vpcatlas 0.8.1

Fixed

• EC2 instance groups carry the tags every member shares (plus the Auto Scaling group tags and the group
  name), so --tag rules keep them. In 0.8.0 a group had only its Name tag, and a rule such as
  Environment=prod dropped every group.

Changed

• The simulated account of the demo tags its prod and shared resources with Environment, so the tag
  filter can be tried on it.

Verify

Check where the files came from before you install them (needs the GitHub CLI and, for the image, cosign 3 or newer):

gh attestation verify vpcatlas-0.8.1-<os>-<arch>.tar.gz --owner karina-pp
gh attestation verify SHA256SUMS --owner karina-pp
gh attestation verify oci://index.docker.io/vpcatlas/vpcatlas:0.8.1 --owner karina-pp
cosign verify index.docker.io/vpcatlas/vpcatlas:0.8.1 \
  --certificate-identity-regexp '^https://github\.com/karina-pp/vpcatlas/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

The SBOM of the binaries is vpcatlas-0.8.1-sbom.cdx.json. See Install.

vpcatlas 0.8.0

Added

• --tag KEY=VALUE (repeatable; KEY alone for any value; * and ? wildcards) narrows discover, inventory,
  diagram and serve to the resources that carry those tags, keeping the account, region, VPC and subnets they hang
  from. The dashboard reads the same rules from VPCATLAS_TAGS. Resources the collectors do not tag never match.

Verify

Check where the files came from before you install them (needs the GitHub CLI and, for the image, cosign 3 or newer):

gh attestation verify vpcatlas-0.8.0-<os>-<arch>.tar.gz --owner karina-pp
gh attestation verify SHA256SUMS --owner karina-pp
gh attestation verify oci://index.docker.io/vpcatlas/vpcatlas:0.8.0 --owner karina-pp
cosign verify index.docker.io/vpcatlas/vpcatlas:0.8.0 \
  --certificate-identity-regexp '^https://github\.com/karina-pp/vpcatlas/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

The SBOM of the binaries is vpcatlas-0.8.0-sbom.cdx.json. See Install.

vpcatlas 0.7.1

Fixed

• A graph loaded with --cache can no longer make diagram or discover write outside --output-dir: region
  names are checked when the graph is read, the page name is made file-safe and every diagram path is checked
  against the output directory before it is written.
• The dashboard refuses unknown Host names on every bind address when no password is set, so a page on another
  site cannot read the panel through DNS rebinding, and POST /refresh without a password always needs the
  X-Requested-With: vpcatlas header. An IPv6 Host without a port is read correctly. A reverse proxy that keeps
  the public name and does the authentication itself needs that name in VPCATLAS_ALLOWED_HOSTS; the docs say so.
• API Gateway HTTP APIs made with Quick Create: the Target URL is cleaned like the integration URIs, and path
  segments that look like JWTs, 16 to 19 character keys or tokens with :, ., % or @ (a Telegram bot token,
  for one) are redacted. Tag values that look like AWS keys, GitHub, GitLab or Slack tokens, JWTs or URLs with a
  password are redacted whatever the key and wherever they sit in the value.
• The Markdown inventory escapes CIDRs, regions, account ids, family titles and the generated_at of a cached
  graph, so a crafted value cannot break a table or inject Markdown.
• An ARN whose region part is * or a stage-variable placeholder no longer aborts a scan: the stub it creates
  carries the unknown region.
• install.sh puts the link in /usr/local/bin only when run as root, checks the version string, uses
  unpredictable staging and link names and reads SHA256SUMS with Windows line endings. Both installers hash and
  extract a private copy of a local archive, and verify its attestation when gh is signed in. install.ps1
  escapes % in the launcher, refuses a data directory the console encoding cannot represent, checks the version
  string to its last character, and takes -NoPath or VPCATLAS_NO_MODIFY_PATH=1 to leave the PATH alone.
• install.sh re-points a vpcatlas link left by an earlier install elsewhere on PATH (/usr/local/bin was the
  default before 0.7.1) when it can write there, and otherwise keeps that version and says so, so an upgrade cannot
  leave a dangling link that shadows the new one. Both installers say that a local archive is still verified online
  when gh is signed in, and how to install without network access.
• The Helm chart no longer writes a plain SHA-256 of the password into the checksum/auth annotation.

Changed

• Releases: the Helm chart .tgz is listed in SHA256SUMS and attested, the SBOM lists every locked package, both
  image architectures pass the smoke test and the Trivy gate before the push, and the documented cosign identity
  is the release workflow on a tag. The nightly audit reads the three lockfiles, and the CI and release tests
  install under the lock's versions.
• The Kubernetes, ECS and Compose examples name the released version, and a test keeps them in step.

Verify

Check where the files came from before you install them (needs the GitHub CLI and, for the image, cosign 3 or newer):

gh attestation verify vpcatlas-0.7.1-<os>-<arch>.tar.gz --owner karina-pp
gh attestation verify SHA256SUMS --owner karina-pp
gh attestation verify oci://index.docker.io/vpcatlas/vpcatlas:0.7.1 --owner karina-pp
cosign verify index.docker.io/vpcatlas/vpcatlas:0.7.1 \
  --certificate-identity-regexp '^https://github\.com/karina-pp/vpcatlas/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

The SBOM of the binaries is vpcatlas-0.7.1-sbom.cdx.json. See Install.

vpcatlas 0.7.0

Added

• --format csv writes the inventory as vpcatlas-inventory.csv, one flat row per resource, so you can filter it in a spreadsheet or with csvkit. It works in discover and inventory, and --format all now includes it. The dashboard serves the same file at /export/inventory.csv, with a .csv button on the inventory tab, and all.zip holds it as inventory/inventory.csv. Columns and cell rules are in docs/outputs/inventory.md.

Verify

Check where the files came from before you install them (needs the GitHub CLI and, for the image, cosign 3 or newer):

gh attestation verify vpcatlas-0.7.0-<os>-<arch>.tar.gz --owner karina-pp
gh attestation verify SHA256SUMS --owner karina-pp
gh attestation verify oci://index.docker.io/vpcatlas/vpcatlas:0.7.0 --owner karina-pp
cosign verify index.docker.io/vpcatlas/vpcatlas:0.7.0 \
  --certificate-identity-regexp '^https://github.com/karina-pp/vpcatlas/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

The SBOM of the binaries is vpcatlas-0.7.0-sbom.cdx.json. See Install.

vpcatlas 0.6.0

Added

• An Agent Skill, skills/vpcatlas, in the open Agent Skills format: a SKILL.md with references on the commands, the outputs and troubleshooting, so a coding agent can run the tool safely and answer from its files. Documented in docs/skill.md.

Verify

Check where the files came from before you install them (needs the GitHub CLI and, for the image, cosign 3 or newer):

gh attestation verify vpcatlas-0.6.0-<os>-<arch>.tar.gz --owner karina-pp
gh attestation verify SHA256SUMS --owner karina-pp
gh attestation verify oci://index.docker.io/vpcatlas/vpcatlas:0.6.0 --owner karina-pp
cosign verify index.docker.io/vpcatlas/vpcatlas:0.6.0 \
  --certificate-identity-regexp '^https://github.com/karina-pp/vpcatlas/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

The SBOM of the binaries is vpcatlas-0.6.0-sbom.cdx.json. See Install.

vpcatlas 0.5.0

Added

• A Helm chart, deploy/helm/vpcatlas, that renders the dashboard pod of deploy/kubernetes/ from values: service
  account with the IRSA annotation, Deployment, Service, and, on request, an Ingress with a base path, a volume for the
  snapshots, a NetworkPolicy, the password Secret and a ConfigMap of account names. It is published as an OCI artifact
  at oci://ghcr.io/karina-pp/charts/vpcatlas, signed with cosign and attested, and as a .tgz on each GitHub release;
  the release workflow also refuses a tag whose Chart.yaml version differs from the package. Every change
  lints and renders it, then installs it in a kind cluster, runs helm test and upgrades it with every option on.
  Guide: docs/deploy/helm.md.
• Two more recordings in the README and on the site, made by the same scripts/demo.sh (it now records every
  tape in demo/): vpcatlas inventory on its own, and vpcatlas diagram --cache drawing the Lucidchart diagrams
  again from a saved graph with no AWS calls.
• The panel shows the pages that could not be drawn: the page list marks them ("Not drawn" and the reason),
  selecting one explains it in the viewer instead of asking for a file that is not there, the joined downloads
  say how many pages they leave out, and a notice at the top lists them. The API already reported
  failed_pages; the browser now reads it.

Changed

• The README, the install guide and the docs home install the Python package from PyPI
  (pipx install vpcatlas); 0.4.2 is the first version published there.
• The lane of global services on the Global page wraps into lines of at most 2400 px instead of one line:
  twenty distributions with a web ACL and a certificate each made a 6360 px page, now 2710 px on three lines.
  A fan whose leaves sit on several lines is still drawn as a bus, with one trunk per line and a spine down
  the left margin of the lane, so the router is not asked and the page carries no notes; a hub on a line
  above every leaf (a zone whose distributions all wrapped) takes the same shape. Region lanes keep one
  line: their fans need it.
• One glyph for "times N": a merged edge reads ×77 and a counted link ×2, as the folded cards always did
  (API Gateway ×77); xN and x N are gone from every label.
• One definition of an AWS service-owned account: the model (NetworkGraph.is_service_owned) decides and the
  inventory reads it, instead of adding conditions of its own. An account that owns any other resource in
  the graph, that a peering or a transit gateway attachment names, or that a label names (--account-names,
  also when only the inventory was given them) is external, as before; the two lists can no longer disagree.

Verify

Check where the files came from before you install them (needs the GitHub CLI and, for the image, cosign 3 or newer):

gh attestation verify vpcatlas-0.5.0-<os>-<arch>.tar.gz --owner karina-pp
gh attestation verify SHA256SUMS --owner karina-pp
gh attestation verify oci://index.docker.io/vpcatlas/vpcatlas:0.5.0 --owner karina-pp
cosign verify index.docker.io/vpcatlas/vpcatlas:0.5.0 \
  --certificate-identity-regexp '^https://github.com/karina-pp/vpcatlas/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

The SBOM of the binaries is vpcatlas-0.5.0-sbom.cdx.json. See Install.

vpcatlas 0.4.2

Added

• A demo in the README and on the site: a recording of vpcatlas discover, the dashboard and two diagrams, all
  produced against a simulated AWS account (demo/fake_aws.py: moto behind a small shim that answers what moto does
  not implement) by scripts/demo.sh, so anyone can reproduce them without an AWS account.

Changed

• The release notes and the install guide say that verifying the image signature needs cosign 3 or newer.
• The tools that build and publish a release moved to build 1.6, twine 7 and PyInstaller 6.22, and the workflows to
  the current majors of the GitHub Actions they use.

Verify

Check where the files came from before you install them (needs the GitHub CLI and, for the image, cosign 3 or newer):

gh attestation verify vpcatlas-0.4.2-<os>-<arch>.tar.gz --owner karina-pp
gh attestation verify SHA256SUMS --owner karina-pp
gh attestation verify oci://index.docker.io/vpcatlas/vpcatlas:0.4.2 --owner karina-pp
cosign verify index.docker.io/vpcatlas/vpcatlas:0.4.2 \
  --certificate-identity-regexp '^https://github.com/karina-pp/vpcatlas/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

The SBOM of the binaries is vpcatlas-0.4.2-sbom.cdx.json. See Install.

vpcatlas 0.4.1

Added

• Build pipeline on every pull request and every push to main: the tests on Linux (Python 3.12 and 3.13), macOS
  and Windows with a coverage gate, the type check, the docs build in strict mode, the package build, and the
  dashboard and Lambda images built, started (the Lambda one through the runtime emulator) and scanned with Trivy;
  dependency review on every pull request, and the workflows themselves linted.
• Release pipeline: an SBOM (CycloneDX) of the Linux x86_64 binary, attached to the release and attested; every image
  is scanned with Trivy before the push (a critical vulnerability with a fix stops that push), then signed with
  cosign and attested; the release notes end with the commands to verify the files and the image. When everything is
  published, a last job installs the release from the live site on Linux, macOS and Windows and checks the version,
  the image, its attestation and its signature. See Install.
• CodeQL analysis of the Python code, an OpenSSF Scorecard run, nightly checks (pip-audit, the links of the docs,
  the layout benchmark and a Trivy scan of the published image) and Dependabot updates for the Python dependencies,
  the GitHub Actions and the Docker base images.
• SECURITY.md (how to report a vulnerability), CODE_OF_CONDUCT.md, CODEOWNERS, a pull request template and a
  longer guide for contributors.

Changed

• The release workflow no longer uses any GitHub Actions cache, so nothing cached by an earlier run can end up in a
  published file. Its checkouts keep no credentials after cloning.

Verify

Check where the files came from before you install them (needs the GitHub CLI and, for the image, cosign 3 or newer):

gh attestation verify vpcatlas-0.4.1-<os>-<arch>.tar.gz --owner karina-pp
gh attestation verify SHA256SUMS --owner karina-pp
gh attestation verify oci://index.docker.io/vpcatlas/vpcatlas:0.4.1 --owner karina-pp
cosign verify index.docker.io/vpcatlas/vpcatlas:0.4.1 \
  --certificate-identity-regexp '^https://github.com/karina-pp/vpcatlas/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

The SBOM of the binaries is vpcatlas-0.4.1-sbom.cdx.json. See Install.

vpcatlas 0.4.0

Added

• --detail simple folds the crowds of the Region lane before the page is laid out: more than three cells of one
  kind become one card ("API Gateway ×77") with one edge per neighbour, labelled x77, so the lane, the Region frame
  and the page shrink with them. Lucid exports fold the lane too (the second pass inside the VPCs stays draw.io only),
  and a diff is never folded. On a page with 77 API Gateways, --detail simple went from 37 s to under a second and
  the Region page from 17,700 to 2,660 px wide. See Diagram.
• The fans of the Region lane (the Internet users to many distributions or APIs, many APIs to one function card)
  are drawn as a bus: one trunk and a branch per icon, with no search per edge. The same 77-API page in
  --detail full went from 97 s and 167 layout notes to under a second and none (rule Q68 in
  Diagram quality).
• A routing budget per page: a crowded page spends it on its edges, the rest are drawn straight and one note says how
  many. Every page carries routing counters, and scripts/bench_layout.py with the fanout fixture measures them.
• The dashboard publishes the snapshot as soon as the graph is loaded and draws each page on its first request; the
  joined file and the zip draw everything. Page routes answer HEAD with the same headers as GET.
• The diagrams.net viewer is bundled under /static/vendor (Apache-2.0, notice included): the page loads no
  third-party script unless VPCATLAS_VIEWER_URL points elsewhere. See Dashboard.
• -q prints errors only, and --help shows the default of every numeric option.
• /api/status lists the pages that could not be drawn (failed_pages) with the reason; the joined file and the
  zip leave them out instead of failing.
• The installers resolve the latest release through the GitHub API (releases/latest) and explain the
  unauthenticated rate limit (60 requests an hour) when it is hit.

Changed

• The repository lives at github.com/karina-pp/vpcatlas for now; the installers download the releases from there and check
  their attestation against that owner. The Docker Hub images keep the vpcatlas/ namespace.
• vpcatlas serve scans once by default (--refresh-seconds 0); with an interval, a scan is skipped while the
  previous one is still running. See serve.
• External accounts are the accounts with a real link (peering, Transit Gateway, RAM, PrivateLink, Direct Connect)
  or a label; the AWS service accounts that only own managed interfaces (Lambda, load balancers, endpoints) are
  listed apart in the inventory and no longer counted.
• A Region whose first EC2 call is refused by a service control policy is skipped with one gap (region_blocked)
  and no empty nodes; a policy that vetoes a single service (WAF, Shield) does not close the Region. That gap and
  the CloudTrail single-Region note are warnings, so --strict passes in an organization that blocks Regions on
  purpose. Credential errors say what to do. See Limitations.
• The dashboard draws in a thread of its own, so a slow page never starves the other routes, and computes the hash,
  size and families of a page once, when it is drawn.
• Folded cards read ×N in every export, and a merged edge counts what the edges it merges stood for (x14 for
  seven edges labelled x2).
• Flow discs of a bus sit on the branch of each edge, and one edge per fan marks the shared trunk or spine once,
  instead of every edge stacking its discs there; a fan of a network page (a transit gateway with many
  attachments) is routed as before.

Fixed

• In the global page the columns of external accounts start below the lane of global services; a wide lane (many
  distributions) used to run through the first external frame, which hid its title and swallowed a WAF badge and a
  distribution.
• Issues never carry the operator identity: the session name of an assumed role, IAM user names and request ids are
  redacted (also in repr and XML forms and with an encoded @), and long messages are cut at a word boundary. The
  caller ARN stored in graph.json keeps the role and replaces the session by [principal], old graphs included,
  and the dashboard logs are redacted under uvicorn and Lambda as well as under the command line.
• The installers say so when no release is published yet (a 404 from releases/latest), apart from the rate limit.