib2 from 0.31.2 to 0.32.0 by @dependabot[bot] in #3074
- chore: bump python from
eb43ff1to6771159by @dependabot[bot] in #3069 - chore: bump the minor-and-patch group with 2 updates by @dependabot[bot] in #3070
- chore: bump the minor-and-patch group with 9 updates by @dependabot[bot] in #3071
- feat(models): make extra node labels declarative by @jychp in #3032
- perf(querybuilder): apply conditional node labels per row instead of via global remove/set passes by @jychp in #3082
- fix(trivy): only set cve_id and :CVE on CVE-backed findings by @jychp in #3077
- refactor(ontology): split Package into Package and PackageVersion by @jychp in #3086
- feat(railway): add Railway intel module by @jychp in #3079
- fix(rules): validate the Fact asset anchor and reserve Finding.source by @jychp in #3085
- feat(rules): add SOC 2 compliance mappings by @jychp in #3080
- feat(supabase): add Supabase intel module by @jychp in #3084
- feat(circleci): code-to-cloud fallback supply-chain matcher by @jychp in #3059
- fix(cloudflare): scope CloudflareDNSRecord to the account, not the zone by @jychp in #3087
- fix(aws): refresh ECR layer credentials by @kunaals in #3093
- chore: bump the minor-and-patch group with 12 updates by @dependabot[bot] in #3100
- chore: bump types-pyyaml from 6.0.12.20260518 to 6.0.12.20260724 by @dependabot[bot] in #3102
- chore: bump the minor-and-patch group with 4 updates by @dependabot[bot] in #3096
- chore: bump astral-sh/setup-uv from 8.3.2 to 9.0.0 by @dependabot[bot] in #3097
- chore: bump actions/setup-python from 6.3.0 to 7.0.0 by @dependabot[bot] in #3098
- fix(ontology,route53): stop deleting route53-owned DNS_POINTS_TO edges and make ELB alias targets match by @jychp in #3090
- perf(container-images): reuse cached layer metadata by @jychp in #3092
- fix(aws): handle null groups in aws-auth mappings by @AlexanderDeBattista in #3095
- chore: bump azure-mgmt-resource from 24.0.0 to 26.0.0 by @jychp in #3104
- fix(vercel): give VercelAccessGroup the UserGroup ontology label by @jychp in #3099
- perf(graph): drop lastupdated from the MatchLink relationship index key by @jychp in #3105
- feat(modal): add Modal intel module by @jychp in #3089
- fix(gcp): stop expanding broad BigQuery grants per table by @jychp in #3101
- feat(docs): generate schema docs from data model by @jychp in #3021
- fix(rules): simplify SOC 2 framework name by @jychp in #3108
- fix(docs): capitalize OCI schema title by @kunaals in #3109
- feat(netlify): add Netlify intel module by @jychp in #3091
- feat(cloudflare): add R2, Workers, and WAF ruleset ingestion by @jychp in #3107
- fix(cloudflare): tolerate optional SDK fields that arrive as null by @jychp in #3116
- feat(aws:inspector): add fixAvailable, exploitAvailable, EPSS score to Inspector findings by @heryxpc in #3115
- chore: drop Python 3.10 support by @jychp in #3113
- feat(microsoft): added o365 Integration by @ShreyashSri in #3017
- chore: bump docker/login-action from 4.5.1 to 4.5.2 in the minor-and-patch group by @dependabot[bot] in #3120
- chore: bump actions/stale from 10.4.0 to 11.0.0 by @dependabot[bot] in #3121
- chore: bump actions/download-artifact from 7.0.0 to 8.0.1 by @dependabot[bot] in #3122
- chore: bump aiohttp from 3.14.1 to 3.14.3 by @dependabot[bot] in #3123
- chore: bump the minor-and-patch group across 1 directory with 3 updates by @dependabot[bot] in #3124
- fix(netlify): tolerate a DNS zone whose apex domain was registered through Netlify by @jychp in #3131
- feat(github): add fork and parent attributes to GitHubRepository by @ryan-lane in #3076
- chore: bump h2 from 4.3.0 to 4.4.1 by @dependabot[bot] in #3137
- chore: bump typer from 0.27.0 to 0.27.1 in the minor-and-patch group by @dependabot[bot] in #3134
- chore: bump the minor-and-patch group with 2 updates by @dependabot[bot] in #3133
- fix(docs): show logo in dark mode by @kunaals in #3138
- fix(rules): return webhook_resources as a list and include the wildcard by @jychp in #3142
- fix(azure): support azure-mgmt-cosmosdb 10 and azure-mgmt-datafactory 10 model shapes by @jychp in #3128
- docs: audit and update project documentation by @jychp in #3111
- feat(wiz): Add Wiz intel module by @kunaals in #2943
- feat(rules): detect ChainDrop (Aug 2026) Shai-Hulud npm compromise by @EmilioDNA in #3130
- fix(wiz): classify issues and findings by ontology by @kunaals in #3145
New Contributors
- @AlexanderDeBattista made their first contribution in #3095
- @ShreyashSri made their first contribution in #3017
- @EmilioDNA made their first contribution in #3130
Full Changelog: 0.139.1...0.140.0