0.140.0

What's Changed

• feat(ontology): materialize (:ComputeService)-[:RUNS_IMAGE]->(:Image) inventory by @jychp in #3054
• feat(ontology): normalize state/status/severity ont* fields to canonical enums by @jychp in #3056
• feat(ontology): wire AWS Inspector & Semgrep findings into the CVE ontology by @jychp in #3055
• docs(aws): document glue:GetConnections permission gap by @jychp in #3060
• feat(rules): declare an affected-node anchor (asset_label) on every Fact by @jychp in #3065
• fix(ontology): normalize Inspector and Semgrep CVE severity by @jychp in #3066
• fix(exposure): single-own LoadBalancer->Container edge in AWS, decouple direct exposure by @jychp in #3067
• chore: bump pyasn1 from 0.6.2 to 0.6.4 by @dependabot[bot] in #3068
• chore: bump types-requests from 2.33.0.20260518 to 2.33.0.20260712 by @dependabot[bot] in #3073
• chore: bump httplib2 from 0.31.2 to 0.32.0 by @dependabot[bot] in #3074
• chore: bump python from eb43ff1 to 6771159 by @dependabot[bot] in #3069
• chore: bump the minor-and-patch group with 2 updates by @dependabot[bot] in #3070
• chore: bump the minor-and-patch group with 9 updates by @dependabot[bot] in #3071
• feat(models): make extra node labels declarative by @jychp in #3032
• perf(querybuilder): apply conditional node labels per row instead of via global remove/set passes by @jychp in #3082
• fix(trivy): only set cve_id and :CVE on CVE-backed findings by @jychp in #3077
• refactor(ontology): split Package into Package and PackageVersion by @jychp in #3086
• feat(railway): add Railway intel module by @jychp in #3079
• fix(rules): validate the Fact asset anchor and reserve Finding.source by @jychp in #3085
• feat(rules): add SOC 2 compliance mappings by @jychp in #3080
• feat(supabase): add Supabase intel module by @jychp in #3084
• feat(circleci): code-to-cloud fallback supply-chain matcher by @jychp in #3059
• fix(cloudflare): scope CloudflareDNSRecord to the account, not the zone by @jychp in #3087
• fix(aws): refresh ECR layer credentials by @kunaals in #3093
• chore: bump the minor-and-patch group with 12 updates by @dependabot[bot] in #3100
• chore: bump types-pyyaml from 6.0.12.20260518 to 6.0.12.20260724 by @dependabot[bot] in #3102
• chore: bump the minor-and-patch group with 4 updates by @dependabot[bot] in #3096
• chore: bump astral-sh/setup-uv from 8.3.2 to 9.0.0 by @dependabot[bot] in #3097
• chore: bump actions/setup-python from 6.3.0 to 7.0.0 by @dependabot[bot] in #3098
• fix(ontology,route53): stop deleting route53-owned DNS_POINTS_TO edges and make ELB alias targets match by @jychp in #3090
• perf(container-images): reuse cached layer metadata by @jychp in #3092
• fix(aws): handle null groups in aws-auth mappings by @AlexanderDeBattista in #3095
• chore: bump azure-mgmt-resource from 24.0.0 to 26.0.0 by @jychp in #3104
• fix(vercel): give VercelAccessGroup the UserGroup ontology label by @jychp in #3099
• perf(graph): drop lastupdated from the MatchLink relationship index key by @jychp in #3105
• feat(modal): add Modal intel module by @jychp in #3089
• fix(gcp): stop expanding broad BigQuery grants per table by @jychp in #3101
• feat(docs): generate schema docs from data model by @jychp in #3021
• fix(rules): simplify SOC 2 framework name by @jychp in #3108
• fix(docs): capitalize OCI schema title by @kunaals in #3109
• feat(netlify): add Netlify intel module by @jychp in #3091
• feat(cloudflare): add R2, Workers, and WAF ruleset ingestion by @jychp in #3107
• fix(cloudflare): tolerate optional SDK fields that arrive as null by @jychp in #3116
• feat(aws:inspector): add fixAvailable, exploitAvailable, EPSS score to Inspector findings by @heryxpc in #3115
• chore: drop Python 3.10 support by @jychp in #3113
• feat(microsoft): added o365 Integration by @ShreyashSri in #3017
• chore: bump docker/login-action from 4.5.1 to 4.5.2 in the minor-and-patch group by @dependabot[bot] in #3120
• chore: bump actions/stale from 10.4.0 to 11.0.0 by @dependabot[bot] in #3121
• chore: bump actions/download-artifact from 7.0.0 to 8.0.1 by @dependabot[bot] in #3122
• chore: bump aiohttp from 3.14.1 to 3.14.3 by @dependabot[bot] in #3123
• chore: bump the minor-and-patch group across 1 directory with 3 updates by @dependabot[bot] in #3124
• fix(netlify): tolerate a DNS zone whose apex domain was registered through Netlify by @jychp in #3131
• feat(github): add fork and parent attributes to GitHubRepository by @ryan-lane in #3076
• chore: bump h2 from 4.3.0 to 4.4.1 by @dependabot[bot] in #3137
• chore: bump typer from 0.27.0 to 0.27.1 in the minor-and-patch group by @dependabot[bot] in #3134
• chore: bump the minor-and-patch group with 2 updates by @dependabot[bot] in #3133
• fix(docs): show logo in dark mode by @kunaals in #3138
• fix(rules): return webhook_resources as a list and include the wildcard by @jychp in #3142
• fix(azure): support azure-mgmt-cosmosdb 10 and azure-mgmt-datafactory 10 model shapes by @jychp in #3128
• docs: audit and update project documentation by @jychp in #3111
• feat(wiz): Add Wiz intel module by @kunaals in #2943
• feat(rules): detect ChainDrop (Aug 2026) Shai-Hulud npm compromise by @EmilioDNA in #3130
• fix(wiz): classify issues and findings by ontology by @kunaals in #3145

New Contributors

• @AlexanderDeBattista made their first contribution in #3095
• @ShreyashSri made their first contribution in #3017
• @EmilioDNA made their first contribution in #3130

Full Changelog: 0.139.1...0.140.0

0.139.1

What's Changed

• refactor(analysis): add typed analysis jobs by @jychp in #2922
• feat(aws-ssm): ingest allowlisted public parameters by @kunaals in #2635
• refactor(intel): replace raw Cypher mutations with data models by @jychp in #3022
• refactor(analysis): make job scoping structural by @jychp in #3024
• docs(databricks): split combined account-config schema section by @jychp in #3027
• refactor(models): normalize provider-prefixed node labels by @jychp in #3020
• fix(microsoft): normalize tenant relationship targets by @jychp in #3026
• docs(databricks): clarify authentication privileges by @kunaals in #3028
• fix(scaleway): link flexible IPs to instances by @jychp in #3030
• fix(databricks): retry transient API failures by @kunaals in #3031
• fix(aws): apigateway client certificate early return by @g-k-s-03 in #2920
• fix(rules): support no-auth Neo4j connections by @kunaals in #3023
• fix(vercel): page access-groups with the 'next' cursor parameter by @vidigoat in #3006
• fix(gcp): route Cloud Asset Inventory calls through the standard retry wrapper by @vidigoat in #3033
• fix(cve): guard _get_primary_metric against empty CVSS metric lists by @vidigoat in #3025
• fix(aws): complete provider label migration by @jychp in #3034
• fix(databricks): tolerate 400 when probing online-table twins by @jychp in #3037
• feat(aws): ingest EKS access entries by @kunaals in #2839
• fix(github): scope Dependency cleanup to GitHubDependency label (#3035) by @jychp in #3040
• chore: bump the minor-and-patch group with 8 updates by @dependabot[bot] in #3042
• chore: bump the minor-and-patch group with 3 updates by @dependabot[bot] in #3041
• fix(aws): skip SES sync in regions where SES v2 is unavailable by @jychp in #3044
• docs: add CircleCI, Databricks, Salesforce to module menu by @jychp in #3045
• docs: use custom domain and improve discovery by @kunaals in #3047
• fix(databricks): tolerate HTTP 400 on ungrantable securables in grants sync by @jychp in #3046
• feat(cli): add --log-timestamps to prepend timestamps to log output by @vidigoat in #3039
• feat(kubernetes): model workload controllers in the WORKLOAD_PARENT chain by @jychp in #3053
• fix(subimage): unwrap Page envelope in team + apikeys intel get() by @jychp in #3048

New Contributors

• @g-k-s-03 made their first contribution in #2920
• @vidigoat made their first contribution in #3006

Full Changelog: 0.139.0...0.139.1

0.139.0

What's Changed

• fix(github): tolerate null dependency manifest nodes by @kunaals in #2935
• fix(docs): Fix schema documentation errors by @kunaals in #2939
• fix(tailscale): use boolean predicates for Tailscale rules by @kunaals in #2941
• fix(gsuite): use immutable group id when listing members by @jychp in #2946
• perf(cve_metadata): batch NVD API requests with cveIds parameter by @jychp in #2945
• fix(github): Normalize GitHub PAT ontology timestamps by @kunaals in #2950
• fix(aws): stop IAM SAML provider sync from crashing on AccessDenied by @jychp in #2953
• chore: bump the minor-and-patch group with 8 updates by @dependabot[bot] in #2956
• chore: bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in #2955
• chore: bump python from c33f0bc to 2b7445f by @dependabot[bot] in #2954
• chore: bump kubernetes from 35.0.0 to 36.0.1 by @dependabot[bot] in #2957
• fix(azure): support azure-mgmt-web 11 model shape by @jychp in #2908
• feat(gcp): ingest GCP API Keys (apikeys.googleapis.com) by @jychp in #2960
• feat(rules): Reduce false positives in cloud security rules and add firewall relevancy signal by @jychp in #2958
• feat(scaleway): add instance security groups and rules by @jychp in #2952
• Add GitHub CODEOWNERS ownership evidence by @kunaals in #2940
• feat(scaleway): add object storage buckets by @jychp in #2963
• feat(scaleway): add VPC/IPAM network layer and Load Balancers by @jychp in #2965
• feat(scaleway): add Domains/DNS and Key/Secret Manager by @jychp in #2966
• Prepare azure-mgmt-storage 25.0.0 bump by @jychp in #2948
• feat(scaleway): add Kapsule (Kubernetes) and Container Registry coverage by @jychp in #2967
• feat(databricks): add intel module with workspace identity coverage by @jychp in #2968
• fix(ontology): populate _ont_source for SubImage, Crowdstrike, Azure tenants by @jychp in #2971
• feat(scaleway): add Managed Databases coverage (RDB, Redis, MongoDB) by @jychp in #2970
• feat(databricks): compute + secrets + IP access by @jychp in #2969
• fix(azure): migrate current SDK shapes by @jychp in #2978
• feat(azure,gcp): ingest Key Vault secret tags and Cloud Function labels by @jychp in #2974
• feat(tags): unify tag-shape ontology with a :Tag extra label by @jychp in #2973
• fix(gcp): scope BigQuery CMEK rule to persistent tables, aggregate by dataset by @jychp in #2979
• feat(scaleway): add Serverless + Public Gateway coverage and exposure rules by @jychp in #2975
• feat(databricks): add Unity Catalog coverage (metastore, catalogs, grants, ...) by @jychp in #2976
• feat(iam): condition-aware permission relationships for AWS and GCP (#2250, #1643, #2312) by @jychp in #2891
• feat(scaleway): complete resource coverage (SSH keys, bare-metal, file/data services, domains) by @jychp in #2981
• fix(subimage): read snake_case tenant fields from API response by @jychp in #2984
• feat(databricks): jobs + SQL, ML serving + apps + content, and Delta Sharing coverage by @jychp in #2982
• feat(ontology): finding->package/device edges and endpoint finding labels by @jychp in #2986
• feat(rules): improve CIS rule accuracy: reduce false positives and align finding cardinality (AWS/GCP/K8s) by @jychp in #2983
• feat(scaleway): IAM permissions, ontology coverage, and container code-to-cloud by @jychp in #2985
• fix(ontology): stop DNS linking cleanup from deleting provider-owned edges by @jychp in #2987
• chore: bump python from 2b7445f to eb43ff1 by @dependabot[bot] in #2990
• fix(ontology): map Scaleway Elastic Metal flexible IPs to PublicIP by @jychp in #2988
• fix(microsoft): retry transient Graph 500/502 across all calls by @jychp in #2989
• chore: bump actions/setup-python from 6.2.0 to 6.3.0 in the minor-and-patch group by @dependabot[bot] in #2991
• chore: bump the minor-and-patch group with 7 updates by @dependabot[bot] in #2992
• fix(workos): support sdk v8 organization memberships by @jychp in #2995
• chore: bump workos from 8.0.0 to 8.2.0 by @dependabot[bot] in #2993
• fix(ontology): stop mapping list-valued GCPRecordSet.data to scalar _ont_value by @jychp in #2997
• fix(gcp): don't abort BigQuery sync on invalidQuery errors by @Vansh-Sharma27 in #2972
• fix(ontology): exclude GCPRecordSet from scalar DNS _ont_value linking by @jychp in #3001
• fix(gcp): retry Cloud Run list calls on transient 5xx by @jychp in #3000
• fix(okta): retry non-JSON SDK errors across all paged requests by @jychp in #2999
• feat: workload-identity ASSUMES/RUNS_AS edges for EC2 and Azure VMs/Function Apps by @jychp in #2998
• feat(cve_metadata): derive effect_tags on CVEMetadata from CWE/CVSS by @jychp in #3003
• feat(salesforce): add Salesforce intel module for users, access, and connected apps by @jychp in #3005
• feat(ontology): add supply-chain relationship constraints by @jychp in #3008
• fix(rules): reduce false positives in GCP flow-log and AWS sync rules; index GitHub repo URLs by @jychp in #3011
• chore: bump the minor-and-patch group with 7 updates by @dependabot[bot] in #3012
• chore: bump the minor-and-patch group with 5 updates by @dependabot[bot] in #3013
• fix(subimage): read frameworks from Page[T] envelope by @jychp in #3009
• feat(databricks): account API, cloud configs, permission resolution, rules + ontology by @jychp in #2996
• feat(circleci): add CircleCI intel module by @jychp in #2921
• feat(tailscale): link devices to cloud instances by @jychp in #3010
• feat(kubernetes): model NetworkPolicy and capture container listening ports by @jychp in #3014
• feat(microsoft): add canonical credential config by @kunaals in #2944

New Contributors

• @Vansh-Sharma27 made their first contribution in #2972

Full Changelog: 0.138.1...0.139.0

0.138.1

What's Changed

• chore: bump the minor-and-patch group with 5 updates by @dependabot[bot] in #2932
• chore: bump python from d12283f to c33f0bc by @dependabot[bot] in #2931

Full Changelog: 0.138.0...0.138.1

0.138.0

What's Changed

• chore: bump aiohttp from 3.13.4 to 3.14.0 by @dependabot[bot] in #2860
• chore: bump starlette from 0.52.1 to 1.0.1 by @dependabot[bot] in #2862
• feat(entra)/fix(gcp): sync Entra directory roles and link GCP instances to their service accounts by @jychp in #2856
• feat(rules): Clean up SubImage coverage rule frameworks by @kunaals in #2864
• chore: bump the minor-and-patch group with 2 updates by @dependabot[bot] in #2867
• feat(rules): add stable finding identity metadata to rules by @jychp in #2863
• feat(spacelift): link stacks to assumed AWS IAM roles by @jychp in #2870
• feat(aws): capture GuardDuty sample findings and exclude them from the active-threat rule by @kunaals in #2865
• fix (rules): Fix CIS AWS IAM datetime casts by @kunaals in #2872
• fix(aws): emr subscription required retry loop by @vanshika2720 in #2311
• chore: bump azure-mgmt-compute from 37.2.0 to 38.0.0 by @dependabot[bot] in #2848
• chore: bump azure-mgmt-keyvault from 13.0.0 to 14.0.1 by @dependabot[bot] in #2734
• chore: bump cloudflare from 4.3.1 to 5.1.0 by @dependabot[bot] in #2869
• chore: bump the minor-and-patch group across 1 directory with 5 updates by @dependabot[bot] in #2868
• feat(aws): Add CloudFormation Stack support by @yashasviyadav30 in #2478
• feat(ontology): add Subnet, VirtualNetwork and Snapshot semantic labels by @jychp in #2873
• fix(okta): skip groups deleted during sync when listing members by @jychp in #2885
• feat(ecr): Add ECR pull through cache rule sync by @kunaals in #2823
• feat(aibom): link detections to GitHub/GitLab code repositories by @jychp in #2875
• Add public_snapshots rule: detect publicly shared EBS/RDS snapshots and AMIs by @jychp in #2879
• feat(rules): detect IAM roles trusting unsynced AWS accounts by @jychp in #2880
• Implement CIS AWS IAM rules 2.3, 2.4, 2.15 (resolve stale TODOs) by @jychp in #2881
• fix(aws): correct AWSTag region handling for tag matching (#1094, #1137) by @jychp in #2883
• feat(ontology): canonical HAS_ROLE edge (UserAccount/ServiceAccount -> PermissionRole) by @jychp in #2888
• feat(github): project GitHub dependencies into the Package ontology with provenance and lockfile fallback by @jychp in #2886
• feat(kubernetes): Process mapAccounts from aws-auth ConfigMap by @jychp in #2884
• fix(aws): draw permission edges for object-level S3 grants (#1639) by @jychp in #2882
• chore: adapt AKS sync to azure-mgmt-containerservice 41.x by @jychp in #2890
• feat(rules): Separate rule identity from compliance framework mapping by @kunaals in #2887
• fix(rules): align ISO and NIST framework filters by @kunaals in #2892
• chore(cubic): add cubic-audit skill and tighten the AI-review config by @jychp in #2893
• feat(ontology): canonical MEMBER_OF / HAS_ROLE(group) / INCLUDES / ENCRYPTED_BY / USES_SECRET edges by @jychp in #2889
• fix(rules): update stale CISA reference by @kunaals in #2894
• feat(azure): Ingest Azure Management Groups and Management Group Subscriptions by @shyammukund in #2842
• fix(azure): defer hierarchy cleanup by @kunaals in #2900
• fix(rules): lead finding output models with a human-readable display field by @jychp in #2902
• chore: bump python from 3.13.13-slim to 3.13.14-slim by @dependabot[bot] in #2903
• chore: bump the minor-and-patch group with 3 updates by @dependabot[bot] in #2904
• chore: bump workos from 6.2.0 to 7.0.1 by @dependabot[bot] in #2906
• fix(rules): reduce CIS Kubernetes finding noise by @jychp in #2898
• chore(gcp): finish GCP HttpError classifier migration by @jychp in #2874
• chore: bump the minor-and-patch group across 1 directory with 10 updates by @dependabot[bot] in #2905
• fix(github): synthesize token_name for classic PATs by @jychp in #2915
• feat(ontology): canonical OWNED_BY / RUNS_AS / ASSUMES workload-identity edges by @jychp in #2899
• fix(aws): skip Inspector region on transient endpoint failure by @jychp in #2914
• fix(rules): K8s 5.1.13 noise, filter-property indexes, KubernetesNode->EC2Instance link, quieter ECR sync by @jychp in #2910
• feat(guardduty): link Kubernetes findings to their EKS cluster by @jychp in #2909
• fix(rules): exclude account-BPA-covered buckets from S3 block public access by @jychp in #2916
• fix(microsoft): make Intune detected-apps export resilient to stalled jobs by @jychp in #2913
• feat(azure): sync management group role assignments by @kunaals in #2901
• chore: bump pyjwt from 2.12.1 to 2.13.0 by @dependabot[bot] in #2917
• chore: bump aiohttp from 3.14.0 to 3.14.1 by @dependabot[bot] in #2919
• chore: bump starlette from 1.0.1 to 1.3.1 by @dependabot[bot] in #2918
• fix(rules): make finding source a connector slug (CROSS_CLOUD + Entra/Snipe-IT/Google Workspace) by @jychp in #2923
• feat(tenable): add Tenable assets and vulnerability findings intel module by @heryxpc in #2897
• fix(cve_metadata): ignore deprecated CVE feed nodes by @kunaals in #2925

New Contributors

• @vanshika2720 made their first contribution in #2311

Full Changelog: 0.137.0...0.138.0

0.137.0

What's Changed

• fix(gcp): persist Artifact Registry image platform by @kunaals in #2740
• fix(gcp): retry transient Vertex AI GAPIC errors by @kunaals in #2741
• fix(gcp): retry transient Cloud Run list failures by @kunaals in #2742
• fix(ci): poll PyPI install path before docker build by @jychp in #2746
• perf(sync): defer provider SDK loading until a stage runs by @jychp in #2747
• fix(azure): skip transient data factory failures by @kunaals in #2748
• fix(gcp): Refactor GCP Artifact Registry image modeling by @kunaals in #2743
• feat(ontology): add AIModel semantic label across AI/ML model nodes by @jychp in #2750
• fix(gcp): resolve Cloud Run service image digests by @kunaals in #2751
• fix(kubernetes): skip unsupported EKS access entries by @kunaals in #2753
• docs(github): clarify image provenance relationship by @kunaals in #2754
• feat(ontology): enforce ontology relationship constraints by @jychp in #2738
• feat(azure): add Application Gateway intel module by @jychp in #2749
• refactor: enforce naming and sub_resource conventions in graph models by @jychp in #2737
• feat(azure): model VM NSG rules and SQL Server firewall rules by @jychp in #2756
• fix(gitlab): ingest dependency artifacts by job id by @kunaals in #2757
• feat(rules): expand CIS benchmark coverage for GCP, Google Workspace, and Kubernetes by @jychp in #2755
• feat(semgrep): Support for OSS Semgrep SAST Findings by @shyammukund in #2716
• docs(tests): add local agent guidance by @kunaals in #2769
• fix(gcp): preserve current GAR images during cleanup by @kunaals in #2767
• feat(ontology): add device ownership links and graph indexes by @jychp in #2759
• feat(gcp): derive Artifact Registry provenance from SBOMs by @kunaals in #2745
• feat(rules): close AWS / GCP / Azure coverage gap on standalone rules by @jychp in #2761
• fix(gcp): reduce policy binding write pressure by @kunaals in #2773
• feat(gcp): derive GAR parent image lineage by @kunaals in #2774
• fix(docs): pull request template linter command by @achantavy in #2771
• Dependabot alerts by @ryan-lane in #2768
• docs: Add test structure guidelines to AGENTS.md by @achantavy in #2775
• chore: bump the minor-and-patch group with 7 updates by @dependabot[bot] in #2779
• chore: bump microsoft-kiota-http from 1.9.8 to 1.9.9 by @dependabot[bot] in #2778
• chore: bump github/codeql-action from 4.35.2 to 4.35.3 in the minor-and-patch group by @dependabot[bot] in #2777
• fix: bump docker-compose Neo4j image to 5-community by @jychp in #2781
• feat(rules): add serverless_workload_exposed multi-cloud rule by @jychp in #2782
• docs(skills): add audit-frameworks skill for rules audits by @jychp in #2787
• feat(ontology): add blockstorage, identityproviders, cicdpipelines categories by @jychp in #2776
• fix(gcp): scope inherited policy binding writes by @kunaals in #2784
• chore: bump urllib3 from 2.6.3 to 2.7.0 by @dependabot[bot] in #2792
• feat(semgrep): link findings and dependencies to GitLabProject by @jychp in #2796
• fix(analysis): MERGE before DELETE-stale to remove read window in 10 analysis jobs by @jychp in #2797
• feat(aws): add ALB mTLS properties to ELBV2Listener by @jychp in #2793
• feat(gitlab): map GitLabDependency to packages ontology by @jychp in #2795
• feat(guardduty): Persist Service Action API fields on AWSGuardDutyFindings by @shyammukund in #2788
• feat(rules): add Mini Shai-Hulud (May 2026) wave to npm dependency rule by @jychp in #2800
• perf: index frequently filtered model properties, map GCPServiceAccountKey to apikeys ontology by @jychp in #2803
• feat(rules): expand ISO 27001 coverage by @jychp in #2786
• fix(rules): correct invalid Cypher syntax in CIS GCP rules by @jychp in #2807
• feat(gcp): migrate HttpError handling in compute and init to canonical classifier by @Denyme24 in #2530
• feat(GitHub): Add support for GitHub repository rulesets by @deidaraiorek in #2163
• feat(gcp): add Workload Identity Federation pool and provider nodes by @jychp in #2799
• fix(rules): reduce false positives in top-volume security rules by @jychp in #2802
• chore: bump github/codeql-action from 4.35.3 to 4.35.4 in the minor-and-patch group by @dependabot[bot] in #2815
• feat(github): ingest personal access token metadata by @kunaals in #2811
• chore: bump the minor-and-patch group with 12 updates by @dependabot[bot] in #2816
• chore: bump types-requests from 2.33.0.20260408 to 2.33.0.20260508 by @dependabot[bot] in #2818
• feat(github): map GitHubContainerImage into Image ontology and wire HAS_IMAGE from workloads by @jychp in #2809
• chore: bump types-pyyaml from 6.0.12.20260408 to 6.0.12.20260508 by @dependabot[bot] in #2817
• chore: bump python from a0779d7 to dc1546e by @dependabot[bot] in #2814
• feat(rules): normalize Kubernetes control-plane exposure and add multi-cloud rule by @jychp in #2794
• fix(rules): five false-positive filters across rules by @jychp in #2808
• fix(entra): skip deleted service principals during appRoleAssignedTo fetch by @jychp in #2812
• feat: downgrade noisy log lines and extend ontology / rule coverage by @jychp in #2813
• feat(ontology): project _ont_has_mfa and _ont_active on AWSUser by @jychp in #2819
• Add ingress-nginx retirement coverage to EOL software rule by @kunaals in #2820
• chore: bump idna from 3.11 to 3.15 by @dependabot[bot] in #2824
• feat(AWS): Add AWS Organizations support by @kunaals in #2780
• fix(rules): skip archived GitHub repos + reorder Finding fields for display name by @jychp in #2827
• fix(aws): skip org cleanup when account state is unavailable by @kunaals in #2828
• feat(guardduty): link AccessKey findings to affected IAM principals by @jychp in #2835
• feat(ontology): project _ont_enabled on EntraApplication by @jychp in #2821
• feat(gcp): close ontology projection gaps for GCP by @jychp in #2822
• feat(aws): add CAN_PASSROLE permission relationship by @jychp in #2833
• chore: bump python from 3.13-slim to 3.13.13-slim by @dependabot[bot] in #2832
• chore: bump the minor-and-patch group with 2 updates by @dependabot[bot] in #2834
• fix(rules): reduce k8s service account token noise by @kunaals in https...

0.136.0

What's Changed

• feat(kube): Extend Kubernetes Module to have KubernetesNode and Container Architecture Info by @shyammukund in #2598
• chore: bump types-requests from 2.33.0.20260327 to 2.33.0.20260402 by @dependabot[bot] in #2605
• chore: bump the minor-and-patch group with 6 updates by @dependabot[bot] in #2604
• chore: bump astral-sh/setup-uv from 7.6.0 to 8.0.0 by @dependabot[bot] in #2603
• chore: bump docker/login-action from 4.0.0 to 4.1.0 in the minor-and-patch group across 1 directory by @dependabot[bot] in #2602
• chore: bump python from 739e721 to eefe082 by @dependabot[bot] in #2601
• chore: bump pytest from 9.0.2 to 9.0.3 by @dependabot[bot] in #2610
• fix(googleworkspace): Handle Google Workspace memberships missing type by @kunaals in #2611
• feat(gcp): Add Container Architecture Coverage for GCP Cloud Run by @shyammukund in #2600
• feat(permissions): Add DynamoDB write and Secrets Manager permission mappings by @jychp in #2613
• feat(kube): Add in HAS_IMAGE rel between KubernetesContainer and GCPArtifactRegistryImage by @shyammukund in #2608
• feat(azure): Extend Azure Coverage so containers have architecture and digest info by @shyammukund in #2607
• fix(ubuntu): add HTTP retry policy to avoid transient 503 failures by @serge-wq in #2609
• feat(ontology): Add Analysis Job to compute RESOLVED_IMAGE rel between Container and Images by @shyammukund in #2617
• feat(aws): Update HAS_IMAGE in ECS to extend to GAR and Gitlab Images by @shyammukund in #2618
• fix(aws): reduce SageMaker regional retry tail by @kunaals in #2616
• feat(gitlab): align code-to-cloud graph modeling by @jychp in #2612
• feat(gcp): Update CloudRunJob and CloudRunRevision to have container ontology label by @shyammukund in #2619
• feat(crowdstrike): enrich device ontology ownership by @kunaals in #2615
• fix(rules): exclude inactive unmanaged accounts by @jychp in #2623
• feat(kubernetes): map KubernetesCluster to its EKSCluster by @jychp in #2626
• fix(github): defer global cleanup until all orgs sync by @jychp in #2621
• feat(kubernetes): add IRSA service account role mapping by @jychp in #2627
• feat(ontology): add SecurityIssue semantic label for non-CVE findings by @jychp in #2576
• feat(jamf): sync device inventory and memberships by @kunaals in #2625
• chore: bump types-requests from 2.33.0.20260402 to 2.33.0.20260408 by @dependabot[bot] in #2634
• chore: bump types-pyyaml from 6.0.12.20250915 to 6.0.12.20260408 by @dependabot[bot] in #2633
• fix(jamf): map mobile display fields into device ontology by @kunaals in #2636
• chore: bump the minor-and-patch group with 2 updates by @dependabot[bot] in #2631
• chore: bump python from eefe082 to d168b8d by @dependabot[bot] in #2630
• fix(jamf): normalize mobile os before ontology mapping by @kunaals in #2638
• fix(keycloak)/unsupported-pagination by @VeteaRes in #2516
• fix(aws) use recommended function to fetch s3 bucket region by @aliahmed58 in #2509
• chore: bump pyopenssl from 25.3.0 to 26.0.0 by @dependabot[bot] in #2637
• chore(graph): bump default cleanup iterationsize to 10000 by @jychp in #2639
• chore: bump the minor-and-patch group across 1 directory with 4 updates by @dependabot[bot] in #2632
• fix(aws): honor configured profile even when only one is discovered by @jychp in #2641
• fix(aws): skip permission relationships without resource arns by @jychp in #2644
• fix(gcp): list Go modules via packages API in Artifact Registry by @jychp in #2649
• feat(gcp): add GCPCloudRunService USES_SERVICE_ACCOUNT relationship by @jychp in #2651
• feat(gcp): map CAN_READ from principals to GCPSecretManagerSecret by @jychp in #2652
• feat(vercel): add Vercel ingestion module by @jychp in #2628
• refactor(aws-iam): drop dead AccountAccessKey rel definitions by @jychp in #2654
• feat(socketdev): add Socket.dev intel module for supply chain security by @jychp in #2629
• feat: scope Container to individual containers; route Cloud Run + image-based Functions through Function by @jychp in #2653
• fix(entra): Skip Group when a group gets deleted between listing and fetching by @shyammukund in #2624
• feat(intune): stream detected apps transform to prevent OOM by @shyammukund in #2643
• fix(gcp): skip default Apps Script project folders by @kunaals in #2656
• feat(ontology): Jamf device emails should derive canonical ownership edges by @kunaals in #2661
• feat(rules): add rule to detect unpinned GitHub Actions by @jychp in #2660
• fix(aws): lower retry attempts and harden transient failures by @kunaals in #2553
• feat(kubernetes): make list secrets and aws-auth configmap permissions optional by @jychp in #2663
• fix(workos): migrate intel module to workos SDK v6 by @jychp in #2650
• refactor: refine Container/Function ontology for Azure container groups and Cloud Run by @jychp in #2657
• feat(tailscale): model grants and resolve effective access relationships by @jychp in #2647
• fix(aws): preserve S3 buckets on head_bucket timeouts by @kunaals in #2666
• fix(microsoft): migrate intune detected apps to report exports by @kunaals in #2664
• fix(aws): filter unsupported service regions by @kunaals in #2662
• fix(gcp): speed up vertex ai sync path by @kunaals in #2669
• fix(cve): retry NIST NVD fetch on ChunkedEncodingError by @jychp in #2665
• feat(cve_metadata): add CVE metadata enrichment intel module by @jychp in #2538
• fix(kubernetes): process templated EKS aws-auth entries by @jychp in #2655
• perf(gcp): batch permission relationship sync by @kunaals in #2673
• refactor(ontology): remove OntologyRelMapping, migrate to analysis jobs and Python by @jychp in #2674
• perf(gcp): speed up cloud run sync path by @kunaals in #2672
• feat(ontology): promote DNSRecord to semantic label and add cross-provider DNS linking by @jychp in #2676
• fix(gcp): Handle billing-disabled GCP KMS syncs gracefully by @kunaals in #2677
• fix(gcp): Handle CAI policy binding rate limits in GCP sync by @kunaals in #2679
• feat(scan): Add DEPLOYED rel between syft/trivy and images by @shyammukund in #2678
• perf(aws): Add index on EC2Instance metadatahttptokens by @jychp in #2685
• fix(gcp): speed up artifact registry sync by @kunaals in #2675
• feat(ontology): map missing nodes and add FileStorage semantic ...

0.135.0

What's Changed

• chore: bump the minor-and-patch group with 2 updates by @dependabot[bot] in #2533
• chore: bump cryptography from 45.0.7 to 46.0.6 by @dependabot[bot] in #2558
• feat(rules): add NIST AI RMF aligned AI governance checks by @kunaals in #2435
• fix(aws): handle SES list_email_identities without paginator by @kunaals in #2561
• chore: add dependabot cooldowns by @jychp in #2560
• fix(aws): use adaptive botocore retries by @kunaals in #2550
• refactor(ontology): convert device hostname rels to conditional matchlinks by @jychp in #2546
• chore: bump pygments from 2.19.2 to 2.20.0 by @dependabot[bot] in #2563
• chore: bump the minor-and-patch group across 1 directory with 19 updates by @dependabot[bot] in #2562
• refactor: cleanup redundant indexes and auto-index lastupdated on extra labels by @jychp in #2564
• fix(ontology): clean up stale derived relationships by @jychp in #2565
• fix(github): add retry logic to call_github_rest_api for transient errors by @jychp in #2566
• fix(core): update CALL subquery to use Neo4j 5 syntax. Update docs. (#1500) by @achantavy in #2547
• chore: bump sphinxcontrib-mermaid from 1.0.0 to 2.0.1 by @dependabot[bot] in #2556
• fix(github): raise ValueError when organization data is None in fetch_all by @jychp in #2568
• fix(gitlab): support additional dependency scanning job names by @kunaals in #2569
• chore: bump kubernetes from 33.1.0 to 35.0.0 by @dependabot[bot] in #2557
• feat(ontology): link Device to SentinelOne agents by @jychp in #2571
• chore: bump packaging from 25.0 to 26.0 by @dependabot[bot] in #2555
• chore: bump aiohttp from 3.13.2 to 3.13.4 by @dependabot[bot] in #2572
• feat(intune): Add Coverage for Microsoft Intune by @shyammukund in #2537
• fix(gcp): retry google api core server errors by @jychp in #2573
• feat: add new intel module for WorkOS by @jychp in #2219
• chore: add Python 3.13 support with deprecation warning for previous versions by @jychp in #2346
• chore: bump aiohttp from 3.13.3 to 3.13.4 by @dependabot[bot] in #2574
• docs(ci): align CNCF references and publish coverage evidence by @jychp in #2567
• fix: change log level from warning to debug for expected Composite Node Pattern cases by @achantavy in #2549
• fix(gcp): retry cleanup and graph job writes by @kunaals in #2540
• feat(kubernetes): link pods to service accounts by @jychp in #2575
• Pin azure-mgmt-resource below 25 by @kunaals in #2577
• chore: bump actions/upload-artifact from 4.3.3 to 7.0.0 by @dependabot[bot] in #2579
• chore: bump the minor-and-patch group with 23 updates by @dependabot[bot] in #2580
• fix(s1): reduce SentinelOne site-scope fallback log noise by @kunaals in #2585
• chore: bump cryptography from 45.0.7 to 46.0.5 by @dependabot[bot] in #2581
• chore: remove redundant load/sync log statements from intel modules by @jychp in #2588
• feat(tailscale): ingest and resolve device posture by @jychp in #2586
• test: align legacy integration tests with AGENTS.md standards by @jychp in #2589
• fix(test): resolve flaky test_sync_ecr caused by non-deterministic mock ordering by @jychp in #2592
• refactor: migrate 5 legacy intel modules to data model by @jychp in #2590
• chore: bump cryptography from 46.0.5 to 46.0.7 by @dependabot[bot] in #2593
• refactor(github): migrate remaining repo sync to data model by @jychp in #2591
• feat(ontology): add EncryptionKey semantic label for cross-cloud key queries by @jychp in #2594
• fix(aws): Skip 503 error for single region in Cloudtrail_mgmt_events module sync by @shyammukund in #2596
• refactor(microsoft): Move Entra and Intune modules under new Microsoft Module by @shyammukund in #2595
• docs(kubernetes): document EKS permission requirements by @kunaals in #2599

Full Changelog: 0.134.0...0.135.0

0.134.0

What's Changed

• fix(gcp): retry artifact registry API requests by @kunaals in #2496
• chore: bump black from 26.1.0 to 26.3.1 by @dependabot[bot] in #2495
• feat(rules): expand EOL software rule for Kubernetes and EC2 by @kunaals in #2483
• feat(docker_scout): Coverage for Docker Scout by @shyammukund in #2488
• fix(gitlab): tolerate transient attestation registry failures by @kunaals in #2503
• feat(gcp):Add unified label support for more GCP resources. by @shyammukund in #2504
• chore: bump pyjwt from 2.10.1 to 2.12.0 by @dependabot[bot] in #2505
• chore: bump astral-sh/setup-uv from 7.3.1 to 7.5.0 in the minor-and-patch group by @dependabot[bot] in #2498
• chore: bump docker/setup-docker-action from 4.7.0 to 5.0.0 by @dependabot[bot] in #2499
• chore: bump docker/metadata-action from 5.10.0 to 6.0.0 by @dependabot[bot] in #2500
• chore: bump the minor-and-patch group with 5 updates by @dependabot[bot] in #2501
• feat(rules): add SubImage coverage framework and rules by @jychp in #2485
• feat(slack): create SlackBot node type for bot accounts by @jychp in #2493
• fix: handle AWS sync edge cases and Docker Scout tag schema by @jychp in #2506
• feat(gcp): implement classify_gcp_http_error utility and update error handling in DNS, GKE, and Vertex AI modules by @Denyme24 in #2502
• feat(sentry): add Sentry intel module by @jychp in #2439
• feat(ontology): add PermissionRole, NetworkAccessControl, and DNSZone semantic labels by @jychp in #2492
• fix(github): continue repo sync when privileged query is forbidden by @kunaals in #2507
• fix(openai): filter project keys from admin API keys endpoint by @jychp in #2511
• chore: bump pyasn1 from 0.6.2 to 0.6.3 by @dependabot[bot] in #2514
• fix(aws): tolerate transient cloudtrail and ecr failures by @kunaals in #2515
• feat(semgrep: Secrets): Include secret findings from semgrep by @serge-wq in #2513
• feat(aws): ingest EC2 IMDS metadata options by @kunaals in #2519
• feat(ontology): switch Device ID from hostname to serial_number by @jychp in #2523
• feat(config): Expose additional Neo4j driver options in run_with_config by @kunaals in #2524
• Align AWS CIS v5 rule metadata and add EC2 IMDSv2 coverage by @kunaals in #2520
• feat(aws): add SES email identity support by @raajheshkannaa in #2497
• fix(graph): order matchlink cleanup index by scope first by @kunaals in #2529
• fix(aws): tolerate transient child failures and parse SLSA v1 provenance by @kunaals in #2525
• feat(aws): pass region parameter to get_sqs_queue_attributes by @kirkj-lightspeed in #2445
• fix(entra): retry transient Graph API errors across all Entra syncs by @jychp in #2531
• feat(sentinelone): support site-scoped MSSP tokens by @kunaals in #2527
• feat(cve): add indexed cve_id property to CVE node by @jychp in #2536
• fix(gitlab): batch large container image ingests by @kunaals in #2528
• chore: bump the minor-and-patch group with 4 updates by @dependabot[bot] in #2534
• chore: bump python from 4b0a8eb to 4ba18b0 by @dependabot[bot] in #2532
• feat: add Jumpcloud intel module by @tr0mpa in #2480
• fix(tailscale): request all fields from devices API to collect serial numbers by @jychp in #2545
• fix(aws): handle account-instance IAM Identity Center permission set errors by @kunaals in #2543
• fix(semgrep): match SAST/SCA findings to GitHubRepository via URL by @serge-wq in #2521
• chore: bump requests from 2.32.5 to 2.33.0 by @dependabot[bot] in #2551
• Tighten readme by @achantavy in #2544
• chore: bump protobuf from 6.33.0 to 6.33.5 by @dependabot[bot] in #2552

New Contributors

• @raajheshkannaa made their first contribution in #2497

Full Changelog: 0.133.0...0.134.0

0.133.0

What's Changed

• fix(gcp): harden config error handling and vertex model property serialization by @kunaals in #2460
• Adding ubuntu intel module and tests by @AdiLyft in #2428
• chore: bump python from 3.10.19-slim to 3.10.20-slim by @dependabot[bot] in #2464
• chore: bump the minor-and-patch group with 2 updates by @dependabot[bot] in #2465
• chore: bump the minor-and-patch group with 5 updates by @dependabot[bot] in #2470
• chore: bump docker/setup-qemu-action from 3.7.0 to 4.0.0 by @dependabot[bot] in #2466
• chore: bump docker/build-push-action from 6.19.2 to 7.0.0 by @dependabot[bot] in #2467
• chore: bump docker/login-action from 3.7.0 to 4.0.0 by @dependabot[bot] in #2468
• chore: bump docker/setup-buildx-action from 3.12.0 to 4.0.0 by @dependabot[bot] in #2469
• fix(gcp): handle KMS API disabled error to prevent project sync crash by @jychp in #2472
• fix(tailscale): add HTTP retry with backoff for transient errors by @yashasviyadav30 in #2463
• feat(gcp): Add GCP Labels Support for GCPInstances and GCPBuckets by @shyammukund in #2437
• feat(gcp): Add Selective Sync for GCP by @shyammukund in #2462
• feat(cli,config): add neo4j liveness check timeout option to prevent connection issues by @Denyme24 in #2471
• fix(gcp): serialize Vertex AI endpoint labels to JSON by @jychp in #2482
• feat(subimage): add SubImage intel module by @jychp in #2474
• fix(gcp): reduce noisy expected error logs by @kunaals in #2490
• fix(gcp): handle artifact registry os packages by @kunaals in #2491
• feat(aibom): ingest AI BOM reports and link detections to canonical ECR images by @kunaals in #2443
• feat(Semgrep/sast) Add Semgrep SAST findings with AI assistant info by @heryxpc in #2486
• feat(ontology): expand ontology with serviceaccounts and certificates categories by @jychp in #2487

New Contributors

• @AdiLyft made their first contribution in #2428
• @yashasviyadav30 made their first contribution in #2463
• @Denyme24 made their first contribution in #2471

Full Changelog: 0.132.0...0.133.0