What's Changed

• [K9CODESEC-2946] Add git-based Terraform module resolvers by @whitemerch in #242
• Nathan.gallet/fix ci failures by @NathanGallet-dd in #247
• Handle missing HCL expression types in Terraform parsing by @whitemerch in #249
• [K9CODESEC-2947] Add network Terraform module resolvers by @whitemerch in #248
• [K9CODESEC-2948/2949] Wire Terraform module resolution into engine and module parser by @whitemerch in #250
• [K9CODESEC-2948/2950] Wire Terraform remote modules into scanner by @whitemerch in #251
• Parse a new "arguments" keyword in new IaC v1.4 config by @barbiergaspard in #206
• Add arguments to rule metadata by @barbiergaspard in #238

Full Changelog: v1.7.2-alpha...v1.8.0

What's Changed

• [K9CODESEC-2946] Add git-based Terraform module resolvers by @whitemerch in #242
• Nathan.gallet/fix ci failures by @NathanGallet-dd in #247

Full Changelog: v1.7.2-alpha...v1.7.1-delta

What's Changed

• Cache Terraform HCL parses during line detection by @whitemerch in #228
• Remove embedded Rego libraries and rely on backend delivery by @whitemerch in #231
• Remove deprecated keyExpectedValue, keyActualValue and issueType fields by @whitemerch in #232
• Fix synthetic module doc model for local module evaluation by @whitemerch in #233
• TFPlans: searchLines as searchKeys by @ChouraquiBen in #230
• Fix CI by @whitemerch in #236

Full Changelog: v1.7.0...v1.7.1-beta

What's Changed

• Cache Terraform HCL parses during line detection by @whitemerch in #228

Full Changelog: v1.7.0...v1.7.1-alpha

What's Changed

• [K9CODESEC-1955] Enable terraform plan scanning behind flag by @ChouraquiBen in #194
• Add the queries-path flag to the scanner binary by @barbiergaspard in #205
• Nathan.gallet/helm deterministic rendering by @NathanGallet-dd in #214
• Add a long-lived serve HTTP server by @MarshalX in #211
• Resolve Terraform plan line numbers from searchKey by @whitemerch in #215
• [K9CODESEC-2546] Fetch Rego libraries from backend API with embedded fallback by @whitemerch in #213
• Relax test-rules required field contract for presentation-only fields by @whitemerch in #220
• Optimize privilege-escalation rules by pre-indexing IAM permission sets by @whitemerch in #221
• Optimize S3 rules by pre-indexing bucket references in has_target_resource by @whitemerch in #222
• Add simple json report by @ChouraquiBen in #216
• Fix report format validation rejecting all valid formats by @MarshalX in #225
• Deduplicate synthetic module docs by resolved content to shrink OPA input on large repos by @whitemerch in #219
• Gate Terraform local module instantiation behind a feature flag by @whitemerch in #226
• Evaluate each query against only its platform's documents by @whitemerch in #224
• Speed up IAM privilege-escalation rules on large Terraform repos by @whitemerch in #227
• Add a shared CPU budget to fix negative scaling at high core counts by @MarshalX in #229
• [Terraform plan] tfplan parser losing track of resources by @ChouraquiBen in #196
• Optimize server-mode scan performance (compiled-rule cache, shared compilation, parallel parsing) by @MarshalX in #218

New Contributors

• @barbiergaspard made their first contribution in #205

Full Changelog: v1.6.0...v1.7.0

What's Changed

• [K9CODESEC-1955] Enable terraform plan scanning behind flag by @ChouraquiBen in #194
• Add the queries-path flag to the scanner binary by @barbiergaspard in #205

New Contributors

• @barbiergaspard made their first contribution in #205

Full Changelog: v1.6.0...v1.7.0-alpha

⚠️ This version has known performance issues. Please do not select it; instead, refer to one of the previous versions.

What's Changed

• Fix Rego correctness bugs in shared libraries by @whitemerch in #180
• Preserve Terraform data source policies with unknown values by @whitemerch in #181
• Enforce Rego formatting and bug linting by @whitemerch in #183
• Helm render error logs by @whitemerch in #182
• Remove legacy Rego compat shim (follow-up to Rego v1) by @whitemerch in #185
• Add test-rules command and CI workflow by @whitemerch in #191
• chore(deps): golang.org/x/sys (minor → v0.46.0) [.github/scripts] by @gh-worker-campaigns-3e9aa4[bot] in #188
• Add per-phase CPU/MEM profiling instrumentation behind a --profiling flag by @MarshalX in #195
• [K9CODESEC-2306] Resolve local Terraform modules during IaC scans by @whitemerch in #192
• [K9CODESEC-2307] Expand local module tfeval for count, for_each, and same-module refs by @whitemerch in #193
• Fix searchKey line detection for array-indexed paths by @whitemerch in #199
• [K9VULN-16354] Differentiate local module findings per caller to prevent fingerprint collisions by @whitemerch in #197
• Unify Datadog fingerprint across findings, reports, and storage by @whitemerch in #200
• Fix race conditions and non-deterministic finding counts and re-enable parallel file parsing by @MarshalX in #209
• Fix data race on Inspector.failedQueries (concurrent map writes -> fatal crash) by @MarshalX in #212
• Replace per-query timeout with slow-rule logging; deprecate --timeout option by @MarshalX in #210
• [K9CODESEC-2398] Add RunCustomRegoQuery and ValidateCustomRegoQuery by @whitemerch in #202
• feat(common): add is_iam_policy_principal_scoped_by_condition helper by @NathanGallet-dd in #208
• Improve scan performance by @whitemerch in #207

New Contributors

• @MarshalX made their first contribution in #195
• @NathanGallet-dd made their first contribution in #208

Full Changelog: v1.5.0...v1.6.0

What's Changed

• Fix Rego correctness bugs in shared libraries by @whitemerch in #180
• Preserve Terraform data source policies with unknown values by @whitemerch in #181
• Enforce Rego formatting and bug linting by @whitemerch in #183
• Helm render error logs by @whitemerch in #182
• Remove legacy Rego compat shim (follow-up to Rego v1) by @whitemerch in #185
• Add test-rules command and CI workflow by @whitemerch in #191
• chore(deps): golang.org/x/sys (minor → v0.46.0) [.github/scripts] by @gh-worker-campaigns-3e9aa4[bot] in #188
• Add per-phase CPU/MEM profiling instrumentation behind a --profiling flag by @MarshalX in #195
• [K9CODESEC-2306] Resolve local Terraform modules during IaC scans by @whitemerch in #192
• [K9CODESEC-2307] Expand local module tfeval for count, for_each, and same-module refs by @whitemerch in #193
• Fix searchKey line detection for array-indexed paths by @whitemerch in #199
• [K9VULN-16354] Differentiate local module findings per caller to prevent fingerprint collisions by @whitemerch in #197
• Unify Datadog fingerprint across findings, reports, and storage by @whitemerch in #200

New Contributors

• @MarshalX made their first contribution in #195

Full Changelog: v1.5.0...v1.6.0-alpha

What's Changed

• Default rule engine to Rego v1 by @whitemerch in #179

Full Changelog: v1.4.0...v1.5.0

What's Changed

• Skip Helm library charts in resolver by @whitemerch in #172
• Rename Rego entry-point from package Cx/CxPolicy to package datadog/DatadogPolicy by @whitemerch in #174
• Rename kics* AST keys to dd* with backward-compatible shim by @whitemerch in #176
• Bypass Chart kubeVersion for Helm scan renders by @whitemerch in #173
• Rename pkg/kics to pkg/runner and keep path discovery in pkg/analyzer by @whitemerch in #175
• Deleted the iac benchmarking workflow by @ChouraquiBen in #166
• Rename KICSCommentRgxp identifiers to DDCommentRgxp and clean up kics comments by @whitemerch in #177

Full Changelog: v1.3.3...v1.4.0