diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 7232bda9..282f0ee9 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "1.0.8"
+  ".": "1.0.9"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index b09b4c6b..c5fc8094 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.0.9](https://github.com/InditexTech/kumoss/compare/v1.0.8...v1.0.9) (2026-10-15)
+
+
+### Bug Fixes
+
+* **iac:** resolve CodeQL incomplete URL substring sanitization in GCP discovery ([8b262ab](https://github.com/InditexTech/kumoss/commit/8b262ab30f4065d538b31c46925e4ece72638c85))
+
 ## [1.0.8](https://github.com/InditexTech/kumoss/compare/v1.0.7...v1.0.8) (2026-10-15)
 
 
diff --git a/client/web/package-lock.json b/client/web/package-lock.json
index 851f7323..19036e3a 100644
--- a/client/web/package-lock.json
+++ b/client/web/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "public_portal",
-  "version": "1.0.8",
+  "version": "1.0.9",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "public_portal",
-      "version": "1.0.8",
+      "version": "1.0.9",
       "dependencies": {
         "@babel/runtime": "8.0.5",
         "@emotion/react": "^11.14.0",
diff --git a/client/web/package.json b/client/web/package.json
index ae06ae7b..c6991973 100644
--- a/client/web/package.json
+++ b/client/web/package.json
@@ -1,7 +1,7 @@
 {
   "name": "public_portal",
   "private": true,
-  "version": "1.0.8",
+  "version": "1.0.9",
   "type": "module",
   "scripts": {
     "dev": "vite",
diff --git a/contracts/conformance/authz/pyproject.toml b/contracts/conformance/authz/pyproject.toml
index 2467a7e7..a7586bbc 100644
--- a/contracts/conformance/authz/pyproject.toml
+++ b/contracts/conformance/authz/pyproject.toml
@@ -4,7 +4,7 @@
 
 [project]
 name = "kumoss-authz-conformance"
-version = "1.0.8"
+version = "1.0.9"
 description = "Schemathesis-driven conformance suite for contracts/openapi/authz.v1.yaml."
 requires-python = ">=3.13"
 dependencies = [
diff --git a/contracts/conformance/authz/uv.lock b/contracts/conformance/authz/uv.lock
index efe6fbe7..57647dcf 100644
--- a/contracts/conformance/authz/uv.lock
+++ b/contracts/conformance/authz/uv.lock
@@ -198,7 +198,7 @@ wheels = [
 
 [[package]]
 name = "kumoss-authz-conformance"
-version = "1.0.8"
+version = "1.0.9"
 source = { virtual = "." }
 dependencies = [
     { name = "pytest" },
diff --git a/contracts/conformance/iac/pyproject.toml b/contracts/conformance/iac/pyproject.toml
index 9f2ba077..c09cd804 100644
--- a/contracts/conformance/iac/pyproject.toml
+++ b/contracts/conformance/iac/pyproject.toml
@@ -4,7 +4,7 @@
 
 [project]
 name = "kumoss-iac-conformance"
-version = "1.0.8"
+version = "1.0.9"
 description = "Schemathesis-driven conformance suite for contracts/openapi/iac.v1.yaml."
 requires-python = ">=3.13"
 dependencies = [
diff --git a/contracts/conformance/mapping/pyproject.toml b/contracts/conformance/mapping/pyproject.toml
index 9dd78a63..23d68e40 100644
--- a/contracts/conformance/mapping/pyproject.toml
+++ b/contracts/conformance/mapping/pyproject.toml
@@ -4,7 +4,7 @@
 
 [project]
 name = "kumoss-mapping-conformance"
-version = "1.0.8"
+version = "1.0.9"
 description = "Schemathesis-driven conformance suite for contracts/openapi/mapping.v1.yaml."
 requires-python = ">=3.13"
 dependencies = [
diff --git a/contracts/conformance/notifications/pyproject.toml b/contracts/conformance/notifications/pyproject.toml
index 0a949ece..c54b749d 100644
--- a/contracts/conformance/notifications/pyproject.toml
+++ b/contracts/conformance/notifications/pyproject.toml
@@ -4,7 +4,7 @@
 
 [project]
 name = "kumoss-notifications-conformance"
-version = "1.0.8"
+version = "1.0.9"
 description = "Schemathesis-driven conformance suite for contracts/openapi/notifications.v1.yaml."
 requires-python = ">=3.13"
 dependencies = [
diff --git a/core/pyproject.toml b/core/pyproject.toml
index 67055dfd..6090cb02 100644
--- a/core/pyproject.toml
+++ b/core/pyproject.toml
@@ -4,7 +4,7 @@
 
 [project]
 name = "Kumoss"
-version = "1.0.8"
+version = "1.0.9"
 description = "FastAPI-based API with Terraform support"
 requires-python = ">=3.13"
 dependencies = [
diff --git a/core/src/main.py b/core/src/main.py
index 2f58875d..6007177d 100644
--- a/core/src/main.py
+++ b/core/src/main.py
@@ -125,7 +125,7 @@ async def lifespan(app: FastAPI):
     title="Kumoss",
     summary="Browser-facing orchestration API of the Kumoss core engine.",
     description="Generate compliant Infrastructure as Code with a couple of clicks",
-    version=os.getenv("APP_VERSION", "1.0.8"),  # x-release-please-version
+    version=os.getenv("APP_VERSION", "1.0.9"),  # x-release-please-version
     contact={
         "name": "Kumoss maintainers",
         "url": "https://github.com/InditexTech/kumoss",
diff --git a/core/uv.lock b/core/uv.lock
index 38eeccac..ed305a19 100644
--- a/core/uv.lock
+++ b/core/uv.lock
@@ -1656,7 +1656,7 @@ wheels = [
 
 [[package]]
 name = "kumoss"
-version = "1.0.8"
+version = "1.0.9"
 source = { virtual = "." }
 dependencies = [
     { name = "arize-phoenix-client" },
diff --git a/docker-compose.yml b/docker-compose.yml
index 660bfbfa..d8ef5de4 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -14,7 +14,7 @@ name: kumoss
 
 services:
   proxy:
-    image: ghcr.io/inditextech/kumoss-proxy:1.0.8 # x-release-please-version
+    image: ghcr.io/inditextech/kumoss-proxy:1.0.9 # x-release-please-version
     restart: on-failure
     build:
       context: .
@@ -34,7 +34,7 @@ services:
       - bridge-network
 
   core:
-    image: ghcr.io/inditextech/kumoss-core:1.0.8 # x-release-please-version
+    image: ghcr.io/inditextech/kumoss-core:1.0.9 # x-release-please-version
     build:
       context: .
       dockerfile: ./core/Dockerfile
@@ -69,7 +69,7 @@ services:
       - bridge-network
 
   notifications:
-    image: ghcr.io/inditextech/kumoss-notifications:1.0.8 # x-release-please-version
+    image: ghcr.io/inditextech/kumoss-notifications:1.0.9 # x-release-please-version
     build:
       context: .
       dockerfile: ./services/notifications/Dockerfile
@@ -82,7 +82,7 @@ services:
       - bridge-network
 
   iac:
-    image: ghcr.io/inditextech/kumoss-iac:1.0.8 # x-release-please-version
+    image: ghcr.io/inditextech/kumoss-iac:1.0.9 # x-release-please-version
     build:
       context: .
       dockerfile: ./services/iac/Dockerfile
diff --git a/services/iac/pyproject.toml b/services/iac/pyproject.toml
index b2df178d..515e3c4e 100644
--- a/services/iac/pyproject.toml
+++ b/services/iac/pyproject.toml
@@ -4,7 +4,7 @@
 
 [project]
 name = "kumoss-iac"
-version = "1.0.8"
+version = "1.0.9"
 description = "Reference implementation of contracts/openapi/iac.v1.yaml — local IaC engine CLI (OpenTofu by default)."
 requires-python = ">=3.13"
 dependencies = [
diff --git a/services/iac/uv.lock b/services/iac/uv.lock
index 1d523aff..b9f29017 100644
--- a/services/iac/uv.lock
+++ b/services/iac/uv.lock
@@ -721,7 +721,7 @@ wheels = [
 
 [[package]]
 name = "kumoss-iac"
-version = "1.0.8"
+version = "1.0.9"
 source = { virtual = "." }
 dependencies = [
     { name = "azure-identity" },
diff --git a/services/notifications/pyproject.toml b/services/notifications/pyproject.toml
index 3e68e4c7..91d9ce08 100644
--- a/services/notifications/pyproject.toml
+++ b/services/notifications/pyproject.toml
@@ -4,7 +4,7 @@
 
 [project]
 name = "kumoss-notifications"
-version = "1.0.8"
+version = "1.0.9"
 description = "Reference implementation of contracts/openapi/notifications.v1.yaml — Slack-backed notification dispatch."
 requires-python = ">=3.13"
 dependencies = [
diff --git a/services/notifications/uv.lock b/services/notifications/uv.lock
index 022a6248..d4a84620 100644
--- a/services/notifications/uv.lock
+++ b/services/notifications/uv.lock
@@ -387,7 +387,7 @@ wheels = [
 
 [[package]]
 name = "kumoss-notifications"
-version = "1.0.8"
+version = "1.0.9"
 source = { virtual = "." }
 dependencies = [
     { name = "fastapi", extra = ["standard"] },