## mondoohq/cnspec — v14.1.0…v14.2.0

_52 commits._

### Features
- **✨ content: add Jamf and Weaviate security policies (#3339)** (6f4908e)

### Fixes
- **🐛 azure: fix remediation steps that would not close their checks (#3665)** (a805f2c)

### Backend
- **🧹 Bump mql to v14.2.0 (#4171)** (aa891a8)
- **🐛 linux: compare the OpenSSH version without bc in the KEX script (#4170)** (ee1a04c)
- **🐛 linux: keep /etc/passwd- and /etc/group- at 0600 after account changes (#4148)** (b403448)
- **🐛 linux: choose the network audit watch path by distribution family (#4166)** (f7dedfa)
- **🐛 linux: strip the dpkg epoch before comparing the OpenSSH version (#4143)** (cf650fb)
- **🐛 linux: install aide-common with aide, with Postfix kept local-only (#4145)** (bad9a91)
- **🐛 linux: restore apt log modes after every package operation (#4147)** (ff6eb76)
- **🐛 linux: create journald.conf where the distribution does not install it (#4150)** (42a00f1)
- **🐛 linux: copy the vendor su PAM file before restricting su on openSUSE (#4161)** (100671d)
- **🐛 linux: handle a missing /etc/security limits configuration in the core dump remediation (#4152)** (c70465d)
- **🐛 linux: restart rsyslog only on change in the Ansible remediation on Debian 12 (#4156)** (2651bed)
- **🐛 linux: skip loading audit rules on an immutable host in the Ansible remediation on Ubuntu 22.04 (#4167)** (de88734)
- **🐛 linux: end the sudoers drop-in with a newline in the Ansible remediation (#4154)** (5ef862a)
- **🐛 linux: use the real collection names for sysctl and zypper in the Ansible remediation (#4157)** (0466770)
- **🐛 linux: fail on a task,never audit rule and skip b32 rules where auditctl lacks them (#4158)** (90cd7c4)
- **🧹 validation: bump 3 pinned CLI releases (#4138)** (246235e)
- **🧹 validation: bump tflint-ruleset-google to 0.40.0 (#4141)** (dea077e)
- **🧹 validation: bump terraform-provider-portainer to ~> 2.0 (#4139)** (6e30218)
- **🧹 validation: bump 2 linter pins (#4140)** (226c6e3)
- **🧹 validation: refresh the checked-in OpenAPI specs (#4135)** (e188054)
- **🧹 validation: bump 2 pinned OpenAPI specs (#4137)** (c6ca83b)
- **🧹 validation: regenerate the vercel CLI command grammar (#4136)** (a4bae81)
- **🐛 openstack: fail a trove instance whose fixed ip sits on an external network (#3968)** (4bd40af)
- **✨ linux: read auditd rules through watches, immutable, and typed config (#4086)** (854d78a)
- **✨ ai: govern Claude desktop MCP servers and detect Aider (#4103)** (a8b2048)
- **🐛 content: lifecycle checks allowlist supported versions with their end-of-life dates (#4126)** (5aac1c9)
- **🧹 content: retire orphaned -terraform-hcl fixtures, land the two UniFi variants they waited for (#4125)** (828215d)
- **🧹 digitalocean: spaces-key-has-scoped-grants reads the typed bucketGrants field (#4124)** (ce1e80d)
- **🐛 release archives: store the binary as root:root (#4111)** (059a1fc)
- **🐛 linux: make the remediation close its check on Ubuntu 24.04 and arm64 (#4113)** (d12e988)
- **⭐ structured error reporting (#4093)** (7fb3850)
- **🐛 linux: read the effective systemd-coredump config in the core dump check (#4107)** (da30916)
- **🧹 windows: read CrashOnAuditFail and RelaxMinimumPasswordLengthLimits through windows.lsa (#4094)** (a15089f)
- **✨ linux: check the effective rsyslog file creation mode of every file action (#4108)** (1222a05)
- **✨ linux: read SNMP write users from snmpd.config.users (#4106)** (4c64c73)
- **✨ linux: classify system accounts with user.system and user.hasLoginShell (#4105)** (b36fad3)
- **✨ windows: read free disk space from mount.point (#4097)** (8f7c020)
- **✨ windows: read disk capacity from windows.disks (#4099)** (0cd25f1)
- **✨ querypacks: report windows package install scope and owning user (#4096)** (590be80)
- **✨ linux: check disk encryption through the block device stack (#4101)** (e867b87)
- **✨ linux: read the effective journald Storage, Compress, and ForwardToSyslog (#4100)** (943cf50)
- **✨ content: read memory size and usage from the memory resource (#4102)** (fa3855a)
- **✨ windows: read LocalAccountTokenFilterPolicy through windows.uac (#4098)** (d73ff3b)
- **✨ content: inventory mdm vendor and enrollment on macos and windows (#4095)** (3b2e669)
- **🧹 content: read Windows logged-in users, scheduled tasks, and CPU from typed resources (#4090)** (df5a611)
- **🧹 windows: read LSA, NTLM, and SMB settings through the typed os resources (#4091)** (5b15537)

### Chore
- **build(deps): bump crate-ci/typos from 1.50.1 to 1.50.2 (#4130)** (a14f940)
- **build(deps): bump the codeql-action group with 3 updates (#4128)** (569105b)
- **build(deps): bump benchmark-action/github-action-benchmark (#4129)** (957c53f)
- **build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 (#4127)** (9a88330)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/mondoohq/cnspec?utm_source=github-action)._