Kubescape
v4.0.15Security2026年9月29日
レポート、スキャン、フリート管理を中心とする保守更新で、正確性や依存関係も見直されています。既定値と適用時の挙動に変更がありますが、新たに必要となるオペレーター対応はありません。
影響確認 (1)
breaking
namespace省略時の既定値とクラスタ全体検索の指定適用対象はリリースノートに明記されていません。
ワークロードの
namespaceを省略した場合の既定値がdefaultになり、クラスタ全体を検索するには*の指定が必要になりました。
その他の記録済み変更 101 件すべてfixes 65 · value changes 18 · additions 13 · constraints 4 · defaults 1
fixes (65)
- d52269cd30487f286772ad44f7b35277cc5ff613 feat(fix): honour --output-dir for file-based reports (#3880)
- c79a1fc4881ba9a0bc6dd790bcc933b98382ae4e fix(anonymizer): keep failed transformations from corrupting reports (#3888)
- 38679a1ea06b8fe36b9b0ddc7611d7c8dcadeb51 fix(cautils): do not carry tenant identity across --kube-contexts scans (#3813)
- 26cca654d8ab7e5435c4bad4bfbd32aae3d64510 fix(cautils): recurse nested JSON arrays and ignore non-manifest JSON values (#3817)
- 904bfaf52ee5b7bcd0ce5e449b5171b3faf941a5 fix(cautils): skip non-regular manifest files instead of reading them (#3931)
- 876554fa44cffacbef3dc5ecc1e90a175a927fea fix(cel): avoid false findings when Namespace data is unavailable (#3920)
- de3088b8da22b638de0b72c6b5df22f8a3e9870c fix(diff): extract failedPath evidence in granular comparison (#3921) (#3922)
- 78422ab7d0311cc43d4644c6d2f1b56328c1143a fix(diff): honor /dev/stdout and /dev/null in diff --output (#3820)
- 0b64d3694c6040e997d8774e0919958fa24dba3f fix(exceptions): generate suppressing exception baselines (#3783)
- 902a546335845e02d5783d52ecf6b12d178848f4 fix(getter): fail on checksum verification errors (#3791)
- 46b5366581fd137c4d8b1708bd1818810d766ac6 fix(hostsensor): preserve virtual host resource identities (#3891)
- ab15de57bb45809eaf0dbaedfbdbdb9161de6f52 fix(hostsensor): surface partial node-data loss as partialGVRPulls (#3844)
- 0bfccf2c367548a245170ffe9f45e07274b4b0e1 fix(httphandler): deliver scan-completion callback on scan panic (#3828)
- e1efc4b6659666166f0d04e173980e95d93d5521 fix(httphandler): do not abandon a posture report on one store error (#3822)
- 5254245785d3f28ba9ff780f5d698e975b7c9a76 fix(httphandler): set DisableKeepAlives to true in postScanCallback (#3948)
- a66fa33d6f8b6fef529b63a4db6176b7aa1b7413 fix(imagescan): correct misleading log in ProcessImages and break severity loop (#3856)
- 87a7e20c96426cfa3e54f406f0e41d28318fa39f fix(imagescan): fail closed on unknown-severity CVEs in threshold gates (#3832)
- 97230f2d892341f61f0a41c8ce33e04614b206d4 fix(imagescan): prevent silent swallow of azure image id validation errors (#3900)
- 605728dfad78ebc25983fbf7abdbb8f2bb104e95 fix(imagescan): stop stalled Azure pagination (#3883)
- d774660c6a68cc7c4b16f82ffec7022f4ec4ed71 fix(imagescan): stop stalled ECR pagination (#3882)
- f266abee04771ce02a64b7daa267ebd7b76bb367 fix(imagescan): support nested Harbor repositories (#3860)
- 81f0ba773a2f447c9cd85dc010381a5390053109 fix(imagescan): warn on stale vulnerability DB, fail with --fail-on-stale-db (#3830)
- fe4fea3dfef657e6b9432806b13247ffcc5e02dd fix(junit): aggregate and serialize skipped count in root testsuites element (#3932) (#3933)
- bbf8d839f8d1ca9ab787313d5ef339b9d1dcf41a fix(kubernetes): stop stalled pagination loops (#3859)
- eaaf82e1d050d7b3f8bb479f05cc9403f5bb8d2b fix(locationresolver): reject negative nodeIndex in ResolveLocation (#3879)
- c342c03ac1ec20d18b14e50e38b5a4a7a6ae1626 fix(mcpserver): skip IaC scan tests if offline policies missing (#3806)
- 2c389c6a37ad527d9b8fbd32cda37465e7654d39 fix(networkpolicy): allow a Pod to always reach itself (#3905)
- 510874b6a0c2115803efc32dd1645e20600fd1c3 fix(networkpolicy): require a common port and protocol for reachability (#3909)
- 3fb32151c08d2b0abfdcdf93f4a1f469e658ed8d fix(opa): validate signed image digest in cosign verification (#3930)
- 8a02cbd5169aa6782cc0e7a09ec7f18bb3939eed fix(opaprocessor): fix excluded control reinsert regression (#3915)
- c90bddbeea2ad32c310f6b70f4eadb094ff6ffdc fix(opaprocessor): propagate skip reasons to control summary and junit (#3885)
- 7d0921e0452f3d48b3cbaaf8e62b76f75d354722 fix(opaprocessor): select whole controls in --skip-controls/--include-controls (#3793)
- 6fa2ef13e059031b77b184bc45a8dfe760df11ac fix(partitionstore): recognise a full disk on Windows (#3855)
- 0f4bf1eae9eed9c7373dc6560bd8b7f930d11fa2 fix(patch): do not print usage when --severity-threshold fails (#3857)
- 82f6b0c8629539c920f545c134f59477ca638ea7 fix(pdf): include image CVEs in combined scan reports (#3949)
- 5c22710a34913396add5a791ccc38726424a5e1b fix(perf): eliminate O(N^2) memory allocations in image scan target deduplication (#3939)
- 4750e2c96e74cbf7c34756cf384d1ec9fedcf849 fix(portforwarder): add timeout to waitForPortForwardReadiness to prevent infinite hang (#3873)
- ab8d06c2f7d793cf264fc7954008c2c901c3cb0e fix(printer): assign info stars deterministically instead of by map iteration order (#3851)
- e77f8c73d6b49011341c0c56fcd71d84f5a8e28c fix(printer): emit PolicyReport timestamps as seconds and nanos per CRD schema (#3887)
- daaf310dac9d2b424fae7a79053400c83f3ffc0a fix(printer): include skipped and unevaluated controls in CSV report output (#3934) (#3935)
- 7a9ef3157271f2e565eba764103e84b098af2468 fix(printer): parse bracketed path keys instead of splitting on every… (#3796)
- dc9ef6d99c52ffc87f41e7c6898a2f7491a81390 fix(printer): qualify bracketed keys with a following index and keep quoted digits keys (#3801)
- dc57daec647424dbf59ed06de2a4279335ed76d9 fix(printer): stream configuration scan JSON and SARIF output (#3794)
- 8a4131fb2008a8951220c7d4427532db63a9797c fix(printer): support combined posture and image scan output in Markdown and HTML printers (#3814)
- ae853e98481f86e10f4ad5e4e2e398ceb501c5f4 fix(printer): support multi-image scan output in YAML printer (#3795)
- 558e9d9a12e3b1302824c4ebef50fc061807f9d2 fix(prometheus): emit container image vulnerability metrics in combined scans (#3941) (#3942)
- bda93023737b25fe1adf5a60a5868909c57db6ee fix(release): write the cosign signing key owner-only and remove it after the release (#3736)
- e1125fe1027c60cf11b1c271026aa7d7834f0b81 fix(reportcrypto): decrypt namespace summaries and env var names in encrypted reports (#3908)
- c9839ae7321e99bc46180e4a94c258c0a6c58e9f fix(sarif): aggregate container image vulnerability runs in combined scans (#3945) (#3946)
- c217e582cdb24cce282fe39f4fffc33fb0064146 fix(scan): hash policy-visible resource metadata (#3919)
- af7ad8f22efb4ff79e68b250bb6c91b4983718da fix(scan): isolate fleet context configuration (#3881)
- 20f624a26d4e8d6e2f2d2b22a7f3b01aa15d0d90 fix(scan): make incremental cache writes durable (#3889)
- 7893b6d0d2e924463785a01157fef209c265e3ef fix(scan): re-evaluate policies that read status through object.get (#3918)
- 6c801b92134d4bfe0c167b84ea6d40a5146cff88 fix(scan): restore fleet context after runner panic (#3848)
- b3c040f7e315c39036ee25c31b17f454229303e1 fix(scan): validate format of workload name, kind, namespace, and API group (#3809)
- 2bf48927b9fac036e471144684217fb794b808ef fix(scan): write fleet reports atomically (#3849)
- 11038ce7c06399d94483b4f42fbc4abd6e3ed9dd fix(scancache): bypass cache when resource fails to encode to JSON (#3953)
- fix(storage): persist workload scan report timestamps
- fix(streaming): update partition counts after purge
- fix: complete V2 to V1 Control Report field mapping
- fix: populate framework resource counters and root metadata in ReportV2ToV1
- fix: preserve YAML source formatting during remediation
- fix: print separator for control scans
- fix(printer): honor /dev/stdout and /dev/null in every output printer
- fix(scan): prevent stale incremental verdicts across scan contexts
value changes (18)
- ac7749efb28fd0e9cc64df975148061bbf7aee7a chore: bump regolibrary to v2.0.36 (#3893)
- 0ed2ec65b3054db470da9f927c3a0887e4fe9459 ci: bump docker/setup-qemu-action from 4.3.0 to 4.4.0 (#3899)
- 087343d486b473f4a65649e79d41e6e5f49318be ci: bump github.com/Azure/azure-sdk-for-go/sdk/azcore (#3962)
- 59543f37fb9d0af5006c1f1f05b2b1dce292abf8 ci: bump github.com/anchore/clio (#3834)
- b6853244941a054085cc7863a85759d04b2dc47f ci: bump github.com/anubhav06/copa-grype (#3837)
- 4343cf64ec2e561d9d3025e9fac972e72b5734c3 ci: bump github.com/deckarep/golang-set/v2 from 2.8.0 to 2.9.0 (#3835)
- 3ce372a7723b0b7f901fbe3b154bd2f5623869ca ci: bump github.com/johnfercher/maroto/v2 from 2.2.2 to 2.4.2 (#3836)
- 0eaf4d78d2da0e81c54850fb7f023eb03af7f32b ci: bump github.com/moby/buildkit from 0.31.1 to 0.33.0 (#3895)
- 15fdfc566c4b42ba0fac9d204ef570965b869180 ci: bump github.com/project-copacetic/copacetic from 0.10.0 to 0.15.0 (#3763)
- f59fe464636ce4b7bbcc2f07970f650d287a5be1 ci: bump github/codeql-action/upload-sarif from 4.37.9 to 4.38.0 (#3838)
- ce00b884ab7ec801db92d63fdb37371e054487cd ci: bump github/codeql-action/upload-sarif from 4.38.0 to 4.38.1 (#3897)
- e25088c5b59703544b8e81da1d6eaaacf7a7da57 ci: bump github/codeql-action/upload-sarif from 4.38.1 to 4.38.2 (#3965)
- 6f9fcd988331c936cbe9648d9ef4bdd7b902c30a ci: bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp (#3963)
- 81484b32c18a0ae3909773eb835b6d3557c1644f ci: bump golang.org/x/mod from 0.40.0 to 0.41.0 (#3896)
- a7f3a750518cfbd384f29c2e35e6392ae19055a6 ci: bump the kubernetes group with 4 updates (#3960)
- dc77396a07093fca0b7977db030c895d04d588d8 feat(httphandler): reload namespace filters without restarting (#3925)
- 78b5fef762716a8701f1ab220ef16e32195a10b0 feat: use mmap and fastjson for manifest parsing (#3500)
- bump github.com/hashicorp/hcl/v2 from 2.24.0 to 2.25.0
additions (13)
- a07aa9f4094112f1a104e21ea93bbfa8c5e448bc feat(config): Filter configurations by key in kubescape config view (#3644)
- d4b287902f3f7eb3ad2d9ed060b343642b151aa5 feat(evidence): warn on incompatible flags and skip lines for anonymized source path (#3864)
- 7360e443388843f260502449c973410a179ee907 feat(fleet): add the compliance rollup to the fleet report (#3852)
- 4910049909942e0342919666c74aa5cb7ace34ac feat(fleet): print a fleet summary after a multi-context scan [LFX 2026] (#3929)
- 0b03ed0be1f2d1bbb368b6187c6dbb275d5050a2 feat(fleet): report the controls clusters disagree on (#3878)
- ef5333f2afcf3fa13435e8918f139a4e54cf9ed3 feat(opaprocessor): define execution policies for whole-cluster controls (#3877)
- 16cfe102f11551a6455fe9bf8e37d7083da90484 feat(printer): add scan coverage to markdown, HTML, and CSV (#3937)
- 028c4887fed286aa17d5ae1d4bc3db1ee37f94a7 feat(printer): report degraded scan coverage and skipped controls (#3926)
- d411dda74dbb056111b810c51077899ff968c383 feat(printer): resolve fix-path line numbers in --show-evidence output (#3786)
- 765d368e9e049cdbe2009a16b0be2a4a5e43c6c3 feat(printer): resolve line numbers for delete and review paths in --show-evidence (#3845)
- 4ab599f1caaae4b0b9b0791b0577213184ec08f3 feat(scan): add --fleet-report to write one combined report across --kube-contexts (#3815)
- 4e039224c4c8b76d1f846c74c03d160e308f54cb feat(vap): include complete Agent Runtime policy set (#3871)
- 3401a493768f1cb2470fe3447fa83522e1392e46 feat: add support for deleting specific configuration keys (#3672)
constraints (4)
- 3a7778aa585e7d8d5d904364d4204a4e89a0c268 feat(imagescan): support Quay vulnerability scanning (#3917)
- f7533fccda082433e91eed919d21f5f6b96bf429 feat(imagescan): support full Azure credential chain for ACR image pulls (#3853)
- 2adae0d663cedc8cf3d5264e9cb74302be610522 feat(locationresolver): resolve bracketed-key paths by building yq expressions from parsed segments (#3816)
- 0372433e255ec59f2684c1237df630acdf2e764f feat(opa): let C-0236 accept key-signed images without a transparency log entry (#3967)
defaults (1)
- 77c05048cbee3545e332eca3f0f81a7a4b64eaa5 fix(scan): default omitted workload namespace to 'default' and require '*' for cluster-wide search (#3798)
Kubescapeをスタックに追加
対応が必要なリリースが出たときに、週次メールでお知らせします。 今回の破壊的変更も、その一例です。