RATATOSKRATATOSK
ログイン

Kubescape

v4.0.13Security
2026年9月2日

ACTION 2CHECK 10PLAN 1OTHER 344

スキャン機能を中心に、ポリシー適用、レポート、修復、通知、テレメトリ、連携、出力に関わる変更を幅広く含むリリースです。セキュリティ対策と実行時の不具合修正に加え、スキャン条件や入力制約も厳格になっています。

要対応 (2)

  • securityGo依存関係のセキュリティ脆弱性を修正

    Go依存関係に含まれるDependabotのセキュリティ脆弱性を修正しました。

  • securitygosec のSAST検出結果を修正

    gosec v2.27.1のSAST検出結果に対応するセキュリティ修正を追加しました。

影響確認 (10)

  • securityGrafeasフィルターインジェクションを防止

    imagescan を実行する場合に該当します。

    resourceURL を介したGrafeasフィルターインジェクションを防ぐようにしました。

  • breakingスキャンリクエストの認証情報指定を停止

    スキャンリクエストを使用する場合に該当します。

    スキャンリクエストでクライアントが指定した account と accessKey を受け付けなくなりました。

  • breaking未知のコントロール指定をエラー化

    --include-controls を設定している場合に該当します。

    --include-controls が既知のコントロールに一致しない場合、エラーとして処理するようにしました。

  • breaking単一リソーススキャンによるSecret読み取りを停止

    単一リソーススキャンを実行する場合に該当します。

    単一リソーススキャンからSecretを読み取れないようにしました。

  • breakingスキャンワークロードでの compliance-threshold 適用

    compliance-threshold を設定している場合に該当します。

    スキャンワークロードで compliance-threshold を適用するようにしました。

  • breaking不明な重大度の検出結果を失敗として処理

    --severity-threshold を設定している場合に該当します。

    --severity-threshold の判定で、重大度が不明な検出結果を安全側で失敗として扱うようにしました。

  • breaking読み込みコントロールゼロをカバレッジ失敗として処理

    スキャンを実行する場合に該当します。

    読み込まれたコントロールがゼロの場合、カバレッジ失敗として扱うようにしました。

  • breakingスキップされたマニフェストをカバレッジに反映

    scan-coverage を実行する場合に該当します。

    スキップされたマニフェストをカバレッジに表示し、ゲート判定を失敗させるようにしました。

  • breakingスキャンフラグの相互排他を適用

    keep-local、omit-raw-resources、または submit を設定している場合に該当します。

    すべてのスキャンコマンドで、keep-local、omit-raw-resources、submit の相互排他を適用するようにしました。

  • breakingファイルスキャンのサイズ上限を適用

    ファイルスキャンの処理を使用する場合に該当します。

    ファイルスキャンの処理で、ファイルごとのサイズ上限を適用するようにしました。

事前準備 (1)

  • deprecated--fail-threshold を非推奨フラグとして再登録

    --fail-threshold を設定している場合に該当します。

    --fail-threshold を非表示の非推奨フラグとして再登録しました。

その他の記録済み変更 344 件すべてfixes 184 · additions 90 · value changes 56 · constraints 14

fixes (184)

  • * 80bddbb4d1ed4f6efb665890ed724f7aaaa5ab53 Fix memory allocation spikes during opa evaluations (#2920)
  • * 07bab27ae460748dcd59ec036993c5b9a5fbbe09 Keep CRD exceptions that a narrower cloud exception does not actually cover (#3351)
  • * e34034437517d1d3bfa2f930df293324bc5c20da feat(imagescan): scan the correct platform for multi-arch images (#3345)
  • * 0fbe6515c651a2f7393189df5e50c084dc0132b5 fix(anonymizer): anonymize Secret/ConfigMap names referenced via spec.volumes (#3619)
  • * 4adf325e4396c3b4860c6b4b5a8de382731dfa31 fix(anonymizer): anonymize container names and images on scanned workloads (#3463)
  • * 431b14f55d752029fc15f298279d07ebeb92e866 fix(anonymizer): anonymize env var names referencing fieldRef and resourceFieldRef (#3484)
  • * f7916a7a17f107f1f1704846334b1e0b584a397b fix(anonymizer): hide scan path, host and cluster identity under --hide and --encrypt (#3611)
  • * d22e5a9a840c627f88d720fda7312f7db860da99 fix(anonymizer): pseudonymize image-scan results under --hide/--encrypt (#3661)
  • * e540e294ae3d8ed59dd84c134700cb3d2a79832f fix(anonymizer): restore reference-backed env var name anonymization (#3579)
  • * 19ccc89464a7748724111326c3f277a0510ad34b fix(anonymizer): stop a Windows drive letter from masking sourcePath (#3202)
  • * 275028f459d2cf879409b339a0b64aa7648c35e4 fix(anonymizer): transform env var names referencing secrets/configmaps (#3364)
  • * 27b77e8ff0f6f36ac9b77dd8ea06f2bcccf579c4 fix(anonymizer): widen --hide pseudonym suffix past the 32-bit collision bound (#3221)
  • * e0475048997c72b1aafdd7e3c6e5a8fdbbc9496b fix(cache): preserve rolling fallback across pinned scans (#3258)
  • * 1a6c101f76b83991d54e2c752259e76b61e50d46 fix(cautils): add cluster-context isolation helper for sequential multi-cluster scans (#3218)
  • * c1215382272c95939d274483a307523efa8d3913 fix(cautils): make config serialization non-mutating (#3228)
  • * e24b7e6b709fe125d6a15a36a2feda18635e4fa3 fix(cautils): propagate scan errors from splitYAMLDocuments instead of truncating silently (#3423)
  • * c8fef2faf78b747f0545a43413a9362affaac0b8 fix(cautils): use sync.Once to safely stop PortForwarder without dropping stop signals (#3272) (#3273)
  • * 79a95b7b8575fd5430264a1c1f407027b07b9578 fix(cautils): validate file-scan YAML manifests against the client-go scheme (#3078)
  • * 722fa506f8c4584c3776eb103730f267688fe272 fix(cel): derive remediation paths through concatenated container lists (#3079)
  • * 5460f7487e33c07bdc33a6cc4f06fe010a46c876 fix(cel): evaluate every matchCondition, not just up to the first false (#3630)
  • * 9ce6cef73652432a679044b47ebea05292006898 fix(cel): honor an equivalent matchPolicy when scoping a policy to a scanned object (#3673)
  • * d8a07e84bc8401f7e1ad5fb532c4d183b7acb9d2 fix(cel): honor failurePolicy Fail for validation eval errors (#3082)
  • * 4214101b4939df3631a331c3f8c51b53d6050003 fix(cel): honor matchConstraints rule scope when scoping offline VAP evaluation (#3251)
  • * b841375203adf39c10f790fc2c2f0a97dfee7734 fix(cel): match CRD plurals the kind guess spells wrong (#3355)
  • * a4a630fe090dc3d35ec3da981f6597e18de71eeb fix(cel): populate request.resource plural from the same guess appliesTo scopes with (#3099)
  • * 8554683e2d9782e05423469299b27a84614de148 fix(cel): refuse a control whose paramKind the scan has no binding to resolve (#3495)
  • * a8637250d92c1287894b44c89f349c2215240aae fix(cel): resolve CRD resource plurals the kind guess cannot reach (#3177)
  • * 0a12e70de419fca105eb4e3478f6bc1172312822 fix(cel): resolve a cluster-scoped paramRef, and refuse one that selects params (#3575)
  • * 80403c265ee7a9a4d799a1b270d80a948bccbafa fix(config): make config set keys case-insensitive and accept kebab-case (#3540) (#3541)
  • * 8f023c151793201347ba75e285e3a60686ade83f fix(config): mask the cached access key in config view output (#3266)
  • * 9cfff6da7f6fbf8660d7a067c79a9f3c31f2a992 fix(containerscan): make IsRCE classification case-insensitive (#3143)
  • * 4e7770353f1452b2160724b327c8a2b8539a3f4d fix(core): close output writers when Scan fails (#3232)
  • * 70c681856cee7f09ad054a902c2800d1b7db8e4e fix(core): ensure OpenTelemetry spans are ended across all exit and error paths (#3665)
  • * 355e4432bdf7feec15df902c265a4dbec8f3bb87 fix(core): pin policy handler during collection (#3250)
  • * 3b0decec2a8830edb25b0609efe64fa2e7ef007d fix(core): report cached exceptions as degraded (#3241)
  • * 2b0171d5628e05d499351b6b4176e08e1e37419e fix(core): return finalized data with OPA errors (#3243)
  • * 60de56aece4eac7b580dab0125b75192b7739b6f fix(decrypt): restore complete encrypted reports (#3198)
  • * 3a4668fcfe88c395a6a63f0d161289ed2f0f8f25 fix(diff): detect evidence-level regressions (#3275)
  • * c791878b7a20cdfa304e1a4e92c429fe563fae61 fix(diff): propagate output errors (#3191)
  • * 0e34233e254c68148eecaed78daa49da5d9d2f1c fix(download): handle nested output directory creation and error wrapping (#3305) (#3306)
  • * bfa3b3213fd49386a95d7a66b5750c0f8f8b8a5f fix(exceptions): error on zero-match namespaceSelector in ClusterSecurityException (#3310)
  • * 0fe7a964912d8c7a2e9a5050493d020a7caa6d85 fix(fixhandler): check the error from closing a fixed file, not just writing it (#3580)
  • * b2a089170609c188900ff5d42721808258b248be fix(fixhandler): cross-control fix promotion checks the value, not just the path (#3634)
  • * a064d705b65730b8c8795c7c9db64b890f4d6c7e fix(getter): give custom rules a base score instead of leaving it zero (#3676)
  • * d1330fa47e5104e1c8b0cd211e29421d17168821 fix(getter): propagate context to cloud requests (#3246)
  • * 6b39f6c0154d517cd630097c8a38ef20f6634b67 fix(host-cache): isolate concurrent temporary files (#3108)
  • * 6ca8e584f5c3471378430edaf2b0f89a81d2b80b fix(hostsensor): emit error when CRD list is empty but nodes exist (#3172)
  • * 647e45a79b0e1977b2c65012f9e11eb0e7e674cd fix(hostsensor): enforce bounded decompression read in cache to prevent OOM (CWE-400) (#3490)
  • * 675afb49eb8197abf5cde2f14bb29560bb404486 fix(hostsensor): return nil handler on initialization error (#3119)
  • * d9e8bae492f855b085f4119ea32bb7f3c8490d70 fix(hostsensor): stop caching empty host sensor collections (#3324)
  • * 824050515aec4f4d2a3a3c73267095e62ef68e24 fix(hostsensorutils): record a status when reported CRD items cannot be read (#3561)
  • * 195cce4083cbe4d79d572783e6db9f6bffba1e26 fix(http): add graceful shutdown to watchForScan goroutine (#3195)
  • * 7476989a99737bf28af1346d5fa8b8a0b78de7bf fix(http): handle JSON marshal errors in responseToBytes (#3193)
  • * fa02c422981080bed7476f32e3aefb1fb0cfdd8d fix(httphandler): add optional bearer auth and trust boundary docs for /v1 endpoints (#3461)
  • * 0aa9c0c84d481305e77cb3f4aa20f41e8a031233 fix(httphandler): prevent metrics scrapes from hijacking latest scan status and results (#3034)
  • * 9ba886cf80ea6e731511a0caeefc3e788cba8f5b fix(imagescan): add guards for empty Hash and Tag in ECR adaptor (#3058)
  • * 2565074eed00b5e5c1e55a3acefb67c16efab418 fix(imagescan): bound GCP GetImagesScanStatus pagination loop (#3566)
  • * cdc03cbf619427447e558cc622e01d5dfa3058a5 fix(imagescan): bound registry API responses (#3473)
  • * a1372633e053c3e994ad86d5b7a30c3896388f0e fix(imagescan): reject invalid exception target regexes (#3192)
  • * 03fabc7a625ba95764016e1a044eca330bcff97e fix(imagescan): stop stalled GitLab pagination (#3472)
  • * 7d53a589b6f404fe297e75c5d96d636bd51c8db5 fix(imagescan): tighten gitlab imageMatches suffix check (#3340)
  • * 42755291ceebf84083c1e41abe25f6ee4b24cadb fix(imagescan): use match metadata for severity gates (#3189)
  • * 9c61b8436cd73c175cbe63fcc9d100f73e5ad18a fix(install): quote paths and limit cleanup to canonical locations (#3464)
  • * 9bcd13b615e54adb28c50e619da3a880d626a33a fix(install): verify downloaded binaries against the release checksum manifest (#3067)
  • * f4dca85da894750f1a75a7e1fe4e00be60d7f03d fix(junit): disambiguate duplicate testcase names with control ID (#3141)
  • * 580c58849ba128f91d319898805f7a7cea9950b5 fix(junit): distinguish image scan platforms (#3544)
  • * 6f98e72d86c4b39e2ee41c462a78ef7786f7471e fix(junit): include image findings in combined scans (#3190)
  • * 1937ec3bc574d5491afa912a5eaedbe121219d1a fix(krew): make .krew.yaml renderable and match published asset names (#3389)
  • * b092677acb0871f3894f5b32b885a0aa60afffda fix(ksinit): resolve the kubeconfig home directory with os.UserHomeDir (#3197)
  • * 6bca9fd46c1645cfc26d634e405587cda32d266d fix(mapreconcile): a policy gated by matchConditions is not a confirmed match (#3654)
  • * 4bcf79005a070d416acb311f920bcf9752bba741 fix(mapreconcile): match the subresource form of a resource rule (#3646)
  • * d78183426afd51177a4580f2a70cd8c5d7b217af fix(mcpserver): add concurrency limits for expensive scans (#3089)
  • * bcf03da129b6fbcb350470382f416b6e03e02e32 fix(mcpserver): detach new callers from canceled scans (#3176)
  • * 33b3ac2e4881f48460a6e83e41020d49c5f572f4 fix(mcpserver): guard getPolicyGetter's lazy init, matching its siblings (#3445)
  • * 5fbcc69117ebdeaad5739918292ad6c5032e3db5 fix(mcpserver): log policy-store initialization errors at startup (#3091)
  • * cf896e5ee86362d9c0963f20242a447914ea2b0b fix(mcpserver): prefer ScanCoverage over the seeded summary when flagging unevaluated controls (#3574)
  • * 685eab2b0cbb5fbf9840d7f4ec2e3f4b400264d9 fix(mcpserver): return marshal errors from get_configuration_drift (#3211)
  • * 33512a84779a0397762aec831e3fb6151b369d37 fix(metrics): report latest resource counts (#3248)
  • * 40ec8193607448f883f161887c4eb86f9a41145a fix(opaprocessor): add C-0261 to whole-cluster control fallback (#3150)
  • * c7699a114d7205d4a603a74a8633cc3bb4044e3d fix(opaprocessor): apply --skip-controls/--include-controls on the streaming path (#3520)
  • * 5de926136a1849e70af92c36e223d29693b4187d fix(opaprocessor): deduplicate merged paths for resources evaluated in every scope (#3060)
  • * f3a9fc9ede02949d16a9e6a343e124afe9f33ced fix(opaprocessor): evaluate rules against full input after enumeration (#3628)
  • * 7218a744a35bb7611285f203727ac0c526f2410e fix(opaprocessor): evaluate whole-cluster controls once after per-namespace batching (#3080)
  • * 2acabaeddf2bc995f4fb08617fb2e2463e423ac8 fix(opaprocessor): flag Passed verdicts reached on incomplete RBAC-dependent data (#3183)
  • * 3b24b270f5be17ba6737193b5e55ec3da2bc394e fix(opaprocessor): guard InfoMap read against concurrent writes in hasUnreachableDependency (#3563)
  • * 905c3293a132ad20520f3d29fdf56346a8f65447 fix(opaprocessor): honor ResourceEnumerator output in scan path (#3559)
  • * fdd64f4358c66d66165397175c7c498104fa237a fix(opaprocessor): honor namespace scope on incremental cache hits (#3501)
  • * 337866f996c72c67731a4f0ac64f63005c59326d fix(opaprocessor): make --skip-controls and --include-controls case-insensitive (#3508)
  • * 0ff591803d3938ef66cc5342e15f125c57ab7a95 fix(opaprocessor): make scope-less exceptions apply to resource-backed findings too (#3427)
  • * 3619aa358a9e43b68f7c4a5d0459655dfc084955 fix(opaprocessor): quote inline exception designator attributes (#3558)
  • * 1376e5a6116b03ad14ebc7de2ed96d8d71d2a6dc fix(opaprocessor): redact ConfigMap binaryData (#3132)
  • * 55366af10f10f005721bc35534fbbbbca09ef75c fix(opaprocessor): stop caching rules that read resource status (#3482)
  • * 7405861e4b71675125aea930ba83047755159765 fix(output): keep combined renderers from mutating scan data (#3139)
  • * 323ae8b50eb98bd56e8f2e2c56f60a9d2fb21cd6 fix(output): return explicit output setup errors (#3140)
  • * ca764bbc5c3c8625fb087d1add2446b0864776a4 fix(patch): close intermediate scan file and guarantee cleanup on error (#3269) (#3271)
  • * 2fe63075ec44dcf0471dfc84979d3397908b9b24 fix(patch): filesystem-safe intermediate filenames and update-all nil guard (#3596)
  • * 255763ae130294afa3db9732c876046b5f982380 fix(patch): read registry credentials from the environment (#3145)
  • * 7b69ebc40f32dca8edc36be495f74bfb578a7f7f fix(policyhandler): bypass shared cache for local policies (#3234)
  • * b712afb90697c9e38fafaa5a109449c8e1c92284 fix(portforward): preserve kubeconfig server URL (#3103)
  • * 206057f8f6fc99f7f4135b58a7d372933fe339b9 fix(preflight): skip Kubescape-served resources in dry-run access review (#3391)
  • * 173f57dcad99504658d90526aed7fd517ea92882 fix(prettyprinter): stop treating resource-derived text as a format string (#3333)
  • * 074f34dae1d1b6842f845d6dc6229e9a36b0b0dc fix(printer): aggregate multiple image scan runs in SARIF report printer (#3395) (#3396)
  • * 371f4aaf270dcec2c0a188516560435cc5af0d50 fix(printer): centralize output path resolution (#3492)
  • * ca2ec4cf4276bf7e92c83979667a7f997cdf835f fix(printer): dedupe enriched failed paths against bare delete paths (#3358)
  • * ca8c630d3395e47f1e69b905b2f1d3191183bc1b fix(printer): format N/A and percentage compliance score correctly in… (#3362)
  • * b4e6620e6b1c4fdadbf477ad46537a1d1480469e fix(printer): migrate v2 report printers to return errors from CloseWriter (#3214) (#3215)
  • * 8c792c3ec17d891c1ef2fc8929ddc56682f9ba09 fix(printer): normalize resource object before evidence path extraction (#3397)
  • * 2799b9cbffd794cc58aed5c1b6aeb189f5c1436c fix(printer): prevent out-of-bounds slice index panic in getSortedControlsIDs (#3363) (#3365)
  • * 2bbe31cec817694e4f37343a22e586322a92922d fix(printer): resolve indexed paths when lists are []map[string]any (#3357)
  • * 8628d483b5c75e195bfa1fc4af08436ad86de250 fix(printer): sanitize cluster and namespace identifiers in PolicyReport names and labels (#3470)
  • * e6a7949d30e9622b2834654b49587167fae2fc86 fix(printer): stop printTopComponents eating the dash on empty severities (#3450) (#3451)
  • * e7074e7f25f6ff9719f6730731de6c726233a43a fix(printer): truncate control names on rune boundaries to avoid inva… (#3048)
  • * 38eca9d33608ff7d6039760bacb78b624a3dcddb fix(prometheus): escape dynamic label values (#3104)
  • * ea0e1f962735e0a979ebd8e4271a5ea2c80d9f70 fix(release): sign release assets with keyless cosign (#3344)
  • * f7bdc948dc689d47c53e47d7e7473bfdea01151c fix(reportcrypto): bind AEAD ciphertexts to the report that owns them (#3414)
  • * 1539361ff70e7535b14d1846588a25b3c23a7b35 fix(reportcrypto): derive the report master key with Argon2id (#3382)
  • * 72820b531bc7e8f54370dcc38716855abe4ea013 fix(reporter): clean up generated credentials on all early returns (#3180)
  • * e81611bf1c7b054b59b1e7e0fc10e6c06db77454 fix(reporter): make posture report chunking deterministic (#3230)
  • * 64ddd062c6e255d657db8b36ed5b07e56c7595ae fix(reporter): split report before first result exceeds limit (#3137)
  • * 7f48cae0e33ceaf6221da922ba19433e4ebf0ba4 fix(reporter): thread context to HTTP submissions to allow cancellation (#3153)
  • * 53befa284a97da58dfe642c5ec70c249a4b35441 fix(resourcehandler): a namespace filter naming no namespace silently skips every namespaced query (#3539)
  • * 78ea1c9a3808b1ceb99f65491caaf98239b8d08a fix(resourcehandler): dedupe served-version aliases in streaming collector (#3303)
  • * 827d9244c93a5e5b60e650acd8b00a238316734a fix(resourcehandler): do not report a kind's other served versions as unexamined (#3609)
  • * 753bac693c771ca2ae915fed4e4ece7e1631be6b fix(resourcehandler): resolve the core API group spelling on live cluster scans (#3426)
  • * c33d2fdb8a1fdf5ec8b79b54715d69d7f8581ffe fix(resourcehandler): scan Terraform-only directories (#3135)
  • * d37bc836337ae3a98021a6b80d62f4c459c4c7f3 fix(resourcehandler): skip discovered resources that do not support list (#3346)
  • * eb14d32191082557855617e78052e54991d40306 fix(resourcehandler): treat an undecided access review as unchecked, not denied (#3446)
  • * df3d64fe919b1a116cc1ac4a34e515deae808608 fix(resourcehandler): use path aliases for containment (#3064)
  • * caeb5705242932fe35cd7cf16341c50baca0dd83 fix(resourcesprioritization): don't drop attack tracks when a resource matches more than one (#3659)
  • * d7bb623d1804a202b0e16154acb8761fd77bb536 fix(resultshandling): apply severity filters to framework control maps (#3455)
  • * 7ee60cd4d5fabc8c06a206dbeea900ee1cb09675 fix(resultshandling): filter per-resource findings by severity, not the unused Report.Results field (#3388)
  • * 5963cb277ec8e3556de6e7d67f71da56472e37f6 fix(resultshandling): recompute score and counters after severity filtering (#3436)
  • * 94a635395c8201a7f3ec26dd72eb0dcf913765fe fix(rules): guard privilege-escalation RBAC rules with resourceNames (#3201)
  • * 87e7dc664af76144b0270364687c0e2e7495b086 fix(rules): handle empty resourceNames in modify-privileged-pods-v1 (#3313)
  • * 55a79e7698963412bfd0825415aa31a10a9788ce fix(scan): apply the resource kind filters before collection, not after (#3411)
  • * 285ea5c78b5dd9655852dbd1447b3ecea89d10d3 fix(scan): clarify --min-severity is output-only and warn about thresholds (#3458)
  • * 4a86ddbfaf14e3952860acbdf02e97be419bbae0 fix(scan): collect a resource once when several API versions serve it (#3297)
  • * cd20fca0f239bc06589837d7241d650d29bf0323 fix(scan): fail explicitly on unmatched severity threshold (#3456)
  • * 1e1aa3bc6b9157f5a4eb938cfa52eb800c7ace90 fix(scan): keep CRD policy clients target-scoped (#3262)
  • * c7ba7d55dec976fbac797fb6f90acc63768110ce fix(scan): preserve exact manifest file selection (#3270)
  • * 585671c8c5088a06ac24d038938493766a724354 fix(scan): propagate combined image scan failures (#2965)
  • * a5efbb1d76c7552439ec4640a85394f545f54b5b fix(scan): reject NaN posture thresholds (#3279)
  • * 231da929a4182b6885964ba0d183179d6775b87d fix(scan): reject invalid persistent flag values (#3130)
  • * 70a8c596bbfafe0336b48d6b6359e2db4ad222c1 fix(scan): reject trailing JSON manifest data (#3264)
  • * d12ecd687f10dbda9c843ee57b55a09a1c894bf6 fix(scan): report parse failures suppressed by "{{" content sniff (#3274)
  • * 39aa0ecd83bd8eb3748f061bc671390a7c118310 fix(scan): resolve markdown output paths with the .md extension (#3073)
  • * 11a4c742cfc536108ad0d701c340a11d64ff4882 fix(scan): validate --label-selector in ValidateCommonScanFlags (#3502)
  • * 1647537685e7cd4de77cdf92ec2e89c93b8b14cb fix(scan): validate minimum severity for subcommands (#3131)
  • * eaffd10238c00da945380467fd82e2a6ad308f1e fix(scancache): reset dirty flag after Flush writes cache file (#3515)
  • * 8d468e32b6483506df988534783f205dfd997104 fix(storage): implement control merge strategy for WorkloadConfigurationScan (#3107)
  • * aa3b8a3f676991aa623a234a20f8b4861d3f4596 fix(storage): recover missing workload posture controls (#3545)
  • * 429df61c9ef0e10fd7db7b1208552db1e64b9e0a fix(streaming): report complete resource telemetry (#3260)
  • * dfc7b0e3fb40f33e9daa868b014910351d52c85a fix(terraform): map sysctl blocks to Kubernetes sysctls (#3133)
  • * 8084b6d561784e19f1d9c77c8951e987d00c5abf fix(vap): refuse a parameter reference that does not match the bound policy's paramKind (#3511)
  • * a9d0ba3c56633a8afa2a60fc182b8cb7103d64d6 fix(vap): reject a resource rule the bound policy can never match (#3394)
  • * 45d64228ddb27b8dd3f7200e2c66dd9f74968bda fix(vap): report a namespace selector that cannot narrow a policy's cluster-scoped resources (#3597)
  • * ecf6e1eafc64b9750fca726cfbe875db1ba427ae fix(vap): stop create-policy-binding silently rewriting the label selector it was given (#3468)
  • * 141001b8ad90283adc5ecca077adfabd54e489c7 fix(vap): validate the --from-release tag before building the release URL (#3296)
  • * 7838f62bb53e7f46bb729f67b10bbc56288ea0bd fix(vapreconcile): correct binding-scope coverage for cluster-scoped resources and Namespaces (#3592)
  • * 7cb079b3e4b0a832c9c10f2e68c5fe795af985e4 fix(vapreconcile): credit admission enforcement to the policy a binding names (#3433)
  • * 6834f9f7040ff65371c1476cf40a1b97be38d5c6 fix(version): propagate text output errors (#3129)
  • * 6c68c56dbecfdb9bc221b7e22fb294091c1430d5 fix: Add chunked pagination to SecurityException CRD retrieval (#3393)
  • * 76dd1b0e20a5305c7077eebb3d1b59b2de31dd85 fix: PolicyReportPrinter.CloseWriter now returns the close error (#3408)
  • * 9192e12b1f6d71dbf428f7514d1578c0e4d4f147 fix: Terraform loader now recurses into subdirectories, like Helm/Kustomize (#3349)
  • * 68b964ddabd48c99263b6ce29820f8593776591c fix: Windows absolute paths parse correctly when document index is omitted (#3070)
  • * d93b6f6aa96467dcc1d3ec38c32f1ae00cbed3bd fix: accept key==value label selectors in vap create-policy-binding (#3404)
  • * f4958ea5990dee248a6c5864d15a41c8d7ee70f3 fix: check SetWriter's error in writeBaselineHeadReport (#3410)
  • * 00617362df2fb917a922786aa9125f4e8b8a5d49 fix: compare --output file extensions case-insensitively (#3334)
  • * e1a700fb354ab26f63945131f63ff826c1ac33b4 fix: count manual-control exceptions in the exception audit (#3371)
  • * 460a0d69616b70b059dc8d677f14c203e473de1c fix: deduplicate included namespaces in splitNamespaces (#3599)
  • * be9c57d1d0a06117bbb417ba2ec30a2915121bef fix: diff --severity-threshold fails closed on unresolvable severity (#3406)
  • * 4c734b46705f98d793b17a892c7b9cb109134b5d fix: embed HTML report logo instead of loading it from GitHub (#3336)
  • * 64abe4a316d2f2cc326c2538ad8551e9f3a94863 fix: implement chunked pagination for namespace counting (#3467)
  • * 53af997412a28cf420caa811c3f2d30ab85c5b7b fix: initialize all vulnerability severities with placeholders (#3498)
  • * 3c7fd6af1379e39413c6910163f13ffe0c1e96ef fix: normalize namespace '*' to empty string for cluster-wide scans (#3087)
  • * 18f4ffb8a8691bde76a58a9cb5b0907d4b7a76ff fix: prevent panic in getLastLineOfResource for empty yaml files (#3203)
  • * c2c1d3f72fbc4a546fef4dc153784a80a512a6dd fix: remove secrets from cluster size estimation to tighten RBAC (#3478)
  • * cab64a200478a8810c1bfb2c597289fdab6eac50 fix: scope cluster size estimation to included namespaces (#3538)
  • * d4c9812cfa47831b12667fc788bcbbad1d14d710 fix: stringify error before json.Marshal in RecoverFunc to avoid empty body (#3075)
  • * cd00b583cd1a35bb31e4e0c3a2ef673f7624d2da fix: subsume CRD exceptions with a scope-less cloud exception (#3370)
  • * f755eb12f7e91b51129582382fc5167c868d9895 fix: use C-0035 instead of C-0016 for RBAC scanning (#3085)
  • * f0a62d13ee4ee6a0a42ec50ecb1951e02a316098 fix: validate URLs in config set (#3585)
  • * 88840d9e662ce4c40eb16fd2b31a8bbdf77d2500 fix: validate layers and vulnerabilities in ScanResultReport (#3126)
  • * 793f9546ae473d29b994fefab4f608eb51ece394 fix(opaprocessor): match CIS section numbers in --skip-controls/--include-controls (#3658)

additions (90)

  • * 88f24cc16dd3ddb4299f98ad2756c8a418365156 Add C-0298: detect subjects that can attach ephemeral containers to pods (#3017)
  • * 6bc13df3cad518e62556fc0ec071c2b7fb4e1c55 Add RBAC-police rules for issue #916: impersonate, token-mint, escalate, bind, node-proxy, PV create (#3093)
  • * 437bd633a05d319cb94cb96efbb835c3409f18ba Add URL context to repository scanner error messages (#3650)
  • * 321b6c05dda31e475d540c4946b5b75ceda5371b Add opt-in audit for posture exceptions (#3095)
  • * 71caf026b2e37aeca8b216712fa26a533733d291 core: add ScanContext, an explicit-context scan entry point (#3237) (#3432)
  • * 858f1d532e9dcfc8deda684f7dc3ed58c4e4be52 core: add ScanImageContext, closing the last explicit-context gap from #3237 (#3442) (#3443)
  • * 61ca76ca71885c3f295a7790be5162a8a7ee2d76 feat(anonymizer): detect pseudo-ID collisions in Mapping.GetOrCreate (#3417)
  • * 6bd86841edd1e3f4439c1d938cdea183515d8552 feat(config): add cached config validation (#3663)
  • * 3496ee1fbbdeb3ddbd5871429847530ae92fe903 feat(config): add config view output formats (#3055)
  • * c109477698fe206673fefbf4f84bde105e2d62a8 feat(config): support --format / -f flag in config view (#3641) (#3642)
  • * bd7ffe44d629e8bc22a4451240b8bb809a847113 feat(containerscan): validate layers, layer hashes, and vulnerability names in ScanResultReport.Validate() (#3591)
  • * 3286d8c3ea43cc2030c2f4b9f95fd280e598b480 feat(coverage): flag frameworks scored 100% purely from irrelevant controls (#3421)
  • * a819b8e6a4e4bd52503d07abd2c10568a1320ee9 feat(coverage): report resource kinds no control examined (#3588)
  • * 352a396287bd63986404ff685dcd00c2f35775f0 feat(diff): add aggregate summary outputs (#3626)
  • * 2fe500ce8aff555a9957784bed0ac5b7e3cabf56 feat(exposure): model external exposure via Ingress, Gateway API, and Service type (#3648)
  • * a87aed89c4f568d2d3dad892ddbac729c852c34e feat(exposure): model spec.externalIPs, flag unconfirmed cross-namespace backendRef as unclear (#3679)
  • * 75e692e090ab5a75bd6a9609aac2c02759b7a7e1 feat(fix): select which controls to remediate with --include-controls and --skip-controls (#3714)
  • * f0914ba6fefa2427eb38bd8d3c455bdc6f78023d feat(fix): support cluster scan reports by printing patched manifests (#3705)
  • * 146d46b80d5dcbd8f484c19f746edf03ab509d9b feat(getter): support --custom-rules for user-authored Rego rules (#3419)
  • * ca4253c977341a8d229069266b9f9b89aa35b584 feat(imagescan): add --skip-db-update flag for offline image scanning (#3387)
  • * 78f14854335116434dc6614e8c2c925f46ab03c3 feat(imagescan): add native GitLab vulnerability adaptor (#3210)
  • * ad7b416b6206675e50381cb2f443936ff8527023 feat(imagescan): add native Harbor vulnerability adaptor (#3209)
  • * 00b709cd843b30c8a539db4aa9540025828b33fe feat(list): filter controls by framework and search (#3624)
  • * 1a73d267d89fe93da596a0cf496098a60116d8e0 feat(list): show the control configuration a scan evaluates against (#3586)
  • * dcc5a0b7f9a64d1a81b3cccb8720944966893685 feat(mapreconcile): add MutatingAdmissionPolicy discovery and impact matching (#3606)
  • * 35ff0da5476c805758bc8b5295160b451033094c feat(mcp): add scan_controls, scan_local_iac_controls, list_frameworks, and list_controls tools (#3252)
  • * 1ee4b9d073d7b914751a4e48565e977f5f1aa333 feat(mcpserver): add SSE transport and advanced MCP tools for LLMs (#3375)
  • * 3ba8218ef6988864cff4a3e6a64eb58c3c1150d2 feat(mcpserver): add apply_remediation tool for deterministic AI auto-patching (#3568)
  • * 7ac644ade55a292eca7f3d71d6c204ce6e217bcb feat(mcpserver): add scan_workload tool for single-resource scanning (#3669)
  • * aa3fb76e17cd0da473fee880fb61261951c80f5e feat(networkpolicy): add real NetworkPolicy reachability engine (#3601)
  • * d41b6fe2099db7833ab98a836edc14d8eedb82d8 feat(networkpolicy,vulnexposure): correlate vulnerabilities with NetworkPolicy exposure (#3632)
  • * 4d205392243c9a117947643404073898e702201e feat(opaprocessor): add inline exception suppression via resource annotations (#3392)
  • * e86026fc5de70ee98b92b568ecd3202f195d3bc7 feat(operator): add findings-driven targeting to the remediate CLI (#3474)
  • * e02e225df88e6cafa91892e7661dd2ba0ca76f00 feat(policy): scaffold custom Rego rules and refresh test fixtures from rule output (#3635)
  • * 0cf33c44d4de186c8348c1411aee858660949cb4 feat(printer): add github-actions output format for inline PR annotations (#3637)
  • * 42ced6e7345bbb83859feeb3890964e8ebc74eb3 feat(printer): generate a posture exceptions baseline from scan results (#3560)
  • * 4ae94d189e04dde0725f37a267b1600d9b41f2f2 feat(rbacgraph): model multi-hop RBAC privilege-escalation paths (#3681)
  • * b0ea5313de14e8e4f361f7b3e8bfd1e1e48f0593 feat(rules): add approve-csr-v1 (#3298)
  • * ceef75a18fd4ca6e21535021360efcde5cd9fa9b feat(rules): add assign-serviceaccount-to-pod-v1 (#3148)
  • * cae36412842e9cea301009cb6d7a28bb74867cf4 feat(rules): add issue-token-secrets-v1 (#3174)
  • * 24b1fd4017497fa88ee4d9708cb5947e7a6f980d feat(rules): add modify-node-status-v1 (#3330)
  • * 6a1fe89993a770314ae92e3e3df0fdc1b4b28154 feat(rules): add modify-pod-status-v1 (#3332)
  • * b3cf05f9a9a3ad5041661559e26df751b3ae8a93 feat(rules): add modify-privileged-pods-v1 (#3146)
  • * 3575421c26ec57a187fb79e586880d37047143cb feat(rules): add modify-service-status-v1 (#3291)
  • * 281d9ff355c76dc3d74775c37f83d4e4faf41cc8 feat(rules): add provider-iam-assumption-v1 (#3149)
  • * d5b1f40de7a0d4c2b19e82fcdb0d10b8c0f5622c feat(rules): add steal-privileged-pods-v1 (#3224)
  • * b4faa6e10b243684470c5f9dfb12d97f9476b527 feat(rules): add weak-namespace-pod-rce-v1 (#3147)
  • * d9c9372033bd346d00c5ceb914be10129f7ed8af feat(rules): add weak-namespace-token-access-v1 (#3339)
  • * 2d1912fda4ae31a3b8162f999148e00fc4eaea9a feat(sarif): show current field values in evidence paths (#3062)
  • * 1e3820554eb429e939cfe1670600540aafd50126 feat(scan): add --dry-run RBAC preflight check (#3083)
  • * 61927afd06d9fa14e06ccc004f2256f8d3a49f97 feat(scan): add --exclude-controls to drop controls from a framework scan (#3441)
  • * ce654fab76b131c7112f9fbb93c12a185abc9dd6 feat(scan): add --exclude-path and .kubescapeignore for local scans (#3422)
  • * dc08f5e7b305e3a69ccacc170cc2e1064635b735 feat(scan): add --include-kinds and --exclude-kinds resource kind filters (#3372)
  • * 80355443d2c666d5b0fb452bdb2b808e27cb86c9 feat(scan): add --show-evidence (-E) and --show-secrets flags (#3220)
  • * e693bc29736a1c0dc6f36f554a7b15a3d5417a34 feat(scan): add SARIF contract validation output (#3622)
  • * dcd7118fcd8515137f966f77494ef71bb5824de9 feat(scan): add Slack webhook notifications (#3571)
  • * ef61a5a8363f5f4e9759aa6486fa249d23e606df feat(scan): add contract report provenance (#3607)
  • * 9f0bb332875f58928653a05f0988841304519882 feat(scan): add generic webhook notifications (#3504)
  • * 71fd98814f4cd02f8ee7b4e43013e75d2b9b6d24 feat(scan): add per-namespace compliance rollup (#3704)
  • * 77e5ff36b4298a176bdc15e5ac5ee0aec6b8d4ab feat(scan): apply repository scan contracts (#3537)
  • * bd56cb54842cd0376c6fef0edd1f99c83c2f982f feat(scan): emit CycloneDX and SPDX SBOMs from posture scans with --scan-images (#3698)
  • * d255b2047613e7a4fab5e7c9fd484882030a25fe feat(scan): extend --min-severity to all output formats and add --max-severity (#3337)
  • * fbe8eef82a879c09e793aef246dc57d96f055464 feat(scan): implement missing controls listing in ScanAll functionality (#3300)
  • * 3e0635f1fb56d0c99581ccd252b3b2faf5d15403 feat(scan): record contract runner input digests (#3640)
  • * 8932c98367339e56d5a6ef454d1996b716b38c6f feat(scan): scan multiple images in one run sharing the vulnerability database (#3682)
  • * 93e722b7beb4f97f9c3c21350053395e124d294c feat(scan): send Microsoft Teams Adaptive Card notifications for --notify webhooks (#3645)
  • * c8a0bb39fca574c06cb4aa923b7959eb2558b3ed feat(scan): validate repository scan contracts (#3481)
  • * c8e5d79863c0f3930d637654159e84faab0de52c feat(scan): wire CEL ValidatingAdmissionPolicy evaluation into the scan pipeline (#3513)
  • * 2b0deac5f64cdbdf9c18848d623badd718f500c2 feat(scan): wire up sequential multi-cluster scanning via --kube-contexts (#3438)
  • * ba47e9dc2c5fd43317be11ffed8b4accadb32aed feat(telemetry): report image DB freshness (#3604)
  • * 39a381eca6400edd99e25c7b4f2427a26fbf6577 feat(vap): list embedded admission policies and the controls they implement (#3674)
  • * 11d6db331dc822245653faa5f44457f2481ad7b2 feat(vap): scope a generated policy binding to specific resources (#3283)
  • * 9e90ed005a9e7fcc3b6ebdf06ffc8d2f51245987 feat(vapreconcile): add dynamic discovery and fallback for VAP versions (#2880)
  • * 06edc3a0c1663f4518a6aa38dd9e093fedd02dc7 feat(vapreconcile): add per-resource VAPBinding scope coverage (#3570)
  • * a9934dd767691f1a80d01dd054c07bebd1245886 feat(version): add yaml output format support (#3542) (#3543)
  • * 1527e546c560456628db6a999ff7f6fa99738085 feat: Add context-aware VAP for ActorTemplate and WorkerPool (#3466)
  • * 54c4d07de64b334df33d9ab4444bc0d37dc7f65b feat: Add eBPF telemetry correlation interface (#3226)
  • * 0c15c020ce1a899e8c42a604dbb78f877e0ebe86 feat: Implement global chunked pagination for Kubernetes resource retrieval (#3428)
  • * 2000541627225fa7138a189716f2f1f6d7ebfc6a feat: Streaming OpenVEX / CSAF Attestation Engine (#3294)
  • * a072e35e31ef186087393f89b447a899e974fa12 feat: add --min-severity flag to filter JSON scan output by severity (#3053)
  • * 5c34e878990f7dacbe4e0e9a94174029de27a8e7 feat: add PolicyReport/ClusterPolicyReport (wgpolicyk8s.io) output format (#3125)
  • * a613ff5dea35b03a26077b48c4515cff7afd6a22 feat: baseline drift detection for live cluster scans (--baseline) (#3353)
  • * b86ed44d30a9eab633fda81ec177c43155889f5d feat: emit exception-match events for file/cloud exceptions too (#3373)
  • * 36749b4698b876b85c2954699b8ab62aff37330c feat: incremental scan caching to skip unchanged resources (--incremental) (#3412)
  • * b8fe42fc0bb36c36e3741cfb0e7cb9103e97a9d8 feat: support --format json for the update command (#3617)
  • * 6827c35feb9732b92f1ac6cdcbad3e9b42f643f5 feat: surface skipped manifests at scan completion (#3031)
  • * 35a201fd7a63d82c0e1619769a60bf45f7e49b61 feat: surface vulnerability DB freshness in image-scan results (#3356)
  • * 250e58f9258bcecaebd6717fa666d519e1abff20 fix(diff): emit CI regression artifacts (#3379)
  • * 806e14e718e608c3c9e12ee22baaaf113358f30d fix(scan): add --skip-controls and --include-controls flags for selective control execution (#3480)
  • * f8a166184476f5ecedef8df991d2ead1461f6d65 feat(telemetry): export scan traces and metrics to an OTLP collector (#3521)

value changes (56)

  • * c90ae813a2b4a4ee8b438ccf20c374736c17bf6a [LFX 2026] chore(deps): bump opa-utils to v0.0.312 for alertOnly exception semantics (#3615)
  • * e6fa8bfb057b8a09849f1e98d4bb749b36c9ab71 chore(cel): bump the pinned CEL policy library to v0.14 and sync the bundle (#3556)
  • * 16b28e24a8d6e7a57eab83a52881226cf1b2c35a chore(deps): bump github.com/armosec/armoapi-go in /httphandler (#3526)
  • * 66df9156a623ad24046089accfd6d4389e6f5f00 chore(deps): bump github.com/armosec/armoapi-go in /httphandler (#3686)
  • * 6f0b30371213e099105ba4bfe4a8477671130d80 chore(deps): bump github.com/aws/aws-sdk-go-v2 from 1.43.7 to 1.45.1 (#3711)
  • * 7dbd0b6c6833e4085581a5cbe6771887da214f4e chore(deps): bump github.com/aws/aws-sdk-go-v2/config (#3528)
  • * 1824b77f6395b0f2fcb8b61fb9a56f425b84f348 chore(deps): bump github.com/go-openapi/runtime in /httphandler (#3685)
  • * 351e4c06332493d90882a5d66a399a0a24adcbbf chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.8 to 6.8.3 (#3530)
  • * 43588f538b3d1923015ad131c29a3c60cdb80834 chore(deps): bump github.com/kubescape/backend in /httphandler (#3684)
  • * e4868d9d2efb9f0dab7815ced3ee2e69c3b67037 chore(deps): bump github.com/kubescape/go-git-url from 0.0.31 to 0.0.33 (#3529)
  • * 97aa966b9089c2c50fe8514005cc9b7eff6f9028 chore(deps): bump github.com/kubescape/go-logger from 0.0.28 to 0.0.34 (#3695)
  • * 42158fdfa0524fca6ee93cb47e8dccd14f62835b chore(deps): bump github.com/kubescape/go-logger in /httphandler (#3522)
  • * 9646cfd0f2988bf4fe0483287111b6d0c3cd37f6 chore(deps): bump github.com/kubescape/k8s-interface in /httphandler (#3166)
  • * 6b909115b18bd65f8f2c887528343b2587a68c57 chore(deps): bump github.com/kubescape/opa-utils in /httphandler (#3524)
  • * 41a952c56524a89d8ecddc9941fe6e518024bb44 chore(deps): bump github.com/kubescape/rbac-utils from 0.0.21-0.20230806101615-07e36f555520 to 0.0.21 (#3170)
  • * 6cf53be4c282a495c5b7f3a2a59fb2b058c3b4b2 chore(deps): bump github.com/mark3labs/mcp-go from 0.29.0 to 0.57.0 (#3168)
  • * b5bd33428d7c39ca357f9b8fcdad6e255d4faf41 chore(deps): bump github.com/mark3labs/mcp-go from 0.57.0 to 0.58.0 (#3692)
  • * 03814d5346be2aabca889d63ddcde666200eebd6 chore(deps): bump github.com/maruel/natural from 1.1.1 to 1.3.0 (#3696)
  • * 336432cf6f3743c0de21f42d878ed1fc4bd73c9b chore(deps): bump github.com/mattn/go-isatty from 0.0.21 to 0.0.24 (#3710)
  • * 80bbc866222c63ea5acfc8dd58a5cee8f6d40045 chore(deps): bump github.com/open-policy-agent/opa from 1.14.1 to 1.19.0 (#3167)
  • * 285affd92b080a14c1d956310ef8c6829ab12f20 chore(deps): bump github.com/owenrumney/go-sarif/v2 from 2.2.0 to 2.3.3 (#3523)
  • * 4f0229f7d77abf112a679aeb88214068c860bd31 chore(deps): bump github.com/zclconf/go-cty from 1.17.0 to 1.19.0 (#3531)
  • * b5860045071bcf3f625ccd2fdaefbced6f056545 chore(deps): bump go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux (#3169)
  • * 7dc067bf11b4d4a0e681dd18dbfd691f472426ed chore(deps): bump go.opentelemetry.io/otel in /httphandler (#3163)
  • * 40ee29c88d9e71327d8c68a51b23bed059278723 chore(deps): bump go.opentelemetry.io/otel/sdk/metric (#3164)
  • * 44af76ca7ed35f3e9e18ff01ae684a48b810e07e chore(deps): bump google.golang.org/protobuf (#3690)
  • * aecc40c43a1b7188ac5c4a9f4d675e224c03576e chore(deps): bump k8s.io/apimachinery in /httphandler (#3165)
  • * 76485e50c9f08890f7158ee210b28abf4aa918c0 chore(deps): bump k8s.io/apimachinery in /httphandler (#3527)
  • * f7e4d10c987dc932db447a9140ebb109f9916eba chore(deps): bump k8s.io/apimachinery in /httphandler (#3687)
  • * 29682f6c4638c9a7349cda2a174b76dc66c6e690 chore(deps): bump opa-utils to v0.0.309 to pick up the NewScore singleton fix (#3416)
  • * 614497b6d4b0e5628bd9d8d54fa9766de1fee8f6 chore(deps): bump sigs.k8s.io/kustomize/api from 0.20.1 to 0.21.1 (#3162)
  • * 1c54706d122e725f3b271fe5346c7ff5a04105af feat(cel): evaluate VAP matchConditions offline instead of refusing the control (#3222)
  • * 5aff86e0b4a5af56c0589a8e8f5ae975f11fc511 feat(cel): honor VAP spec.failurePolicy for validation expression errors (#3583)
  • * fcc1fd83fcc7b06b38fff70ef3004624076cf772 feat(gitlab-sast): populate Solution field with fix paths and current values (#3182)
  • * e06a1c545014d9b4d96bab7cad787baf634747b8 feat(image): surface VEX status in reports (#3594)
  • * b08c5550700ced4f1621834e9f44825b7e0a797c feat(printer): include evidence paths in GitHub Actions annotation messages (#3677)
  • * 60f5017977004f4356c42fac974f5c9c95aa9be9 feat(printer): render map/slice values in AssistedRemediation evidence (#3254)
  • * f6ec4e957ec43582b3b511692f22ea8836860868 feat(printer): surface failed-path evidence values in JSON/YAML output (#3256)
  • * 40e302c40de1620f00d0a989a218b6d597828c65 feat(sarif): add stable scan fingerprints (#3639)
  • * 2b435a126bdc39046181377d0ce92fa087ab7f2f feat(sarif): resolve each FailedPath to its own relatedLocation (#3257)
  • * 2ade57112a10037ab0b99f6332380e2df123f51f feat: parallelize OPA control evaluation (#2825)
  • * 90f9ae71335750ff26cb3c8e27eb5113cf469906 fix(mcpserver): scan_resource_slice returns [] not null for an empty result set (#3506)
  • * d689713a9350058939ed353816ba0e3108c624ad fix(printer): add container names to HTML/SARIF evidence paths (#3301)
  • * 48303c86cbb5fd04335bb5f5e4a8c0c0e663180b fix(printer): annotate init/ephemeral container names on evidence paths (#3292)
  • * 7da2a148d235ac99783777541d3a4c8dfdcb662f fix(printer): include the scanned platform in GitLab finding ids (#3713)
  • * 5d498b39d688da4c88ae316b01dd59bae29a00f2 fix(printer): show assisted-remediation paths in control-view resource list (#3359)
  • * 129b49b5a29ada4d39d7a43b01abcab2374efbb2 fix(printer): support multiple image SBOM generation in CycloneDX and SPDX printers (#3399) (#3400)
  • * 86b436ac283e22cae115f0b0f5fb9591f0593a61 fix(results): preserve exception audit in programmatic JSON (#3277)
  • * a5fe36c32745d8d8bad3754fd37337df6da4c076 fix(results): preserve scan ID in posture reports (#3239)
  • * b1011854517570fabbfa09bc2aa945b4f0cf5a6e fix(resultshandling): deterministic AssociatedControls ordering across scans (#3590)
  • * 68ade8e4fdd88d5d77f13cac3dfd71ff2e7cbeab fix(score): route dead telemetry scorer output to logger.L().Debug (#3702)
  • * ee50c298686f42dfa14a4534df14c88fde08534d perf(fileutils): resolve directory ownership by ancestor lookup instead of scanning every directory (#3092)
  • * 0bf63073b1cf91a8d93486dbb407dcae8b699b83 perf(opaprocessor): cache LARGE_CLUSTER_SIZE threshold per OPAProcessor (#3342)
  • * 1d96e4a25e571350ecea0b7fe0beea5391b0411b perf(printer): dedupe image scan summary in O(N) via a shared helper (#3178)
  • * 0d842d3b3834fabfce1b571e2f12cfb44db12d27 perf: stream JSON outputs instead of massive byte array allocations in memory (#3670)
  • * cfc1db58505b7b3910bb6565f3a3ab0434c913ae chore(deps): bump github.com/armosec/armoapi-go in /httphandler (#3161)

constraints (14)

  • * 99193247e815f35ec55a48be83717d3100b59567 feat(fixhandler): apply fixes to JSON manifests (#3608)
  • * 76cf9a5fb529b178059760cc33be74c049d6be50 feat(getter): load custom rules from the standard rule directory layout (#3553)
  • * 23ac4a5a1f29dc60fbf40c6e4088f50c60a03b6a feat(markdown): support image scan reports (#3573)
  • * 4ea7d4a849d806783c66162cf984feccc913e5f5 feat(printer): support initContainers and ephemeralContainers in assisted remediation paths (#3578)
  • * 5cde74e3b84080f536b964fcf989de1f4e12f6bc feat(resourcehandler): collect via namespaced endpoints under --include-namespaces (#3683)
  • * d255b2047613e7a4fab5e7c9fd484882030a25fe feat(scan): extend --min-severity to all output formats and add --max-severity (#3337)
  • * 1644f548b95d50064aec1df7bbdfdeb4542facdb feat(vap): allow a policy binding to declare multiple validation actions (#3295)
  • * 1e914ad871d149062d73e4421fdda19d9f208f18 feat(vapreconcile): discover the served VAP API version instead of assuming v1 (#3196)
  • * 7e8bc58f73d5abfc98a8b3fe4c256ec3c73cdc3f feat: Add GCP and Azure support for DescribeRepositories and ListEnti… (#2573)
  • * 4c7dc1b8058a1eb1a5537beaaa85a5eb0a4e9c68 feat: support downloading all controls when no ID is specified (#3435)
  • * 18fefe12fe0702457665ff82ab16755ace07b5ff fix(download): accept plural and alias target arguments (#3666) (#3667)
  • * 22e6aa9f9594ae8e51418b2014823e6cfba5d5c9 fix(fixhandler): reject yq expression syntax in report fix paths (#3096)
  • * ae599c7ff9b9df850fa6a764452062141eec1d33 fix(gitlabsast): reject absolute paths filepath.IsAbs does not recognise (#3076)
  • * 254cbcd08184082e341f93ae2afdea49e2881d17 fix: add missing CronJob, ReplicaSet, and Job support to MCP get_configuration_drift tool (#3282)
Kubescapeをスタックに追加

対応が必要なリリースが出たときに、週次メールでお知らせします。 今回のセキュリティパッチと破壊的変更も、その一例です。

スタックに追加 →
公式リリースノート ↗Kubescapeのリリース一覧 →