RATATOSKRATATOSK
로그인

Kubescape

v4.0.15Security
2026년 9월 29일

CHECK 1OTHER 101

보고, 스캔, 플릿 관리 기능이 개선되고 정확성 및 의존성 관련 업데이트가 반영된 유지보수 릴리스입니다. 기본값과 적용 방식이 달라진 부분이 있으며, 새로 추가된 운영자 요구 사항은 없습니다.

영향 확인 (1)

  • breaking스캔 네임스페이스 기본값과 클러스터 전체 검색 조건 변경

    적용 대상이 릴리스 노트에 명시되지 않았습니다.

    워크로드 네임스페이스를 생략하면 기본값으로 default를 사용합니다. 클러스터 전체를 검색하려면 *를 지정해야 합니다.

그 외 기록된 변경 101건 전체fixes 65 · value changes 18 · additions 13 · constraints 4 · defaults 1

fixes (65)

  • d52269cd30487f286772ad44f7b35277cc5ff613 feat(fix): honour --output-dir for file-based reports (#3880)
  • c79a1fc4881ba9a0bc6dd790bcc933b98382ae4e fix(anonymizer): keep failed transformations from corrupting reports (#3888)
  • 38679a1ea06b8fe36b9b0ddc7611d7c8dcadeb51 fix(cautils): do not carry tenant identity across --kube-contexts scans (#3813)
  • 26cca654d8ab7e5435c4bad4bfbd32aae3d64510 fix(cautils): recurse nested JSON arrays and ignore non-manifest JSON values (#3817)
  • 904bfaf52ee5b7bcd0ce5e449b5171b3faf941a5 fix(cautils): skip non-regular manifest files instead of reading them (#3931)
  • 876554fa44cffacbef3dc5ecc1e90a175a927fea fix(cel): avoid false findings when Namespace data is unavailable (#3920)
  • de3088b8da22b638de0b72c6b5df22f8a3e9870c fix(diff): extract failedPath evidence in granular comparison (#3921) (#3922)
  • 78422ab7d0311cc43d4644c6d2f1b56328c1143a fix(diff): honor /dev/stdout and /dev/null in diff --output (#3820)
  • 0b64d3694c6040e997d8774e0919958fa24dba3f fix(exceptions): generate suppressing exception baselines (#3783)
  • 902a546335845e02d5783d52ecf6b12d178848f4 fix(getter): fail on checksum verification errors (#3791)
  • 46b5366581fd137c4d8b1708bd1818810d766ac6 fix(hostsensor): preserve virtual host resource identities (#3891)
  • ab15de57bb45809eaf0dbaedfbdbdb9161de6f52 fix(hostsensor): surface partial node-data loss as partialGVRPulls (#3844)
  • 0bfccf2c367548a245170ffe9f45e07274b4b0e1 fix(httphandler): deliver scan-completion callback on scan panic (#3828)
  • e1efc4b6659666166f0d04e173980e95d93d5521 fix(httphandler): do not abandon a posture report on one store error (#3822)
  • 5254245785d3f28ba9ff780f5d698e975b7c9a76 fix(httphandler): set DisableKeepAlives to true in postScanCallback (#3948)
  • a66fa33d6f8b6fef529b63a4db6176b7aa1b7413 fix(imagescan): correct misleading log in ProcessImages and break severity loop (#3856)
  • 87a7e20c96426cfa3e54f406f0e41d28318fa39f fix(imagescan): fail closed on unknown-severity CVEs in threshold gates (#3832)
  • 97230f2d892341f61f0a41c8ce33e04614b206d4 fix(imagescan): prevent silent swallow of azure image id validation errors (#3900)
  • 605728dfad78ebc25983fbf7abdbb8f2bb104e95 fix(imagescan): stop stalled Azure pagination (#3883)
  • d774660c6a68cc7c4b16f82ffec7022f4ec4ed71 fix(imagescan): stop stalled ECR pagination (#3882)
  • f266abee04771ce02a64b7daa267ebd7b76bb367 fix(imagescan): support nested Harbor repositories (#3860)
  • 81f0ba773a2f447c9cd85dc010381a5390053109 fix(imagescan): warn on stale vulnerability DB, fail with --fail-on-stale-db (#3830)
  • fe4fea3dfef657e6b9432806b13247ffcc5e02dd fix(junit): aggregate and serialize skipped count in root testsuites element (#3932) (#3933)
  • bbf8d839f8d1ca9ab787313d5ef339b9d1dcf41a fix(kubernetes): stop stalled pagination loops (#3859)
  • eaaf82e1d050d7b3f8bb479f05cc9403f5bb8d2b fix(locationresolver): reject negative nodeIndex in ResolveLocation (#3879)
  • c342c03ac1ec20d18b14e50e38b5a4a7a6ae1626 fix(mcpserver): skip IaC scan tests if offline policies missing (#3806)
  • 2c389c6a37ad527d9b8fbd32cda37465e7654d39 fix(networkpolicy): allow a Pod to always reach itself (#3905)
  • 510874b6a0c2115803efc32dd1645e20600fd1c3 fix(networkpolicy): require a common port and protocol for reachability (#3909)
  • 3fb32151c08d2b0abfdcdf93f4a1f469e658ed8d fix(opa): validate signed image digest in cosign verification (#3930)
  • 8a02cbd5169aa6782cc0e7a09ec7f18bb3939eed fix(opaprocessor): fix excluded control reinsert regression (#3915)
  • c90bddbeea2ad32c310f6b70f4eadb094ff6ffdc fix(opaprocessor): propagate skip reasons to control summary and junit (#3885)
  • 7d0921e0452f3d48b3cbaaf8e62b76f75d354722 fix(opaprocessor): select whole controls in --skip-controls/--include-controls (#3793)
  • 6fa2ef13e059031b77b184bc45a8dfe760df11ac fix(partitionstore): recognise a full disk on Windows (#3855)
  • 0f4bf1eae9eed9c7373dc6560bd8b7f930d11fa2 fix(patch): do not print usage when --severity-threshold fails (#3857)
  • 82f6b0c8629539c920f545c134f59477ca638ea7 fix(pdf): include image CVEs in combined scan reports (#3949)
  • 5c22710a34913396add5a791ccc38726424a5e1b fix(perf): eliminate O(N^2) memory allocations in image scan target deduplication (#3939)
  • 4750e2c96e74cbf7c34756cf384d1ec9fedcf849 fix(portforwarder): add timeout to waitForPortForwardReadiness to prevent infinite hang (#3873)
  • ab8d06c2f7d793cf264fc7954008c2c901c3cb0e fix(printer): assign info stars deterministically instead of by map iteration order (#3851)
  • e77f8c73d6b49011341c0c56fcd71d84f5a8e28c fix(printer): emit PolicyReport timestamps as seconds and nanos per CRD schema (#3887)
  • daaf310dac9d2b424fae7a79053400c83f3ffc0a fix(printer): include skipped and unevaluated controls in CSV report output (#3934) (#3935)
  • 7a9ef3157271f2e565eba764103e84b098af2468 fix(printer): parse bracketed path keys instead of splitting on every… (#3796)
  • dc9ef6d99c52ffc87f41e7c6898a2f7491a81390 fix(printer): qualify bracketed keys with a following index and keep quoted digits keys (#3801)
  • dc57daec647424dbf59ed06de2a4279335ed76d9 fix(printer): stream configuration scan JSON and SARIF output (#3794)
  • 8a4131fb2008a8951220c7d4427532db63a9797c fix(printer): support combined posture and image scan output in Markdown and HTML printers (#3814)
  • ae853e98481f86e10f4ad5e4e2e398ceb501c5f4 fix(printer): support multi-image scan output in YAML printer (#3795)
  • 558e9d9a12e3b1302824c4ebef50fc061807f9d2 fix(prometheus): emit container image vulnerability metrics in combined scans (#3941) (#3942)
  • bda93023737b25fe1adf5a60a5868909c57db6ee fix(release): write the cosign signing key owner-only and remove it after the release (#3736)
  • e1125fe1027c60cf11b1c271026aa7d7834f0b81 fix(reportcrypto): decrypt namespace summaries and env var names in encrypted reports (#3908)
  • c9839ae7321e99bc46180e4a94c258c0a6c58e9f fix(sarif): aggregate container image vulnerability runs in combined scans (#3945) (#3946)
  • c217e582cdb24cce282fe39f4fffc33fb0064146 fix(scan): hash policy-visible resource metadata (#3919)
  • af7ad8f22efb4ff79e68b250bb6c91b4983718da fix(scan): isolate fleet context configuration (#3881)
  • 20f624a26d4e8d6e2f2d2b22a7f3b01aa15d0d90 fix(scan): make incremental cache writes durable (#3889)
  • 7893b6d0d2e924463785a01157fef209c265e3ef fix(scan): re-evaluate policies that read status through object.get (#3918)
  • 6c801b92134d4bfe0c167b84ea6d40a5146cff88 fix(scan): restore fleet context after runner panic (#3848)
  • b3c040f7e315c39036ee25c31b17f454229303e1 fix(scan): validate format of workload name, kind, namespace, and API group (#3809)
  • 2bf48927b9fac036e471144684217fb794b808ef fix(scan): write fleet reports atomically (#3849)
  • 11038ce7c06399d94483b4f42fbc4abd6e3ed9dd fix(scancache): bypass cache when resource fails to encode to JSON (#3953)
  • fix(storage): persist workload scan report timestamps
  • fix(streaming): update partition counts after purge
  • fix: complete V2 to V1 Control Report field mapping
  • fix: populate framework resource counters and root metadata in ReportV2ToV1
  • fix: preserve YAML source formatting during remediation
  • fix: print separator for control scans
  • fix(printer): honor /dev/stdout and /dev/null in every output printer
  • fix(scan): prevent stale incremental verdicts across scan contexts

value changes (18)

  • ac7749efb28fd0e9cc64df975148061bbf7aee7a chore: bump regolibrary to v2.0.36 (#3893)
  • 0ed2ec65b3054db470da9f927c3a0887e4fe9459 ci: bump docker/setup-qemu-action from 4.3.0 to 4.4.0 (#3899)
  • 087343d486b473f4a65649e79d41e6e5f49318be ci: bump github.com/Azure/azure-sdk-for-go/sdk/azcore (#3962)
  • 59543f37fb9d0af5006c1f1f05b2b1dce292abf8 ci: bump github.com/anchore/clio (#3834)
  • b6853244941a054085cc7863a85759d04b2dc47f ci: bump github.com/anubhav06/copa-grype (#3837)
  • 4343cf64ec2e561d9d3025e9fac972e72b5734c3 ci: bump github.com/deckarep/golang-set/v2 from 2.8.0 to 2.9.0 (#3835)
  • 3ce372a7723b0b7f901fbe3b154bd2f5623869ca ci: bump github.com/johnfercher/maroto/v2 from 2.2.2 to 2.4.2 (#3836)
  • 0eaf4d78d2da0e81c54850fb7f023eb03af7f32b ci: bump github.com/moby/buildkit from 0.31.1 to 0.33.0 (#3895)
  • 15fdfc566c4b42ba0fac9d204ef570965b869180 ci: bump github.com/project-copacetic/copacetic from 0.10.0 to 0.15.0 (#3763)
  • f59fe464636ce4b7bbcc2f07970f650d287a5be1 ci: bump github/codeql-action/upload-sarif from 4.37.9 to 4.38.0 (#3838)
  • ce00b884ab7ec801db92d63fdb37371e054487cd ci: bump github/codeql-action/upload-sarif from 4.38.0 to 4.38.1 (#3897)
  • e25088c5b59703544b8e81da1d6eaaacf7a7da57 ci: bump github/codeql-action/upload-sarif from 4.38.1 to 4.38.2 (#3965)
  • 6f9fcd988331c936cbe9648d9ef4bdd7b902c30a ci: bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp (#3963)
  • 81484b32c18a0ae3909773eb835b6d3557c1644f ci: bump golang.org/x/mod from 0.40.0 to 0.41.0 (#3896)
  • a7f3a750518cfbd384f29c2e35e6392ae19055a6 ci: bump the kubernetes group with 4 updates (#3960)
  • dc77396a07093fca0b7977db030c895d04d588d8 feat(httphandler): reload namespace filters without restarting (#3925)
  • 78b5fef762716a8701f1ab220ef16e32195a10b0 feat: use mmap and fastjson for manifest parsing (#3500)
  • bump github.com/hashicorp/hcl/v2 from 2.24.0 to 2.25.0

additions (13)

  • a07aa9f4094112f1a104e21ea93bbfa8c5e448bc feat(config): Filter configurations by key in kubescape config view (#3644)
  • d4b287902f3f7eb3ad2d9ed060b343642b151aa5 feat(evidence): warn on incompatible flags and skip lines for anonymized source path (#3864)
  • 7360e443388843f260502449c973410a179ee907 feat(fleet): add the compliance rollup to the fleet report (#3852)
  • 4910049909942e0342919666c74aa5cb7ace34ac feat(fleet): print a fleet summary after a multi-context scan [LFX 2026] (#3929)
  • 0b03ed0be1f2d1bbb368b6187c6dbb275d5050a2 feat(fleet): report the controls clusters disagree on (#3878)
  • ef5333f2afcf3fa13435e8918f139a4e54cf9ed3 feat(opaprocessor): define execution policies for whole-cluster controls (#3877)
  • 16cfe102f11551a6455fe9bf8e37d7083da90484 feat(printer): add scan coverage to markdown, HTML, and CSV (#3937)
  • 028c4887fed286aa17d5ae1d4bc3db1ee37f94a7 feat(printer): report degraded scan coverage and skipped controls (#3926)
  • d411dda74dbb056111b810c51077899ff968c383 feat(printer): resolve fix-path line numbers in --show-evidence output (#3786)
  • 765d368e9e049cdbe2009a16b0be2a4a5e43c6c3 feat(printer): resolve line numbers for delete and review paths in --show-evidence (#3845)
  • 4ab599f1caaae4b0b9b0791b0577213184ec08f3 feat(scan): add --fleet-report to write one combined report across --kube-contexts (#3815)
  • 4e039224c4c8b76d1f846c74c03d160e308f54cb feat(vap): include complete Agent Runtime policy set (#3871)
  • 3401a493768f1cb2470fe3447fa83522e1392e46 feat: add support for deleting specific configuration keys (#3672)

constraints (4)

  • 3a7778aa585e7d8d5d904364d4204a4e89a0c268 feat(imagescan): support Quay vulnerability scanning (#3917)
  • f7533fccda082433e91eed919d21f5f6b96bf429 feat(imagescan): support full Azure credential chain for ACR image pulls (#3853)
  • 2adae0d663cedc8cf3d5264e9cb74302be610522 feat(locationresolver): resolve bracketed-key paths by building yq expressions from parsed segments (#3816)
  • 0372433e255ec59f2684c1237df630acdf2e764f feat(opa): let C-0236 accept key-signed images without a transparency log entry (#3967)

defaults (1)

  • 77c05048cbee3545e332eca3f0f81a7a4b64eaa5 fix(scan): default omitted workload namespace to 'default' and require '*' for cluster-wide search (#3798)
Kubescape 스택에 추가

조치가 필요한 릴리스가 나왔을 때 주간 메일로 알려드립니다. 이번 릴리스의 브레이킹 체인지 같은 것들입니다.

스택에 추가 →
공식 릴리스 노트 ↗Kubescape 릴리스 전체 →