## mondoohq/cnspec — v13.33.0…v13.33.2

_15 commits._

### Fixes
- **🐛 vercel: fix vacuous protection-bypass check, scope it to the project (#3252)** (886dc1f)

### Backend
- **🧹 Bump mql to v13.33.2 (#3244)** (48212de)
- **🧹 aws: migrate IAM incident-response query off deprecated user.policies (#3256)** (775f039)
- **🧹 ci: update content validation dependencies (#3255)** (7d2c409)
- **🧹 email: migrate PTR lookups off deprecated dns.reverse (#3254)** (437496b)
- **🧹 azure: migrate Front Door WAF check off deprecated wafPolicyId (#3251)** (4e96c98)
- **🧹 arista: migrate BGP peer route-map checks off deprecated fields (#3250)** (66500f1)
- **🐛 oci: migrate VCN security list checks to typed rules, fixing a vacuous check (#3247)** (7baee34)
- **🐛 content: restore OWASP Top 10:2025 mapping parity, fixing red main (#3249)** (270387d)
- **🧹 oci: replace deprecated fields in the OCI inventory querypack (#3246)** (0a94e30)
- **🧹 k8s testdata: shorten four over-length query titles (#3245)** (34f05e1)
- **🌟 content: map policies to OWASP Top 10:2025 + LLM Top 10, with tests and gap-fill checks (#3242)** (9210f7d)
- **Use user loggedIn resource for query on MacOS (#3241)** (7afaf30)
- **🐛 cloudflare: bind the zone/account before reading sub-resource fields (#3236)** (9c59bd0)

### Chore
- **ci: migrate workflow runners to arc-runners (#3238)** (ba18d40)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/mondoohq/cnspec?utm_source=github-action)._