# Kubescape v4.0.13

> Security · 2026-09-02

A broad feature release expands scanning, policy, reporting, remediation, notifications, telemetry, integrations, and output capabilities. It also includes security hardening and stricter scan constraints, alongside many correctness and runtime fixes.

## Action needed
- **[security]** Go dependency security vulnerabilities
  - Dependabot fixes security vulnerabilities in Go dependencies shipped with the release.
- **[security]** `gosec` SAST findings
  - The release remediates `gosec` SAST findings in the Go codebase.

## Check if affected
- **[security]** Grafeas filtering through `resourceURL`
  - Applies if you run imagescan.
  - Image scanning now prevents Grafeas filter injection through `resourceURL`.
- **[breaking]** Client-supplied `account` and `accessKey` in scan requests
  - Applies if you use scan requests.
  - The scan request handler no longer honors client-supplied `account` or `accessKey` values in scan requests.
- **[breaking]** Hard validation for `--include-controls`
  - Applies if you configure `--include-controls`.
  - The `--include-controls` option now returns a hard error when it matches no known control.
- **[breaking]** `Secret` reads in single-resource scans
  - Applies if you run single-resource scans.
  - Single-resource scans now block reads of `Secret` resources.
- **[breaking]** `compliance-threshold` enforcement in scan workloads
  - Applies if you configure `compliance-threshold`.
  - Scan workloads now enforce the configured `compliance-threshold`.
- **[breaking]** Unknown-severity handling in `--severity-threshold`
  - Applies if you configure `--severity-threshold`.
  - The `--severity-threshold` path now fails closed when findings have an unknown severity.
- **[breaking]** Zero loaded controls as a scan coverage failure
  - Applies if you run scans.
  - Scans now treat zero loaded controls as a coverage failure.
- **[breaking]** Skipped manifests in scan coverage
  - Applies if you run scan-coverage.
  - Scan coverage now surfaces skipped manifests and fails the coverage gate for them.
- **[breaking]** Mutual exclusivity for `keep-local`, `omit-raw-resources`, and `submit`
  - Applies if you configure `keep-local`, `omit-raw-resources`, or `submit`.
  - All scan commands now enforce mutual exclusivity between `keep-local`, `omit-raw-resources`, and `submit`.
- **[breaking]** Per-file size limits on the file-scan path
  - Applies if you use the file-scan path.
  - The file-scan path now enforces a per-file size limit.

## Plan ahead
- **[deprecated]** The `--fail-threshold` flag, hidden and deprecated
  - Applies if you configure `--fail-threshold`.
  - The `--fail-threshold` flag is registered again as a hidden, deprecated flag for scans.

## Other recorded changes
- 344 (defect_corrected 184, added 90, value_changed 56, constraint_changed 14)

[Full analysis](https://ratatosk.io/en/releases/kubescape/v4.0.13)

[Original release notes](https://github.com/kubescape/kubescape/releases/tag/v4.0.13)