chore(sdk,mcp): pin direct dependencies to exact versions by HugoPBrito · Pull Request #10593 · prowler-cloud/prowler

HugoPBrito · 2026-04-07T10:29:34Z

Context

Part of PROWLER-1271. This updates the SDK and MCP Server packaging metadata so all direct dependencies that were still expressed as ranges are pinned to exact versions.

Description

Pin the remaining direct SDK dependencies in pyproject.toml (defusedxml, google-auth-httplib2, pydantic, python-dateutil)
Pin httpx in mcp_server/pyproject.toml
Refresh poetry.lock and uv.lock so lock file hashes match the pinned dependencies
Add a SDK changelog entry for the packaging change
Document in the developer guide that reproducible SDK installs should come from poetry.lock

Steps to review

Review pyproject.toml and confirm these direct SDK dependencies are now exact pins:
- defusedxml
- google-auth-httplib2
- pydantic
- python-dateutil
Review mcp_server/pyproject.toml and confirm httpx is now an exact pin
Review poetry.lock and mcp_server/uv.lock diffs
Review the SDK changelog entry and the documentation note in docs/developer-guide/introduction.mdx
Run poetry check and cd mcp_server && uv lock --check

Checklist

Community Checklist

This feature/issue is listed in here or roadmap.prowler.com
Is it assigned to me, if not, request it via the issue/feature in here or Prowler Community Slack

Review if the code is being covered by tests.
Review if code is being documented following this specification https://github.com/google/styleguide/blob/gh-pages/pyguide.md#38-comments-and-docstrings
Review if backport is needed.
Review if is needed to change the Readme.md
Ensure new entries are added to CHANGELOG.md, if applicable.

SDK/CLI

Are there new checks included in this PR? No

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

- Pin previously ranged direct SDK dependencies to exact versions - Refresh poetry.lock and document reproducible installs - Add SDK changelog entry for dependency hardening

…k-pyproject # Conflicts: # poetry.lock

mintlify · 2026-04-07T10:29:38Z

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
prowler	🟢 Ready	View Preview	Apr 7, 2026, 10:31 AM

github-actions · 2026-04-07T10:30:03Z

✅ All necessary CHANGELOG.md files have been updated.

github-actions · 2026-04-07T10:30:05Z

✅ Conflict Markers Resolved

All conflict markers have been successfully resolved in this pull request.

github-actions · 2026-04-07T10:40:11Z

🔒 Container Security Scan

Image: prowler:ae1697b
Last scan: 2026-04-09 12:20:42 UTC

📊 Vulnerability Summary

Severity	Count
🔴 Critical	4
Total	4

4 package(s) affected

⚠️ Action Required

Critical severity vulnerabilities detected. These should be addressed before merging:

Review the detailed scan results
Update affected packages to patched versions
Consider using a different base image if updates are unavailable

📋 Resources:

Download full report (see artifacts)
View in Security tab
Scanned with Trivy

Pin httpx>=0.28.0 to httpx==0.28.1 in mcp_server/pyproject.toml and refresh lock files accordingly.

github-actions · 2026-04-07T11:23:23Z

🔒 Container Security Scan

Image: prowler-mcp:ae1697b
Last scan: 2026-04-09 12:12:35 UTC

📊 Vulnerability Summary

Severity	Count
🔴 Critical	1
Total	1

1 package(s) affected

⚠️ Action Required

Critical severity vulnerabilities detected. These should be addressed before merging:

Review the detailed scan results
Update affected packages to patched versions
Consider using a different base image if updates are unavailable

📋 Resources:

Download full report (see artifacts)
View in Security tab
Scanned with Trivy

github-actions · 2026-04-07T11:30:12Z

🔒 Container Security Scan

Image: prowler-api:d258bb2
Last scan: 2026-04-09 08:36:12 UTC

📊 Vulnerability Summary

Severity	Count
🔴 Critical	5
Total	5

4 package(s) affected

⚠️ Action Required

Critical severity vulnerabilities detected. These should be addressed before merging:

Review the detailed scan results
Update affected packages to patched versions
Consider using a different base image if updates are unavailable

📋 Resources:

Download full report (see artifacts)
View in Security tab
Scanned with Trivy

codecov · 2026-04-07T11:43:25Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.15%. Comparing base (bc38104) to head (c1ea8c7).
⚠️ Report is 25 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #10593      +/-   ##
==========================================
- Coverage   85.71%   84.15%   -1.56%     
==========================================
  Files          15     1675    +1660     
  Lines         504    53665   +53161     
==========================================
+ Hits          432    45162   +44730     
- Misses         72     8503    +8431

Flag	Coverage Δ
prowler-py3.10-aws	`90.56% <ø> (?)`
prowler-py3.10-azure	`89.70% <ø> (?)`
prowler-py3.10-config	`84.14% <ø> (?)`
prowler-py3.10-gcp	`90.04% <ø> (?)`
prowler-py3.10-github	`89.29% <ø> (?)`
prowler-py3.10-googleworkspace	`87.12% <ø> (+1.41%)`	⬆️
prowler-py3.10-iac	`88.84% <ø> (?)`
prowler-py3.10-kubernetes	`89.68% <ø> (?)`
prowler-py3.10-lib	`84.16% <ø> (?)`
prowler-py3.10-m365	`89.09% <ø> (?)`
prowler-py3.10-mongodbatlas	`88.74% <ø> (?)`
prowler-py3.10-nhn	`89.23% <ø> (?)`
prowler-py3.10-openstack	`87.14% <ø> (?)`
prowler-py3.10-oraclecloud	`86.88% <ø> (?)`
prowler-py3.10-vercel	`86.85% <ø> (?)`
prowler-py3.11-aws	`90.56% <ø> (?)`
prowler-py3.11-azure	`89.70% <ø> (?)`
prowler-py3.11-config	`84.15% <ø> (?)`
prowler-py3.11-gcp	`90.04% <ø> (?)`
prowler-py3.11-github	`89.29% <ø> (?)`
prowler-py3.11-googleworkspace	`87.14% <ø> (+1.42%)`	⬆️
prowler-py3.11-iac	`88.85% <ø> (?)`
prowler-py3.11-kubernetes	`89.68% <ø> (?)`
prowler-py3.11-lib	`84.17% <ø> (?)`
prowler-py3.11-m365	`89.11% <ø> (?)`
prowler-py3.11-mongodbatlas	`88.76% <ø> (?)`
prowler-py3.11-nhn	`89.23% <ø> (?)`
prowler-py3.11-openstack	`87.15% <ø> (?)`
prowler-py3.11-oraclecloud	`86.89% <ø> (?)`
prowler-py3.11-vercel	`86.86% <ø> (?)`
prowler-py3.12-aws	`90.56% <ø> (?)`
prowler-py3.12-azure	`89.70% <ø> (?)`
prowler-py3.12-config	`84.14% <ø> (?)`
prowler-py3.12-gcp	`90.04% <ø> (?)`
prowler-py3.12-github	`89.29% <ø> (?)`
prowler-py3.12-googleworkspace	`87.12% <ø> (+1.41%)`	⬆️
prowler-py3.12-iac	`88.84% <ø> (?)`
prowler-py3.12-kubernetes	`89.68% <ø> (?)`
prowler-py3.12-lib	`84.16% <ø> (?)`
prowler-py3.12-m365	`89.09% <ø> (?)`
prowler-py3.12-mongodbatlas	`88.74% <ø> (?)`
prowler-py3.12-nhn	`89.23% <ø> (?)`
prowler-py3.12-openstack	`87.14% <ø> (?)`
prowler-py3.12-oraclecloud	`86.88% <ø> (?)`
prowler-py3.12-vercel	`86.85% <ø> (?)`

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
prowler	`84.15% <ø> (-1.56%)`	⬇️
api	`∅ <ø> (∅)`

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

puchy22

LGTM 👍

- Resolve merge conflicts in poetry.lock and prowler/CHANGELOG.md\n- Preserve the changelog entries from both branches

- Keep api/poetry.lock and mcp_server/uv.lock from forcing changelog updates\n- Preserve the existing changelog requirement for real user-facing changes

This reverts commit ea3937e.

HugoPBrito added 3 commits March 27, 2026 13:04

chore(sdk): pin direct SDK dependencies

b6376f5

- Pin previously ranged direct SDK dependencies to exact versions - Refresh poetry.lock and document reproducible installs - Add SDK changelog entry for dependency hardening

Merge remote-tracking branch 'origin/master' into PROWLER-1271-pin-sd…

cd3c3f5

…k-pyproject # Conflicts: # poetry.lock

chore(sdk): normalize poetry lock serialization

0c8e9f7

HugoPBrito requested review from a team as code owners April 7, 2026 10:29

github-actions bot added the documentation label Apr 7, 2026

docs(sdk): link changelog entry to PR

7c577ab

mintlify bot deployed to staging - docs April 7, 2026 10:31 View deployment

chore(mcp): pin httpx to exact version

4edc13c

Pin httpx>=0.28.0 to httpx==0.28.1 in mcp_server/pyproject.toml and refresh lock files accordingly.

HugoPBrito requested a review from a team as a code owner April 7, 2026 11:22

github-actions bot added component/api component/mcp-server labels Apr 7, 2026

HugoPBrito changed the title ~~chore(sdk): pin direct SDK dependencies~~ chore(sdk,mcp): pin direct dependencies to exact versions Apr 7, 2026

docs(mcp): add changelog entry for httpx pin

8740619

HugoPBrito added 2 commits April 7, 2026 12:45

docs(api): add changelog entry for authlib security bump

0d538c9

merge: resolve conflicts with master

e1b87e5

mintlify bot deployed to staging - docs April 7, 2026 12:22 View deployment

danibarranqueroo previously approved these changes Apr 8, 2026

View reviewed changes

chore: update api lock

bd63367

AdriiiPRodri dismissed danibarranqueroo’s stale review via bd63367 April 8, 2026 09:41

chore: remove api entry

0c38722

puchy22 previously approved these changes Apr 8, 2026

View reviewed changes

danibarranqueroo previously approved these changes Apr 8, 2026

View reviewed changes

chore: merge master into PR 10593

a158022

- Resolve merge conflicts in poetry.lock and prowler/CHANGELOG.md\n- Preserve the changelog entries from both branches

HugoPBrito dismissed stale reviews from danibarranqueroo and puchy22 via a158022 April 9, 2026 08:00

mintlify bot deployed to staging - docs April 9, 2026 08:01 View deployment

fix(ci): ignore generated lockfiles in changelog gate

ea3937e

- Keep api/poetry.lock and mcp_server/uv.lock from forcing changelog updates\n- Preserve the existing changelog requirement for real user-facing changes

HugoPBrito requested a review from a team as a code owner April 9, 2026 08:24

github-actions bot added the github_actions Pull requests that update GitHub Actions code label Apr 9, 2026

Revert "fix(ci): ignore generated lockfiles in changelog gate"

fb8f864

This reverts commit ea3937e.

github-actions bot removed the github_actions Pull requests that update GitHub Actions code label Apr 9, 2026

HugoPBrito added the no-changelog Skip including change in changelog/release notes label Apr 9, 2026

HugoPBrito removed the request for review from a team April 9, 2026 08:26

puchy22 previously approved these changes Apr 9, 2026

View reviewed changes

danibarranqueroo previously approved these changes Apr 9, 2026

View reviewed changes

fix(api): remove poetry lock changes

c1ea8c7

HugoPBrito dismissed stale reviews from danibarranqueroo and puchy22 via c1ea8c7 April 9, 2026 12:11

github-actions bot removed the component/api label Apr 9, 2026

HugoPBrito removed the request for review from a team April 9, 2026 12:11

HugoPBrito removed the no-changelog Skip including change in changelog/release notes label Apr 9, 2026

puchy22 approved these changes Apr 9, 2026

View reviewed changes

AdriiiPRodri approved these changes Apr 9, 2026

View reviewed changes

HugoPBrito merged commit cccb3a4 into master Apr 9, 2026
39 of 40 checks passed

HugoPBrito deleted the PROWLER-1271-pin-sdk-pyproject branch April 9, 2026 13:43

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(sdk,mcp): pin direct dependencies to exact versions#10593

chore(sdk,mcp): pin direct dependencies to exact versions#10593
HugoPBrito merged 14 commits intomasterfrom
PROWLER-1271-pin-sdk-pyproject

HugoPBrito commented Apr 7, 2026 •

edited

Loading

Uh oh!

mintlify bot commented Apr 7, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Apr 7, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Apr 7, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Apr 7, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Apr 7, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Apr 7, 2026 •

edited

Loading

Uh oh!

codecov bot commented Apr 7, 2026 •

edited

Loading

Uh oh!

puchy22 left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

HugoPBrito commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Context

Description

Steps to review

Checklist

SDK/CLI

License

Uh oh!

mintlify bot commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔒 Container Security Scan

📊 Vulnerability Summary

⚠️ Action Required

Uh oh!

github-actions bot commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔒 Container Security Scan

📊 Vulnerability Summary

⚠️ Action Required

Uh oh!

github-actions bot commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔒 Container Security Scan

📊 Vulnerability Summary

⚠️ Action Required

Uh oh!

codecov bot commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

puchy22 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

HugoPBrito commented Apr 7, 2026 •

edited

Loading

mintlify bot commented Apr 7, 2026 •

edited

Loading

github-actions bot commented Apr 7, 2026 •

edited

Loading

github-actions bot commented Apr 7, 2026 •

edited

Loading

github-actions bot commented Apr 7, 2026 •

edited

Loading

github-actions bot commented Apr 7, 2026 •

edited

Loading

github-actions bot commented Apr 7, 2026 •

edited

Loading

codecov bot commented Apr 7, 2026 •

edited

Loading