RATATOSKRATATOSK
Sign in

Kubescape

v4.0.19Security
Nov 5, 2026

ACTION 1CHECK 2OTHER 13

A maintenance release with dependency updates and correctness fixes. It also enforces workspace and scan-input constraints that may require operator changes.

Action needed (1)

  • breakingDownload argument validation

    The download command now rejects extraneous positional arguments, with enhanced test coverage.

Check if affected (2)

  • breakingWorkspace boundary containment for local IaC scans

    Applies if you use local IaC scans.

    The mcpserver now enforces workspace boundary containment for local IaC scans.

  • breaking--file-path conflict validation

    Applies if you use positional paths with framework and control scans.

    Framework and control scans now reject conflicting use of the --file-path flag and positional paths.

All 13 other recorded changesvalue changes 7 · fixes 6

value changes (7)

  • * 9498fcc4defcece549144142a03174c0065f7718 ci: bump github.com/kubescape/regolibrary/v2 from 2.0.38 to 2.0.39 (#4565)
  • * cf02f6684c948cb3532a10eb0b55de803ba4d52a ci: bump github.com/schollz/progressbar/v3 from 3.13.0 to 3.19.1 (#4567)
  • * 72be2dde4dffe2a84d5b224e5159084b1e6c2317 ci: bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp (#4568)
  • * 6df7a85df472dbb460b847db2d9cf3a28cee3b5b ci: bump k8s.io/pod-security-admission (#4564)
  • * f6f44ff606f5e5b1a248cf2f94d496ff1197039f ci: bump mikepenz/action-junit-report from 6.6.1 to 6.6.2 (#4569)
  • * 98263cf6306253028b878cd81ae008b2ef875382 ci: bump sigs.k8s.io/controller-runtime from 0.24.0 to 0.25.2 (#4566)
  • * 293374cec967a958c1000aeb9f36d59084625cea ci: bump sigs.k8s.io/kustomize/kyaml from 0.21.2 to 0.21.3 (#4363)

fixes (6)

  • * a38180e474e3748d727845119ff91fd7229f8452 fix(fix): honor command output writer in cluster fixes and add nil-safety check (#4570)
  • * 14fa2c5e1169be41d5c5e62d6f6dd22f91ac0c9f fix(mcpserver): collect complete vulnerability payloads for exposure analysis (#4579)
  • * a4af090ce1389554cb077eb84dd93674a4292da2 fix(opaprocessor): harden incremental cache correctness (#4580)
  • * 63f942fc4816e3ff11c81c93998ce8b194187dc8 fix(rbac): require an authorized username for group impersonation (#4578)
  • * fed07219f7e70412791c93024ef05c2d4696fbe0 fix: clean up exceptions temp files on rejected REST scans (#4574)
  • * 97c9506d13e342ea84dcd03f4d2337fd98e4cdfd fix: prevent resource loss across multiple scan input roots (#4575)
Add Kubescape to your stack

A weekly email arrives when a release needs action. Like the breaking changes in this release.

Add to stack →
Official release note ↗All Kubescape releases →