v13.28.0

What's Changed

• 🐛 nextdns: remove non-existent settings.blockBypassMethods field by @tas50 in #8914
• 🎉 nextdns-13.0.5 by @tas50 in #8916
• ⭐ aws: add discovery for memorydb, codebuild, cognito, and transfer by @tas50 in #8915
• ⭐ aws: add ACM certificate cross-references by @tas50 in #8919
• ⭐ aws: add networkInterface() cross-references by @tas50 in #8918
• ✨ azure: bump operationalinsights/privatedns SDKs and expose systemMetadata by @tas50 in #8920
• ⭐ aws: add EFS filesystem cross-references by @tas50 in #8921
• ⭐ aws: add IAM role, S3, snapshot, subnet, and hosted zone cross-references by @tas50 in #8922
• 🎉 aws-13.42.0 by @tas50 in #8923
• ⭐ aws: add ECS EFS volume filesystem cross-reference by @tas50 in #8928
• ⭐ aws: add kmsKeys cross-reference on secret versions by @tas50 in #8927
• ⭐ aws: add EC2 image and volume cross-references by @tas50 in #8926
• ⭐ aws: add FSx filesystem cross-references by @tas50 in #8925
• ✨ package.files for pacman (arch linux) by @arlimus in #8930
• ✨ detect package ownershp of files by @arlimus in #8929
• 🎉 os-13.33.0 by @arlimus in #8932
• ⭐ aws: add route table cross-references (NAT gateway, instance, prefix list) by @tas50 in #8924
• 🐛 nutanix: pin v4 SDKs to v4.0.x for GA Prism Central compatibility by @tas50 in #8917
• ⭐ azure: bump armnetwork to v10 and add unlocked network fields by @tas50 in #8936
• 🐛 nutanix: pin v4 client require lines to v4.0.x so weekly mod-update can't advance them by @tas50 in #8938
• ⭐ aws: add VPC encryption-in-transit control + bump aws SDK deps by @tas50 in #8939
• ✨ AI agents: add runtime (and package) resolution by @arlimus in #8940
• 🎉 os-13.34.0 by @arlimus in #8942
• ⭐ azure: add network security perimeter + firewall policy rule collection groups by @tas50 in #8941
• ⭐ azure: add IP group resource + typed IP-group refs on IDPS bypass rules by @tas50 in #8946
• Bump actions/setup-go from 6.4.0 to 6.5.0 by @dependabot[bot] in #8945
• Bump goreleaser/goreleaser-action from 7.2.2 to 7.2.3 by @dependabot[bot] in #8944
• ⭐ azure: add Virtual WAN VPN/ExpressRoute gateways, ER ports, route filters by @tas50 in #8947
• ⭐ azure: add NVAs, virtual routers, public/custom IP prefixes, VNet taps, IP allocations by @tas50 in #8948
• ⭐ azure: add Azure Virtual Network Manager (AVNM) with security admin rules by @tas50 in #8949
• ⭐ azure: type network interface IP configurations (subnet/publicIP/ASG refs) by @tas50 in #8950
• ⭐ azure: wire IP-prefix/allocation/tap/private-endpoint refs into existing resources by @tas50 in #8951
• ⭐ azure: typed subnet/public-IP refs on LB frontends and Bastion IP configs by @tas50 in #8952
• ⭐ azure: add network interface effectiveRouteTable() by @tas50 in #8953
• ⭐ azure: enrich public IP address (sku, idle timeout, ip tags, NAT gateway ref) by @tas50 in #8954
• ⭐ azure: add PIM role eligibility + assignment schedules by @tas50 in #8955
• ⭐ azure: add Defender for Cloud sub-assessments (per-finding drill-down) by @tas50 in #8956
• ⭐ azure: add Defender for Cloud JIT network access policies by @tas50 in #8957
• 🐛 azure: capture permissions from client-factory-created clients by @tas50 in #8958
• ⭐ azure: add Defender for Cloud alert-suppression rules + workspace settings by @tas50 in #8959
• 🐛 recover panics during query execution instead of crashing by @preslavgerchev in #8934
• 🎉 aws-13.43.0, azure-13.26.0, nutanix-13.2.1 by @tas50 in #8964
• 🧹 os: migrate off deprecated docker/docker to moby/moby by @czunker in #8961
• 🧹 Update deps for mql and providers 20260706 by @github-actions[bot] in #8962
• 🧹 Update pinned tool versions by @github-actions[bot] in #8960
• ⭐ oci: model transit network + traversable route rules by @tas50 in #8967
• ⭐ oci: model site-to-site VPN and FastConnect ingress paths by @tas50 in #8969
• 🐛 azure: evaluate NSG priority and full NSG chain in VM exposure by @tas50 in #8968
• ⭐ aws: typed route table next-hops for network path traversal by @tas50 in #8972
• 🌟 gcp: typed network edges + typed instance NICs for attack-path traversal by @tas50 in #8971
• 🐛 oci: fix internet-exposure to weigh routes and security lists by @tas50 in #8970
• ⭐ aws: complete the load balancer listener-to-backend chain by @tas50 in #8976
• ⭐ aws: typed WAF web ACL association on load balancers (both directions) by @tas50 in #8975
• 🐛 terraform: show module-qualified address in plan check failures by @tas50 in #8977
• ⭐ azure: traverse resource identities to their role assignments (attack path) by @tas50 in #8974
• ⭐ aws: resolve Route 53 alias records to load balancer and CloudFront by @tas50 in #8973
• ⭐ azure: traverse private-link reachability (endpoint → subnet → vnet) by @tas50 in #8978
• ⭐ hetzner: server backupsEnabled + SSH key algorithm/bits by @tas50 in #8979
• ⭐ azure: expose system-assigned identity on internet-facing app resources by @tas50 in #8980
• ⭐ hetzner: cross-resource edges for load balancer and region rollups by @tas50 in #8982
• ⭐ digitalocean: App Platform depth, Functions listing, and typed refs by @tas50 in #8981
• ⭐ digitalocean: more typed refs, K8s upgrade/autoscaler fields, Functions access keys by @tas50 in #8985
• ⭐ hetzner: parse TLS certificate PEM for hygiene audits by @tas50 in #8984
• ⭐ azure: private endpoint network interfaces + fix PE cache collision by @tas50 in #8983

Full Changelog: v13.27.4...v13.28.0