Proto commits in mondoohq/cnquery

These commits are when the Protocol Buffers files have changed: (only the last 100 relevant commits are shown)

2026-08-22

🧹 spell check: enforce US English and fix the typos the dictionary missed `typos` has been passing on every PR, but three things were going unchecked. **No locale was set.** Without `locale = "en-us"` the checker accepts British spellings, so they never failed CI. Turning it on surfaced 236 findings across 128 files, 40 of them in `.lr` doc comments, which is the prose that gets parsed into the public resource docs. 177 are fixed here: `behaviour`, `labelling`, `recognised`, `unrecognised`, `marshalled`, `realised`, `modelled`, `favour`, `honoured` and friends, in comments, markdown, test names and test messages. The other 59 are spelled the British way by contract, not by accident, so they are exempted rather than renamed: - upstream API and SDK identifiers: `AnalyseAsset` (mvd), `ContentSynchronisation` (Artifactory), `FixVersionDependant` (Xray), `SynchroniseConsumerGroupOffsets` (MSK), `AllowQueueing` (Vertex AI), `GetBehaviourOk` (STACKIT), `FixKustomizationPreMarshalling` (kustomize) - the shipped MQL fields derived from them, where a rename would be a breaking schema change - the proper nouns MITRE, Spectre and EndeavourOS, which the en-us dictionary wants to turn into `miter`, `specter` and `endeavor` These go in `extend-identifiers` where the exact token is what needs exempting, so the same word stays flagged in prose. Only the MSK local variable `synchronise` and comments around these fields were touched. **Five typos the correction dictionary has no entry for**, found by diffing comment prose against a word list and keeping near-misses of words the repo already uses: - `cound not determine orgName ...` in an okta error string returned to users - `serverVASetings` in the azure cloud defender lister - `try to collecta instance metadata` in the awsebs id detector - `report jever result it has` in the llx block executor - `counterparty asset` in inventory.proto, where every other use in the tree says `counterpart` **Two dead baselines.** `compleated` and `deliminated` matched nothing anywhere in the tree, including generated files and testdata. `cound` and `setings` drop out too now that their single occurrences are fixed. Verified: `typos` is clean with the new config, `go build ./...` passes in the root module and all 20 touched provider modules, and the tests in every package with a changed test file pass. Schema regeneration produces no diff, since `.lr` doc comments are not embedded in `.lr.go`. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-08-20

🛑 inventory: remove the deprecated connection `backend` field The `backend` field and its `ProviderType` enum were replaced by the string `type` field back in v10, and every code path since has treated `backend` purely as a migration fallback. The FIXME asking for their removal has been sitting in `inventory.proto` for four majors; v14 is the window. Removed: - `enum ProviderType` and `Config.backend` from `inventory.proto`. Field number 28 is now `reserved` so a future field cannot silently inherit the old wire tag. - `v8_inventory.go` in full. It held the `ProviderID_*` constants, the `ProviderType_idvalue` lookup, `ProviderType.UnmarshalJSON` and `ConnBackendToType` — all of which existed only to serve `backend`, and none of which is referenced anywhere else. Its own header said the file could go in v10. - The migration fallbacks in `InventoryFromYAML` and `Runtime.providerForAsset`. - `conf.Backend = ProviderType_HOST` in the network provider, a write that nothing read. An inventory that specifies neither `type` nor `backend` previously warned and resolved to an empty connection type, which then failed further down in provider lookup with an unrelated message. It now reports "no connection `type` provided in inventory" against that connection and moves to the next one, so the multierr names the real problem. The commented-out examples in `testdata/aws_inventory.yaml` were updated to `type:` so they stop teaching a field that no longer exists. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

🟢 reserve the min_mondoo_version field name and fix protolint - reserve the field *name* in addition to the number, so neither the tag nor the identifier can be reused (review suggestion) - shorten the two reserved-field comments; protolint enforces an 80 column limit and both were 81 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

🛑 remove deprecated min_mondoo_version from the resource schema `ResourceInfo.min_mondoo_version` (field 25) and `Field.min_mondoo_version` (field 23) were marked `[deprecated = true]` and documented "remove in v14, not used anymore as of v13". Nothing in this repo or in cnspec reads or writes them outside the generated marshalling code -- `min_provider_version` carries the signal now. Both field numbers are marked `reserved` so they can never be reused. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

🧹 v14 -> non-versioned go-mod (#10234) * 🧹 v14 -> non-versioned go-mod We are removing the versioned dependency in golang. This doesn't affect end-users of MQL, so y'all are fine. This is only relevant for developers and whoever integrates with the go-dependencies of this project (or cnspec). Given the consistancy at which we are now releasing major versions, we decided that this version indicator doesn't really provide much value anymore. The important APIs are versioned anyway and everything else has clean deprecation windows that aren't affected by the go-dependencies. Thus, we can avoid one annoying (potentially erroneous) update step every 6 months and all the ripple-effects it has. * 🟢 reviewer feedback Signed-off-by: Dominik Richter <dominik.richter@gmail.com> --------- Signed-off-by: Dominik Richter <dominik.richter@gmail.com>

The documentation is generated from this commit.

2026-08-18

🛑 inventory: remove the deprecated connection `backend` field The `backend` field and its `ProviderType` enum were replaced by the string `type` field back in v10, and every code path since has treated `backend` purely as a migration fallback. The FIXME asking for their removal has been sitting in `inventory.proto` for four majors; v14 is the window. Removed: - `enum ProviderType` and `Config.backend` from `inventory.proto`. Field number 28 is now `reserved` so a future field cannot silently inherit the old wire tag. - `v8_inventory.go` in full. It held the `ProviderID_*` constants, the `ProviderType_idvalue` lookup, `ProviderType.UnmarshalJSON` and `ConnBackendToType` — all of which existed only to serve `backend`, and none of which is referenced anywhere else. Its own header said the file could go in v10. - The migration fallbacks in `InventoryFromYAML` and `Runtime.providerForAsset`. - `conf.Backend = ProviderType_HOST` in the network provider, a write that nothing read. An inventory that specifies neither `type` nor `backend` previously warned and resolved to an empty connection type, which then failed further down in provider lookup with an unrelated message. It now reports "no connection `type` provided in inventory" against that connection and moves to the next one, so the multierr names the real problem. The commented-out examples in `testdata/aws_inventory.yaml` were updated to `type:` so they stop teaching a field that no longer exists. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

🟢 reserve the min_mondoo_version field name and fix protolint - reserve the field *name* in addition to the number, so neither the tag nor the identifier can be reused (review suggestion) - shorten the two reserved-field comments; protolint enforces an 80 column limit and both were 81 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

🛑 remove deprecated min_mondoo_version from the resource schema `ResourceInfo.min_mondoo_version` (field 25) and `Field.min_mondoo_version` (field 23) were marked `[deprecated = true]` and documented "remove in v14, not used anymore as of v13". Nothing in this repo or in cnspec reads or writes them outside the generated marshalling code -- `min_provider_version` carries the signal now. Both field numbers are marked `reserved` so they can never be reused. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

🟢 reserve the min_mondoo_version field name and fix protolint - reserve the field *name* in addition to the number, so neither the tag nor the identifier can be reused (review suggestion) - shorten the two reserved-field comments; protolint enforces an 80 column limit and both were 81 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

🛑 remove deprecated min_mondoo_version from the resource schema `ResourceInfo.min_mondoo_version` (field 25) and `Field.min_mondoo_version` (field 23) were marked `[deprecated = true]` and documented "remove in v14, not used anymore as of v13". Nothing in this repo or in cnspec reads or writes them outside the generated marshalling code -- `min_provider_version` carries the signal now. Both field numbers are marked `reserved` so they can never be reused. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-08-17

🛑 inventory: remove the deprecated connection `backend` field The `backend` field and its `ProviderType` enum were replaced by the string `type` field back in v10, and every code path since has treated `backend` purely as a migration fallback. The FIXME asking for their removal has been sitting in `inventory.proto` for four majors; v14 is the window. Removed: - `enum ProviderType` and `Config.backend` from `inventory.proto`. Field number 28 is now `reserved` so a future field cannot silently inherit the old wire tag. - `v8_inventory.go` in full. It held the `ProviderID_*` constants, the `ProviderType_idvalue` lookup, `ProviderType.UnmarshalJSON` and `ConnBackendToType` — all of which existed only to serve `backend`, and none of which is referenced anywhere else. Its own header said the file could go in v10. - The migration fallbacks in `InventoryFromYAML` and `Runtime.providerForAsset`. - `conf.Backend = ProviderType_HOST` in the network provider, a write that nothing read. An inventory that specifies neither `type` nor `backend` previously warned and resolved to an empty connection type, which then failed further down in provider lookup with an unrelated message. It now reports "no connection `type` provided in inventory" against that connection and moves to the next one, so the multierr names the real problem. The commented-out examples in `testdata/aws_inventory.yaml` were updated to `type:` so they stop teaching a field that no longer exists. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-08-02

🌟 v14: asset tree relationships (ADR-030) (#9534) * 🌟 asset tree relationships (ADR-030) This is a v14 feature that provides Asset Relationships, anchored in the resource-tree. It deprecates the traditional (flat) relationships in favor of these relationships which point to schema anchors that can be used to tie it all together. The follow-up ADR-031 will allow us to run queries across this connection. * 🟢 reviewer feedback Signed-off-by: Dominik Richter <dominik.richter@gmail.com> --------- Signed-off-by: Dominik Richter <dominik.richter@gmail.com>

2026-07-24

feat(fex): add label and mime_type to File evidence (#9423) * feat(fex): add label and mime_type to File evidence The File evidence message could carry document contents but had no way to name or type them. Add two optional fields: - `label` — a human-readable label/identifier for the file evidence, useful when a finding carries several file evidences or when a UI needs a title for the document rather than a raw path. - `mime_type` — the MIME/content type (e.g. "application/json") so consumers can interpret or render `contents` correctly. Regenerated fex.pb.go and fex_vtproto.pb.go. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(fex): keep File label/mime_type comments under 80 cols (protolint) The label comment line exceeded protolint's 80-column limit. Reflow the two new comments and regenerate (the doc comments are mirrored into fex.pb.go). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

sbom: dependency graph + dev/prod scope + stable bom_ref (#9036) * feat(languages): expose package→package dependency edges (npm, ref-based) Adds `DependsOn []string` to languages.Package — the refs (purls) of the packages a package directly depends on, i.e. the dependency-graph edges the Bom's Root/Direct/Transitive shape flattened away. Refs (not names) disambiguate a package present at multiple versions. npm packagelockjson (lockfileVersion 2+) populates it: for each package entry's `dependencies`, resolve the required name to its installed `packages` entry via npm hoisting (fromPath/node_modules/dep, walking up to root), and use that entry's purl as the ref — built identically to how the target node's own Purl is built, so an edge ref always matches its target node (self-consistent graph). Left nil where the manifest encodes no edges (Go go.mod) or the legacy lockfileVersion≤1 branch. Same pattern will extend to cargo/pnpm/yarn/bun. Prototype for xgrep SCA reachability (R2); to be reconciled with the mql team + the sbom-proto/CycloneDX dependencies section before upstreaming (see design doc). Tests: TestPackageJsonLockDependencyEdges (app→foo→bar, edge ref == target Purl); full languages suite green. * fix(languages): packagelockjson Direct() resolves deps by install path Direct() looked the root's declared dependencies up in the `packages` map by bare name, but that map is keyed by install path (node_modules/<name>) for lockfileVersion 2+, so every lookup missed and Direct() returned an empty set. Resolve via node_modules/<name> and build Name/Purl/Cpes/DependsOn from the path key, identical to Transitive(), so a package's Direct and Transitive representations (and refs) match. This restores the direct/transitive split that downstream SCA scope relies on. Test: TestPackageJsonLockDirect (root→foo resolved, matches Transitive's foo). * feat(languages): expose dev/prod dependency scope (npm) Add `Scope` to languages.Package (PackageScopeProd / PackageScopeDev / "" when the manifest doesn't distinguish), so a consumer can rank a CVE in a dev/test-only tool differently from a production-runtime one. npm packagelockjson populates it from the lock's per-package `dev` flag (lockfileVersion 2+); devOptional counts as prod since it can appear in the production tree. Left "" for the legacy v1 branch and ecosystems without the flag. Parser gains Dev/DevOptional fields. Tests: TestPackageJsonLockScope + @babel/code-frame (dev) equality/golden assertions updated. Full languages suite green (52 pkgs). * sbom: model dependency graph + dev/prod scope + stable bom_ref on the proto Add the CycloneDX/SPDX dependency-graph and scope shape to the sbom proto so the package->package dependency graph and dev/prod scope the lockfile parsers already resolve survive into the standard SBOM output (previously flattened away): - Package.bom_ref (28): a stable, document-internal component id. Deterministic -- purl-when-present, else synthesized -- replacing the per-render uuid.New() bom-ref so CycloneDX output is reproducible and dependency edges have a stable endpoint. - Package.scope (29): prod/dev dependency scope. - Sbom.dependencies (7) + Dependency{ref, depends_on}: the package->package graph, each endpoint referenced by bom_ref (the CycloneDX dependencies / SPDX DEPENDS_ON shape). Renderers: the generator stamps a deterministic bom_ref on every component; CycloneDX emits the dependencies section + maps dev scope to ScopeExcluded; SPDX emits DEPENDS_ON relationships. sbom.BomRefFor centralizes the ref rule. Populating Sbom.dependencies/scope end-to-end still needs the per-ecosystem package resources to carry dependsOn/scope (schema + codegen) -- a follow-up; the proto model and renderers are in place here. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * languages: dependency edges + scope for pnpm, yarn, cargo Fan out the DependsOn (ref=purl) + Scope pattern (established for npm packagelockjson) to the other tree-encoding lockfile parsers, so their package->package graph survives into the SBOM: - pnpm (pnpmlock): DependsOn from each entry's resolved `dependencies`; Scope from the per-entry `dev` flag (v5/v6; v9 carries no per-entry flag -> prod). - yarn (yarnlock): DependsOn resolved via a name@spec -> resolved-version index built from the lockfile keys (which may list several specs per entry). yarn v1 does not distinguish dev from prod, so no scope. - cargo (cargolock): DependsOn from each crate's `dependencies` list, resolving a version-less reference when the crate is locked at a single version. Cargo.lock has a unified resolve graph (no dev/normal split), so no scope. Each edge ref is built the same way the parser builds each package's own Purl, so an edge ref matches its target node's Purl (a self-consistent graph). bun.lock is deferred: it uses npm-style hoisting with a tuple format that needs richer fixtures to resolve edges. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * sbom: satisfy protolint + copywrite on the new proto/fields - rename repeated field depends_on -> dependency_refs (protolint REPEATED_FIELD_NAMES_PLURALIZED); update renderers + test. - reflow new proto comments under the 80-col limit. - add the copyright year to the new dependency_graph_test.go header. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(sbom): integrity hashes on the package model and renderers Add the third SBOM-fidelity field alongside the dependency graph and scope: package integrity digests. - languages.Package.Hashes ([]PackageHash{Alg, Value}) — hex digests tagged with the CycloneDX algorithm spelling. Populated by the npm packagelockjson parser from the lockfile Subresource-Integrity `integrity` (sha512-<base64> -> hex), across the v2+ packages, root-declared, and legacy dependency paths. - sbom proto: a Hash message + repeated Package.hashes (field 30), regenerated. - CycloneDX renderer emits component.hashes; SPDX emits package checksums (dash-free algorithm spelling). - Tests: hashesFor SRI parsing (algs/malformed/empty), updated npm extractor expectations, and CycloneDX/SPDX hash rendering. Other ecosystems leave Hashes nil (unaffected). protolint + the sbom/languages suites are green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(languages): correct npm purls for scoped and nested packages NewPackageUrl was fed the lockfileVersion 2+ install-path key (e.g. "node_modules/@babel/core"), which it split on "/" — taking "node_modules" as the namespace and "@babel" as the name. Every scoped package under a path key collapsed to `pkg:npm/node-modules/%40<scope>@<version>`, so purl-keyed consumers deduped whole scopes down to one component (all of @babel/* → one). Nested copies were also named by their full path ("@babel/core/node_modules/ms"). - packageLockPackageName now takes the segment after the LAST "node_modules/", so scoped names survive ("@babel/core") and nested copies resolve to the bare name ("ms"). - Direct/Transitive and resolveDepPurl build Purl/Cpes/edge-refs from that name, not the path key — yielding `pkg:npm/%40babel/core@<version>` and self-consistent graph edges. Verified against a real express+jest tree: recovers ~40 previously-dropped scoped packages (incl. all @babel core packages) with zero purl-prefix artifacts. Updated the extractor test that had encoded the buggy purl/cpe. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(sbom): review hardening — DoS guard, SPDX injection, scope/dedup fixes Addresses the performance/security/production-readiness review of this PR: - SECURITY: bound the npm resolveDepPurl node_modules walk-up (maxNodeModulesDepth) so a crafted deeply-nested lockfile key can't drive superlinear CPU (per-scan DoS). Also precompute a path→purl index once per lockfile, removing the O(edges) redundant NewPackageUrl rebuilds. - SECURITY: NewSPDXPackageID now assigns the sanitizer result back (`id = expr.ReplaceAllString(...)`) — previously a no-op, letting a package name with a newline inject tags into SPDX tag-value output. - ACCURACY: pnpm v9 lockfiles carry no per-entry dev flag; scopeOf now returns "" (unknown) for v9 instead of asserting prod, so a dev-only package isn't mislabeled production (consistent with yarn/cargo). - CORRECTNESS: the CycloneDX renderer dedups components by bom-ref (two packages sharing a purl no longer emit a duplicate, invalid bom-ref) and drops dependency edges referencing absent components (matches the SPDX renderer). - Deterministic root/OS component bom-refs (were per-render UUIDs). Tests added for each. Full sbom + languages suites green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(languages): parse classic yarn.lock v1 + integrity hashes for pnpm/yarn (a) Classic yarn.lock (v1) failed to parse: the on-the-fly YAML converter only rewrote quoted `key "value"` lines, but yarn writes `integrity sha512-…` unquoted, leaving invalid YAML — so a real `yarn add` lockfile never parsed. The converter now handles both quoted and unquoted values and passes through comments/blank lines/mapping headers; scanner buffer grown for long integrity lines. Verified against a real express yarn.lock (68 pkgs, exact syft parity). (b) Integrity hashes now extend to pnpm and yarn (both record SRI `integrity`), not just npm. Extracted the shared SRI→hash logic into javascript.NewHashes and call it from all three parsers; npm's local hashesFor is removed. pnpm reads resolution.integrity, yarn reads the new entry Integrity field. Verified e2e vs syft across react-dom/webpack/eslint/@nestjs (npm), pnpm-webpack, and yarn-express: exact coverage parity, clean purls, self-consistent graphs, and hashes now present for pnpm (0→70) and yarn (68). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore: fix golangci-lint (De Morgan) and license headers - yarnlock converter: `!(A && B)` → `!A || !B` (staticcheck QF1001). - Add the copywrite-compliant license header to the new test files. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(sbom): address code-review — SPDX dedup, license field, scope docs - SPDX renderer now dedups packages by bom-ref (matches CycloneDX). Two entries sharing a purl no longer emit duplicate SPDX packages / silently overwrite the refToID map with a possibly-different id. - Fix a pre-existing copy-paste bug: PackageLicenseDeclared was set to pkg.Version instead of pkg.License. - Document the npm scopeOf devOptional handling (dev+optional and optional-only both report prod, since they can appear in the deployed tree) and add a TestScopeOf covering the four flag combinations. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

2026-07-23

✨ fex: add CloudResource component detail (#9394) * ✨ fex: add CloudResource component detail A Component captures the id/identifiers of what a finding is about, but for a cloud object (an AWS/Azure/GCP resource) the bare id loses the structured detail worth recording. Add a CloudResource variant to the component details oneof — provider, native id (ARN / full resource name), type, region, account, partition, and tags — so a finding can carry the resource's structure, not just its id. All fields optional. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * 🧹 fex: keep CloudResource proto comments under the 80-char lint limit --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

✨ fex: add city and coordinates to NetworkRange geolocation (#9391) NetworkRange already carries the ASN, AS/org name, and country of an IP block. Add the finer geolocation an IP-geo lookup commonly returns — city name and latitude/longitude (decimal degrees) — so a network evidence can record where an address is located, not just which country and ASN it belongs to. All optional. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-22

✨ fex: add ThreatIntelIndicator, Malware, AiModel, AiAgent evidence (#9355) Extend the FindingExchange Evidence.details oneof with four structured evidence types: - ThreatIntelIndicator — an IP, domain, URL, or file hash observed and matched against threat intelligence (type, value, category, source, source_url, last_observed_at). First-class evidence for threat findings. - Malware — a detected malicious-software artifact (name, type, path, state). - AiModel — the AI/ML model involved in a finding (name, type, version, publisher, deployment). - AiAgent — the AI agent implicated in or that flagged a finding (id, name, model, session_id). Additive: field numbers 32-35 in the oneof, no existing field changed, so wire-compatible. Regenerated fex.pb.go and fex_vtproto.pb.go. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

feat(fex): propose network detail types for Evidence (#9351) * feat(fex): propose network detail types for Evidence Add typed network artifacts to fex.Evidence so findings from network scanners carry structured detail instead of untyped properties, following the HttpRequest precedent. Adds Connection.evidence (matched banner/service string, field 6) and four details oneof variants: DnsRecord (28), Certificate (29), DomainRegistration (30), and NetworkRange (31). Generated code regenerated; protolint passes. Status: Proposed. Field names mirror the server-internal etl schema, so these only surface once the server learns them; see ADR 029. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(fex): use uint32 for NetworkRange.asn to fit 4-byte ASNs ASNs are unsigned 32-bit (RFC 6793), up to 4,294,967,295 — a signed int32 caps at 2^31-1 and would sign-flip high ASNs already in use. Switch to uint32. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(fex): DnsRecord.ttl uint32; document type as free-form string TTL is a 31-bit unsigned quantity (RFC 2181 §8), so uint32 avoids representing nonsensical negative TTLs, consistent with NetworkRange.asn. Keep DnsRecord.type a free-form string (not an enum) — the IANA record-type registry is large and evolving and scanners surface arbitrary types; documented inline. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-19

✨ fex: add code-location line/column to FileComponent (#9228) Add start_line/end_line/start_column/end_column to FileComponent so SAST/SARIF findings can carry the code location where an issue occurs. The SARIF converter (and future SAST converters) currently drop region line info because there was nowhere to put it. Additive/backward-compatible (0 = unset). Regenerated pb/vtproto. Part of ADR-062's field-fidelity proto-extension backlog (Tier 1, code location). Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

✨ fex: add HttpRequest evidence type for DAST findings (#9226) Add an HttpRequest message and wire it into the Evidence oneof (field 27). It captures the web request that triggered a finding — method, url, param, attack payload, matched evidence, and optional raw request/response — giving DAST scanners (OWASP ZAP, Burp Suite) a first-class home for request context instead of the generic properties map. Additive/backward-compatible. Regenerated pb/vtproto; added a round-trip test. Part of ADR-062's field-fidelity proto-extension backlog (Tier 2). Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

✨ Add sbomupload upstream client (Sbom.BulkUploadSbom) (#9223) Add the Mondoo Platform SBOM-upload client to mql, next to sbomscan/fex/mvd. Uploading an SBOM via Sbom.BulkUploadSbom stores it and lets the platform enrich it into vulnerabilities automatically — the client computes no VEX. This is the "upload SBOM, VEX happens upstream" path (distinct from sbomscan's ephemeral ScanUploadedSbom, which returns VEX for the caller to upload). - providers-sdk/v1/upstream/sbomupload: sbomupload.proto (package mql.sbomupload.v1, service Sbom) + generated pb/vtproto + hand-written ranger client + round-trip test. - Makefile: add to shared/generate. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

✨ Add sbomscan upstream client (ExtendedVulnMgmt.ScanUploadedSbom) (#9150) Promote the Mondoo Platform vulnerability-scan client from xgrep into mql, its canonical home next to providers-sdk/v1/upstream/{fex,mvd}. Clients (cnspec, xgrep) send an SBOM to ExtendedVulnMgmt.ScanUploadedSbom and get back VEX (ephemeral scan; caller uploads the VEX itself). - providers-sdk/v1/upstream/sbomscan: vulnscan.proto (package mql.sbomscan.v1) + generated pb/vtproto + the hand-written ranger client + a round-trip test. - Makefile: add the package to shared/generate. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-10

sbom: satisfy protolint + copywrite on the new proto/fields - rename repeated field depends_on -> dependency_refs (protolint REPEATED_FIELD_NAMES_PLURALIZED); update renderers + test. - reflow new proto comments under the 80-col limit. - add the copyright year to the new dependency_graph_test.go header. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

sbom: model dependency graph + dev/prod scope + stable bom_ref on the proto Add the CycloneDX/SPDX dependency-graph and scope shape to the sbom proto so the package->package dependency graph and dev/prod scope the lockfile parsers already resolve survive into the standard SBOM output (previously flattened away): - Package.bom_ref (28): a stable, document-internal component id. Deterministic -- purl-when-present, else synthesized -- replacing the per-render uuid.New() bom-ref so CycloneDX output is reproducible and dependency edges have a stable endpoint. - Package.scope (29): prod/dev dependency scope. - Sbom.dependencies (7) + Dependency{ref, depends_on}: the package->package graph, each endpoint referenced by bom_ref (the CycloneDX dependencies / SPDX DEPENDS_ON shape). Renderers: the generator stamps a deterministic bom_ref on every component; CycloneDX emits the dependencies section + maps dev scope to ScopeExcluded; SPDX emits DEPENDS_ON relationships. sbom.BomRefFor centralizes the ref rule. Populating Sbom.dependencies/scope end-to-end still needs the per-ecosystem package resources to carry dependsOn/scope (schema + codegen) -- a follow-up; the proto model and renderers are in place here. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-08

✨ Add CATEGORY_SECRET to FEX FindingDetail category (#9019) Secrets-detection findings (e.g. from xgrep's `secrets` rule category) were indistinguishable from code/SAST findings because there was no dedicated category — they had to be reported as CATEGORY_SECURITY. Add CATEGORY_SECRET (= 7) so downstream consumers can classify and surface secrets on their own. Additive enum value; regenerated fex.pb.go. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-18

🌟 fex: publish Finding Exchange proto contract in the provider SDK (#8478) * 🌟 fex: publish Finding Exchange proto contract in the provider SDK Add a new providers-sdk/v1/upstream/fex package publishing the public Finding Exchange (FEX) and Vulnerability Exchange (VEX) data structures. This is the contract query packs use to construct finding/vulnerability documents and the format used to batch findings for upload. Messages: - FindingDocument (oneof wrapper: vex or fex) - VulnerabilityExchange, FindingExchange - FindingsUploadRequest (batch wrapper) - supporting types: Affects, Component, FileComponent, Rating, Severity, Source, Reference, VulnerabilityDetails, Remediation, FindingDetail, Evidence (+ File/User/Process/Container/Kubernetes/RegistryKey/ Connection/AttackTactic/AttackTechnique) - enums: Status, ScoringMethod, Confidence, SeverityRating, and the nested Remediation.Category, FindingDetail.Category, Connection.ConnectionProtocol The package is self-contained (imports only well-known google protobuf types). Field 14 of VulnerabilityExchange is reserved. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * 📄 fex: fix two doc-comment typos in fex.proto - "finding wa last seen" -> "finding was last seen" - add missing space after // on the Evidence comment Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * 📄 fex: wrap Evidence comment to stay under 80 cols Adding the missing space after // pushed the line to 81 chars. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-17

🧹 ci: replace check-spelling with typos (#8461) * 🧹 ci: replace check-spelling with typos for spell checking The check-spelling@v0.0.26 action self-aborts on a security advisory it published against its own latest release, so the spell-check job fails on every PR that touches a checked file. Switch to crate-ci/typos, which checks the whole repo and is config-driven. Add _typos.toml: exclude generated code and testdata, and baseline the existing vocabulary — real technical terms and abbreviations, a company name, intentional test fixtures, and a set of pre-existing misspellings that are baked into MQL schema field names / exported Go identifiers (renaming those is a breaking change, left for a separate cleanup). Also fix the genuine typos typos found in comments, strings, and local identifiers across the tree, and drop the now-unused check-spelling config under .github/actions/spelling. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * 🧹 ci: address spell-check review feedback - ipmi: keep the misspelled "ipmbEventReciever" JSON tag for wire/persisted compatibility (renaming it silently drops the field from old payloads); the Go field stays correctly named. Baseline "reciever" in _typos.toml. - ms365: fix "scaped"/"scaping" -> "escaped"/"escaping" in comments, which typos missed. - sbom: regenerate mql_sbom.pb.go from the .proto via go generate rather than hand-editing the generated file. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

🧹 ci: replace check-spelling with typos for spell checking The check-spelling@v0.0.26 action self-aborts on a security advisory it published against its own latest release, so the spell-check job fails on every PR that touches a checked file. Switch to crate-ci/typos, which checks the whole repo and is config-driven. Add _typos.toml: exclude generated code and testdata, and baseline the existing vocabulary — real technical terms and abbreviations, a company name, intentional test fixtures, and a set of pre-existing misspellings that are baked into MQL schema field names / exported Go identifiers (renaming those is a breaking change, left for a separate cleanup). Also fix the genuine typos typos found in comments, strings, and local identifiers across the tree, and drop the now-unused check-spelling config under .github/actions/spelling. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-06-06

📃 document alias handling on resources metadata (#8201)

2026-05-29

✨ Add SendReport RPC for structured diagnostic reports ErrorReporting now also exposes SendReport — a schema-less envelope that ships a google.protobuf.Struct payload tagged with a report_type discriminator. The envelope (service_account_mrn, agent_mrn, product, tags) mirrors SendErrorReq so both flow through the same auth + Sentry routing on the platform side. First consumer is the serverless-scanner-aws lambda's on-demand health report. The server-side handler can stay a no-op until consumers materialize; the type registration in this PR is enough for clients to start emitting. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-22

✨ sbom.Package: add license + install_date proto fields (#7817) Adds two slots on sbom.Package so SBOM uploads can carry the new package metadata exposed by the OS / npm / python work: string license = 26; string install_date = 27; `license` is the SPDX expression (or upstream-reported license string). `install_date` is RFC3339 — empty when the backend doesn't report install time (dpkg without log parsing, apk, pacman, macOS). Pure proto + regen; no behavioural change to existing code paths. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-04-24

🎫 Add feature flag for token-response WIF token exchange (#7362) Introduces the ExchangeTokenForToken feature flag. When enabled, the WIF external token exchange sends response_type=TOKEN and decodes the returned bearer token into ServiceAccountCredentials.Token. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Allow authenticating a service account with a bearer token (#6910)

2026-04-09

⭐ introduce maturity for providers, resources, and fields (#7140)

2026-04-01

🧹 update copyright year to 2024, 2026 and bump copywrite to v0.25.2 (#7082) Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-03-31

✨ implement vault delete for berglas (#7078) * ✨ implement vault delete for berglas Signed-off-by: Ivan Milchev <ivan@mondoo.com> * address comments Signed-off-by: Ivan Milchev <ivan@mondoo.com> --------- Signed-off-by: Ivan Milchev <ivan@mondoo.com>

2026-03-17

✨ Add custom tags to error reports for enhanced context (#6957)

2026-03-13

✨ Add platform info to slow query alert Add PlatformInfo message to the error reporting proto and include it in SendErrorReq and SlowQueryInfo so slow query alerts carry context about the platform being scanned (name, arch, title, kind, runtime). Closes #6877 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-02-22

✨ track provider versions per resources and fields (#6654) * ✨ track provider versions per resources and fields Signed-off-by: Dominik Richter <dominik.richter@gmail.com> * 🐛 fix minMondooVersions to previous state Signed-off-by: Dominik Richter <dominik.richter@gmail.com> --------- Signed-off-by: Dominik Richter <dominik.richter@gmail.com>

2026-02-18

🛑 rename sbom cnquery=>mql Signed-off-by: Dominik Richter <dominik.richter@gmail.com>

🛑🌟 cnquery => mql (#6599) * 🛑🌟 rename cnquery => mql This is a major restructure as part of the v13 release. We are renaming cnquery to simplify concepts and just focus on mql instead. As part of v13 we are already moving all querypacks to cnspec, so what remains is the unification of the data-plane. Signed-off-by: Dominik Richter <dominik.richter@gmail.com> * ✨ cnquery => mql logo + duplicate cleanup Signed-off-by: Dominik Richter <dominik.richter@gmail.com>

🛑 remove cnquery scan (#6513) * 🛑 remove cnquery scan Signed-off-by: Dominik Richter <dominik.richter@gmail.com> * 🟢 try to fix tests Signed-off-by: Dominik Richter <dominik.richter@gmail.com> * 🧹 remove benchmark tests (see details) - we don't have querypacks anymore, which is what the benchmarks were running - we have benchmarks in cnspec - we will instead want separate provider and runtime benchmarks Signed-off-by: Dominik Richter <dominik.richter@gmail.com> --------- Signed-off-by: Dominik Richter <dominik.richter@gmail.com>

🛑 rename sbom cnquery=>mql Signed-off-by: Dominik Richter <dominik.richter@gmail.com>

2026-02-13

🛑🌟 cnquery => mql (#6599) * 🛑🌟 rename cnquery => mql This is a major restructure as part of the v13 release. We are renaming cnquery to simplify concepts and just focus on mql instead. As part of v13 we are already moving all querypacks to cnspec, so what remains is the unification of the data-plane. Signed-off-by: Dominik Richter <dominik.richter@gmail.com> * ✨ cnquery => mql logo + duplicate cleanup Signed-off-by: Dominik Richter <dominik.richter@gmail.com>

2026-02-05

📄 Update outdated documentation URLs (#6569) * 📄 Update outdated documentation URLs Fix redirecting URLs in comments and documentation: - golang.org → go.dev (Go moved their docs) - docs.microsoft.com → learn.microsoft.com (Microsoft consolidated docs) - jqlang.github.io/jq → jqlang.org (jq moved their site) - tools.ietf.org → datatracker.ietf.org (IETF consolidated) - www.terraform.io/docs → developer.hashicorp.com/terraform (HashiCorp moved docs) - cnquery.io → mondoo.com/cnquery (domain redirect) - git.k8s.io → github.com/kubernetes (shortlink to full URL) - confluence.jetbrains.com → jetbrains.com/help/teamcity (JetBrains moved docs) - wiki.jenkins.io → jenkins.io/doc (Jenkins moved docs) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * 🧹 regenerate proto file * 🧹 fix protolint errors --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> Co-authored-by: Christoph Hartmann <chris@lollyrock.com>

2026-02-03

🛑 remove cnquery scan (#6513) * 🛑 remove cnquery scan Signed-off-by: Dominik Richter <dominik.richter@gmail.com> * 🟢 try to fix tests Signed-off-by: Dominik Richter <dominik.richter@gmail.com> * 🧹 remove benchmark tests (see details) - we don't have querypacks anymore, which is what the benchmarks were running - we have benchmarks in cnspec - we will instead want separate provider and runtime benchmarks Signed-off-by: Dominik Richter <dominik.richter@gmail.com> --------- Signed-off-by: Dominik Richter <dominik.richter@gmail.com>

2026-01-11

🧹shell suggestions (#6378) * 🧹 remove filtered queries for shell as this is not stable * 🧹simplify the shell completer * 🧹 include provider in suggestion * 🧹sort shell suggestion by connected provider * 🧹 add test for shell resource sorting function

2026-01-09

🧹 include provider in suggestion

2025-09-03

🧹 Drop deprecated v8 kind. (#3976) Signed-off-by: Preslav <preslav@mondoo.com>

2025-09-02

✨ extract property handler for bundles/packs + update examples (#5900)

2025-09-01

⭐ add support for server-side features (#5898) This allows the server to set or unset certain features that it supports. This means e.g. that if the server can store resources data in the new format, we can send it this way. Signed-off-by: Dominik Richter <dominik.richter@gmail.com>

2025-08-28

🎉 v12.0.0-pre1 Signed-off-by: Dominik Richter <dominik.richter@gmail.com>

2025-08-27

🎉 v12.0.0-pre1 Signed-off-by: Dominik Richter <dominik.richter@gmail.com>

✨ Add installed kernels explicitly to SBOM (#5868) * ✨ Detect active and inactive kernels Add the MQL data to the SBOM. Signed-off-by: Christian Zunker <christian@mondoo.com> * 📃 tiny message doc Signed-off-by: Dominik Richter <dominik.richter@gmail.com> --------- Signed-off-by: Christian Zunker <christian@mondoo.com> Signed-off-by: Dominik Richter <dominik.richter@gmail.com> Co-authored-by: Dominik Richter <dominik.richter@gmail.com>

2025-08-26

✨ Detect active and inactive kernels Add the MQL data to the SBOM. Signed-off-by: Christian Zunker <christian@mondoo.com>

2025-08-22

🎉 v12 🎉 Signed-off-by: Dominik Richter <dominik.richter@gmail.com>

2025-08-20

⭐ v12 Signed-off-by: Dominik Richter <dominik.richter@gmail.com>

2025-08-18

⭐ v12 Signed-off-by: Dominik Richter <dominik.richter@gmail.com>

2025-08-12

⭐ v12 Signed-off-by: Dominik Richter <dominik.richter@gmail.com>

2025-07-09

✨ introduce human time (#5778) This allows users to specify timestamps in a human-readable way. Particularly useful when dealing with YAML files, ie querypacks and policies, where you can now specify timestamps with a lot more grace and variety. We are also breaking out the time parsing code into its own utility so the same parser is now shared between MQL and policy/querypack bundles. Finally I found an issue with the numeric variants of RFC 822 and RFC 1123, since both are parsed in their non-numeric variants without error. Thus, the numeric variants are removed for now in the auto-detection. Signed-off-by: Dominik Richter <dominik.richter@gmail.com>

2025-07-03

⭐️ Improve cnquery sbom command (#5750) * ⭐️ add protobom for sbom conversion * 🧹 users need to explicitly enable the exclusion of the evidence for sbom generation * ⭐️ exclude CPEs from SBOM export * ⭐️ sbom asset title * 🧹 update go mod * 🧹 update protobuf files * 🧹 update go mod * 🧹 fix tests * 🧹 update cli test

2025-07-01

✨ Add title to SBOM packages (#5746) Signed-off-by: Christian Zunker <christian@mondoo.com>

2025-06-13

✨ cnquery run `--exit-1-on-failure` (#5656) This change adds a new flag named `--exit-1-on-failure` which will make `cnquery` exit with code `1` if any query result failed. Simple Example: ``` cnquery run -c "1==2" --exit-1-on-failure ``` Closes https://github.com/mondoohq/cnspec/issues/1671 Signed-off-by: Salim Afiune Maya <afiune@mondoo.com>

2025-06-12

✨ cnquery run `--exit-1-on-failure` This change adds a new flag named `--exit-1-on-failure` which will make `cnquery` exit with code `1` if any query result failed. Simple Example: ``` cnquery run -c "1==2" --exit-1-on-failure ``` Closes https://github.com/mondoohq/cnspec/issues/1671 Signed-off-by: Salim Afiune Maya <afiune@mondoo.com>

2025-05-20

✨ Add MQL VEX document resource (#5555) * ✨ Add VEX documents to shodan hosts Fixes: https://github.com/mondoohq/cnquery/issues/5404 Signed-off-by: Christian Zunker <christian@mondoo.com> * 🧹 Rename VEX MQL resource and also add to core Signed-off-by: Christian Zunker <christian@mondoo.com> * Remove source from proto Signed-off-by: Christian Zunker <christian@mondoo.com> * 🧹 reverse changes in shodan * 🧹 make vex resource public Signed-off-by: Christian Zunker <christian@mondoo.com> --------- Signed-off-by: Christian Zunker <christian@mondoo.com> Co-authored-by: Christoph Hartmann <chris@lollyrock.com>

2025-05-13

✨ extend sbom proto (#5535) Signed-off-by: Ivan Milchev <ivan@mondoo.com>

2025-05-05

⭐️ `lr`: add provider dependencies to schema (#5495) * ⭐️ `lr`: add provider dependencies to schema Resources within a provider can depend on resources from another provider, for example; The `os` provider depends on `network` provider. The `lr` parser already reads these imports but it wasn't passing it to the schema. This change adds the list of dependencies so that we can install them at runtime. Signed-off-by: Salim Afiune Maya <afiune@mondoo.com> * ✨ test dependencies in lr files Signed-off-by: Salim Afiune Maya <afiune@mondoo.com> --------- Signed-off-by: Salim Afiune Maya <afiune@mondoo.com>

2025-05-02

⭐ v12 Signed-off-by: Dominik Richter <dominik.richter@gmail.com>

2025-05-01

⭐️ `lr`: add provider dependencies to schema Resources within a provider can depend on resources from another provider, for example; The `os` provider depends on `network` provider. The `lr` parser already reads these imports but it wasn't passing it to the schema. This change adds the list of dependencies so that we can install them at runtime. Signed-off-by: Salim Afiune Maya <afiune@mondoo.com>

wip Signed-off-by: Salim Afiune Maya <afiune@mondoo.com>

2025-04-22

⭐ v12 Signed-off-by: Dominik Richter <dominik.richter@gmail.com>

✨ Add WIF auth support (#5439) * Add WIF token exchange calls to client * Add token fetching and handle exchange * Add function to figures out which provider to use * Add updated proto for upstream changes * Add ranger.go file for changed upstream.proto * Fix indentation * Add support for WIF config files * remove the default issuerUri from config.go, it's handled elsewhere * Use afero and add unit tests * Cleanup from when this was using flags * Clean up old and redundant code * Fix up tests

2025-04-21

Fix indentation

Add WIF token exchange calls to client

2025-04-17

✨ add new exception types

2025-04-16

✨ add new exception types

⭐ v12 Signed-off-by: Dominik Richter <dominik.richter@gmail.com>

2025-04-15

Fix indentation

Add WIF token exchange calls to client

2025-04-03

Add status to sbom package

2025-03-08

✨ ip.cidr, ip.address and raw IP storage (#5292) * ✨ ip.cidr and raw IP storage Signed-off-by: Dominik Richter <dominik.richter@gmail.com> * 🧹 rename mask -> prefixlength Signed-off-by: Dominik Richter <dominik.richter@gmail.com> * 🧹 expand int2ip types Signed-off-by: Dominik Richter <dominik.richter@gmail.com> * 🐛 print CIDR of IP by default Signed-off-by: Dominik Richter <dominik.richter@gmail.com> * 🐎 more efficient bitmask generator Signed-off-by: Dominik Richter <dominik.richter@gmail.com> * 📃 clarify IP internal vars Signed-off-by: Dominik Richter <dominik.richter@gmail.com> * ✨ add ip.address Signed-off-by: Dominik Richter <dominik.richter@gmail.com> * 🔨 switch from manual to proto-based IP marshaling Signed-off-by: Dominik Richter <dominik.richter@gmail.com> * 🧹 remove those unnecessary types Signed-off-by: Dominik Richter <dominik.richter@gmail.com> * 🧹 split up test for data conversion Signed-off-by: Dominik Richter <dominik.richter@gmail.com> --------- Signed-off-by: Dominik Richter <dominik.richter@gmail.com>

2025-02-26

🐛 fix core `asset.labels` + ✨ new `asset.platformMetadata` (#5227) The labels of an asset come from the asset itself, not the platform, but as some point we made a mistake to use the platform labels, this PR is the first step to fix this issue. In this PR we are: * Introducing a new field to the proto message `asset.Platform.Metadata` with the goal to give more clarity and avoid confusions with `asset.Labels` * We are deprecating `asset.Platform.Labels` in favor of `asset.Platform.Metadata` (this field will be remove in `v12`) * We are introducing a new `asset.platformMetadata` to the `asset` MQL schema, this new field will have the `asset.Platform.Metadata` * We are fixing the `asset.labels` MQL resource to have the actual asset labels but, we are going to merge this field with the platform labels for backwards compatibility After merging this PR, we will start migrating the use of `asset.Platform.Labels` to `asset.Platform.Metadata`, so that in `v12` we can remove `asset.Platform.Labels. --------- Signed-off-by: Salim Afiune Maya <afiune@mondoo.com>

2025-02-22

wip: remove platform.labels for testing Signed-off-by: Salim Afiune Maya <afiune@mondoo.com>

2025-02-21

⚙️ expose platform labels as `asset.platformMetadata` Signed-off-by: Salim Afiune Maya <afiune@mondoo.com>

2025-02-07

✨ resource context in LR definition (#5176) Signed-off-by: Dominik Richter <dominik.richter@gmail.com>

2025-01-10

⭐️ Add tags to objectref (#5083) * ⭐️ Add tags to objectref We can use the tags to provide additional metadata for variants like what icon to use and what title to show An example: ``` queries: - uid: mondoo-edr-policy-ensure-edr-agent-is-installed title: Ensure EDR Agent is installed variants: - uid: mondoo-edr-policy-ensure-edr-agent-is-installed-macos tags: mondoo.com/filter-title: macos - uid: mondoo-edr-policy-ensure-edr-agent-is-installed-linux tags: mondoo.com/filter-title: linux - uid: mondoo-edr-policy-ensure-edr-agent-is-installed-windows tags: mondoo.com/filter-title: windows ``` * update example

2024-12-30

🧹 update documentation for protobuf and regenerate with latest protoc (#5045) * 🧹 update documentation of proto file * 🧹 update generated protobuf code

2024-12-03

Add disabled scoring system (#4944) Needed for https://github.com/mondoohq/cnspec/pull/1502

2024-11-11

⭐️ add more optional metadata fields to remediations (#4826)

2024-08-11

⭐️ product.releaseCycle resource (#4512)

2024-07-31

Capitalize Mondoo Platform in a few places (#4464) * Capitalize Mondoo Platform in a few places This also updates the short description of the platform that is used in `cnspec scan/shell help` ``` ... mondoo Scan the Mondoo Platform ... ``` Signed-off-by: Tim Smith <tsmith84@gmail.com> * Update Makefile Co-authored-by: Letha <letha@mondoo.com> * Update providers/mondoo/config/config.go Co-authored-by: Letha <letha@mondoo.com> * Update providers-sdk/v1/upstream/upstream.proto Co-authored-by: Letha <letha@mondoo.com> --------- Signed-off-by: Tim Smith <tsmith84@gmail.com> Co-authored-by: Letha <letha@mondoo.com>

✨ ListResources for resources explorer (#4448) Slowly starting to extend the functionality to cover exploration use-cases Signed-off-by: Dominik Richter <dominik.richter@gmail.com>

2024-07-24

✨ Add labels to the reporter assets. (#4401) Signed-off-by: Preslav <preslav@mondoo.com>

2024-07-23

✨ Add Azure ID and Azure sub external IDs to the sbom proto. (#4348) Signed-off-by: Preslav <preslav@mondoo.com>

2024-07-18

✨ Expose package vendor via MQL (#4357) Based on #7524 Signed-off-by: Christian Zunker <christian@mondoo.com>

2024-05-13

🧹 Drop deprecated v8 kind. Signed-off-by: Preslav <preslav@mondoo.com>

2024-04-18

⭐️ support env variables as credential type for inventories (#3792) This is especially useful when used in CI/CD environments. Users have a pre-defined inventory file with one or multiple entries but do not want to store the secrets in there. Instead the CI/CD run defines the secret via an environment variable. ```yaml spec: assets: - connections: - type: slack credentials: - type: env env: CUSTOM_SLACK_TOKEN ```

2024-04-17

🎉 v11 🎉 (#3755) * 🎉 v11 🎉 Signed-off-by: Dominik Richter <dominik.richter@gmail.com> * 🟢 lint Signed-off-by: Dominik Richter <dominik.richter@gmail.com> * 🟢 fix mockprovider (version bumped to v11) Signed-off-by: Dominik Richter <dominik.richter@gmail.com> --------- Signed-off-by: Dominik Richter <dominik.richter@gmail.com>

2024-04-15

✨Add trace-id to sbom proto. (#3752) Signed-off-by: Preslav <preslav@mondoo.com>

⭐️ trace-id argument for cnquery (#3749) * ⭐️ trace-id argument for cnquery * 🧹 update tests