## mondoohq/cnspec — v13.34.1…v13.35.0

_28 commits._

### Features
- **✨ aws: add 60 CloudFormation variants and document the 36 that cannot exist (#3519)** (db1c0ec)
- **✨ content: add Terraform variants to the STACKIT policy (#3502)** (2a23301)
- **✨ content: add Terraform variants to mondoo-netlify-security (#3497)** (c577eaa)
- **✨ content: add Terraform variants to mondoo-vercel-security (#3496)** (5ab75d7)
- **✨ content: add Terraform variants to mondoo-databricks-security (#3495)** (ee0684f)

### Backend
- **🧹 Bump mql to v13.35.0 (#3529)** (dfd6956)
- **📝 readme: list Ubuntu 26.04 in validated platform versions (#3521)** (c0ef105)
- **📝 kubernetes: rewrite every check description to name the setting and the real risk (#3382)** (78ad4d0)
- **🌟 scandb content checksums + upload wire surface (unchanged-scan short-circuit) (#3225)** (b9290b8)
- **🐛 aws: scope the Terraform filters to the resource each check reads (#3520)** (52bc33e)
- **🐛 github: fail the README content checks when there is no README (#3517)** (19c3cf4)
- **🐛 stackit: treat a rule with no port range as covering every port (#3516)** (13934e8)
- **🐛 okta: scope the Terraform filters to the resource each check reads (#3518)** (5704a0a)
- **🐛 aws: stop counting an unreadable IAM policy as MFA enforcement (#3510)** (34eaf8f)
- **🐛 bigip: assert peer-cert-mode so backend verification can actually fail (#3508)** (99acb1b)
- **🧹 oci: read the cipher suite through the typed field (#3509)** (3baaff2)
- **🐛 github: stop code-scanning and release-branch checks passing on nothing (#3507)** (4074d3d)
- **🐛 github: scan the whole file tree for binary artifacts (#3505)** (bafab89)
- **🐛 azure: accept TLS 1.3 where Azure allows it (#3506)** (2b431fb)
- **🐛 linux: pass ssh-protocol-is-set-to-2 when the directive is absent (#3504)** (77a1361)
- **🧹 validation: refresh the checked-in OpenAPI specs (#3499)** (08e84c5)
- **🧹 validation: regenerate the vercel CLI command grammar (#3500)** (bd6baaa)
- **👷 ci: shard every IaC suite and stop content/ changes triggering all of it (#3503)** (d326ea6)
- **🧹 validation: pretty-print the checked-in API specs so their diffs are reviewable (#3498)** (54b2535)
- **✨ validation: validate pvesh remediation commands against the Proxmox API schema (#3494)** (0c56d95)
- **✨ validation: validate stackit CLI remediation commands (#3493)** (b367d34)
- **✨ validation: validate openstack CLI remediation commands (#3492)** (6a62979)
- **📝 validation: powershell.py has no allowlist, stop telling authors it does (#3491)** (eda427a)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/mondoohq/cnspec?utm_source=github-action)._