## What's Changed * chore: bump the minor-and-patch group with 2 updates by @dependabot[bot] in https://github.com/cartography-cncf/cartography/pull/2533 * chore: bump cryptography from 45.0.7 to 46.0.6 by @dependabot[bot] in https://github.com/cartography-cncf/cartography/pull/2558 * feat(rules): add NIST AI RMF aligned AI governance checks by @kunaals in https://github.com/cartography-cncf/cartography/pull/2435 * fix(aws): handle SES list_email_identities without paginator by @kunaals in https://github.com/cartography-cncf/cartography/pull/2561 * chore: add dependabot cooldowns by @jychp in https://github.com/cartography-cncf/cartography/pull/2560 * fix(aws): use adaptive botocore retries by @kunaals in https://github.com/cartography-cncf/cartography/pull/2550 * refactor(ontology): convert device hostname rels to conditional matchlinks by @jychp in https://github.com/cartography-cncf/cartography/pull/2546 * chore: bump pygments from 2.19.2 to 2.20.0 by @dependabot[bot] in https://github.com/cartography-cncf/cartography/pull/2563 * chore: bump the minor-and-patch group across 1 directory with 19 updates by @dependabot[bot] in https://github.com/cartography-cncf/cartography/pull/2562 * refactor: cleanup redundant indexes and auto-index lastupdated on extra labels by @jychp in https://github.com/cartography-cncf/cartography/pull/2564 * fix(ontology): clean up stale derived relationships by @jychp in https://github.com/cartography-cncf/cartography/pull/2565 * fix(github): add retry logic to call_github_rest_api for transient errors by @jychp in https://github.com/cartography-cncf/cartography/pull/2566 * fix(core): update CALL subquery to use Neo4j 5 syntax. Update docs. (#1500) by @achantavy in https://github.com/cartography-cncf/cartography/pull/2547 * chore: bump sphinxcontrib-mermaid from 1.0.0 to 2.0.1 by @dependabot[bot] in https://github.com/cartography-cncf/cartography/pull/2556 * fix(github): raise ValueError when organization data is None in fetch_all by @jychp in https://github.com/cartography-cncf/cartography/pull/2568 * fix(gitlab): support additional dependency scanning job names by @kunaals in https://github.com/cartography-cncf/cartography/pull/2569 * chore: bump kubernetes from 33.1.0 to 35.0.0 by @dependabot[bot] in https://github.com/cartography-cncf/cartography/pull/2557 * feat(ontology): link Device to SentinelOne agents by @jychp in https://github.com/cartography-cncf/cartography/pull/2571 * chore: bump packaging from 25.0 to 26.0 by @dependabot[bot] in https://github.com/cartography-cncf/cartography/pull/2555 * chore: bump aiohttp from 3.13.2 to 3.13.4 by @dependabot[bot] in https://github.com/cartography-cncf/cartography/pull/2572 * feat(intune): Add Coverage for Microsoft Intune by @shyammukund in https://github.com/cartography-cncf/cartography/pull/2537 * fix(gcp): retry google api core server errors by @jychp in https://github.com/cartography-cncf/cartography/pull/2573 * feat: add new intel module for WorkOS by @jychp in https://github.com/cartography-cncf/cartography/pull/2219 * chore: add Python 3.13 support with deprecation warning for previous versions by @jychp in https://github.com/cartography-cncf/cartography/pull/2346 * chore: bump aiohttp from 3.13.3 to 3.13.4 by @dependabot[bot] in https://github.com/cartography-cncf/cartography/pull/2574 * docs(ci): align CNCF references and publish coverage evidence by @jychp in https://github.com/cartography-cncf/cartography/pull/2567 * fix: change log level from warning to debug for expected Composite Node Pattern cases by @achantavy in https://github.com/cartography-cncf/cartography/pull/2549 * fix(gcp): retry cleanup and graph job writes by @kunaals in https://github.com/cartography-cncf/cartography/pull/2540 * feat(kubernetes): link pods to service accounts by @jychp in https://github.com/cartography-cncf/cartography/pull/2575 * Pin azure-mgmt-resource below 25 by @kunaals in https://github.com/cartography-cncf/cartography/pull/2577 * chore: bump actions/upload-artifact from 4.3.3 to 7.0.0 by @dependabot[bot] in https://github.com/cartography-cncf/cartography/pull/2579 * chore: bump the minor-and-patch group with 23 updates by @dependabot[bot] in https://github.com/cartography-cncf/cartography/pull/2580 * fix(s1): reduce SentinelOne site-scope fallback log noise by @kunaals in https://github.com/cartography-cncf/cartography/pull/2585 * chore: bump cryptography from 45.0.7 to 46.0.5 by @dependabot[bot] in https://github.com/cartography-cncf/cartography/pull/2581 * chore: remove redundant load/sync log statements from intel modules by @jychp in https://github.com/cartography-cncf/cartography/pull/2588 * feat(tailscale): ingest and resolve device posture by @jychp in https://github.com/cartography-cncf/cartography/pull/2586 * test: align legacy integration tests with AGENTS.md standards by @jychp in https://github.com/cartography-cncf/cartography/pull/2589 * fix(test): resolve flaky test_sync_ecr caused by non-deterministic mock ordering by @jychp in https://github.com/cartography-cncf/cartography/pull/2592 * refactor: migrate 5 legacy intel modules to data model by @jychp in https://github.com/cartography-cncf/cartography/pull/2590 * chore: bump cryptography from 46.0.5 to 46.0.7 by @dependabot[bot] in https://github.com/cartography-cncf/cartography/pull/2593 * refactor(github): migrate remaining repo sync to data model by @jychp in https://github.com/cartography-cncf/cartography/pull/2591 * feat(ontology): add EncryptionKey semantic label for cross-cloud key queries by @jychp in https://github.com/cartography-cncf/cartography/pull/2594 * fix(aws): Skip 503 error for single region in Cloudtrail_mgmt_events module sync by @shyammukund in https://github.com/cartography-cncf/cartography/pull/2596 * refactor(microsoft): Move Entra and Intune modules under new Microsoft Module by @shyammukund in https://github.com/cartography-cncf/cartography/pull/2595 * docs(kubernetes): document EKS permission requirements by @kunaals in https://github.com/cartography-cncf/cartography/pull/2599 **Full Changelog**: https://github.com/cartography-cncf/cartography/compare/0.134.0...0.135.0

## What's Changed * feat(eks,kubernetes): add cert parsing diagnostics and kube TLS posture metadata by @kunaals in https://github.com/cartography-cncf/cartography/pull/2393 * feat(aws): add RDS permission relationships for IAM database access by @jychp in https://github.com/cartography-cncf/cartography/pull/2447 * feat(rules): add CIS Kubernetes Benchmark v1.12 framework by @jychp in https://github.com/cartography-cncf/cartography/pull/2434 * fix(github): extract dependency graph into per-repo paginated queries by @jychp in https://github.com/cartography-cncf/cartography/pull/2450 * feat(aws/iam): add get_account_summary ingestion by @jychp in https://github.com/cartography-cncf/cartography/pull/2451 * fix(aws): skip unsupported SageMaker regional operations by @kunaals in https://github.com/cartography-cncf/cartography/pull/2455 * feat(ecs): normalize runtime container architecture by @kunaals in https://github.com/cartography-cncf/cartography/pull/2401 * fix(aws): enforce extension-only EKS cert SKI/AKI metadata by @kunaals in https://github.com/cartography-cncf/cartography/pull/2449 * fix(identitycenter): scope ALLOWED_BY matchlinks by identity_store_id by @jychp in https://github.com/cartography-cncf/cartography/pull/2448 * fix(anthropic,openai): add HTTP retry with backoff for transient errors by @jychp in https://github.com/cartography-cncf/cartography/pull/2456 * fix(aws): fix `exposed_internet` not set on ELB/ELBv2 nodes by @josema-xyz in https://github.com/cartography-cncf/cartography/pull/2454 * feat(rules): add rule to detect AWS accounts not synced by @jychp in https://github.com/cartography-cncf/cartography/pull/2458 * fix(aws): correct GuardDuty finding date fields by @kunaals in https://github.com/cartography-cncf/cartography/pull/2459 ## New Contributors * @josema-xyz made their first contribution in https://github.com/cartography-cncf/cartography/pull/2454 **Full Changelog**: https://github.com/cartography-cncf/cartography/compare/0.131.1...0.132.0

## What's Changed * docs(kubernetes): add required RBAC permissions by @kunaals in https://github.com/cartography-cncf/cartography/pull/2392 * fix(gitlab): propagate org sync HTTP errors to caller by @kunaals in https://github.com/cartography-cncf/cartography/pull/2429 * chore: bump the minor-and-patch group with 5 updates by @dependabot[bot] in https://github.com/cartography-cncf/cartography/pull/2432 * chore: bump actions/upload-artifact from 6.0.0 to 7.0.0 by @dependabot[bot] in https://github.com/cartography-cncf/cartography/pull/2431 * chore: bump python from `e508a34` to `6a58611` by @dependabot[bot] in https://github.com/cartography-cncf/cartography/pull/2430 * feat(ontology): add UserGroup semantic label for cross-platform group queries by @jychp in https://github.com/cartography-cncf/cartography/pull/2420 * feat(gcp): add BigQuery resource ingestion by @jychp in https://github.com/cartography-cncf/cartography/pull/2433 **Full Changelog**: https://github.com/cartography-cncf/cartography/compare/0.130...0.131.0

## What's Changed * docs(kubernetes): add required RBAC permissions by @kunaals in https://github.com/cartography-cncf/cartography/pull/2392 **Full Changelog**: https://github.com/cartography-cncf/cartography/compare/0.130.0...0.130.1rc1

## What's Changed * feat(azure): Azure Firewall Support by @ashton-suire in https://github.com/cartography-cncf/cartography/pull/2223 * feat(AWS): Complete AWS Compute Internet Exposure Coverage by @shyammukund in https://github.com/cartography-cncf/cartography/pull/2391 * fix(aws): split LBv2 sync to defer IP MatchLinks after network_interface by @jychp in https://github.com/cartography-cncf/cartography/pull/2395 * fix(aws,gcp): isolate IP labels and migrate shared IP nodes by @kunaals in https://github.com/cartography-cncf/cartography/pull/2404 * feat(ontology): add canonical Package node to ontology by @jychp in https://github.com/cartography-cncf/cartography/pull/2399 * fix(aws): sync IAM user and group tags via IAM fallback by @kunaals in https://github.com/cartography-cncf/cartography/pull/2409 * chore: bump the minor-and-patch group with 6 updates by @dependabot[bot] in https://github.com/cartography-cncf/cartography/pull/2408 * chore: bump werkzeug from 3.1.5 to 3.1.6 by @dependabot[bot] in https://github.com/cartography-cncf/cartography/pull/2411 * chore: bump the minor-and-patch group with 2 updates by @dependabot[bot] in https://github.com/cartography-cncf/cartography/pull/2407 * feat(azure): Azure Compute Exposure by @shyammukund in https://github.com/cartography-cncf/cartography/pull/2397 * feat(k8s): Kubernetes Compute Internet Exposure by @shyammukund in https://github.com/cartography-cncf/cartography/pull/2405 * fix(aws): Resourcegroupstagging cleanup batch by @heryxpc in https://github.com/cartography-cncf/cartography/pull/2400 * feat(okta): add --okta-base-domain option for custom Okta domains by @jychp in https://github.com/cartography-cncf/cartography/pull/2416 * fix(aws-iam): handle missing Group.tags/ListGroupTags without crashing sync by @kunaals in https://github.com/cartography-cncf/cartography/pull/2418 * fix(aws): add internet exposed type to ecs containers by @shyammukund in https://github.com/cartography-cncf/cartography/pull/2419 * feat(gcp): Add GCP Compute Exposure Coverage by @shyammukund in https://github.com/cartography-cncf/cartography/pull/2412 * fix(rules): add GitLab to Module enum by @jychp in https://github.com/cartography-cncf/cartography/pull/2425 * chore: bump cryptography from 45.0.7 to 46.0.5 by @dependabot[bot] in https://github.com/cartography-cncf/cartography/pull/2422 * Fix syntax error in Cloudflare zone filtering by @kirkj-lightspeed in https://github.com/cartography-cncf/cartography/pull/2371 * fix(aws): make ECR layer manifest access-denied errors non-fatal by @kunaals in https://github.com/cartography-cncf/cartography/pull/2415 * feat(aws-ecs): add IS_INSTANCE relationship from ECSContainerInstance to EC2Instance by @jychp in https://github.com/cartography-cncf/cartography/pull/2426 * fix(aws) Add batching to avoid threads hanging on s3 and ecr GetDetails by @heryxpc in https://github.com/cartography-cncf/cartography/pull/2423 ## New Contributors * @ashton-suire made their first contribution in https://github.com/cartography-cncf/cartography/pull/2223 * @kirkj-lightspeed made their first contribution in https://github.com/cartography-cncf/cartography/pull/2371 **Full Changelog**: https://github.com/cartography-cncf/cartography/compare/0.129.0...0.130

## What's Changed * chore: update PR template by @jychp in https://github.com/cartography-cncf/cartography/pull/2279 * fix(gcp): Fix for Location Name prefix mismatch by @shyammukund in https://github.com/cartography-cncf/cartography/pull/2282 * chore: bump the minor-and-patch group with 3 updates by @dependabot[bot] in https://github.com/cartography-cncf/cartography/pull/2288 * chore: migrate OCI and JAMF tests by @jychp in https://github.com/cartography-cncf/cartography/pull/2287 * feat(gcp): Support GCP Artifact Registry by @shyammukund in https://github.com/cartography-cncf/cartography/pull/2230 * feat(gitlab): Support GitLab Container Registries by @shyammukund in https://github.com/cartography-cncf/cartography/pull/2254 * fix(gcp): Handle HttpError per location in CloudRun job and execution sync by @kunaals in https://github.com/cartography-cncf/cartography/pull/2297 * feat(rules): Add Asset Compliance Metrics to Cartography Rules by @jychp in https://github.com/cartography-cncf/cartography/pull/2261 * feat(trivy): Add Trivy Support for GitLab Container Registries by @shyammukund in https://github.com/cartography-cncf/cartography/pull/2263 * feat(ontology): add LoadBalancer + Function and improve existing coverage by @jychp in https://github.com/cartography-cncf/cartography/pull/2271 * doc: split AGENTS.md into separate procedures by @jychp in https://github.com/cartography-cncf/cartography/pull/2281 * chore: CI fix and improvment by @jychp in https://github.com/cartography-cncf/cartography/pull/2283 * chore: create a stale workflow by @jychp in https://github.com/cartography-cncf/cartography/pull/2276 * doc: add refererence (autodoc from docstring) by @jychp in https://github.com/cartography-cncf/cartography/pull/1707 * fix(rules): add deduplication key for cloudtrail rules by @jychp in https://github.com/cartography-cncf/cartography/pull/2303 * fix: ensure all analysis jobs are called by @jychp in https://github.com/cartography-cncf/cartography/pull/2300 * fix(gcp): Fix GCP Sync and cascade delete by @shyammukund in https://github.com/cartography-cncf/cartography/pull/2299 * fix(trivy): handle missing Results key for images with no vulnerabilities by @kunaals in https://github.com/cartography-cncf/cartography/pull/2310 * fix(docs): Fix GitLab docs navigation and terminology by @kunaals in https://github.com/cartography-cncf/cartography/pull/2308 * feat(gcp): connect GCP IAM Roles to Organizations and Projects by @kunaals in https://github.com/cartography-cncf/cartography/pull/1469 * feat(k8s): add HAS_IMAGE relationship to GitLabContainerImage by @kunaals in https://github.com/cartography-cncf/cartography/pull/2307 * feat(trivy): Add Trivy Support for GCP Artifact Registry by @shyammukund in https://github.com/cartography-cncf/cartography/pull/2267 * feat(aws): add support for aws iam saml providers by @abhinav-1305 in https://github.com/cartography-cncf/cartography/pull/1901 * feat(AWS): added functionality to check service last accessed by @krishi-agrawal in https://github.com/cartography-cncf/cartography/pull/1930 * refactor(jamf): migrate to new datamodel by @jychp in https://github.com/cartography-cncf/cartography/pull/2291 * feat(aws): add support for MFA devices by @ongdisheng in https://github.com/cartography-cncf/cartography/pull/2278 * chore: enable stale and add cubic config by @jychp in https://github.com/cartography-cncf/cartography/pull/2314 * feat(ontology): Container Registry Ontology by @shyammukund in https://github.com/cartography-cncf/cartography/pull/2304 * refactor(oci): migrate OCI to new datamodel by @jychp in https://github.com/cartography-cncf/cartography/pull/2290 * feat(gitlab): Add GitLab User Coverage by @shyammukund in https://github.com/cartography-cncf/cartography/pull/2302 * feat(github): Add GitHub Actions support by @kunaals in https://github.com/cartography-cncf/cartography/pull/2139 * hotfix: fix tests broken by recenet AI slop PR by @jychp in https://github.com/cartography-cncf/cartography/pull/2317 * feat(core): add conditional label by @jychp in https://github.com/cartography-cncf/cartography/pull/2316 * feat(ontology): add PublicIP by @jychp in https://github.com/cartography-cncf/cartography/pull/2285 * feat(aws): EKS Access Entry Mappings by @Tushar240503 in https://github.com/cartography-cncf/cartography/pull/2239 * fix(aws): fix Kms secret relationship by @Tushar240503 in https://github.com/cartography-cncf/cartography/pull/2296 ## New Contributors * @abhinav-1305 made their first contribution in https://github.com/cartography-cncf/cartography/pull/1901 * @krishi-agrawal made their first contribution in https://github.com/cartography-cncf/cartography/pull/1930 * @ongdisheng made their first contribution in https://github.com/cartography-cncf/cartography/pull/2278 **Full Changelog**: https://github.com/cartography-cncf/cartography/compare/0.126.0...0.127.0

## What's Changed * feat(ontology): enable Ontology users for AWS and Okta by @jychp in https://github.com/cartography-cncf/cartography/pull/2036 * fix(aws): no exec info on EndpointConnectError by @kunaals in https://github.com/cartography-cncf/cartography/pull/2039 * feat: Spacelift Integration by @shyammukund in https://github.com/cartography-cncf/cartography/pull/2022 * feat: Add EC2 ownership tracking to Spacelift module by @shyammukund in https://github.com/cartography-cncf/cartography/pull/2042 * feature(spacelift): Use S3 object prefix instead of key by @kunaals in https://github.com/cartography-cncf/cartography/pull/2045 * chore: bump github/codeql-action from 4.31.0 to 4.31.2 in the minor-and-patch group by @dependabot[bot] in https://github.com/cartography-cncf/cartography/pull/2041 * feat(azure): Add initial ingestion for Security Center and Monitor by @janithashri in https://github.com/cartography-cncf/cartography/pull/1994 * feat(spacelift): CloudTrailEvent node type by @kunaals in https://github.com/cartography-cncf/cartography/pull/2046 **Full Changelog**: https://github.com/cartography-cncf/cartography/compare/0.119.0...0.120.0

## What's Changed * feat(rules): consider denies in iam manipulation rules by @achantavy in https://github.com/cartography-cncf/cartography/pull/2016 * fix: handle empty groups response in Google Workspace sync by @bhaskargurram-ai in https://github.com/cartography-cncf/cartography/pull/2018 * fix(gcp): Consume neo4j results in GCP firewall ingestion by @kunaals in https://github.com/cartography-cncf/cartography/pull/2014 * fix(ecr): ECR image layers batching by @kunaals in https://github.com/cartography-cncf/cartography/pull/2005 * fix(aws): Rely on aws_handle_regions for SCP deny handling by @kunaals in https://github.com/cartography-cncf/cartography/pull/2006 * fix(github): Handle null GitHub repository entries by @kunaals in https://github.com/cartography-cncf/cartography/pull/2008 * fix(ecr): Remove static creds sent to aioboto3 by @kunaals in https://github.com/cartography-cncf/cartography/pull/2010 * fix: uv.lock for now by @achantavy in https://github.com/cartography-cncf/cartography/pull/2021 * fix(ecr): Only attach layers to real images by @kunaals in https://github.com/cartography-cncf/cartography/pull/2011 * refactor(gsuite): migrate to new data model by @jychp in https://github.com/cartography-cncf/cartography/pull/2030 * feat: Ontology - Phase 1 - Users & Devices by @jychp in https://github.com/cartography-cncf/cartography/pull/1633 * docs: clarify ec2 route table association semantics for subnets by @IlyaasK in https://github.com/cartography-cncf/cartography/pull/2029 * fix: missing link between AWSUser and AWSGroup by @achantavy in https://github.com/cartography-cncf/cartography/pull/2035 * fix: improve ontology with multiple sources of truth by @jychp in https://github.com/cartography-cncf/cartography/pull/2031 * chore: bump the minor-and-patch group with 3 updates by @dependabot[bot] in https://github.com/cartography-cncf/cartography/pull/2013 * chore: bump python from `b1e484d` to `6214889` by @dependabot[bot] in https://github.com/cartography-cncf/cartography/pull/2012 * chore: bump the minor-and-patch group with 2 updates by @dependabot[bot] in https://github.com/cartography-cncf/cartography/pull/2025 * chore: bump python from `6214889` to `e0c4fae` by @dependabot[bot] in https://github.com/cartography-cncf/cartography/pull/2023 * chore: bump actions/upload-artifact from 4.6.2 to 5.0.0 by @dependabot[bot] in https://github.com/cartography-cncf/cartography/pull/2026 ## New Contributors * @bhaskargurram-ai made their first contribution in https://github.com/cartography-cncf/cartography/pull/2018 * @IlyaasK made their first contribution in https://github.com/cartography-cncf/cartography/pull/2029 **Full Changelog**: https://github.com/cartography-cncf/cartography/compare/0.118.0...0.119.0