v13.28.0

What's Changed

• 🐛 nextdns: fix bypass check and correct remediation UI labels by @tas50 in #2983
• ♻️ aws: scope 5 checks to resource-level assets instead of the account by @tas50 in #2981
• 🧹 googleworkspace: migrate policies off deprecated report.usage dict fields by @tas50 in #2984
• ✨ gitlab: add 12 supply-chain security checks for push rules, CI/CD, and webhooks by @tas50 in #2976
• ✨ Add missing AWS runtime and CloudFormation check variants by @tas50 in #2987
• ♻️ Migrate encryption/TLS checks to typed provider fields by @tas50 in #2988
• ♻️ azure: migrate app service & function identity checks to typed fields by @tas50 in #2989
• 🐛 aws: fix false positives/negatives in terraform-hcl checks by @tas50 in #2991
• 🐛 aws: index jsonencode policies with .first in terraform-hcl policy checks by @tas50 in #2992
• 🐛 aws: fix terraform-hcl logging/NACL checks that missed real misconfigs by @tas50 in #2993
• 🐛 aws: fix cloudformation checks that mis-evaluate template properties by @tas50 in #2994
• 🐛 fix terraform-hcl false negatives in hetzner/vsphere-esxi/oci checks by @tas50 in #2996
• 🐛 saas: scope IaC variants via per-check filters, not group-level filters by @tas50 in #2995
• 🐛 nextdns: remove block-bypass check that fails to compile by @czunker in #2997
• 🐛 azure: fix broken Terraform HCL checks producing false results by @tas50 in #3000
• 🐛 oci: fix vcn ingress port checks reading a nonexistent tcp_options block by @tas50 in #2998
• 🐛 azure: fix eight broken Terraform HCL checks producing false results by @tas50 in #3001
• ✨ azure: add terraform-hcl variants for 4 checks by @tas50 in #3003
• ✨ gcp: add terraform-hcl variant for 1 check by @tas50 in #3004
• 🧹 k8s: use workload-level securityContext rollups for pod/workload checks by @tas50 in #2923
• Bump the gomodupdates group with 3 updates by @dependabot[bot] in #3011
• 🐛 recover panics during policy query execution instead of crashing by @preslavgerchev in #3014
• Bump actions/cache/restore from 5.0.5 to 6.1.0 by @dependabot[bot] in #3008
• Bump actions/setup-python from 6.2.0 to 6.3.0 by @dependabot[bot] in #3009
• Bump goreleaser/goreleaser-action from 7.2.2 to 7.2.3 by @dependabot[bot] in #3010
• Bump actions/setup-go from 6.4.0 to 6.5.0 by @dependabot[bot] in #3012
• Bump actions/cache from 5.0.5 to 6.1.0 by @dependabot[bot] in #3013
• 🔧 aws: run codebuild/cognito/memorydb/transfer checks per-resource asset by @tas50 in #3006
• ✨ azure: add Virtual Network Manager security admin deny rule check by @tas50 in #3017
• 🐛 gcp: fix five broken Terraform HCL checks for Cloud Functions gen2 and KMS by @tas50 in #2999
• ✨ aws/azure: add checks for new provider capabilities (VPC encryption-in-transit, JIT, PIM, NSP, alert suppression) by @tas50 in #3016
• 🧹 bump mql to pull in docker/docker → moby/moby migration by @czunker in #3018
• 🧹 Bump mql to v13.28.0 by @mondoo-mergebot[bot] in #3019

Full Changelog: v13.27.4...v13.28.0