0.139.0

What's Changed

• fix(github): tolerate null dependency manifest nodes by @kunaals in #2935
• fix(docs): Fix schema documentation errors by @kunaals in #2939
• fix(tailscale): use boolean predicates for Tailscale rules by @kunaals in #2941
• fix(gsuite): use immutable group id when listing members by @jychp in #2946
• perf(cve_metadata): batch NVD API requests with cveIds parameter by @jychp in #2945
• fix(github): Normalize GitHub PAT ontology timestamps by @kunaals in #2950
• fix(aws): stop IAM SAML provider sync from crashing on AccessDenied by @jychp in #2953
• chore: bump the minor-and-patch group with 8 updates by @dependabot[bot] in #2956
• chore: bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in #2955
• chore: bump python from c33f0bc to 2b7445f by @dependabot[bot] in #2954
• chore: bump kubernetes from 35.0.0 to 36.0.1 by @dependabot[bot] in #2957
• fix(azure): support azure-mgmt-web 11 model shape by @jychp in #2908
• feat(gcp): ingest GCP API Keys (apikeys.googleapis.com) by @jychp in #2960
• feat(rules): Reduce false positives in cloud security rules and add firewall relevancy signal by @jychp in #2958
• feat(scaleway): add instance security groups and rules by @jychp in #2952
• Add GitHub CODEOWNERS ownership evidence by @kunaals in #2940
• feat(scaleway): add object storage buckets by @jychp in #2963
• feat(scaleway): add VPC/IPAM network layer and Load Balancers by @jychp in #2965
• feat(scaleway): add Domains/DNS and Key/Secret Manager by @jychp in #2966
• Prepare azure-mgmt-storage 25.0.0 bump by @jychp in #2948
• feat(scaleway): add Kapsule (Kubernetes) and Container Registry coverage by @jychp in #2967
• feat(databricks): add intel module with workspace identity coverage by @jychp in #2968
• fix(ontology): populate _ont_source for SubImage, Crowdstrike, Azure tenants by @jychp in #2971
• feat(scaleway): add Managed Databases coverage (RDB, Redis, MongoDB) by @jychp in #2970
• feat(databricks): compute + secrets + IP access by @jychp in #2969
• fix(azure): migrate current SDK shapes by @jychp in #2978
• feat(azure,gcp): ingest Key Vault secret tags and Cloud Function labels by @jychp in #2974
• feat(tags): unify tag-shape ontology with a :Tag extra label by @jychp in #2973
• fix(gcp): scope BigQuery CMEK rule to persistent tables, aggregate by dataset by @jychp in #2979
• feat(scaleway): add Serverless + Public Gateway coverage and exposure rules by @jychp in #2975
• feat(databricks): add Unity Catalog coverage (metastore, catalogs, grants, ...) by @jychp in #2976
• feat(iam): condition-aware permission relationships for AWS and GCP (#2250, #1643, #2312) by @jychp in #2891
• feat(scaleway): complete resource coverage (SSH keys, bare-metal, file/data services, domains) by @jychp in #2981
• fix(subimage): read snake_case tenant fields from API response by @jychp in #2984
• feat(databricks): jobs + SQL, ML serving + apps + content, and Delta Sharing coverage by @jychp in #2982
• feat(ontology): finding->package/device edges and endpoint finding labels by @jychp in #2986
• feat(rules): improve CIS rule accuracy: reduce false positives and align finding cardinality (AWS/GCP/K8s) by @jychp in #2983
• feat(scaleway): IAM permissions, ontology coverage, and container code-to-cloud by @jychp in #2985
• fix(ontology): stop DNS linking cleanup from deleting provider-owned edges by @jychp in #2987
• chore: bump python from 2b7445f to eb43ff1 by @dependabot[bot] in #2990
• fix(ontology): map Scaleway Elastic Metal flexible IPs to PublicIP by @jychp in #2988
• fix(microsoft): retry transient Graph 500/502 across all calls by @jychp in #2989
• chore: bump actions/setup-python from 6.2.0 to 6.3.0 in the minor-and-patch group by @dependabot[bot] in #2991
• chore: bump the minor-and-patch group with 7 updates by @dependabot[bot] in #2992
• fix(workos): support sdk v8 organization memberships by @jychp in #2995
• chore: bump workos from 8.0.0 to 8.2.0 by @dependabot[bot] in #2993
• fix(ontology): stop mapping list-valued GCPRecordSet.data to scalar _ont_value by @jychp in #2997
• fix(gcp): don't abort BigQuery sync on invalidQuery errors by @Vansh-Sharma27 in #2972
• fix(ontology): exclude GCPRecordSet from scalar DNS _ont_value linking by @jychp in #3001
• fix(gcp): retry Cloud Run list calls on transient 5xx by @jychp in #3000
• fix(okta): retry non-JSON SDK errors across all paged requests by @jychp in #2999
• feat: workload-identity ASSUMES/RUNS_AS edges for EC2 and Azure VMs/Function Apps by @jychp in #2998
• feat(cve_metadata): derive effect_tags on CVEMetadata from CWE/CVSS by @jychp in #3003
• feat(salesforce): add Salesforce intel module for users, access, and connected apps by @jychp in #3005
• feat(ontology): add supply-chain relationship constraints by @jychp in #3008
• fix(rules): reduce false positives in GCP flow-log and AWS sync rules; index GitHub repo URLs by @jychp in #3011
• chore: bump the minor-and-patch group with 7 updates by @dependabot[bot] in #3012
• chore: bump the minor-and-patch group with 5 updates by @dependabot[bot] in #3013
• fix(subimage): read frameworks from Page[T] envelope by @jychp in #3009
• feat(databricks): account API, cloud configs, permission resolution, rules + ontology by @jychp in #2996
• feat(circleci): add CircleCI intel module by @jychp in #2921
• feat(tailscale): link devices to cloud instances by @jychp in #3010
• feat(kubernetes): model NetworkPolicy and capture container listening ports by @jychp in #3014
• feat(microsoft): add canonical credential config by @kunaals in #2944

New Contributors

• @Vansh-Sharma27 made their first contribution in #2972

Full Changelog: 0.138.1...0.139.0