v14.0.0-rc.2

What's Changed

• 🧹 os: capture real Windows DNS Server output as per-release test fixtures by @tas50 in #10386
• 🐛 os: report a scheduled task that has never run as null, not as 1999 by @tas50 in #10383
• 🐛 os: read Event Log retention for modern channels, not just the classic logs by @tas50 in #10382
• 🐛 os: fix five Windows dotted-path husks in windows.update and windows.spooler by @tas50 in #10379
• 🐛 os: don't panic when the process resource is queried without a pid by @tas50 in #10375
• 🛑 os: fix the windows.defender field types and null preferences by @tas50 in #10369
• 🐛 os: report ports without an owning process as null instead of erroring by @preslavgerchev in #10377
• 🟢 os: pin the Windows platform security parsers to real per-version output by @tas50 in #10388
• 🟢 os: add Windows Server 2025 to the live firewall fixtures by @tas50 in #10389
• 🐛 os: correct two windows.rdp settings that reported a state the host was not in by @tas50 in #10393
• 🟢 os: pin the Windows system inventory parsers to four live Server releases by @tas50 in #10392
• 🐛 os: make the SMB and WinRM configuration resources reachable by their own path by @tas50 in #10396
• 🧹 os: add platform detection fixtures for eight untested Linux releases by @tas50 in #10395
• 🐛 os: make windows.lsa.ntlm and secureChannel resolvable by their dotted path by @tas50 in #10368
• ⚡ os: size the tar extract buffer from the entry header by @MaxRink in #9864
• ⚡ os: resolve rpm %{_dbpath} once instead of per package by @tas50 in #9123
• ⚡ llx: share the entrypoint and callback tables of a block by @MaxRink in #9874
• 🛑 mql run exits 0 when no asset could be connected by @tas50 in #10267
• 🛑 remove deprecated min_mondoo_version from the resource schema by @tas50 in #10028
• 🛑 inventory: remove the deprecated connection backend field by @tas50 in #9992
• ⚡ os: add a fast path to the tar Abs helper by @MaxRink in #9865
• 🐛 fix stale mql/v13 imports in the blockexec bench by @preslavgerchev in #10407
• 🐛 os: read ntp.conf directives separated by tabs or extra spaces by @tas50 in #10403
• 🐛 os: split mysql/mariadb tmpdir on the separator the server actually uses by @tas50 in #10401
• 📄 os: describe what a Windows DNS zone reports when it has no such setting by @tas50 in #10399
• 🐛 os: give fstab entries a unique __id so rows stop disappearing by @tas50 in #10402
• 🟢 os: add Windows Server 2016/2019/2022/2025 policy and registry fixtures by @tas50 in #10400
• 🐛 os: don't treat a # inside a quoted ini value as a comment by @tas50 in #10410
• 📄 os: document that pam.conf.serviceEntry.lineNumber counts from zero by @tas50 in #10411
• 🐛 os: stop logrotate's lone-brace log path leaking into globalConfig by @tas50 in #10409
• 🐛 os: follow includes out of rsyslog fragments found by .d auto-discovery by @tas50 in #10408
• 🐛 os: stop reporting the Debian kernel metapackage as an installed kernel by @tas50 in #10398
• 🐛 os: list FreeBSD ports with sockstat instead of lsof by @tas50 in #10413
• 🐛 os: let the networkinterface package compile on BSD and other unix targets by @tas50 in #10412
• 🐛 os: fix four wrong values in the windows.computerInfo fallback by @tas50 in #10384
• 🐛 os: fix dotted-path husks on the exploit protection and BitLocker policy resources by @tas50 in #10367
• 🐛 os: add the Access Rights audit subcategory and null an unknown category by @tas50 in #10365
• 🐛 os: stop windows.update reporting a host it could not reach as fully patched by @tas50 in #10380
• ⭐ UploadResourcesData: resource recording delivered via the scan upload by @preslavgerchev in #10406
• 🐛 os: detect redhat-family release files that omit the "release" keyword by @tas50 in #10415
• 🐛 os: report SMBv1 as disabled when the mrxsmb10 driver is not installed by @tas50 in #10390
• 🐛 os: read the effective WinRM configuration instead of guessing at it by @tas50 in #10378
• 🐛 os: read sshd_config Include paths that are quoted by @tas50 in #10419
• 🐛 os: identify the hypervisor on EC2 Nitro instances by @tas50 in #10418
• 🐛 os: map the systemd-detect-virt identifiers for Hyper-V, GCE, VirtualBox and Apple by @tas50 in #10420
• 🐛 os: stop postgresql.conf inventing defaults when no config file exists by @tas50 in #10417
• 🧹 azure: a shared lister for the ARM pager walk by @tas50 in #9759
• ⭐ os: detect Red Hat Enterprise Linux CoreOS by @tas50 in #10425
• 🐛 os: stop reading the apk build timestamp as a package epoch by @tas50 in #10427
• 🟢 os: pin openSUSE Leap 16 platform detection by @tas50 in #10436
• 🐛 os: read /proc/mounts when the mount command cannot answer by @tas50 in #10433
• 🐛 network: keep each Set-Cookie header its own cookie by @tas50 in #10423
• 🐛 os: stop kernel.installed hiding kernels on Arch and phantoms on dpkg by @tas50 in #10432
• 🐛 os: decode linux route flags with linux constants, not BSD ones by @tas50 in #10431
• ⭐ os: detect CloudLinux OS as a redhat-family platform by @tas50 in #10424
• 🧹 azure: drop the stale subscription.go permission entry by @tas50 in #10437
• 🐛 os: read config from /usr/etc on openSUSE Leap 16 and SLE 16 by @tas50 in #10434
• 🐛 os: emit whole-disk filesystems from lsblk.list by @tas50 in #10428
• 🐛 os: detect ALT Linux instead of reporting it as scratch by @tas50 in #10440
• 📄 cloudflare: add a provider README by @tas50 in #10442
• 🐛 os: grub.config.passwordProtected trusted a template as a password by @tas50 in #10429
• 🛑 os: drop busybox's v prefix from the reported version by @tas50 in #10441
• 🐛 os: stop reading the legacy Kerberos encryption types on Windows Server 2025 by @tas50 in #10397
• 🐛 os: report a failure when the BitLocker WMI provider cannot be read by @tas50 in #10372
• 🐛 os: read windows.schannel.ellipticCurves from the supported-group list by @tas50 in #10364
• 🐛 os: fail loudly when the SMB collections cannot be read by @tas50 in #10394
• 🐛 os: detect Manjaro ARM instead of reporting it as scratch by @tas50 in #10443
• 🐛 os: detect Void Linux instead of reporting it as scratch by @tas50 in #10444
• 🐛 os: detect Clear Linux OS instead of reporting it as scratch by @tas50 in #10445
• 🐛 os: detect Bottlerocket without /etc/bottlerocket-release by @tas50 in #10447
• 🐛 os: detect Container-Optimized OS instead of reporting it as scratch by @tas50 in #10446
• 🛑 os: detect darwin systems as macOS, drop the legacy darwin platform by @tas50 in #10450
• 🐛 os: trim the line ending off the windows machine id by @tas50 in #10454
• 🐛 os: read os.path on windows by @tas50 in #10455
• 🐛 os: read kernel modules from /proc when lsmod is not in /sbin by @tas50 in #10452
• 🐛 os: make the platform tree match the names detection emits by @tas50 in #10449
• 🧹 deps: point go-scp at the mondoohq fork v1.0.4 by @tas50 in #10414
• 🐛 os: fail when the apparmor profile list cannot be read by @tas50 in #10453
• 🐛 os: read the rpm database on ALT Linux by @tas50 in #10458
• 🐛 os: detect openSUSE MicroOS instead of reporting it as scratch by @tas50 in #10459
• 🐛 os: detect Talos instead of reporting it as scratch by @tas50 in #10462
• 🐛 os: stop reporting a running firewalld as "not running" when polkit denies by @tas50 in #10416
• 🐛 os: report the DNS debug log size limit in the unit it is actually in by @tas50 in #10387
• 🛑 os: Defender threat history null, running mode, and a preferences-cache race by @tas50 in #10374
• 📄 network: document initializers that compile by @tas50 in #10468
• ⭐ os: read installed packages on Void Linux through xbps by @tas50 in #10469
• ⭐ Runtime.EnsureResourcesRecording: mount and register in one call by @preslavgerchev in #10470
• ⭐ ADR40: Cross-version MQL support by @arlimus in #10465
• 🐛 secpol: keep a failing SID lookup out of the other three sections by @M-gre in #10485
• 🐛 os: detect Anolis OS, OpenCloudOS, deepin and openKylin by @tas50 in #10483
• 🐛 bicep: fix a fatal parser crash and eight silent misparses by @tas50 in #10476
• 🐛 kustomize: read the modern labels syntax and file-referenced replacements by @tas50 in #10475
• 🐛 cloudformation: resolve YAML aliases and stop one bad member erasing a whole section by @tas50 in #10474
• 🐛 bicep: ARM template discovery, nested resources, and stamp races by @tas50 in #10481
• 🐛 k8s: keep an Ingress's other TLS entries when one certificate is unreadable by @tas50 in #10487
• 🛑 llx: remove deprecated dictNotEmptyV2 by @tas50 in #10029
• 🐛 k8s: resolve automountServiceAccountToken against the ServiceAccount by @tas50 in #10486
• 🐛 os: follow tar hardlinks so OSTree and bootc images are readable by @tas50 in #10482
• 🐛 arista: map the SSH containment fields the parser already produces by @tas50 in #10495
• 🐛 arista: report locked user accounts correctly by @tas50 in #10494
• 🐛 arista: report power-supply sensors and fans instead of erroring by @tas50 in #10492
• 🐛 arista: keep distinct SNMP, syslog and RADIUS records apart in the cache by @tas50 in #10498
• 🐛 aws: give flow logs and RDS parameter groups a real identity by @tas50 in #10497
• 🐛 arista: never publish a password as its encoding format by @tas50 in #10496
• 🐛 arista: read ACL binding direction and routing instance correctly by @tas50 in #10500
• 🐛 arista: fold BGP peer-group settings into member sessions by @tas50 in #10499
• 🐛 arista: derive MLAG and BGP admin state from the running-config by @tas50 in #10502
• 🐛 aws: stop dropping Condition blocks from IAM policy documents by @tas50 in #10503
• 🐛 azure: report a refused Key Vault read as null, not an empty vault by @tas50 in #10493
• 🐛 arista: surface config fetch failures instead of an empty device by @tas50 in #10504
• 🐛 aws: report a real DynamoDB table identifier by @tas50 in #10505
• 🐛 gcp: give each GKE cluster its own network-policy cache key by @tas50 in #10506
• 🐛 gcp: resolve serialPortEnabled the way Compute Engine resolves it by @tas50 in #10508
• 🐛 arista: stop reading banner text as device configuration by @tas50 in #10501
• 🐛 gcp: request the scope the IAM API accepts for federated pools by @tas50 in #10507
• 🐛 os: stop the technology URL builder from stamping "unknown" onto the platform by @tas50 in #10430
• 🐛 os: read the repositories under /etc/apt/sources.list.d by @tas50 in #10421
• ✨ macos: surface system_profiler obtained_from as the package origin by @tas50 in #9447
• 📄 arista: document how to stand up a real test device in AWS by @tas50 in #10511
• 🐛 arista: fix two bugs a live device found, and pin the fixtures against one by @tas50 in #10510
• 🐛 mikrotik: don't let a TLS request silently become a cleartext session by @tas50 in #10513
• 🐛 mikrotik: stop reporting a value the device never sent by @tas50 in #10512
• 🐛 os: fix Solaris core counting, silent empty lists, and release detection by @tas50 in #10516
• 📄 mikrotik: document how to stand up a test device in AWS by @tas50 in #10514
• 🐛 os: parse the Solaris uptime pluralization by @tas50 in #10519
• 🐛 os: run the SVR4 ps on Solaris so processes is not empty by @tas50 in #10517
• 🐛 os: stop the scp filesystem claiming an lstat it cannot do by @tas50 in #10518
• 🐛 os: fix macOS resources that reported the wrong security state by @tas50 in #10521
• 🐛 os: read the Secure Boot EFI variables over SSH by @tas50 in #10532
• 🐛 os: stop one unreadable sysctl emptying kernel.parameters by @tas50 in #10526
• 🐛 os: keep the readable SMBIOS attributes when a serial is root-only by @tas50 in #10525
• 🐛 os: give fstab its default path and a per-file __id by @tas50 in #10523
• 🐛 os: list running instances of systemd template units by @tas50 in #10530
• 🐛 os: fix os.uptime on the 13 of 19 Linux images where it read null by @tas50 in #10528
• 🐛 os: name the right resource in the parse.* errors by @tas50 in #10524
• 🐛 os: stop systemd.units reporting an empty list when systemctl cannot answer by @tas50 in #10527
• 🐛 os: stop crontab/limits/logrotate entries panicking without a file by @tas50 in #10522
• 🐛 os: stop the docker resource reading the scanner's daemon by @tas50 in #10534
• 🐛 os: look for systemd units in /lib/systemd/system too by @tas50 in #10535
• 🐛 os: fill in systemd.sockets and systemd.timers when systemctl cannot answer by @tas50 in #10531
• 🐛 os: fill in systemd.targets when systemctl cannot answer by @tas50 in #10533
• 🐛 os: fix os.rebootpending on rpm containers and add SUSE support by @tas50 in #10529
• 🧹 os: one test file per resource file by @tas50 in #10536
• 📄 Add a rule: a test that cannot fail is worse than no test by @tas50 in #10537
• 🐛 os: read the root CA bundle when its path is a symlink by @tas50 in #10540
• 🐛 os: keep systemd.units from losing generator units to a template unit by @tas50 in #10539
• ✨ sbom: give Package a license model that can tell declared from concluded by @chris-rock in #10491
• 🌙 network: report the zone apex a DNS name belongs to by @chris-rock in #10542
• 🐛 network: retry the zone walk's NS query instead of failing on one lost packet by @chris-rock in #10543
• 🌟 claude: expose service accounts, workload identity federation, and API key principals by @tas50 in #10555
• ✨ digitalocean: expose the routes leaving a VPC by @tas50 in #10551
• ✨ openai: report which geography a project's data is pinned to by @tas50 in #10550
• 🧹 mongodbatlas: move to atlas-sdk v20250312024 by @tas50 in #10549
• 🐛 stackit: keep a null observability parameter from reading as empty by @tas50 in #10547
• ✨ oci: report the Autonomous Database long-term backup schedule by @tas50 in #10553
• ✨ gcp: expose the Cloud Armor preconfigured WAF expression sets by @tas50 in #10554
• 🧹 providers: refresh SDK dependencies by @tas50 in #10546
• 🧹 alicloud: move polardb to the v9 client by @tas50 in #10548
• ✨ os: add os.lastUpdate, lastUpdateAge and lastUpdateSource by @AdamVB in #10477
• 🐛 github: add a request timeout so a scan cannot hang forever by @preslavgerchev in #10561
• ✨ redfish: move to gofish v0.25.0 and expose the account service, TPM, consoles and SMC hardening by @tas50 in #10565
• 🛑 gcp: stop publishing the GKE control-plane password and the IAP client secret by @tas50 in #10566
• ⭐ Ollama config resources + detection by @arlimus in #10567
• 🐛 languages: assign the license three extractors already parse by @chris-rock in #10557
• 🐛 aws: fix five data gaps that silently broke mondoo-aws-security checks by @atomic111 in #10576
• Bump dawidd6/action-download-artifact from 23 to 24 by @dependabot[bot] in #10575
• 📄 skills: make update-provider-deps target one provider at a time by @tas50 in #10581
• 🐛 aws: init per-asset sub-resources for EMR encryption config and VPC encryption control by @atomic111 in #10580
• 🐛 aws: give every construction site a cache key it owns by @tas50 in #10582
• 🐛 azure: read the App Service runtime stacks Azure actually returns by @tas50 in #10583
• 🧹 oci: keep every construction site's cache key honest by @tas50 in #10586
• 🐛 azure: give two identity references a key the runtime accepts by @tas50 in #10584
• 🧹 gcp: keep every construction site's cache key honest by @tas50 in #10585
• 🐛 azure: detect Defender vulnerability management on the field ARM sets by @tas50 in #10589
• 🧹 azure, oci: apply the #10585 guard review to the other two copies by @tas50 in #10588
• 🐛 os: add nginx returnDirective, the return field collides with an MQL keyword by @tas50 in #10591
• 🐛 wheelegg: read the license PEP 639 actually puts it in by @chris-rock in #10577
• 🐛 sbom: carry the license into the generated SBOM by @chris-rock in #10579
• 🐛 languages: read the declared licenses three more extractors drop, and bound them all by @chris-rock in #10578
• 🐛 pomxml: resolve ${property} versions, dependencyManagement, and declared licenses by @chris-rock in #10545
• 🐛 php: expose the license and description php.package never mapped by @chris-rock in #10587
• 🐛 pomxml: key dependencyManagement on the identity Maven keys it on by @chris-rock in #10594
• 🐛 java: tell an OSGi license list from a name that contains a comma by @chris-rock in #10595
• 🧹 manifestmf: export the Bundle-License parsing so it has one implementation by @chris-rock in #10596
• 🐛 sbom: say on the license how it was arrived at, instead of by where it sits by @chris-rock in #10598
• 🐛 sbom: read the licensing an imported document states by @chris-rock in #10597
• 🐛 sbom: give an SPDX document the identity the spec requires, and a creator it can render by @chris-rock in #10599
• 🐛 azure: list ADLS Gen2 containers, and stop publishing three secrets by @tas50 in #10590
• 🐛 sbom: render a CycloneDX document for a BOM that names no metadata by @chris-rock in #10600
• 🐛 sbom: read licensing in the SPDX decoder consumers actually reach by @chris-rock in #10601
• 🐛 gcp: gate the vertexai and monitoring collections on the API being enabled by @tas50 in #10592
• Bump the codeql-action group with 3 updates by @dependabot[bot] in #10573
• Bump docker/setup-buildx-action from 4.2.0 to 4.3.0 by @dependabot[bot] in #10574
• ✨ oci: replace dict sub-objects with sub-resources that mirror the SDK structs by @tas50 in #10569
• 🧹 Update deps for mql and providers 20260828 by @github-actions[bot] in #10556
• ⭐ os: detect CBL-Mariner and wire it up for package detection by @tas50 in #10607
• 🐛 gcp: read network firewall policies when judging instance exposure by @tas50 in #10602
• 🌙 mqlc: allow escaped quotes inside string literals by @tas50 in #10593
• 🐛 providers: fix ABBA deadlock between the coordinator mutex and the schema lock by @preslavgerchev in #10617
• 🐛 os: rpm 7 reports no packages, MODULARITYLABEL needs a lower version bound by @tas50 in #10606
• 🐛 network: one unparseable certificate must not empty the trust store by @tas50 in #10611
• 🐛 os: find postgresql.conf by glob so a new major is not missed by @tas50 in #10613
• 🐛 os: sudoers user specs never parse, the splitter ignores tabs by @tas50 in #10612
• 🐛 os: pam.conf(path) sets a field that does not exist by @tas50 in #10609
• 🐛 providers: publish and hand out provider-map snapshots, not aliases by @preslavgerchev in #10621
• 🛑 gcp: encode protobuf-backed dicts with protojson, not encoding/json by @tas50 in #10568
• ✨ azure: replace the config dicts with typed sub-resources by @tas50 in #10572
• 🧹 Update deps for mql and providers 20260831 by @github-actions[bot] in #10615
• ⭐ providers: harvest new fields from the 2026-08-31 SDK refresh by @tas50 in #10623
• ✨ aws: replace opaque security dicts with typed sub-resources by @tas50 in #10570
• ✨ gcp: replace the dicts that carry a security answer with sub-resources by @tas50 in #10571
• 🐛 aws/azure/gcp/oci: stop reporting unread exposure as "not public" by @tas50 in #10624
• 🐛 aws: stop discovering terminated EC2 instances as scan targets by @tas50 in #10625
• 🐛 aws: stop inventing SQS and SNS values that were never read by @tas50 in #10629
• 🐛 aws: a refused KMS read must not report rotation off or a key as not public by @tas50 in #10628
• 🐛 aws: a refused EFS read must not report a file system as not public by @tas50 in #10627
• ✨ status: check that the ingest endpoint is reachable by @AdamVB in #10620
• 🐛 aws: stop reporting Lambda state as empty and unlimited concurrency as zero by @tas50 in #10630
• ⭐ show assessments in blocks by @arlimus in #10631
• 🐛 network: retry truncated DNS answers over TCP by @tas50 in #10460
• 🐛 os: probe for a package database when no case names the platform by @tas50 in #10605
• 🐛 network: parse the url query and fragment by @tas50 in #10467
• 🟢 os: give the rpm probe test a name of its own by @tas50 in #10632
• 🐛 llx: only log the malformed-primitive error for husks that hold content by @preslavgerchev in #10385
• 🐛 network: don't report an unsigned zone when the resolver strips DNSSEC by @tas50 in #10463
• 🌟 network: determine certificate revocation from CRLs, and report when it could not be determined by @tas50 in #10464
• 🐛 providers: complete a schema-only install when the provider must run by @preslavgerchev in #10236
• 🧹 deps: bump packageurl-go to v0.1.7 and drop the v0.1.5 pin by @czunker in #10634
• 🐛 os/purl: stop String() writing derived qualifiers into the caller's map by @czunker in #10635
• 🐛 languages: read the project license from composer.json and Cargo.toml by @chris-rock in #10638
• 🐛 pomxml: inherit versions from the parent chain and imported BOMs by @chris-rock in #10643
• ✨ languages/java: read Gradle build scripts, version catalogs and project version properties by @chris-rock in #10644
• 🐛 aws: stop asserting facts about ECR public repositories that were never read by @tas50 in #10626
• 🐛 os: read the cgroup tree from the filesystem, not through find by @tas50 in #10610
• 🐛 gcp: stop init functions returning husks, panicking, or caching stubs by @tas50 in #10509
• 📄 os: package.files is package-manager provenance, not installed files by @tas50 in #10604
• 🧹 ci: skip the Cloud Build substitutions doc in the link check by @tas50 in #10649
• 🐛 os: resolve the hostname on systems that never write /etc/hostname by @jaym in #10637
• 🐛 os: quote directory paths in the cat filesystem listing by @tas50 in #10645
• 🐛 providers: unpack archive entries by their file name by @tas50 in #10646
• 🐛 os/docker: quote the path in the container directory listing by @tas50 in #10647
• 🐛 os: quote paths interpolated into PowerShell scripts by @tas50 in #10648
• 🐛 os/languages: read what Conan and vcpkg actually state by @chris-rock in #10651
• ✨ languages: carry whether a dependency is optional by @chris-rock in #10652
• 🐛 pomxml: parse a POM that is not UTF-8 by @chris-rock in #10654
• 📃 draft MQL min version (v15) by @arlimus in #10656
• 🧹 github: update go-github to v91 by @tas50 in #10657
• 🐛 os/powershell: create the staged script file rather than reuse one by @tas50 in #10650
• ⭐ ADR-042 Cross Provider Invocation by @arlimus in #10658
• 🐛 os: I include Homebrew revisions in latestVersion by @w3lld1 in #10653
• 🛑 update to SemVer 2.0.0 by @arlimus in #10660
• 🐛 oci: detectorRecipes returns an error instead of the recipe list by @tas50 in #10662
• 🐛 azure: six resource lists return an error instead of their data by @tas50 in #10663
• 🐛 os: Arch Linux ARM is not detected and loses its package manager by @tas50 in #10664
• 🐛 os: ollama integration models are empty when the config omits the tag by @tas50 in #10665
• 🐛 os: only report real macOS application bundles as installed software by @tas50 in #10666
• 🐛 digitalocean: teams reads empty when the token cannot see them by @tas50 in #10667
• 🐛 os: stage the windows local-users script so users.list works over winrm by @tas50 in #10456
• 🧹 ci: move Go to 1.26.8 by @tas50 in #10668
• 🐛 os: only follow symlinks in files.find when searching for links by @czunker in #9426
• 🟢 os: point the rsyslog .d mock at the find command #9426 now emits by @chris-rock in #10673
• 🐛 sbom: read the CycloneDX dependency graph on import by @chris-rock in #10659
• 🟢 os: make the sysv runlevel fixture assert Service.Enabled instead of nothing by @chris-rock in #10674

New Contributors

• @w3lld1 made their first contribution in #10653

Full Changelog: v14.0.0-rc.1...v14.0.0-rc.2