chore(release): 3.5.4 -> 3.5.5 (#376)

* bump: version 3.5.4 → 3.5.5

* chore(release): 3.5.4 -> 3.5.5

Triggered-by: @rafaelpereyra via workflow_dispatch

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Author: github-actions[bot]

CHANGELOG.md

@@ -44,6 +44,14 @@
 - [1.0.1-e-10Jan2023](#101-e-10jan2023)
 
 
+## v3.5.5 (2026-06-30)
+
+### Fix
+
+- **windows**: document Git prerequisite, persist alias, shorten long paths (#375)
+- install CDK dependencies in container mode (#373) (#374)
+- update vulnerable dependencies and switch to slim base image (#368)
+
 ## v3.5.4 (2026-06-12)
 
 ### Fix

README.md

@@ -79,9 +79,9 @@ ASH v3 integrates multiple open-source security tools as scanners. Tools like Ba
 
 | Mode      | Requirements                                                                                                                                                         | Notes                                                    |
 |-----------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------|
-| Local     | Python 3.10+, UV package manager, [Git](https://git-scm.com/downloads)                                                                                              | Some scanners require additional tools (see table above) |
+| Local     | Python 3.10+, UV package manager                                                                                                                                     | Some scanners require additional tools (see table above) |
 | Container | Any OCI-compatible container runtime ([Finch](https://github.com/runfinch/finch), [Docker](https://docs.docker.com/get-docker/), [Podman](https://podman.io/), etc.) | On Windows: WSL2 is typically required                   |
-| Precommit | Python 3.10+, UV package manager, [Git](https://git-scm.com/downloads)                                                                                              | Subset of scanners, optimized for speed                  |
+| Precommit | Python 3.10+, UV package manager                                                                                                                                     | Subset of scanners, optimized for speed                  |
 
 ## Installation Options
 
@@ -92,25 +92,18 @@ ASH v3 integrates multiple open-source security tools as scanners. Tools like Ba
 curl -sSfL https://astral.sh/uv/install.sh | sh
 
 # Create an alias for ASH
-alias ash="uvx git+https://github.com/awslabs/automated-security-helper.git@v3.5.4"
+alias ash="uvx git+https://github.com/awslabs/automated-security-helper.git@v3.5.5"
 ```
 
 ```powershell
-# Install Git for Windows if not already installed
-winget install --id Git.Git -e --source winget
-
 # Install uv on Windows with PowerShell if it isn't installed already
 irm https://astral.sh/uv/install.ps1 | iex
 
-# Create a function for ASH (current session)
-function ash { uvx git+https://github.com/awslabs/automated-security-helper.git@v3.5.4 $args }
-
-# Persist the function for new terminals by adding it to your PowerShell profile
-if (!(Test-Path -Path $PROFILE)) { New-Item -ItemType File -Path $PROFILE -Force }
-Add-Content -Path $PROFILE -Value "`nfunction ash { uvx git+https://github.com/awslabs/automated-security-helper.git@v3.5.4 `$args }"
+# Create a function for ASH
+function ash { uvx git+https://github.com/awslabs/automated-security-helper.git@v3.5.5 $args }
 ```
 
-> **Floating tag `v3`**: We also maintain a `v3` floating tag that always points to the latest stable v3.x release. You can use `@v3` instead of `@v3.5.4` to stay up to date automatically. Pin a specific version (e.g., `@v3.5.4`) when you need reproducible builds.
+> **Floating tag `v3`**: We also maintain a `v3` floating tag that always points to the latest stable v3.x release. You can use `@v3` instead of `@v3.5.5` to stay up to date automatically. Pin a specific version (e.g., `@v3.5.5`) when you need reproducible builds.
 
 ### Other Installation Methods
 
@@ -137,13 +130,13 @@ ash --help
 #### Using `pip`
 
 ```bash
-pip install git+https://github.com/awslabs/automated-security-helper.git@v3.5.4
+pip install git+https://github.com/awslabs/automated-security-helper.git@v3.5.5
 ```
 
 #### Clone the Repository
 
 ```bash
-git clone https://github.com/awslabs/automated-security-helper.git --branch v3.5.4
+git clone https://github.com/awslabs/automated-security-helper.git --branch v3.5.5
 cd automated-security-helper
 pip install .
 ```
@@ -232,7 +225,7 @@ The ASH MCP server provides:
     "ash": {
       "command": "uvx",
       "args": [
-        "--from=git+https://github.com/awslabs/automated-security-helper@v3.5.4",
+        "--from=git+https://github.com/awslabs/automated-security-helper@v3.5.5",
         "ash",
         "mcp"
       ],
@@ -250,7 +243,7 @@ The ASH MCP server provides:
     "ash-security": {
       "command": "uvx",
       "args": [
-        "--from=git+https://github.com/awslabs/automated-security-helper@v3.5.4",
+        "--from=git+https://github.com/awslabs/automated-security-helper@v3.5.5",
         "ash",
         "mcp"
       ]
@@ -266,7 +259,7 @@ The ASH MCP server provides:
     "ash": {
       "command": "uvx",
       "args": [
-        "--from=git+https://github.com/awslabs/automated-security-helper@v3.5.4",
+        "--from=git+https://github.com/awslabs/automated-security-helper@v3.5.5",
         "ash",
         "mcp"
       ],
@@ -366,7 +359,7 @@ Add this to your `.pre-commit-config.yaml`:
 ```yaml
 repos:
   - repo: https://github.com/awslabs/automated-security-helper
-    rev: v3.5.4
+    rev: v3.5.5
     hooks:
       - id: ash-simple-scan
 ```
@@ -399,24 +392,6 @@ The `ash_aggregated_results.json` file includes comprehensive validation informa
 <summary>How do I run ASH on Windows?</summary>
 
 ASH v3 can run directly on Windows in local mode with Python 3.10+. Simply install ASH using pip, pipx, or uvx and run with `--mode local`. For container mode, you'll need WSL2 and a container runtime like Docker Desktop, Rancher Desktop, or Podman Desktop.
-
-**Prerequisites for Windows:**
-- [Git for Windows](https://git-scm.com/downloads/win) — required for `uvx` and `pip` git-based installs
-- Python 3.10+ and UV (`irm https://astral.sh/uv/install.ps1 | iex`)
-
-**Long path errors:** If you see `path too long` or `filename too long` errors during installation, enable Windows long path support:
-
-```powershell
-# Run PowerShell as Administrator
-New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\FileSystem" -Name "LongPathsEnabled" -Value 1 -PropertyType DWORD -Force
-```
-
-Then configure Git to use long paths:
-```powershell
-git config --system core.longpaths true
-```
-
-Restart your terminal after making these changes.
 </details>
 
 <details>

automated_security_helper/schemas/AshAggregatedResults.json

@@ -21438,7 +21438,7 @@
                 "supportedTaxonomies": [],
                 "taxa": [],
                 "translationMetadata": null,
-                "version": "3.5.4"
+                "version": "3.5.5"
               },
               "extensions": [],
               "properties": null

docs/content/docs/advanced-usage.md

@@ -255,7 +255,7 @@ print(f"Found {results.summary_stats.total_findings} findings")
 
 ## CI/CD Integration
 
-> **Tip**: The examples below use pinned versions (`@v3.5.4`) for reproducibility. You can also use the `v3` floating tag (`@v3`) to always get the latest stable v3.x release, though pinned versions are recommended for CI/CD.
+> **Tip**: The examples below use pinned versions (`@v3.5.5`) for reproducibility. You can also use the `v3` floating tag (`@v3`) to always get the latest stable v3.x release, though pinned versions are recommended for CI/CD.
 
 ### GitHub Actions
 
@@ -278,7 +278,7 @@ jobs:
         with:
           python-version: '3.10'
       - name: Install ASH
-        run: pip install git+https://github.com/awslabs/automated-security-helper.git@v3.5.4
+        run: pip install git+https://github.com/awslabs/automated-security-helper.git@v3.5.5
       - name: Run ASH scan
         run: ash --mode local
       - name: Upload scan results
@@ -294,7 +294,7 @@ jobs:
 ash-scan:
   image: python:3.10
   script:
-    - pip install git+https://github.com/awslabs/automated-security-helper.git@v3.5.4
+    - pip install git+https://github.com/awslabs/automated-security-helper.git@v3.5.5
     - ash --mode local
   artifacts:
     paths:

docs/content/docs/installation-guide.md

@@ -33,7 +33,7 @@ ASH v3 uses UV's tool isolation system to automatically manage most scanner depe
 curl -sSf https://astral.sh/uv/install.sh | sh
 
 # Create an alias for ASH
-alias ash="uvx git+https://github.com/awslabs/automated-security-helper.git@v3.5.4"
+alias ash="uvx git+https://github.com/awslabs/automated-security-helper.git@v3.5.5"
 
 # Use as normal
 ash --help
@@ -45,22 +45,22 @@ ash --help
 irm https://astral.sh/uv/install.ps1 | iex
 
 # Create a function for ASH
-function ash { uvx git+https://github.com/awslabs/automated-security-helper.git@v3.5.4 $args }
+function ash { uvx git+https://github.com/awslabs/automated-security-helper.git@v3.5.5 $args }
 
 # Use as normal
 ash --help
 ```
 
 !!! tip "Floating tag `v3`"
-    We also maintain a `v3` floating tag that always points to the latest stable v3.x release. You can use `@v3` instead of a specific version to stay up to date automatically. Pin a specific version (e.g., `@v3.5.4`) when you need reproducible builds, such as in CI/CD pipelines.
+    We also maintain a `v3` floating tag that always points to the latest stable v3.x release. You can use `@v3` instead of a specific version to stay up to date automatically. Pin a specific version (e.g., `@v3.5.5`) when you need reproducible builds, such as in CI/CD pipelines.
 
 #### 2. Using `pipx`
 
 [`pipx`](https://pypa.github.io/pipx/) installs packages in isolated environments and makes their entry points available globally.
 
 ```bash
 # Works on Windows, macOS, and Linux
-pipx install git+https://github.com/awslabs/automated-security-helper.git@v3.5.4
+pipx install git+https://github.com/awslabs/automated-security-helper.git@v3.5.5
 
 # Use as normal
 ash --help
@@ -72,7 +72,7 @@ Standard Python package installation:
 
 ```bash
 # Works on Windows, macOS, and Linux
-pip install git+https://github.com/awslabs/automated-security-helper.git@v3.5.4
+pip install git+https://github.com/awslabs/automated-security-helper.git@v3.5.5
 
 # Use as normal
 ash --help
@@ -84,7 +84,7 @@ For development or if you want to modify ASH:
 
 ```bash
 # Works on Windows, macOS, and Linux
-git clone https://github.com/awslabs/automated-security-helper.git --branch v3.5.4
+git clone https://github.com/awslabs/automated-security-helper.git --branch v3.5.5
 cd automated-security-helper
 pip install .
 
@@ -134,7 +134,7 @@ To upgrade ASH to the latest version:
 ### If installed with `uvx`
 ```bash
 # Your alias will use the latest version when specified
-alias ash="uvx git+https://github.com/awslabs/automated-security-helper.git@v3.5.4"
+alias ash="uvx git+https://github.com/awslabs/automated-security-helper.git@v3.5.5"
 ```
 
 ### If installed with `pipx`
@@ -144,7 +144,7 @@ pipx upgrade automated-security-helper
 
 ### If installed with `pip`
 ```bash
-pip install --upgrade git+https://github.com/awslabs/automated-security-helper.git@v3.5.4
+pip install --upgrade git+https://github.com/awslabs/automated-security-helper.git@v3.5.5
 ```
 
 ### If installed from repository

docs/content/docs/migration-guide.md

@@ -48,13 +48,13 @@ export PATH="${PATH}:/path/to/automated-security-helper"
 
 ```bash
 # Option 1: Using uvx (recommended) -- add to shell profile
-alias ash="uvx git+https://github.com/awslabs/automated-security-helper.git@v3.5.4"
+alias ash="uvx git+https://github.com/awslabs/automated-security-helper.git@v3.5.5"
 
 # Option 2: Using pipx
-pipx install git+https://github.com/awslabs/automated-security-helper.git@v3.5.4
+pipx install git+https://github.com/awslabs/automated-security-helper.git@v3.5.5
 
 # Option 3: Using pip
-pip install git+https://github.com/awslabs/automated-security-helper.git@v3.5.4
+pip install git+https://github.com/awslabs/automated-security-helper.git@v3.5.5
 ```
 
 > **Tip**: You can also use the `v3` floating tag (`@v3`) instead of a specific version to always get the latest stable v3.x release. Pin a specific version for CI/CD or reproducible environments.
@@ -236,7 +236,7 @@ reporters:
 ```yaml
 repos:
   - repo: https://github.com/awslabs/automated-security-helper
-    rev: v3.5.4
+    rev: v3.5.5
     hooks:
       - id: ash
 ```
@@ -248,7 +248,7 @@ repos:
 ```yaml
 repos:
   - repo: https://github.com/awslabs/automated-security-helper
-    rev: v3.5.4
+    rev: v3.5.5
     hooks:
       - id: ash-simple-scan
 ```

docs/content/docs/quick-start-guide.md

@@ -25,7 +25,7 @@ Prerequisites: Python 3.10+, [uv](https://docs.astral.sh/uv/getting-started/inst
 curl -sSf https://astral.sh/uv/install.sh | sh
 
 # Create an alias for ASH
-alias ash="uvx git+https://github.com/awslabs/automated-security-helper.git@v3.5.4"
+alias ash="uvx git+https://github.com/awslabs/automated-security-helper.git@v3.5.5"
 ```
 
 #### Windows PowerShell
@@ -34,25 +34,25 @@ alias ash="uvx git+https://github.com/awslabs/automated-security-helper.git@v3.5
 irm https://astral.sh/uv/install.ps1 | iex
 
 # Create a function for ASH
-function ash { uvx git+https://github.com/awslabs/automated-security-helper.git@v3.5.4 $args }
+function ash { uvx git+https://github.com/awslabs/automated-security-helper.git@v3.5.5 $args }
 ```
 
-> **Floating tag `v3`**: We also maintain a `v3` floating tag that always points to the latest stable v3.x release. You can use `@v3` instead of a specific version to stay up to date automatically. Pin a specific version (e.g., `@v3.5.4`) when you need reproducible builds.
+> **Floating tag `v3`**: We also maintain a `v3` floating tag that always points to the latest stable v3.x release. You can use `@v3` instead of a specific version to stay up to date automatically. Pin a specific version (e.g., `@v3.5.5`) when you need reproducible builds.
 
 ### Option 2: Using pipx
 
 Prerequisites: Python 3.10+, [pipx](https://pipx.pypa.io/stable/installation/)
 
 ```bash
-pipx install git+https://github.com/awslabs/automated-security-helper.git@v3.5.4
+pipx install git+https://github.com/awslabs/automated-security-helper.git@v3.5.5
 ```
 
 ### Option 3: Using pip
 
 Prerequisites: Python 3.10+
 
 ```bash
-pip install git+https://github.com/awslabs/automated-security-helper.git@v3.5.4
+pip install git+https://github.com/awslabs/automated-security-helper.git@v3.5.5
 ```
 
 ## Basic Usage
@@ -189,7 +189,7 @@ Add this to your `.pre-commit-config.yaml`:
 ```yaml
 repos:
   - repo: https://github.com/awslabs/automated-security-helper
-    rev: v3.5.4
+    rev: v3.5.5
     hooks:
       - id: ash-simple-scan
 ```