Prowler 5.39.1

API

🔄 Changed

• Bump alibabacloud-tea-openapi to 0.4.6, oci to 2.184.1 and pyopenssl to 26.4.0 to match the SDK; the cryptography override now names its actual blockers (azure-cli-core pins msal below 1.37, workos 8.3.0 requires cryptography 48) (#12477)

🐞 Fixed

• Pin zstd to 1.5.7.2; 1.5.7.3 was yanked from PyPI as not thread safe (#12477)

🔐 Security

• Trivy from v0.72.0 to v0.73.0 in the container image, fixing HIGH CVE-2026-46600 in the bundled golang.org/x/net (#12445)
• Trivy v0.74.0 and Debian util-linux 2.41.5-0+deb13u1 in the API container image, patching Go standard library vulnerabilities and CVE-2026-53615 (#12470)

SDK

🐞 Fixed

• Bump alibabacloud-tea-openapi to 0.4.6, oci to 2.184.1 and pyopenssl to 26.4.0 so the published wheel installs with cryptography 50.0.0; 5.38.0 declared cryptography 50.0.0 while those packages capped it below 50, so pip could not install it and pip install prowler silently fell back to 5.37.1 (#12477)
• Pin zstd to 1.5.7.2; 1.5.7.3 was yanked from PyPI as not thread safe (#12477)
• ECS task-definition checks no longer report PASS when DescribeTaskDefinition fails before container evidence is gathered (#12478)
• ses_identity_not_publicly_accessible now evaluates every SES identity authorization policy and marks mixed public Allow and Deny statements for manual review (#12480)

🔐 Security

• Trivy from v0.72.0 to v0.73.0 in the container image, fixing HIGH CVE-2026-46600 in the bundled golang.org/x/net (#12445)
• Trivy v0.74.0 and Debian util-linux 2.41.5-0+deb13u1 in the SDK container image, patching Go standard library vulnerabilities and CVE-2026-53615 (#12470)