RATATOSKRATATOSK
로그인

Kubescape

v4.0.13Security
2026년 9월 2일

ACTION 2CHECK 10PLAN 1OTHER 344

스캔, 정책, 보고, 수정, 알림, 텔레메트리, 통합 및 출력 기능을 넓히고 여러 정확성 및 실행 환경 문제를 바로잡은 릴리스입니다. 보안 강화와 함께 스캔 요청, 입력 범위, 적용 범위에 관한 제약도 엄격해졌습니다.

조치 필요 (2)

  • securityGo 의존성의 Dependabot 보안 취약점 수정

    Go 의존성에 포함된 Dependabot 보안 취약점을 수정했습니다.

  • securitygosec SAST 결과 수정

    gosec의 SAST 결과에 포함된 문제를 수정했습니다.

영향 확인 (10)

  • securityGrafeas 필터 주입 차단

    imagescan을 실행하는 경우에 적용됩니다.

    imagescan에서 resourceURL을 이용한 Grafeas 필터 주입을 차단했습니다.

  • breaking스캔 요청의 클라이언트 인증 정보 무시

    스캔 요청을 사용하는 경우에 적용됩니다.

    스캔 요청에서 클라이언트가 전달한 account와 accessKey를 더 이상 따르지 않습니다.

  • breaking알려지지 않은 제어 항목 지정 시 오류 처리

    --include-controls를 설정하는 경우에 적용됩니다.

    --include-controls가 알려진 제어 항목과 일치하지 않으면 오류로 처리합니다.

  • breaking단일 리소스 스캔의 Secret 읽기 차단

    단일 리소스 스캔을 실행하는 경우에 적용됩니다.

    단일 리소스 스캔에서 Secret 읽기를 차단했습니다.

  • breaking스캔 작업의 compliance-threshold 적용

    compliance-threshold를 설정하는 경우에 적용됩니다.

    스캔 작업에서 compliance-threshold 설정을 적용합니다.

  • breaking알 수 없는 심각도 결과의 보수적 처리

    --severity-threshold를 설정하는 경우에 적용됩니다.

    --severity-threshold를 사용할 때 심각도가 확인되지 않은 결과가 있으면 안전한 실패 상태로 종료합니다.

  • breaking로드된 제어 항목이 없을 때 적용 범위 실패 처리

    스캔을 실행하는 경우에 적용됩니다.

    로드된 제어 항목이 하나도 없으면 적용 범위 실패로 처리합니다.

  • breaking건너뛴 매니페스트의 적용 범위 반영

    scan-coverage를 실행하는 경우에 적용됩니다.

    적용 범위 결과에 건너뛴 매니페스트를 표시하고 게이트를 실패 처리합니다.

  • breaking스캔 플래그 간 상호 배타성 적용

    keep-local, omit-raw-resources 또는 submit을 설정하는 경우에 적용됩니다.

    모든 스캔 명령에서 keep-local, omit-raw-resources, submit 플래그를 서로 함께 사용할 수 없도록 제한합니다.

  • breaking파일 스캔의 파일별 크기 제한

    파일 스캔 경로를 사용하는 경우에 적용됩니다.

    파일 스캔 경로에서 파일별 크기 제한을 적용합니다.

미리 준비 (1)

  • deprecated--fail-threshold 플래그의 사용 중단 표시

    --fail-threshold를 설정하는 경우에 적용됩니다.

    --fail-threshold를 숨김 상태의 더 이상 사용하지 않는 플래그로 다시 등록했습니다.

그 외 기록된 변경 344건 전체fixes 184 · additions 90 · value changes 56 · constraints 14

fixes (184)

  • * 80bddbb4d1ed4f6efb665890ed724f7aaaa5ab53 Fix memory allocation spikes during opa evaluations (#2920)
  • * 07bab27ae460748dcd59ec036993c5b9a5fbbe09 Keep CRD exceptions that a narrower cloud exception does not actually cover (#3351)
  • * e34034437517d1d3bfa2f930df293324bc5c20da feat(imagescan): scan the correct platform for multi-arch images (#3345)
  • * 0fbe6515c651a2f7393189df5e50c084dc0132b5 fix(anonymizer): anonymize Secret/ConfigMap names referenced via spec.volumes (#3619)
  • * 4adf325e4396c3b4860c6b4b5a8de382731dfa31 fix(anonymizer): anonymize container names and images on scanned workloads (#3463)
  • * 431b14f55d752029fc15f298279d07ebeb92e866 fix(anonymizer): anonymize env var names referencing fieldRef and resourceFieldRef (#3484)
  • * f7916a7a17f107f1f1704846334b1e0b584a397b fix(anonymizer): hide scan path, host and cluster identity under --hide and --encrypt (#3611)
  • * d22e5a9a840c627f88d720fda7312f7db860da99 fix(anonymizer): pseudonymize image-scan results under --hide/--encrypt (#3661)
  • * e540e294ae3d8ed59dd84c134700cb3d2a79832f fix(anonymizer): restore reference-backed env var name anonymization (#3579)
  • * 19ccc89464a7748724111326c3f277a0510ad34b fix(anonymizer): stop a Windows drive letter from masking sourcePath (#3202)
  • * 275028f459d2cf879409b339a0b64aa7648c35e4 fix(anonymizer): transform env var names referencing secrets/configmaps (#3364)
  • * 27b77e8ff0f6f36ac9b77dd8ea06f2bcccf579c4 fix(anonymizer): widen --hide pseudonym suffix past the 32-bit collision bound (#3221)
  • * e0475048997c72b1aafdd7e3c6e5a8fdbbc9496b fix(cache): preserve rolling fallback across pinned scans (#3258)
  • * 1a6c101f76b83991d54e2c752259e76b61e50d46 fix(cautils): add cluster-context isolation helper for sequential multi-cluster scans (#3218)
  • * c1215382272c95939d274483a307523efa8d3913 fix(cautils): make config serialization non-mutating (#3228)
  • * e24b7e6b709fe125d6a15a36a2feda18635e4fa3 fix(cautils): propagate scan errors from splitYAMLDocuments instead of truncating silently (#3423)
  • * c8fef2faf78b747f0545a43413a9362affaac0b8 fix(cautils): use sync.Once to safely stop PortForwarder without dropping stop signals (#3272) (#3273)
  • * 79a95b7b8575fd5430264a1c1f407027b07b9578 fix(cautils): validate file-scan YAML manifests against the client-go scheme (#3078)
  • * 722fa506f8c4584c3776eb103730f267688fe272 fix(cel): derive remediation paths through concatenated container lists (#3079)
  • * 5460f7487e33c07bdc33a6cc4f06fe010a46c876 fix(cel): evaluate every matchCondition, not just up to the first false (#3630)
  • * 9ce6cef73652432a679044b47ebea05292006898 fix(cel): honor an equivalent matchPolicy when scoping a policy to a scanned object (#3673)
  • * d8a07e84bc8401f7e1ad5fb532c4d183b7acb9d2 fix(cel): honor failurePolicy Fail for validation eval errors (#3082)
  • * 4214101b4939df3631a331c3f8c51b53d6050003 fix(cel): honor matchConstraints rule scope when scoping offline VAP evaluation (#3251)
  • * b841375203adf39c10f790fc2c2f0a97dfee7734 fix(cel): match CRD plurals the kind guess spells wrong (#3355)
  • * a4a630fe090dc3d35ec3da981f6597e18de71eeb fix(cel): populate request.resource plural from the same guess appliesTo scopes with (#3099)
  • * 8554683e2d9782e05423469299b27a84614de148 fix(cel): refuse a control whose paramKind the scan has no binding to resolve (#3495)
  • * a8637250d92c1287894b44c89f349c2215240aae fix(cel): resolve CRD resource plurals the kind guess cannot reach (#3177)
  • * 0a12e70de419fca105eb4e3478f6bc1172312822 fix(cel): resolve a cluster-scoped paramRef, and refuse one that selects params (#3575)
  • * 80403c265ee7a9a4d799a1b270d80a948bccbafa fix(config): make config set keys case-insensitive and accept kebab-case (#3540) (#3541)
  • * 8f023c151793201347ba75e285e3a60686ade83f fix(config): mask the cached access key in config view output (#3266)
  • * 9cfff6da7f6fbf8660d7a067c79a9f3c31f2a992 fix(containerscan): make IsRCE classification case-insensitive (#3143)
  • * 4e7770353f1452b2160724b327c8a2b8539a3f4d fix(core): close output writers when Scan fails (#3232)
  • * 70c681856cee7f09ad054a902c2800d1b7db8e4e fix(core): ensure OpenTelemetry spans are ended across all exit and error paths (#3665)
  • * 355e4432bdf7feec15df902c265a4dbec8f3bb87 fix(core): pin policy handler during collection (#3250)
  • * 3b0decec2a8830edb25b0609efe64fa2e7ef007d fix(core): report cached exceptions as degraded (#3241)
  • * 2b0171d5628e05d499351b6b4176e08e1e37419e fix(core): return finalized data with OPA errors (#3243)
  • * 60de56aece4eac7b580dab0125b75192b7739b6f fix(decrypt): restore complete encrypted reports (#3198)
  • * 3a4668fcfe88c395a6a63f0d161289ed2f0f8f25 fix(diff): detect evidence-level regressions (#3275)
  • * c791878b7a20cdfa304e1a4e92c429fe563fae61 fix(diff): propagate output errors (#3191)
  • * 0e34233e254c68148eecaed78daa49da5d9d2f1c fix(download): handle nested output directory creation and error wrapping (#3305) (#3306)
  • * bfa3b3213fd49386a95d7a66b5750c0f8f8b8a5f fix(exceptions): error on zero-match namespaceSelector in ClusterSecurityException (#3310)
  • * 0fe7a964912d8c7a2e9a5050493d020a7caa6d85 fix(fixhandler): check the error from closing a fixed file, not just writing it (#3580)
  • * b2a089170609c188900ff5d42721808258b248be fix(fixhandler): cross-control fix promotion checks the value, not just the path (#3634)
  • * a064d705b65730b8c8795c7c9db64b890f4d6c7e fix(getter): give custom rules a base score instead of leaving it zero (#3676)
  • * d1330fa47e5104e1c8b0cd211e29421d17168821 fix(getter): propagate context to cloud requests (#3246)
  • * 6b39f6c0154d517cd630097c8a38ef20f6634b67 fix(host-cache): isolate concurrent temporary files (#3108)
  • * 6ca8e584f5c3471378430edaf2b0f89a81d2b80b fix(hostsensor): emit error when CRD list is empty but nodes exist (#3172)
  • * 647e45a79b0e1977b2c65012f9e11eb0e7e674cd fix(hostsensor): enforce bounded decompression read in cache to prevent OOM (CWE-400) (#3490)
  • * 675afb49eb8197abf5cde2f14bb29560bb404486 fix(hostsensor): return nil handler on initialization error (#3119)
  • * d9e8bae492f855b085f4119ea32bb7f3c8490d70 fix(hostsensor): stop caching empty host sensor collections (#3324)
  • * 824050515aec4f4d2a3a3c73267095e62ef68e24 fix(hostsensorutils): record a status when reported CRD items cannot be read (#3561)
  • * 195cce4083cbe4d79d572783e6db9f6bffba1e26 fix(http): add graceful shutdown to watchForScan goroutine (#3195)
  • * 7476989a99737bf28af1346d5fa8b8a0b78de7bf fix(http): handle JSON marshal errors in responseToBytes (#3193)
  • * fa02c422981080bed7476f32e3aefb1fb0cfdd8d fix(httphandler): add optional bearer auth and trust boundary docs for /v1 endpoints (#3461)
  • * 0aa9c0c84d481305e77cb3f4aa20f41e8a031233 fix(httphandler): prevent metrics scrapes from hijacking latest scan status and results (#3034)
  • * 9ba886cf80ea6e731511a0caeefc3e788cba8f5b fix(imagescan): add guards for empty Hash and Tag in ECR adaptor (#3058)
  • * 2565074eed00b5e5c1e55a3acefb67c16efab418 fix(imagescan): bound GCP GetImagesScanStatus pagination loop (#3566)
  • * cdc03cbf619427447e558cc622e01d5dfa3058a5 fix(imagescan): bound registry API responses (#3473)
  • * a1372633e053c3e994ad86d5b7a30c3896388f0e fix(imagescan): reject invalid exception target regexes (#3192)
  • * 03fabc7a625ba95764016e1a044eca330bcff97e fix(imagescan): stop stalled GitLab pagination (#3472)
  • * 7d53a589b6f404fe297e75c5d96d636bd51c8db5 fix(imagescan): tighten gitlab imageMatches suffix check (#3340)
  • * 42755291ceebf84083c1e41abe25f6ee4b24cadb fix(imagescan): use match metadata for severity gates (#3189)
  • * 9c61b8436cd73c175cbe63fcc9d100f73e5ad18a fix(install): quote paths and limit cleanup to canonical locations (#3464)
  • * 9bcd13b615e54adb28c50e619da3a880d626a33a fix(install): verify downloaded binaries against the release checksum manifest (#3067)
  • * f4dca85da894750f1a75a7e1fe4e00be60d7f03d fix(junit): disambiguate duplicate testcase names with control ID (#3141)
  • * 580c58849ba128f91d319898805f7a7cea9950b5 fix(junit): distinguish image scan platforms (#3544)
  • * 6f98e72d86c4b39e2ee41c462a78ef7786f7471e fix(junit): include image findings in combined scans (#3190)
  • * 1937ec3bc574d5491afa912a5eaedbe121219d1a fix(krew): make .krew.yaml renderable and match published asset names (#3389)
  • * b092677acb0871f3894f5b32b885a0aa60afffda fix(ksinit): resolve the kubeconfig home directory with os.UserHomeDir (#3197)
  • * 6bca9fd46c1645cfc26d634e405587cda32d266d fix(mapreconcile): a policy gated by matchConditions is not a confirmed match (#3654)
  • * 4bcf79005a070d416acb311f920bcf9752bba741 fix(mapreconcile): match the subresource form of a resource rule (#3646)
  • * d78183426afd51177a4580f2a70cd8c5d7b217af fix(mcpserver): add concurrency limits for expensive scans (#3089)
  • * bcf03da129b6fbcb350470382f416b6e03e02e32 fix(mcpserver): detach new callers from canceled scans (#3176)
  • * 33b3ac2e4881f48460a6e83e41020d49c5f572f4 fix(mcpserver): guard getPolicyGetter's lazy init, matching its siblings (#3445)
  • * 5fbcc69117ebdeaad5739918292ad6c5032e3db5 fix(mcpserver): log policy-store initialization errors at startup (#3091)
  • * cf896e5ee86362d9c0963f20242a447914ea2b0b fix(mcpserver): prefer ScanCoverage over the seeded summary when flagging unevaluated controls (#3574)
  • * 685eab2b0cbb5fbf9840d7f4ec2e3f4b400264d9 fix(mcpserver): return marshal errors from get_configuration_drift (#3211)
  • * 33512a84779a0397762aec831e3fb6151b369d37 fix(metrics): report latest resource counts (#3248)
  • * 40ec8193607448f883f161887c4eb86f9a41145a fix(opaprocessor): add C-0261 to whole-cluster control fallback (#3150)
  • * c7699a114d7205d4a603a74a8633cc3bb4044e3d fix(opaprocessor): apply --skip-controls/--include-controls on the streaming path (#3520)
  • * 5de926136a1849e70af92c36e223d29693b4187d fix(opaprocessor): deduplicate merged paths for resources evaluated in every scope (#3060)
  • * f3a9fc9ede02949d16a9e6a343e124afe9f33ced fix(opaprocessor): evaluate rules against full input after enumeration (#3628)
  • * 7218a744a35bb7611285f203727ac0c526f2410e fix(opaprocessor): evaluate whole-cluster controls once after per-namespace batching (#3080)
  • * 2acabaeddf2bc995f4fb08617fb2e2463e423ac8 fix(opaprocessor): flag Passed verdicts reached on incomplete RBAC-dependent data (#3183)
  • * 3b24b270f5be17ba6737193b5e55ec3da2bc394e fix(opaprocessor): guard InfoMap read against concurrent writes in hasUnreachableDependency (#3563)
  • * 905c3293a132ad20520f3d29fdf56346a8f65447 fix(opaprocessor): honor ResourceEnumerator output in scan path (#3559)
  • * fdd64f4358c66d66165397175c7c498104fa237a fix(opaprocessor): honor namespace scope on incremental cache hits (#3501)
  • * 337866f996c72c67731a4f0ac64f63005c59326d fix(opaprocessor): make --skip-controls and --include-controls case-insensitive (#3508)
  • * 0ff591803d3938ef66cc5342e15f125c57ab7a95 fix(opaprocessor): make scope-less exceptions apply to resource-backed findings too (#3427)
  • * 3619aa358a9e43b68f7c4a5d0459655dfc084955 fix(opaprocessor): quote inline exception designator attributes (#3558)
  • * 1376e5a6116b03ad14ebc7de2ed96d8d71d2a6dc fix(opaprocessor): redact ConfigMap binaryData (#3132)
  • * 55366af10f10f005721bc35534fbbbbca09ef75c fix(opaprocessor): stop caching rules that read resource status (#3482)
  • * 7405861e4b71675125aea930ba83047755159765 fix(output): keep combined renderers from mutating scan data (#3139)
  • * 323ae8b50eb98bd56e8f2e2c56f60a9d2fb21cd6 fix(output): return explicit output setup errors (#3140)
  • * ca764bbc5c3c8625fb087d1add2446b0864776a4 fix(patch): close intermediate scan file and guarantee cleanup on error (#3269) (#3271)
  • * 2fe63075ec44dcf0471dfc84979d3397908b9b24 fix(patch): filesystem-safe intermediate filenames and update-all nil guard (#3596)
  • * 255763ae130294afa3db9732c876046b5f982380 fix(patch): read registry credentials from the environment (#3145)
  • * 7b69ebc40f32dca8edc36be495f74bfb578a7f7f fix(policyhandler): bypass shared cache for local policies (#3234)
  • * b712afb90697c9e38fafaa5a109449c8e1c92284 fix(portforward): preserve kubeconfig server URL (#3103)
  • * 206057f8f6fc99f7f4135b58a7d372933fe339b9 fix(preflight): skip Kubescape-served resources in dry-run access review (#3391)
  • * 173f57dcad99504658d90526aed7fd517ea92882 fix(prettyprinter): stop treating resource-derived text as a format string (#3333)
  • * 074f34dae1d1b6842f845d6dc6229e9a36b0b0dc fix(printer): aggregate multiple image scan runs in SARIF report printer (#3395) (#3396)
  • * 371f4aaf270dcec2c0a188516560435cc5af0d50 fix(printer): centralize output path resolution (#3492)
  • * ca2ec4cf4276bf7e92c83979667a7f997cdf835f fix(printer): dedupe enriched failed paths against bare delete paths (#3358)
  • * ca8c630d3395e47f1e69b905b2f1d3191183bc1b fix(printer): format N/A and percentage compliance score correctly in… (#3362)
  • * b4e6620e6b1c4fdadbf477ad46537a1d1480469e fix(printer): migrate v2 report printers to return errors from CloseWriter (#3214) (#3215)
  • * 8c792c3ec17d891c1ef2fc8929ddc56682f9ba09 fix(printer): normalize resource object before evidence path extraction (#3397)
  • * 2799b9cbffd794cc58aed5c1b6aeb189f5c1436c fix(printer): prevent out-of-bounds slice index panic in getSortedControlsIDs (#3363) (#3365)
  • * 2bbe31cec817694e4f37343a22e586322a92922d fix(printer): resolve indexed paths when lists are []map[string]any (#3357)
  • * 8628d483b5c75e195bfa1fc4af08436ad86de250 fix(printer): sanitize cluster and namespace identifiers in PolicyReport names and labels (#3470)
  • * e6a7949d30e9622b2834654b49587167fae2fc86 fix(printer): stop printTopComponents eating the dash on empty severities (#3450) (#3451)
  • * e7074e7f25f6ff9719f6730731de6c726233a43a fix(printer): truncate control names on rune boundaries to avoid inva… (#3048)
  • * 38eca9d33608ff7d6039760bacb78b624a3dcddb fix(prometheus): escape dynamic label values (#3104)
  • * ea0e1f962735e0a979ebd8e4271a5ea2c80d9f70 fix(release): sign release assets with keyless cosign (#3344)
  • * f7bdc948dc689d47c53e47d7e7473bfdea01151c fix(reportcrypto): bind AEAD ciphertexts to the report that owns them (#3414)
  • * 1539361ff70e7535b14d1846588a25b3c23a7b35 fix(reportcrypto): derive the report master key with Argon2id (#3382)
  • * 72820b531bc7e8f54370dcc38716855abe4ea013 fix(reporter): clean up generated credentials on all early returns (#3180)
  • * e81611bf1c7b054b59b1e7e0fc10e6c06db77454 fix(reporter): make posture report chunking deterministic (#3230)
  • * 64ddd062c6e255d657db8b36ed5b07e56c7595ae fix(reporter): split report before first result exceeds limit (#3137)
  • * 7f48cae0e33ceaf6221da922ba19433e4ebf0ba4 fix(reporter): thread context to HTTP submissions to allow cancellation (#3153)
  • * 53befa284a97da58dfe642c5ec70c249a4b35441 fix(resourcehandler): a namespace filter naming no namespace silently skips every namespaced query (#3539)
  • * 78ea1c9a3808b1ceb99f65491caaf98239b8d08a fix(resourcehandler): dedupe served-version aliases in streaming collector (#3303)
  • * 827d9244c93a5e5b60e650acd8b00a238316734a fix(resourcehandler): do not report a kind's other served versions as unexamined (#3609)
  • * 753bac693c771ca2ae915fed4e4ece7e1631be6b fix(resourcehandler): resolve the core API group spelling on live cluster scans (#3426)
  • * c33d2fdb8a1fdf5ec8b79b54715d69d7f8581ffe fix(resourcehandler): scan Terraform-only directories (#3135)
  • * d37bc836337ae3a98021a6b80d62f4c459c4c7f3 fix(resourcehandler): skip discovered resources that do not support list (#3346)
  • * eb14d32191082557855617e78052e54991d40306 fix(resourcehandler): treat an undecided access review as unchecked, not denied (#3446)
  • * df3d64fe919b1a116cc1ac4a34e515deae808608 fix(resourcehandler): use path aliases for containment (#3064)
  • * caeb5705242932fe35cd7cf16341c50baca0dd83 fix(resourcesprioritization): don't drop attack tracks when a resource matches more than one (#3659)
  • * d7bb623d1804a202b0e16154acb8761fd77bb536 fix(resultshandling): apply severity filters to framework control maps (#3455)
  • * 7ee60cd4d5fabc8c06a206dbeea900ee1cb09675 fix(resultshandling): filter per-resource findings by severity, not the unused Report.Results field (#3388)
  • * 5963cb277ec8e3556de6e7d67f71da56472e37f6 fix(resultshandling): recompute score and counters after severity filtering (#3436)
  • * 94a635395c8201a7f3ec26dd72eb0dcf913765fe fix(rules): guard privilege-escalation RBAC rules with resourceNames (#3201)
  • * 87e7dc664af76144b0270364687c0e2e7495b086 fix(rules): handle empty resourceNames in modify-privileged-pods-v1 (#3313)
  • * 55a79e7698963412bfd0825415aa31a10a9788ce fix(scan): apply the resource kind filters before collection, not after (#3411)
  • * 285ea5c78b5dd9655852dbd1447b3ecea89d10d3 fix(scan): clarify --min-severity is output-only and warn about thresholds (#3458)
  • * 4a86ddbfaf14e3952860acbdf02e97be419bbae0 fix(scan): collect a resource once when several API versions serve it (#3297)
  • * cd20fca0f239bc06589837d7241d650d29bf0323 fix(scan): fail explicitly on unmatched severity threshold (#3456)
  • * 1e1aa3bc6b9157f5a4eb938cfa52eb800c7ace90 fix(scan): keep CRD policy clients target-scoped (#3262)
  • * c7ba7d55dec976fbac797fb6f90acc63768110ce fix(scan): preserve exact manifest file selection (#3270)
  • * 585671c8c5088a06ac24d038938493766a724354 fix(scan): propagate combined image scan failures (#2965)
  • * a5efbb1d76c7552439ec4640a85394f545f54b5b fix(scan): reject NaN posture thresholds (#3279)
  • * 231da929a4182b6885964ba0d183179d6775b87d fix(scan): reject invalid persistent flag values (#3130)
  • * 70a8c596bbfafe0336b48d6b6359e2db4ad222c1 fix(scan): reject trailing JSON manifest data (#3264)
  • * d12ecd687f10dbda9c843ee57b55a09a1c894bf6 fix(scan): report parse failures suppressed by "{{" content sniff (#3274)
  • * 39aa0ecd83bd8eb3748f061bc671390a7c118310 fix(scan): resolve markdown output paths with the .md extension (#3073)
  • * 11a4c742cfc536108ad0d701c340a11d64ff4882 fix(scan): validate --label-selector in ValidateCommonScanFlags (#3502)
  • * 1647537685e7cd4de77cdf92ec2e89c93b8b14cb fix(scan): validate minimum severity for subcommands (#3131)
  • * eaffd10238c00da945380467fd82e2a6ad308f1e fix(scancache): reset dirty flag after Flush writes cache file (#3515)
  • * 8d468e32b6483506df988534783f205dfd997104 fix(storage): implement control merge strategy for WorkloadConfigurationScan (#3107)
  • * aa3b8a3f676991aa623a234a20f8b4861d3f4596 fix(storage): recover missing workload posture controls (#3545)
  • * 429df61c9ef0e10fd7db7b1208552db1e64b9e0a fix(streaming): report complete resource telemetry (#3260)
  • * dfc7b0e3fb40f33e9daa868b014910351d52c85a fix(terraform): map sysctl blocks to Kubernetes sysctls (#3133)
  • * 8084b6d561784e19f1d9c77c8951e987d00c5abf fix(vap): refuse a parameter reference that does not match the bound policy's paramKind (#3511)
  • * a9d0ba3c56633a8afa2a60fc182b8cb7103d64d6 fix(vap): reject a resource rule the bound policy can never match (#3394)
  • * 45d64228ddb27b8dd3f7200e2c66dd9f74968bda fix(vap): report a namespace selector that cannot narrow a policy's cluster-scoped resources (#3597)
  • * ecf6e1eafc64b9750fca726cfbe875db1ba427ae fix(vap): stop create-policy-binding silently rewriting the label selector it was given (#3468)
  • * 141001b8ad90283adc5ecca077adfabd54e489c7 fix(vap): validate the --from-release tag before building the release URL (#3296)
  • * 7838f62bb53e7f46bb729f67b10bbc56288ea0bd fix(vapreconcile): correct binding-scope coverage for cluster-scoped resources and Namespaces (#3592)
  • * 7cb079b3e4b0a832c9c10f2e68c5fe795af985e4 fix(vapreconcile): credit admission enforcement to the policy a binding names (#3433)
  • * 6834f9f7040ff65371c1476cf40a1b97be38d5c6 fix(version): propagate text output errors (#3129)
  • * 6c68c56dbecfdb9bc221b7e22fb294091c1430d5 fix: Add chunked pagination to SecurityException CRD retrieval (#3393)
  • * 76dd1b0e20a5305c7077eebb3d1b59b2de31dd85 fix: PolicyReportPrinter.CloseWriter now returns the close error (#3408)
  • * 9192e12b1f6d71dbf428f7514d1578c0e4d4f147 fix: Terraform loader now recurses into subdirectories, like Helm/Kustomize (#3349)
  • * 68b964ddabd48c99263b6ce29820f8593776591c fix: Windows absolute paths parse correctly when document index is omitted (#3070)
  • * d93b6f6aa96467dcc1d3ec38c32f1ae00cbed3bd fix: accept key==value label selectors in vap create-policy-binding (#3404)
  • * f4958ea5990dee248a6c5864d15a41c8d7ee70f3 fix: check SetWriter's error in writeBaselineHeadReport (#3410)
  • * 00617362df2fb917a922786aa9125f4e8b8a5d49 fix: compare --output file extensions case-insensitively (#3334)
  • * e1a700fb354ab26f63945131f63ff826c1ac33b4 fix: count manual-control exceptions in the exception audit (#3371)
  • * 460a0d69616b70b059dc8d677f14c203e473de1c fix: deduplicate included namespaces in splitNamespaces (#3599)
  • * be9c57d1d0a06117bbb417ba2ec30a2915121bef fix: diff --severity-threshold fails closed on unresolvable severity (#3406)
  • * 4c734b46705f98d793b17a892c7b9cb109134b5d fix: embed HTML report logo instead of loading it from GitHub (#3336)
  • * 64abe4a316d2f2cc326c2538ad8551e9f3a94863 fix: implement chunked pagination for namespace counting (#3467)
  • * 53af997412a28cf420caa811c3f2d30ab85c5b7b fix: initialize all vulnerability severities with placeholders (#3498)
  • * 3c7fd6af1379e39413c6910163f13ffe0c1e96ef fix: normalize namespace '*' to empty string for cluster-wide scans (#3087)
  • * 18f4ffb8a8691bde76a58a9cb5b0907d4b7a76ff fix: prevent panic in getLastLineOfResource for empty yaml files (#3203)
  • * c2c1d3f72fbc4a546fef4dc153784a80a512a6dd fix: remove secrets from cluster size estimation to tighten RBAC (#3478)
  • * cab64a200478a8810c1bfb2c597289fdab6eac50 fix: scope cluster size estimation to included namespaces (#3538)
  • * d4c9812cfa47831b12667fc788bcbbad1d14d710 fix: stringify error before json.Marshal in RecoverFunc to avoid empty body (#3075)
  • * cd00b583cd1a35bb31e4e0c3a2ef673f7624d2da fix: subsume CRD exceptions with a scope-less cloud exception (#3370)
  • * f755eb12f7e91b51129582382fc5167c868d9895 fix: use C-0035 instead of C-0016 for RBAC scanning (#3085)
  • * f0a62d13ee4ee6a0a42ec50ecb1951e02a316098 fix: validate URLs in config set (#3585)
  • * 88840d9e662ce4c40eb16fd2b31a8bbdf77d2500 fix: validate layers and vulnerabilities in ScanResultReport (#3126)
  • * 793f9546ae473d29b994fefab4f608eb51ece394 fix(opaprocessor): match CIS section numbers in --skip-controls/--include-controls (#3658)

additions (90)

  • * 88f24cc16dd3ddb4299f98ad2756c8a418365156 Add C-0298: detect subjects that can attach ephemeral containers to pods (#3017)
  • * 6bc13df3cad518e62556fc0ec071c2b7fb4e1c55 Add RBAC-police rules for issue #916: impersonate, token-mint, escalate, bind, node-proxy, PV create (#3093)
  • * 437bd633a05d319cb94cb96efbb835c3409f18ba Add URL context to repository scanner error messages (#3650)
  • * 321b6c05dda31e475d540c4946b5b75ceda5371b Add opt-in audit for posture exceptions (#3095)
  • * 71caf026b2e37aeca8b216712fa26a533733d291 core: add ScanContext, an explicit-context scan entry point (#3237) (#3432)
  • * 858f1d532e9dcfc8deda684f7dc3ed58c4e4be52 core: add ScanImageContext, closing the last explicit-context gap from #3237 (#3442) (#3443)
  • * 61ca76ca71885c3f295a7790be5162a8a7ee2d76 feat(anonymizer): detect pseudo-ID collisions in Mapping.GetOrCreate (#3417)
  • * 6bd86841edd1e3f4439c1d938cdea183515d8552 feat(config): add cached config validation (#3663)
  • * 3496ee1fbbdeb3ddbd5871429847530ae92fe903 feat(config): add config view output formats (#3055)
  • * c109477698fe206673fefbf4f84bde105e2d62a8 feat(config): support --format / -f flag in config view (#3641) (#3642)
  • * bd7ffe44d629e8bc22a4451240b8bb809a847113 feat(containerscan): validate layers, layer hashes, and vulnerability names in ScanResultReport.Validate() (#3591)
  • * 3286d8c3ea43cc2030c2f4b9f95fd280e598b480 feat(coverage): flag frameworks scored 100% purely from irrelevant controls (#3421)
  • * a819b8e6a4e4bd52503d07abd2c10568a1320ee9 feat(coverage): report resource kinds no control examined (#3588)
  • * 352a396287bd63986404ff685dcd00c2f35775f0 feat(diff): add aggregate summary outputs (#3626)
  • * 2fe500ce8aff555a9957784bed0ac5b7e3cabf56 feat(exposure): model external exposure via Ingress, Gateway API, and Service type (#3648)
  • * a87aed89c4f568d2d3dad892ddbac729c852c34e feat(exposure): model spec.externalIPs, flag unconfirmed cross-namespace backendRef as unclear (#3679)
  • * 75e692e090ab5a75bd6a9609aac2c02759b7a7e1 feat(fix): select which controls to remediate with --include-controls and --skip-controls (#3714)
  • * f0914ba6fefa2427eb38bd8d3c455bdc6f78023d feat(fix): support cluster scan reports by printing patched manifests (#3705)
  • * 146d46b80d5dcbd8f484c19f746edf03ab509d9b feat(getter): support --custom-rules for user-authored Rego rules (#3419)
  • * ca4253c977341a8d229069266b9f9b89aa35b584 feat(imagescan): add --skip-db-update flag for offline image scanning (#3387)
  • * 78f14854335116434dc6614e8c2c925f46ab03c3 feat(imagescan): add native GitLab vulnerability adaptor (#3210)
  • * ad7b416b6206675e50381cb2f443936ff8527023 feat(imagescan): add native Harbor vulnerability adaptor (#3209)
  • * 00b709cd843b30c8a539db4aa9540025828b33fe feat(list): filter controls by framework and search (#3624)
  • * 1a73d267d89fe93da596a0cf496098a60116d8e0 feat(list): show the control configuration a scan evaluates against (#3586)
  • * dcc5a0b7f9a64d1a81b3cccb8720944966893685 feat(mapreconcile): add MutatingAdmissionPolicy discovery and impact matching (#3606)
  • * 35ff0da5476c805758bc8b5295160b451033094c feat(mcp): add scan_controls, scan_local_iac_controls, list_frameworks, and list_controls tools (#3252)
  • * 1ee4b9d073d7b914751a4e48565e977f5f1aa333 feat(mcpserver): add SSE transport and advanced MCP tools for LLMs (#3375)
  • * 3ba8218ef6988864cff4a3e6a64eb58c3c1150d2 feat(mcpserver): add apply_remediation tool for deterministic AI auto-patching (#3568)
  • * 7ac644ade55a292eca7f3d71d6c204ce6e217bcb feat(mcpserver): add scan_workload tool for single-resource scanning (#3669)
  • * aa3fb76e17cd0da473fee880fb61261951c80f5e feat(networkpolicy): add real NetworkPolicy reachability engine (#3601)
  • * d41b6fe2099db7833ab98a836edc14d8eedb82d8 feat(networkpolicy,vulnexposure): correlate vulnerabilities with NetworkPolicy exposure (#3632)
  • * 4d205392243c9a117947643404073898e702201e feat(opaprocessor): add inline exception suppression via resource annotations (#3392)
  • * e86026fc5de70ee98b92b568ecd3202f195d3bc7 feat(operator): add findings-driven targeting to the remediate CLI (#3474)
  • * e02e225df88e6cafa91892e7661dd2ba0ca76f00 feat(policy): scaffold custom Rego rules and refresh test fixtures from rule output (#3635)
  • * 0cf33c44d4de186c8348c1411aee858660949cb4 feat(printer): add github-actions output format for inline PR annotations (#3637)
  • * 42ced6e7345bbb83859feeb3890964e8ebc74eb3 feat(printer): generate a posture exceptions baseline from scan results (#3560)
  • * 4ae94d189e04dde0725f37a267b1600d9b41f2f2 feat(rbacgraph): model multi-hop RBAC privilege-escalation paths (#3681)
  • * b0ea5313de14e8e4f361f7b3e8bfd1e1e48f0593 feat(rules): add approve-csr-v1 (#3298)
  • * ceef75a18fd4ca6e21535021360efcde5cd9fa9b feat(rules): add assign-serviceaccount-to-pod-v1 (#3148)
  • * cae36412842e9cea301009cb6d7a28bb74867cf4 feat(rules): add issue-token-secrets-v1 (#3174)
  • * 24b1fd4017497fa88ee4d9708cb5947e7a6f980d feat(rules): add modify-node-status-v1 (#3330)
  • * 6a1fe89993a770314ae92e3e3df0fdc1b4b28154 feat(rules): add modify-pod-status-v1 (#3332)
  • * b3cf05f9a9a3ad5041661559e26df751b3ae8a93 feat(rules): add modify-privileged-pods-v1 (#3146)
  • * 3575421c26ec57a187fb79e586880d37047143cb feat(rules): add modify-service-status-v1 (#3291)
  • * 281d9ff355c76dc3d74775c37f83d4e4faf41cc8 feat(rules): add provider-iam-assumption-v1 (#3149)
  • * d5b1f40de7a0d4c2b19e82fcdb0d10b8c0f5622c feat(rules): add steal-privileged-pods-v1 (#3224)
  • * b4faa6e10b243684470c5f9dfb12d97f9476b527 feat(rules): add weak-namespace-pod-rce-v1 (#3147)
  • * d9c9372033bd346d00c5ceb914be10129f7ed8af feat(rules): add weak-namespace-token-access-v1 (#3339)
  • * 2d1912fda4ae31a3b8162f999148e00fc4eaea9a feat(sarif): show current field values in evidence paths (#3062)
  • * 1e3820554eb429e939cfe1670600540aafd50126 feat(scan): add --dry-run RBAC preflight check (#3083)
  • * 61927afd06d9fa14e06ccc004f2256f8d3a49f97 feat(scan): add --exclude-controls to drop controls from a framework scan (#3441)
  • * ce654fab76b131c7112f9fbb93c12a185abc9dd6 feat(scan): add --exclude-path and .kubescapeignore for local scans (#3422)
  • * dc08f5e7b305e3a69ccacc170cc2e1064635b735 feat(scan): add --include-kinds and --exclude-kinds resource kind filters (#3372)
  • * 80355443d2c666d5b0fb452bdb2b808e27cb86c9 feat(scan): add --show-evidence (-E) and --show-secrets flags (#3220)
  • * e693bc29736a1c0dc6f36f554a7b15a3d5417a34 feat(scan): add SARIF contract validation output (#3622)
  • * dcd7118fcd8515137f966f77494ef71bb5824de9 feat(scan): add Slack webhook notifications (#3571)
  • * ef61a5a8363f5f4e9759aa6486fa249d23e606df feat(scan): add contract report provenance (#3607)
  • * 9f0bb332875f58928653a05f0988841304519882 feat(scan): add generic webhook notifications (#3504)
  • * 71fd98814f4cd02f8ee7b4e43013e75d2b9b6d24 feat(scan): add per-namespace compliance rollup (#3704)
  • * 77e5ff36b4298a176bdc15e5ac5ee0aec6b8d4ab feat(scan): apply repository scan contracts (#3537)
  • * bd56cb54842cd0376c6fef0edd1f99c83c2f982f feat(scan): emit CycloneDX and SPDX SBOMs from posture scans with --scan-images (#3698)
  • * d255b2047613e7a4fab5e7c9fd484882030a25fe feat(scan): extend --min-severity to all output formats and add --max-severity (#3337)
  • * fbe8eef82a879c09e793aef246dc57d96f055464 feat(scan): implement missing controls listing in ScanAll functionality (#3300)
  • * 3e0635f1fb56d0c99581ccd252b3b2faf5d15403 feat(scan): record contract runner input digests (#3640)
  • * 8932c98367339e56d5a6ef454d1996b716b38c6f feat(scan): scan multiple images in one run sharing the vulnerability database (#3682)
  • * 93e722b7beb4f97f9c3c21350053395e124d294c feat(scan): send Microsoft Teams Adaptive Card notifications for --notify webhooks (#3645)
  • * c8a0bb39fca574c06cb4aa923b7959eb2558b3ed feat(scan): validate repository scan contracts (#3481)
  • * c8e5d79863c0f3930d637654159e84faab0de52c feat(scan): wire CEL ValidatingAdmissionPolicy evaluation into the scan pipeline (#3513)
  • * 2b0deac5f64cdbdf9c18848d623badd718f500c2 feat(scan): wire up sequential multi-cluster scanning via --kube-contexts (#3438)
  • * ba47e9dc2c5fd43317be11ffed8b4accadb32aed feat(telemetry): report image DB freshness (#3604)
  • * 39a381eca6400edd99e25c7b4f2427a26fbf6577 feat(vap): list embedded admission policies and the controls they implement (#3674)
  • * 11d6db331dc822245653faa5f44457f2481ad7b2 feat(vap): scope a generated policy binding to specific resources (#3283)
  • * 9e90ed005a9e7fcc3b6ebdf06ffc8d2f51245987 feat(vapreconcile): add dynamic discovery and fallback for VAP versions (#2880)
  • * 06edc3a0c1663f4518a6aa38dd9e093fedd02dc7 feat(vapreconcile): add per-resource VAPBinding scope coverage (#3570)
  • * a9934dd767691f1a80d01dd054c07bebd1245886 feat(version): add yaml output format support (#3542) (#3543)
  • * 1527e546c560456628db6a999ff7f6fa99738085 feat: Add context-aware VAP for ActorTemplate and WorkerPool (#3466)
  • * 54c4d07de64b334df33d9ab4444bc0d37dc7f65b feat: Add eBPF telemetry correlation interface (#3226)
  • * 0c15c020ce1a899e8c42a604dbb78f877e0ebe86 feat: Implement global chunked pagination for Kubernetes resource retrieval (#3428)
  • * 2000541627225fa7138a189716f2f1f6d7ebfc6a feat: Streaming OpenVEX / CSAF Attestation Engine (#3294)
  • * a072e35e31ef186087393f89b447a899e974fa12 feat: add --min-severity flag to filter JSON scan output by severity (#3053)
  • * 5c34e878990f7dacbe4e0e9a94174029de27a8e7 feat: add PolicyReport/ClusterPolicyReport (wgpolicyk8s.io) output format (#3125)
  • * a613ff5dea35b03a26077b48c4515cff7afd6a22 feat: baseline drift detection for live cluster scans (--baseline) (#3353)
  • * b86ed44d30a9eab633fda81ec177c43155889f5d feat: emit exception-match events for file/cloud exceptions too (#3373)
  • * 36749b4698b876b85c2954699b8ab62aff37330c feat: incremental scan caching to skip unchanged resources (--incremental) (#3412)
  • * b8fe42fc0bb36c36e3741cfb0e7cb9103e97a9d8 feat: support --format json for the update command (#3617)
  • * 6827c35feb9732b92f1ac6cdcbad3e9b42f643f5 feat: surface skipped manifests at scan completion (#3031)
  • * 35a201fd7a63d82c0e1619769a60bf45f7e49b61 feat: surface vulnerability DB freshness in image-scan results (#3356)
  • * 250e58f9258bcecaebd6717fa666d519e1abff20 fix(diff): emit CI regression artifacts (#3379)
  • * 806e14e718e608c3c9e12ee22baaaf113358f30d fix(scan): add --skip-controls and --include-controls flags for selective control execution (#3480)
  • * f8a166184476f5ecedef8df991d2ead1461f6d65 feat(telemetry): export scan traces and metrics to an OTLP collector (#3521)

value changes (56)

  • * c90ae813a2b4a4ee8b438ccf20c374736c17bf6a [LFX 2026] chore(deps): bump opa-utils to v0.0.312 for alertOnly exception semantics (#3615)
  • * e6fa8bfb057b8a09849f1e98d4bb749b36c9ab71 chore(cel): bump the pinned CEL policy library to v0.14 and sync the bundle (#3556)
  • * 16b28e24a8d6e7a57eab83a52881226cf1b2c35a chore(deps): bump github.com/armosec/armoapi-go in /httphandler (#3526)
  • * 66df9156a623ad24046089accfd6d4389e6f5f00 chore(deps): bump github.com/armosec/armoapi-go in /httphandler (#3686)
  • * 6f0b30371213e099105ba4bfe4a8477671130d80 chore(deps): bump github.com/aws/aws-sdk-go-v2 from 1.43.7 to 1.45.1 (#3711)
  • * 7dbd0b6c6833e4085581a5cbe6771887da214f4e chore(deps): bump github.com/aws/aws-sdk-go-v2/config (#3528)
  • * 1824b77f6395b0f2fcb8b61fb9a56f425b84f348 chore(deps): bump github.com/go-openapi/runtime in /httphandler (#3685)
  • * 351e4c06332493d90882a5d66a399a0a24adcbbf chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.8 to 6.8.3 (#3530)
  • * 43588f538b3d1923015ad131c29a3c60cdb80834 chore(deps): bump github.com/kubescape/backend in /httphandler (#3684)
  • * e4868d9d2efb9f0dab7815ced3ee2e69c3b67037 chore(deps): bump github.com/kubescape/go-git-url from 0.0.31 to 0.0.33 (#3529)
  • * 97aa966b9089c2c50fe8514005cc9b7eff6f9028 chore(deps): bump github.com/kubescape/go-logger from 0.0.28 to 0.0.34 (#3695)
  • * 42158fdfa0524fca6ee93cb47e8dccd14f62835b chore(deps): bump github.com/kubescape/go-logger in /httphandler (#3522)
  • * 9646cfd0f2988bf4fe0483287111b6d0c3cd37f6 chore(deps): bump github.com/kubescape/k8s-interface in /httphandler (#3166)
  • * 6b909115b18bd65f8f2c887528343b2587a68c57 chore(deps): bump github.com/kubescape/opa-utils in /httphandler (#3524)
  • * 41a952c56524a89d8ecddc9941fe6e518024bb44 chore(deps): bump github.com/kubescape/rbac-utils from 0.0.21-0.20230806101615-07e36f555520 to 0.0.21 (#3170)
  • * 6cf53be4c282a495c5b7f3a2a59fb2b058c3b4b2 chore(deps): bump github.com/mark3labs/mcp-go from 0.29.0 to 0.57.0 (#3168)
  • * b5bd33428d7c39ca357f9b8fcdad6e255d4faf41 chore(deps): bump github.com/mark3labs/mcp-go from 0.57.0 to 0.58.0 (#3692)
  • * 03814d5346be2aabca889d63ddcde666200eebd6 chore(deps): bump github.com/maruel/natural from 1.1.1 to 1.3.0 (#3696)
  • * 336432cf6f3743c0de21f42d878ed1fc4bd73c9b chore(deps): bump github.com/mattn/go-isatty from 0.0.21 to 0.0.24 (#3710)
  • * 80bbc866222c63ea5acfc8dd58a5cee8f6d40045 chore(deps): bump github.com/open-policy-agent/opa from 1.14.1 to 1.19.0 (#3167)
  • * 285affd92b080a14c1d956310ef8c6829ab12f20 chore(deps): bump github.com/owenrumney/go-sarif/v2 from 2.2.0 to 2.3.3 (#3523)
  • * 4f0229f7d77abf112a679aeb88214068c860bd31 chore(deps): bump github.com/zclconf/go-cty from 1.17.0 to 1.19.0 (#3531)
  • * b5860045071bcf3f625ccd2fdaefbced6f056545 chore(deps): bump go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux (#3169)
  • * 7dc067bf11b4d4a0e681dd18dbfd691f472426ed chore(deps): bump go.opentelemetry.io/otel in /httphandler (#3163)
  • * 40ee29c88d9e71327d8c68a51b23bed059278723 chore(deps): bump go.opentelemetry.io/otel/sdk/metric (#3164)
  • * 44af76ca7ed35f3e9e18ff01ae684a48b810e07e chore(deps): bump google.golang.org/protobuf (#3690)
  • * aecc40c43a1b7188ac5c4a9f4d675e224c03576e chore(deps): bump k8s.io/apimachinery in /httphandler (#3165)
  • * 76485e50c9f08890f7158ee210b28abf4aa918c0 chore(deps): bump k8s.io/apimachinery in /httphandler (#3527)
  • * f7e4d10c987dc932db447a9140ebb109f9916eba chore(deps): bump k8s.io/apimachinery in /httphandler (#3687)
  • * 29682f6c4638c9a7349cda2a174b76dc66c6e690 chore(deps): bump opa-utils to v0.0.309 to pick up the NewScore singleton fix (#3416)
  • * 614497b6d4b0e5628bd9d8d54fa9766de1fee8f6 chore(deps): bump sigs.k8s.io/kustomize/api from 0.20.1 to 0.21.1 (#3162)
  • * 1c54706d122e725f3b271fe5346c7ff5a04105af feat(cel): evaluate VAP matchConditions offline instead of refusing the control (#3222)
  • * 5aff86e0b4a5af56c0589a8e8f5ae975f11fc511 feat(cel): honor VAP spec.failurePolicy for validation expression errors (#3583)
  • * fcc1fd83fcc7b06b38fff70ef3004624076cf772 feat(gitlab-sast): populate Solution field with fix paths and current values (#3182)
  • * e06a1c545014d9b4d96bab7cad787baf634747b8 feat(image): surface VEX status in reports (#3594)
  • * b08c5550700ced4f1621834e9f44825b7e0a797c feat(printer): include evidence paths in GitHub Actions annotation messages (#3677)
  • * 60f5017977004f4356c42fac974f5c9c95aa9be9 feat(printer): render map/slice values in AssistedRemediation evidence (#3254)
  • * f6ec4e957ec43582b3b511692f22ea8836860868 feat(printer): surface failed-path evidence values in JSON/YAML output (#3256)
  • * 40e302c40de1620f00d0a989a218b6d597828c65 feat(sarif): add stable scan fingerprints (#3639)
  • * 2b435a126bdc39046181377d0ce92fa087ab7f2f feat(sarif): resolve each FailedPath to its own relatedLocation (#3257)
  • * 2ade57112a10037ab0b99f6332380e2df123f51f feat: parallelize OPA control evaluation (#2825)
  • * 90f9ae71335750ff26cb3c8e27eb5113cf469906 fix(mcpserver): scan_resource_slice returns [] not null for an empty result set (#3506)
  • * d689713a9350058939ed353816ba0e3108c624ad fix(printer): add container names to HTML/SARIF evidence paths (#3301)
  • * 48303c86cbb5fd04335bb5f5e4a8c0c0e663180b fix(printer): annotate init/ephemeral container names on evidence paths (#3292)
  • * 7da2a148d235ac99783777541d3a4c8dfdcb662f fix(printer): include the scanned platform in GitLab finding ids (#3713)
  • * 5d498b39d688da4c88ae316b01dd59bae29a00f2 fix(printer): show assisted-remediation paths in control-view resource list (#3359)
  • * 129b49b5a29ada4d39d7a43b01abcab2374efbb2 fix(printer): support multiple image SBOM generation in CycloneDX and SPDX printers (#3399) (#3400)
  • * 86b436ac283e22cae115f0b0f5fb9591f0593a61 fix(results): preserve exception audit in programmatic JSON (#3277)
  • * a5fe36c32745d8d8bad3754fd37337df6da4c076 fix(results): preserve scan ID in posture reports (#3239)
  • * b1011854517570fabbfa09bc2aa945b4f0cf5a6e fix(resultshandling): deterministic AssociatedControls ordering across scans (#3590)
  • * 68ade8e4fdd88d5d77f13cac3dfd71ff2e7cbeab fix(score): route dead telemetry scorer output to logger.L().Debug (#3702)
  • * ee50c298686f42dfa14a4534df14c88fde08534d perf(fileutils): resolve directory ownership by ancestor lookup instead of scanning every directory (#3092)
  • * 0bf63073b1cf91a8d93486dbb407dcae8b699b83 perf(opaprocessor): cache LARGE_CLUSTER_SIZE threshold per OPAProcessor (#3342)
  • * 1d96e4a25e571350ecea0b7fe0beea5391b0411b perf(printer): dedupe image scan summary in O(N) via a shared helper (#3178)
  • * 0d842d3b3834fabfce1b571e2f12cfb44db12d27 perf: stream JSON outputs instead of massive byte array allocations in memory (#3670)
  • * cfc1db58505b7b3910bb6565f3a3ab0434c913ae chore(deps): bump github.com/armosec/armoapi-go in /httphandler (#3161)

constraints (14)

  • * 99193247e815f35ec55a48be83717d3100b59567 feat(fixhandler): apply fixes to JSON manifests (#3608)
  • * 76cf9a5fb529b178059760cc33be74c049d6be50 feat(getter): load custom rules from the standard rule directory layout (#3553)
  • * 23ac4a5a1f29dc60fbf40c6e4088f50c60a03b6a feat(markdown): support image scan reports (#3573)
  • * 4ea7d4a849d806783c66162cf984feccc913e5f5 feat(printer): support initContainers and ephemeralContainers in assisted remediation paths (#3578)
  • * 5cde74e3b84080f536b964fcf989de1f4e12f6bc feat(resourcehandler): collect via namespaced endpoints under --include-namespaces (#3683)
  • * d255b2047613e7a4fab5e7c9fd484882030a25fe feat(scan): extend --min-severity to all output formats and add --max-severity (#3337)
  • * 1644f548b95d50064aec1df7bbdfdeb4542facdb feat(vap): allow a policy binding to declare multiple validation actions (#3295)
  • * 1e914ad871d149062d73e4421fdda19d9f208f18 feat(vapreconcile): discover the served VAP API version instead of assuming v1 (#3196)
  • * 7e8bc58f73d5abfc98a8b3fe4c256ec3c73cdc3f feat: Add GCP and Azure support for DescribeRepositories and ListEnti… (#2573)
  • * 4c7dc1b8058a1eb1a5537beaaa85a5eb0a4e9c68 feat: support downloading all controls when no ID is specified (#3435)
  • * 18fefe12fe0702457665ff82ab16755ace07b5ff fix(download): accept plural and alias target arguments (#3666) (#3667)
  • * 22e6aa9f9594ae8e51418b2014823e6cfba5d5c9 fix(fixhandler): reject yq expression syntax in report fix paths (#3096)
  • * ae599c7ff9b9df850fa6a764452062141eec1d33 fix(gitlabsast): reject absolute paths filepath.IsAbs does not recognise (#3076)
  • * 254cbcd08184082e341f93ae2afdea49e2881d17 fix: add missing CronJob, ReplicaSet, and Job support to MCP get_configuration_drift tool (#3282)
Kubescape 스택에 추가

조치가 필요한 릴리스가 나왔을 때 주간 메일로 알려드립니다. 이번 릴리스의 보안 패치와 브레이킹 체인지 같은 것들입니다.

스택에 추가 →
공식 릴리스 노트 ↗Kubescape 릴리스 전체 →