atlan-application-sdk 2.3.1__tar.gz → 2.3.2__tar.gz

atlan_application_sdk-2.3.2/.cursor/rules/build-security.mdc

@@ -0,0 +1,35 @@
+# Build & Security Scanning
+
+This rule is triggered when working with Docker images, security scanning (Trivy/Grype/Snyk), Dapr configuration, or CI/CD pipelines.
+
+> **IMPORTANT**: Always run security scans after Dockerfile changes or dependency updates. CI will block HIGH/CRITICAL vulnerabilities.
+
+## Quick Reference
+
+- **Image base**: `cgr.dev/chainguard-private/python` → golden images → SDK → apps
+- **Dapr runtime**: Installed via Chainguard APK (0 CVEs), configured in Dockerfile
+- **Registries**: Harbor (`registry.atlan.com`) for production, GHCR for CI
+
+## Build & Scan Commands
+
+```bash
+# Build image locally
+docker build -t application-sdk:local .
+
+# Scan image
+trivy image application-sdk:local
+grype application-sdk:local
+
+# Scan dependencies
+trivy fs uv.lock
+snyk test --file=requirements.txt  # requires: uv export --frozen --no-hashes --no-header -o requirements.txt
+```
+
+## For Full Details
+
+Read `docs/build-scan-overview.md` for:
+- Complete image hierarchy and layer details
+- Publishing triggers and tag conventions
+- Dapr Dockerfile configuration
+- CI/CD workflow matrix
+- Snyk/uv.lock workaround

{atlan_application_sdk-2.3.1 → atlan_application_sdk-2.3.2}/.cursor/rules/commits.mdc

@@ -114,6 +114,7 @@ This reverts commit abc123def456.
 - **Reference issues**: Link commits to relevant GitHub issues when applicable
 - **Test before committing**: Ensure all tests pass before creating a commit
 - **Review the diff**: Always review your changes before committing
+- **Scan before pushing**: For Dockerfile or dependency changes, run security scans before pushing (see [build-security.mdc](mdc:.cursor/rules/build-security.mdc))
 
 ## Tools
 

atlan_application_sdk-2.3.2/.github/CODEOWNERS

@@ -0,0 +1 @@
+* @stefan-atlan @cmgrote @OnkarVO7

{atlan_application_sdk-2.3.1 → atlan_application_sdk-2.3.2}/.github/actions/secure-build-push-apps/action.yaml

@@ -310,7 +310,7 @@ runs:
 
     - name: Run Trivy Scan
       id: trivy_scan
-      uses: aquasecurity/trivy-action@0.24.0
+      uses: aquasecurity/trivy-action@0.33.1
       with:
         # UPDATED: Use the single, primary tag from the step above
         image-ref: ${{ steps.extract_tag.outputs.primary_tag }}
@@ -549,4 +549,4 @@ runs:
         else
           echo "❌ Failed to start import job. HTTP Code: $HTTP_CODE"
           exit 1
-        fi
+        fi

{atlan_application_sdk-2.3.1 → atlan_application_sdk-2.3.2}/.github/actions/trivy/action.yaml

@@ -18,7 +18,7 @@ runs:
 
 
     - name: Trivy Vulnerability Scan (SARIF)
-      uses: aquasecurity/trivy-action@0.28.0
+      uses: aquasecurity/trivy-action@0.33.1
       with:
         scan-type: 'fs'
         format: 'sarif'
@@ -31,7 +31,7 @@ runs:
         TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db:1
 
     - name: Trivy Vulnerability Scan (JSON)
-      uses: aquasecurity/trivy-action@0.28.0
+      uses: aquasecurity/trivy-action@0.33.1
       with:
         scan-type: 'fs'
         format: 'json'
@@ -44,7 +44,7 @@ runs:
         TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db:1
 
     - name: Trivy Secret Scan (SARIF)
-      uses: aquasecurity/trivy-action@0.28.0
+      uses: aquasecurity/trivy-action@0.33.1
       with:
         scan-type: 'fs'
         format: 'sarif'
@@ -57,7 +57,7 @@ runs:
         TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db:1
 
     - name: Trivy Secret Scan (JSON)
-      uses: aquasecurity/trivy-action@0.28.0
+      uses: aquasecurity/trivy-action@0.33.1
       with:
         scan-type: 'fs'
         format: 'json'
@@ -119,22 +119,23 @@ runs:
         message-id: trivy-secret
         message-path: trivy-secret-results.md
 
-    - name: Fail on High/Critical Vulnerabilities
+    - name: Fail on High/Critical Vulnerabilities (with fix available)
       if: inputs.add-report-comment-to-pr == 'true'
-      uses: aquasecurity/trivy-action@0.28.0
+      uses: aquasecurity/trivy-action@0.33.1
       with:
         scan-type: 'fs'
         format: 'table'
         severity: 'CRITICAL,HIGH'
         exit-code: '1'
         scanners: 'vuln'
+        ignore-unfixed: true
       env:
         TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2
         TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db:1
 
     - name: Fail on Any Secrets Found
       if: inputs.add-report-comment-to-pr == 'true'
-      uses: aquasecurity/trivy-action@0.28.0
+      uses: aquasecurity/trivy-action@0.33.1
       with:
         scan-type: 'fs'
         format: 'table'

atlan_application_sdk-2.3.2/.github/actions/trivy-container/action.yaml

@@ -0,0 +1,107 @@
+name: Trivy Container Scan for Atlan Apps
+
+description: |
+  Runs Trivy security scanner on container images to detect and report vulnerabilities.
+  Builds the Docker image with Chainguard base image authentication and scans it.
+  Results are uploaded to the GitHub Security tab.
+
+inputs:
+  chainguard-username:
+    description: Chainguard registry username
+    required: true
+  chainguard-password:
+    description: Chainguard registry password
+    required: true
+  github-token:
+    description: GitHub token for Docker build secrets
+    required: true
+  fail-on-vulns:
+    description: Whether to fail if HIGH/CRITICAL vulnerabilities with fixes are found
+    required: false
+    default: 'false'
+  skip-files:
+    description: Comma-separated list of files or directories to be skipped
+    required: false
+
+outputs:
+  results-file:
+    description: Path to the JSON results file
+    value: ${{ steps.scan.outputs.results-file }}
+
+runs:
+  using: "composite"
+  steps:
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+
+    - name: Log in to Chainguard Container Registry
+      uses: docker/login-action@v3
+      with:
+        registry: cgr.dev
+        username: ${{ inputs.chainguard-username }}
+        password: ${{ inputs.chainguard-password }}
+
+    - name: Build Docker image
+      uses: docker/build-push-action@v6
+      with:
+        context: .
+        file: ./Dockerfile
+        push: false
+        load: true
+        tags: trivy-scan-target:latest
+        cache-from: type=gha
+        cache-to: type=gha,mode=max
+        secrets: |
+          "PRIVATE_REPO_ACCESS_TOKEN=${{ inputs.github-token }}"
+
+    - name: Run Trivy scan (JSON)
+      id: scan
+      uses: aquasecurity/trivy-action@0.33.1
+      with:
+        image-ref: 'trivy-scan-target:latest'
+        format: 'json'
+        output: 'trivy-container-results.json'
+        severity: 'CRITICAL,HIGH'
+        scanners: 'vuln'
+      env:
+        TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2
+        TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db:1
+
+    - name: Set results file output
+      shell: bash
+      run: echo "results-file=trivy-container-results.json" >> $GITHUB_OUTPUT
+
+    - name: Run Trivy scan (SARIF)
+      uses: aquasecurity/trivy-action@0.33.1
+      with:
+        image-ref: 'trivy-scan-target:latest'
+        format: 'sarif'
+        output: 'trivy-container-results.sarif'
+        severity: 'CRITICAL,HIGH'
+        scanners: 'vuln'
+        skip-files: ${{ inputs.skip-files }}
+      env:
+        TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2
+        TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db:1
+
+    - name: Upload scan results to GitHub Security tab
+      uses: github/codeql-action/upload-sarif@v3
+      if: always()
+      continue-on-error: true
+      with:
+        sarif_file: 'trivy-container-results.sarif'
+        category: 'trivy-container'
+
+    - name: Fail on HIGH/CRITICAL vulnerabilities (with fix available)
+      if: inputs.fail-on-vulns == 'true'
+      uses: aquasecurity/trivy-action@0.33.1
+      with:
+        image-ref: 'trivy-scan-target:latest'
+        format: 'table'
+        severity: 'CRITICAL,HIGH'
+        exit-code: '1'
+        scanners: 'vuln'
+        ignore-unfixed: true
+      env:
+        TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2
+        TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db:1

atlan_application_sdk-2.3.2/.github/dependabot.yaml

@@ -0,0 +1,19 @@
+version: 2
+updates:
+  - package-ecosystem: pip
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      python-deps:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: weekly

atlan_application_sdk-2.3.2/.github/release_notes.md

@@ -0,0 +1,9 @@
+## v2.3.2 (February 04, 2026)
+
+Full Changelog: https://github.com/atlanhq/application-sdk/compare/v2.3.1...v2.3.2
+
+### Bug Fixes
+
+- update codeowner (#954) (by @OnkarVO7 in [3a29977](https://github.com/atlanhq/application-sdk/commit/3a29977))
+- align daft writer behavior with pandas to prevent data loss (BLDX-305) (#953) (by @fyzanshaik-atlan in [1a73d02](https://github.com/atlanhq/application-sdk/commit/1a73d02))
+- tune dependabot settings to reduce noise (#1008) (by @fyzanshaik-atlan in [50e09ac](https://github.com/atlanhq/application-sdk/commit/50e09ac))

{atlan_application_sdk-2.3.1 → atlan_application_sdk-2.3.2}/.github/workflows/build-image.yaml

@@ -97,4 +97,4 @@ jobs:
           github-token: ${{ secrets.ORG_PAT_GITHUB }}
         env:
           DOCKER_CLIENT_TIMEOUT: 600
-          COMPOSE_HTTP_TIMEOUT: 600
+          COMPOSE_HTTP_TIMEOUT: 600

atlan_application_sdk-2.3.2/.github/workflows/harbor-release.yaml

@@ -0,0 +1,74 @@
+name: Publish Harbor Image (Release)
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  actions: read
+
+jobs:
+  push-to-harbor:
+    runs-on: ubuntu-latest
+    concurrency:
+      group: ${{ github.workflow }}-${{ github.ref }}-harbor
+      cancel-in-progress: ${{ startsWith(github.ref, 'refs/pull/') }}
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4.0.0
+        with:
+          fetch-depth: 0
+
+      - name: Set up Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Get SDK version
+        id: get_version
+        run: echo "version=$(awk -F'"' '/^version = / {print $2}' pyproject.toml)" >> $GITHUB_OUTPUT
+
+      - name: Get short commit SHA
+        id: get_sha
+        run: echo "sha=${GITHUB_SHA::7}" >> $GITHUB_OUTPUT
+
+      - name: Log in to Atlan Harbor Registry
+        uses: docker/login-action@v3
+        with:
+          registry: registry.atlan.com
+          username: ${{ secrets.HARBOR_USERNAME }}
+          password: ${{ secrets.HARBOR_PASSWORD }}
+
+      - name: Log in to Chainguard Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: cgr.dev
+          username: ${{ secrets.CHAINGUARD_USERNAME }}
+          password: ${{ secrets.CHAINGUARD_PASSWORD }}
+
+      - name: Build, scan, and push image to Harbor
+        id: harbor_docker_build
+        uses: ./.github/actions/secure-build-push-apps
+        with:
+          branch: main
+          snyk-token: ${{ secrets.SNYK_TOKEN_BU_APPS }}
+          snyk-ghcr-integration-id: ${{ secrets.SNYK_GHCR_INTEGRATION_ID }}
+          snyk-docker-integration-id: ${{ secrets.SNYK_DOCKER_INTEGRATION_ID }}
+          snyk-integration-id: ${{ secrets.SNYK_INTEGRATION_ID }}
+          snyk-org-id: ${{ secrets.SNYK_ORG_ID }}
+          context: .
+          file: ./Dockerfile
+          push: true
+          platforms: linux/amd64,linux/arm64
+          tags: |
+            registry.atlan.com/public/application-sdk:main-latest
+            registry.atlan.com/public/application-sdk:main-${{ steps.get_version.outputs.version }}
+            registry.atlan.com/public/application-sdk:sha-${{ steps.get_sha.outputs.sha }}
+          build-args: |
+            ACCESS_TOKEN_USR=$GITHUB_ACTOR
+            ACCESS_TOKEN_PWD=${{ secrets.ORG_PAT_GITHUB }}
+          github-token: ${{ secrets.ORG_PAT_GITHUB }}
+        env:
+          DOCKER_CLIENT_TIMEOUT: 600
+          COMPOSE_HTTP_TIMEOUT: 600

{atlan_application_sdk-2.3.1 → atlan_application_sdk-2.3.2}/.github/workflows/pull_request.yaml

@@ -14,6 +14,22 @@ permissions:
   actions: write
 
 jobs:
+  # Detect which files changed
+  changes:
+    name: Detect Changes
+    runs-on: ubuntu-latest
+    outputs:
+      container: ${{ steps.filter.outputs.container }}
+    steps:
+      - uses: actions/checkout@v5
+      - uses: dorny/paths-filter@v3
+        id: filter
+        with:
+          filters: |
+            container:
+              - 'Dockerfile'
+              - 'entrypoint.sh'
+
   # Conventional Commits
   commits:
     name: Conventional Commits
@@ -46,6 +62,20 @@ jobs:
         with:
           add-report-comment-to-pr: "true"
 
+  trivy-container:
+    name: Trivy Container Scan
+    needs: changes
+    if: needs.changes.outputs.container == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: "./.github/actions/trivy-container"
+        with:
+          chainguard-username: ${{ secrets.CHAINGUARD_USERNAME }}
+          chainguard-password: ${{ secrets.CHAINGUARD_PASSWORD }}
+          github-token: ${{ secrets.ORG_PAT_GITHUB }}
+          fail-on-vulns: 'true'
+
   # Testing
   unit:
     name: Unit Tests

atlan_application_sdk-2.3.2/.github/workflows/scheduled-vulnerability-scan.yaml

@@ -0,0 +1,122 @@
+name: Scheduled Vulnerability Scan
+
+on:
+  schedule:
+    # Run every Monday at 9 AM UTC
+    - cron: '0 9 * * 1'
+  workflow_dispatch: # Allow manual trigger
+
+permissions:
+  contents: read
+  issues: write
+  security-events: write
+
+jobs:
+  scan-base-image:
+    name: Scan SDK Base Image
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Run container vulnerability scan
+        id: scan
+        uses: "./.github/actions/trivy-container"
+        with:
+          chainguard-username: ${{ secrets.CHAINGUARD_USERNAME }}
+          chainguard-password: ${{ secrets.CHAINGUARD_PASSWORD }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          fail-on-vulns: 'false'
+
+      - name: Check for daprd vulnerabilities
+        id: check-daprd
+        run: |
+          # Extract vulnerabilities specifically from daprd binary
+          DAPRD_VULNS=$(cat trivy-container-results.json | jq -r '
+            .Results[]
+            | select(.Target | contains("daprd"))
+            | .Vulnerabilities // []
+            | length
+          ' | awk '{s+=$1} END {print s+0}')
+
+          echo "daprd_vulns=$DAPRD_VULNS" >> $GITHUB_OUTPUT
+
+          if [ "$DAPRD_VULNS" -gt 0 ]; then
+            echo "::warning::Found $DAPRD_VULNS vulnerabilities in daprd runtime!"
+            echo "has_daprd_vulns=true" >> $GITHUB_OUTPUT
+          else
+            echo "daprd runtime is clean (0 vulnerabilities)"
+            echo "has_daprd_vulns=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Check for CLI vulnerabilities
+        id: check-cli
+        run: |
+          # Extract vulnerabilities from dapr CLI
+          CLI_VULNS=$(cat trivy-container-results.json | jq -r '
+            .Results[]
+            | select(.Target | contains("usr/local/bin/dapr"))
+            | .Vulnerabilities // []
+            | length
+          ' | awk '{s+=$1} END {print s+0}')
+
+          echo "cli_vulns=$CLI_VULNS" >> $GITHUB_OUTPUT
+          echo "Found $CLI_VULNS HIGH/CRITICAL vulnerabilities in dapr CLI"
+
+      - name: Generate scan summary
+        run: |
+          echo "## Vulnerability Scan Summary" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "| Component | HIGH/CRITICAL Vulns | Status |" >> $GITHUB_STEP_SUMMARY
+          echo "|-----------|---------------------|--------|" >> $GITHUB_STEP_SUMMARY
+          echo "| daprd (runtime) | ${{ steps.check-daprd.outputs.daprd_vulns }} | ${{ steps.check-daprd.outputs.daprd_vulns == '0' && '✅ Clean' || '⚠️ Action Required' }} |" >> $GITHUB_STEP_SUMMARY
+          echo "| dapr CLI | ${{ steps.check-cli.outputs.cli_vulns }} | ℹ️ Upstream issue |" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "**Note:** CLI vulnerabilities are in unused code paths (Helm packages)." >> $GITHUB_STEP_SUMMARY
+
+      - name: Create issue if daprd has vulnerabilities
+        if: steps.check-daprd.outputs.has_daprd_vulns == 'true'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const title = '🚨 Security: Vulnerabilities detected in daprd runtime';
+            const body = `## Vulnerability Alert
+
+            The scheduled vulnerability scan has detected **HIGH/CRITICAL vulnerabilities** in the daprd runtime binary.
+
+            ### Details
+            - **Vulnerabilities found:** ${{ steps.check-daprd.outputs.daprd_vulns }}
+            - **Scan date:** ${new Date().toISOString().split('T')[0]}
+
+            ### Recommended Actions
+            1. Check if Chainguard has a patched version: \`apk search dapr\`
+            2. If available, update Dockerfile to use Chainguard APK
+            3. If not, contact Chainguard via their support channel
+
+            ### References
+            - [Chainguard DAPR packages](https://images.chainguard.dev/directory/image/dapr-daprd/compare)
+            - [DAPR releases](https://github.com/dapr/dapr/releases)
+
+            /cc @atlanhq/builder-experience
+            `;
+
+            // Check if similar issue already exists
+            const issues = await github.rest.issues.listForRepo({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              state: 'open',
+              labels: 'security,daprd-vulnerability'
+            });
+
+            if (issues.data.length === 0) {
+              await github.rest.issues.create({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                title: title,
+                body: body,
+                labels: ['security', 'daprd-vulnerability', 'priority:high']
+              });
+              console.log('Created new security issue');
+            } else {
+              console.log('Security issue already exists, skipping creation');
+            }

{atlan_application_sdk-2.3.1 → atlan_application_sdk-2.3.2}/.github/workflows/trivy-container.yaml

@@ -7,12 +7,21 @@ on:
     secrets:
       ORG_PAT_GITHUB:
         required: true
+      CHAINGUARD_USERNAME:
+        required: true
+      CHAINGUARD_PASSWORD:
+        required: true
 
     inputs:
       skip-files:
         description: "Comma-separated list of files or directories to be skipped"
         required: false
         type: string
+      fail-on-vulns:
+        description: "Whether to fail if HIGH/CRITICAL vulnerabilities with fixes are found"
+        required: false
+        type: string
+        default: 'true'
 
 permissions:
   contents: read
@@ -29,4 +38,8 @@ jobs:
 
       - uses: "atlanhq/application-sdk/.github/actions/trivy-container@main"
         with:
+          chainguard-username: ${{ secrets.CHAINGUARD_USERNAME }}
+          chainguard-password: ${{ secrets.CHAINGUARD_PASSWORD }}
           github-token: ${{ secrets.ORG_PAT_GITHUB }}
+          skip-files: ${{ inputs.skip-files }}
+          fail-on-vulns: ${{ inputs.fail-on-vulns }}

{atlan_application_sdk-2.3.1 → atlan_application_sdk-2.3.2}/.pre-commit-config.yaml

@@ -25,6 +25,14 @@ repos:
       - id: conventional-pre-commit
         stages: [commit-msg]
         args: []
+  - repo: local
+    hooks:
+      - id: sync-requirements-txt
+        name: Sync requirements.txt with uv.lock
+        entry: bash -c 'uv export --all-extras --no-hashes > requirements.txt && git add requirements.txt'
+        language: system
+        files: ^uv\.lock$
+        pass_filenames: false
   - repo: https://github.com/RobertCraigie/pyright-python
     rev: v1.1.393
     hooks:

{atlan_application_sdk-2.3.1 → atlan_application_sdk-2.3.2}/AGENTS.md

@@ -5,11 +5,23 @@ Atlan Application SDK is a Python library for building applications on the Atlan
 Package manager: `uv` (task runner via `poe` in `pyproject.toml`).
 
 Non-standard commands used across the repo:
+
 - `uv sync --all-extras --all-groups` (full dev/test deps)
 - `uv run poe start-deps` (local Dapr + Temporal)
 - `uv run poe generate-apidocs` (MkDocs + API docs)
+- `uv run pre-commit run --files <file>` (run pre-commit on specific file)
+- `uv run pre-commit run --all-files` (run pre-commit on all files)
+
+**IMPORTANT**: Always run pre-commit checks before committing. CI will fail if pre-commit checks fail.
+
+**IMPORTANT**: For Dockerfile or dependency changes, run security scans (`trivy`, `grype`) before pushing. See `docs/build-scan-overview.md`.
+
+**Commit Rules**:
+- Never add Co-Authored-By lines to commits
+- Follow Conventional Commits format from `.cursor/rules/commits.mdc`
 
 Where to look next (progressive disclosure):
+
 - `docs/agents/project-structure.md` — quick map of key directories.
 - `docs/agents/dev-commands.md` — setup and repeatable workflows.
 - `docs/agents/coding-standards.md` — formatting, logging, exceptions, performance.
@@ -18,3 +30,4 @@ Where to look next (progressive disclosure):
 - `docs/agents/docs-updates.md` — which conceptual docs to update with code changes.
 - `docs/agents/review.md` — code review checklist.
 - `docs/agents/deepwiki.md` — DeepWiki MCP setup and when to verify SDK details.
+- `docs/build-scan-overview.md` — image hierarchy, security scanning, Dapr setup.

{atlan_application_sdk-2.3.1 → atlan_application_sdk-2.3.2}/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## v2.3.2 (February 04, 2026)
+
+Full Changelog: https://github.com/atlanhq/application-sdk/compare/v2.3.1...v2.3.2
+
+### Bug Fixes
+
+- update codeowner (#954) (by @OnkarVO7 in [3a29977](https://github.com/atlanhq/application-sdk/commit/3a29977))
+- align daft writer behavior with pandas to prevent data loss (BLDX-305) (#953) (by @fyzanshaik-atlan in [1a73d02](https://github.com/atlanhq/application-sdk/commit/1a73d02))
+- tune dependabot settings to reduce noise (#1008) (by @fyzanshaik-atlan in [50e09ac](https://github.com/atlanhq/application-sdk/commit/50e09ac))
+
+
 ## v2.3.1 (January 28, 2026)
 
 Full Changelog: https://github.com/atlanhq/application-sdk/compare/v2.3.0...v2.3.1

{atlan_application_sdk-2.3.1 → atlan_application_sdk-2.3.2}/CLAUDE.md

@@ -8,6 +8,16 @@ Non-standard commands used across the repo:
 - `uv sync --all-extras --all-groups` (full dev/test deps)
 - `uv run poe start-deps` (local Dapr + Temporal)
 - `uv run poe generate-apidocs` (MkDocs + API docs)
+- `uv run pre-commit run --files <file>` (run pre-commit on specific file)
+- `uv run pre-commit run --all-files` (run pre-commit on all files)
+
+**IMPORTANT**: Always run pre-commit checks before committing. CI will fail if pre-commit checks fail.
+
+**IMPORTANT**: For Dockerfile or dependency changes, run security scans (`trivy`, `grype`) before pushing. See `docs/build-scan-overview.md`.
+
+**Commit Rules**:
+- Never add Co-Authored-By lines to commits
+- Follow Conventional Commits format from `.cursor/rules/commits.mdc`
 
 Where to look next (progressive disclosure):
 - `docs/agents/project-structure.md` — quick map of key directories.
@@ -18,3 +28,4 @@ Where to look next (progressive disclosure):
 - `docs/agents/docs-updates.md` — which conceptual docs to update with code changes.
 - `docs/agents/review.md` — code review checklist.
 - `docs/agents/deepwiki.md` — DeepWiki MCP setup and when to verify SDK details.
+- `docs/build-scan-overview.md` — image hierarchy, security scanning, Dapr setup.