chore(deps): update helm release kubescape-operator to v1.40.4

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change
kubescape-operator (source)	minor	1.30.7 → 1.40.4

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

kubescape/helm-charts (kubescape-operator)

v1.40.4

Compare Source

Kubescape is an E2E Kubernetes cluster security platform

What's Changed

• docs: remove dead kubescape.submit value from README by @​matthyx in #​886
• Bump storage image to v0.0.298 and ignore local CLI files by @​matthyx in #​887
• feat: expose defaultFrameworks in kubescape-operator chart by @​manumathon in #​890
• feat(node-agent): auto-set super_t on Bottlerocket node groups by @​slashben in #​880
• bump operator to v0.2.162 for the bottlerocket detection by @​matthyx in #​892
• feat(kubescape): add opt-in RBAC for agent runtime posture by @​dakshhhhh16 in #​893
• feat(storage): allow running the APIServer on the host network by @​ahauserv in #​894
• fix(kubescape): stop masking the baked policy library when downloads are off by @​ahauserv in #​895
• fix: drop all Linux capabilities in workload container securityContexts by @​ahauserv in #​897
• fix: mount CA certificates into the sbom-scanner sidecar by @​matthyx in #​898
• fix(storage): omit the empty annotations key on the seccompprofiles CRD by @​ahauserv in #​900
• feat(autoupdater): support pod metadata overrides by @​AnvayKharb in #​903
• Drop pods/delete RBAC for node-agent by @​matthyx in #​904
• fix(node-agent): enable Prometheus OTEL exporter by @​khuswant18 in #​907
• [LFX 2026] feat(crds): align SecurityException vulnerability schema with the kubevuln types by @​yugal07 in #​909
• fix(kubescape): mount config.json as a file, not over the whole policy directory by @​matthyx in #​908
• feat(node-agent): remove ClamAV and move malware detection to the hash sensor by @​AlonLiwsky in #​910
• fix: pin runAsGroup wherever the chart pins runAsUser by @​ahauserv in #​912
• fix: bump kubescape scanner to v4.0.12 to unbreak standalone configuration scanning by @​slashben in #​914
• feat: add options to disable exec and open tracing by @​ystkfujii in #​906
• move extra node-agent configuration to extra by @​matthyx in #​884
• prepare next release by @​matthyx in #​905
• kubescape/kubescape@v4.0.11...v4.0.13
  • fix(prettyprinter): stop treating resource-derived text as a format string by @​magic-peach in kubescape/kubescape#3333
  • fix(printer): add container names to HTML/SARIF evidence paths by @​manumathon in kubescape/kubescape#3301
  • fix: embed HTML report logo instead of loading it from GitHub by @​doraem-on in kubescape/kubescape#3336
  • feat(rules): add weak-namespace-token-access-v1 by @​aryanghai12 in kubescape/kubescape#3339
  • fix(imagescan): tighten gitlab imageMatches suffix check by @​magic-peach in kubescape/kubescape#3340
  • chore(deps): bump github.com/mark3labs/mcp-go from 0.29.0 to 0.57.0 by @​dependabot[bot] in kubescape/kubescape#3168
  • chore(deps): bump github.com/kubescape/rbac-utils from 0.0.21-0.20230806101615-07e36f555520 to 0.0.21 by @​dependabot[bot] in kubescape/kubescape#3170
  • fix(gomod): bump module path to /v4 to match release tags by @​aryanghai12 in kubescape/kubescape#3350
  • fix(cel): match CRD plurals the kind guess spells wrong by @​parthdagia05 in kubescape/kubescape#3355
  • fix(resourcehandler): skip discovered resources that do not support list by @​parthdagia05 in kubescape/kubescape#3346
  • fix(release): sign release assets with keyless cosign by @​arp1traj in kubescape/kubescape#3344
  • Keep CRD exceptions that a narrower cloud exception does not actually cover by @​parthdagia05 in kubescape/kubescape#3351
  • fix: compare --output file extensions case-insensitively by @​doraem-on in kubescape/kubescape#3334
  • feat(scan): extend --min-severity to all output formats and add --max-severity by @​Nakshatra480 in kubescape/kubescape#3337
  • perf(opaprocessor): cache LARGE_CLUSTER_SIZE threshold per OPAProcessor by @​karthik120710 in kubescape/kubescape#3342
  • fix: Terraform loader now recurses into subdirectories, like Helm/Kustomize by @​doraem-on in kubescape/kubescape#3349
  • chore(goreleaser): embed E2E hook as single script by @​AnouarMohamed in kubescape/kubescape#3299
  • fix: repair master build breaks (stale v3 import + jsonprinter test arg) by @​matthyx in kubescape/kubescape#3361
  • feat: surface vulnerability DB freshness in image-scan results by @​AdeshDeshmukh in kubescape/kubescape#3356
  • test(httphandler): skip directory permission test on Windows by @​Kayd-06 in kubescape/kubescape#3380
  • fix: a scope-less cloud exception now subsumes CRD exceptions for the same control by @​doraem-on in kubescape/kubescape#3370
  • feat: emit exception-match events for file/cloud exceptions too by @​doraem-on in kubescape/kubescape#3373
  • fix: count manual-control exceptions in the exception audit by @​doraem-on in kubescape/kubescape#3371
  • fix(printer): resolve indexed paths when lists are []map[string]any by @​manumathon in kubescape/kubescape#3357
  • fix(printer): format N/A and percentage compliance score correctly in… by @​NaitikRishu in kubescape/kubescape#3362
  • fix(printer): dedupe enriched failed paths against bare delete paths by @​adity1raut in kubescape/kubescape#3358
  • fix(printer): prevent out-of-bounds slice index panic in getSortedControlsIDs (#​3363) by @​NaitikRishu in kubescape/kubescape#3365
  • fix(reportcrypto): derive the report master key with Argon2id by @​arp1traj in kubescape/kubescape#3382
  • feat(rules): add approve-csr-v1 by @​AnouarMohamed in kubescape/kubescape#3298
  • feat: baseline drift detection for live cluster scans (--baseline) by @​mohityadav8 in kubescape/kubescape#3353
  • fix(diff): emit CI regression artifacts by @​AnvayKharb in kubescape/kubescape#3379
  • fix(printer): show assisted-remediation paths in control-view resource list by @​manumathon in kubescape/kubescape#3359
  • fix(krew): make .krew.yaml renderable and match published asset names by @​arp1traj in kubescape/kubescape#3389
  • fix(resultshandling): filter per-resource findings by severity, not the unused Report.Results field by @​Ady0333 in kubescape/kubescape#3388
  • fix(vap): reject a resource rule the bound policy can never match by @​parthdagia05 in kubescape/kubescape#3394
  • fix(preflight): skip Kubescape-served resources in dry-run access review by @​parthdagia05 in kubescape/kubescape#3391
  • test(cautils): skip helm chart symlink test when symlinks are unavailable by @​adity1raut in kubescape/kubescape#3398
  • fix(printer): normalize resource object before evidence path extraction by @​adity1raut in kubescape/kubescape#3397
  • fix(printer): aggregate multiple image scan runs in SARIF report printer (#​3395) by @​NaitikRishu in kubescape/kubescape#3396
  • feat(imagescan): scan the correct platform for multi-arch images by @​dakshhhhh16 in kubescape/kubescape#3345
  • feat(scan): add --include-kinds and --exclude-kinds resource kind filters by @​Nakshatra480 in kubescape/kubescape#3372
  • fix(scan): apply the resource kind filters before collection, not after by @​parthdagia05 in kubescape/kubescape#3411
  • fix: PolicyReportPrinter.CloseWriter now returns the close error by @​doraem-on in kubescape/kubescape#3408
  • fix: check SetWriter's error in writeBaselineHeadReport by @​doraem-on in kubescape/kubescape#3410
  • fix: diff --severity-threshold fails closed on unresolvable severity by @​doraem-on in kubescape/kubescape#3406
  • feat(opaprocessor): add inline exception suppression via resource annotations by @​karthik120710 in kubescape/kubescape#3392
  • fix(anonymizer): transform env var names referencing secrets/configmaps by @​shivv23 in kubescape/kubescape#3364
  • fix: accept key==value label selectors in vap create-policy-binding by @​doraem-on in kubescape/kubescape#3404
  • feat(imagescan): add --skip-db-update flag for offline image scanning by @​AdeshDeshmukh in kubescape/kubescape#3387
  • fix: Add chunked pagination to SecurityException CRD retrieval by @​shivansh-gohem in kubescape/kubescape#3393
  • feat(anonymizer): detect pseudo-ID collisions in Mapping.GetOrCreate by @​arp1traj in kubescape/kubescape#3417
  • fix(reportcrypto): bind AEAD ciphertexts to the report that owns them by @​arp1traj in kubescape/kubescape#3414
  • fix(cautils): propagate scan errors from splitYAMLDocuments instead of truncating silently by @​arp1traj in kubescape/kubescape#3423
  • ci: pin golangci-lint to v2.12.2 to avoid v2.13.0 timeout regression by @​matthyx in kubescape/kubescape#3429
  • ci: bound pr-scanner job runtime with timeout-minutes by @​doraem-on in kubescape/kubescape#3431
  • fix(vapreconcile): credit admission enforcement to the policy a binding names by @​parthdagia05 in kubescape/kubescape#3433
  • core: add ScanContext, an explicit-context scan entry point by @​doraem-on in kubescape/kubescape#3432
  • feat(scan): add --exclude-path and .kubescapeignore for local scans by @​Nakshatra480 in kubescape/kubescape#3422
  • feat(getter): support --custom-rules for user-authored Rego rules by @​karthik120710 in kubescape/kubescape#3419
  • fix(resultshandling): recompute score and counters after severity filtering by @​AdeshDeshmukh in kubescape/kubescape#3436
  • feat(coverage): flag frameworks scored 100% purely from irrelevant controls by @​Ady0333 in kubescape/kubescape#3421
  • fix: enforce per-file size limit on file-scan path by @​arp1traj in kubescape/kubescape#3453
  • feat: Implement global chunked pagination for Kubernetes resource retrieval by @​shivansh-gohem in kubescape/kubescape#3428
  • feat: incremental scan caching to skip unchanged resources (--incremental) by @​mohityadav8 in kubescape/kubescape#3412
  • feat: support downloading all controls when no ID is specified by @​Kayd-06 in kubescape/kubescape#3435
  • core: add ScanImageContext, closing the last explicit-context gap from #​3237 by @​doraem-on in kubescape/kubescape#3443
  • fix(resourcehandler): resolve the core API group spelling on live cluster scans by @​parthdagia05 in kubescape/kubescape#3426
  • feat: Streaming OpenVEX / CSAF Attestation Engine by @​Rucha0901 in kubescape/kubescape#3294
  • fix(printer): support multiple image SBOM generation in CycloneDX and SPDX printers (#​3399) by @​NaitikRishu in kubescape/kubescape#3400
  • feat(scan): add --exclude-controls to drop controls from a framework scan by @​Nakshatra480 in kubescape/kubescape#3441
  • fix(mcpserver): guard getPolicyGetter's lazy init, matching its siblings by @​doraem-on in kubescape/kubescape#3445
  • fix(resourcehandler): treat an undecided access review as unchecked, not denied by @​parthdagia05 in kubescape/kubescape#3446
  • fix(printer): printTopComponents corrupts output when a package has no recorded severities by @​doraem-on in kubescape/kubescape#3451
  • ci(comments): gate pr_agent on trusted commenter author_association by @​arp1traj in kubescape/kubescape#3449
  • fix: implement chunked pagination for namespace counting by @​shivansh-gohem in kubescape/kubescape#3467
  • fix(scan): fail explicitly on unmatched severity threshold by @​arp1traj in kubescape/kubescape#3456
  • fix(anonymizer): anonymize container names and images on scanned workloads by @​Nakshatra480 in kubescape/kubescape#3463
  • fix(resultshandling): apply severity filters to framework control maps by @​Nakshatra480 in kubescape/kubescape#3455
  • fix(scan): clarify --min-severity is output-only and warn about thresholds by @​arp1traj in kubescape/kubescape#3458
  • fix(vap): stop create-policy-binding silently rewriting the label selector it was given by @​parthdagia05 in kubescape/kubescape#3468
  • fix(install): quote paths and limit cleanup to canonical locations by @​arp1traj in kubescape/kubescape#3464
  • feat: Add context-aware VAP for ActorTemplate and WorkerPool by @​Rucha0901 in kubescape/kubescape#3466
  • fix(imagescan): stop stalled GitLab pagination by @​dakshhhhh16 in kubescape/kubescape#3472
  • Fix memory allocation spikes during opa evaluations by @​Rucha0901 in kubescape/kubescape#2920
  • fix: remove secrets from cluster size estimation to tighten RBAC by @​shivansh-gohem in kubescape/kubescape#3478
  • feat(scan): add --skip-controls and --include-controls filtering by @​karthik120710 in kubescape/kubescape#3480
  • feat(operator): add findings-driven targeting to the remediate CLI by @​yugal07 in kubescape/kubescape#3474
  • fix(anonymizer): anonymize env var names referencing fieldRef and resourceFieldRef by @​manoj-1407 in kubescape/kubescape#3484
  • fix(printer): sanitize cluster and namespace identifiers in PolicyReport names and labels (#​3469) by @​NaitikRishu in kubescape/kubescape#3470
  • fix(printer): centralize output path resolution by @​AnvayKharb in kubescape/kubescape#3492
  • fix(httphandler): add optional bearer auth and trust boundary docs for /v1 endpoints by @​arp1traj in kubescape/kubescape#3461
  • fix(imagescan): bound registry API responses by @​dakshhhhh16 in kubescape/kubescape#3473
  • fix(opaprocessor): stop caching rules that read resource status by @​Nakshatra480 in kubescape/kubescape#3482
  • feat(mcpserver): add SSE transport and advanced MCP tools for LLMs by @​Rucha0901 in kubescape/kubescape#3375
  • fix(cel): refuse a control whose paramKind the scan has no binding to resolve by @​parthdagia05 in kubescape/kubescape#3495
  • fix(printer): restore missing strings import in policyreportprinter.go by @​adity1raut in kubescape/kubescape#3503
  • feat(policy): add kubescape policy test to run rule fixtures against the real evaluator by @​Ady0333 in kubescape/kubescape#3477
  • fix(opaprocessor): make scope-less exceptions apply to resource-backed findings too by @​adity1raut in kubescape/kubescape#3427
  • chore(deps): bump opa-utils to v0.0.309 to pick up the NewScore singleton fix by @​doraem-on in kubescape/kubescape#3416
  • feat: Add GCP and Azure support for DescribeRepositories and ListEnti… by @​dolliecoder in kubescape/kubescape#2573
  • feat(scan): validate repository scan contracts by @​dakshhhhh16 in kubescape/kubescape#3481
  • fix(printer): unify output path resolution across all printers by @​axolotl5165 in kubescape/kubescape#3493
  • fix(metrics): export ResetForTest so external packages can rebind instruments by @​shivv23 in kubescape/kubescape#3483
  • fix(hostsensor): enforce bounded decompression read in cache to prevent OOM (CWE-400) by @​axolotl5165 in kubescape/kubescape#3490
  • fix(mcpserver): scan_resource_slice returns [] not null for an empty result set by @​doraem-on in kubescape/kubescape#3506
  • docs(cel): correct the authorizer skip scope and make the verification recipe reproducible by @​Sanchit2662 in kubescape/kubescape#3496
  • fix(opaprocessor): honor namespace scope on incremental cache hits by @​Ady0333 in kubescape/kubescape#3501
  • fix: initialize all vulnerability severities with placeholders by @​Kayd-06 in kubescape/kubescape#3498
  • fix(opaprocessor): make --skip-controls and --include-controls case-insensitive by @​doraem-on in kubescape/kubescape#3508
  • fix(vap): refuse a parameter reference that does not match the bound policy's paramKind by @​parthdagia05 in kubescape/kubescape#3511
  • fix(opaprocessor): apply --skip-controls/--include-controls on the streaming path by @​Ady0333 in kubescape/kubescape#3520
  • feat(telemetry): export scan traces and metrics to an OTLP collector by @​Nakshatra480 in kubescape/kubescape#3521
  • fix(scan): validate --label-selector in ValidateCommonScanFlags by @​manoj-1407 in kubescape/kubescape#3502
  • feat(scan): wire CEL ValidatingAdmissionPolicy evaluation into the scan pipeline by @​karthik120710 in kubescape/kubescape#3513
  • ci: bump rajatjindal/krew-release-bot from 0.0.47 to 0.0.51 by @​dependabot[bot] in kubescape/kubescape#3536
  • feat(scan): add generic webhook notifications by @​thuanlm215 in kubescape/kubescape#3504
  • chore(deps): bump k8s.io/apimachinery from 0.36.3 to 0.36.4 in /httphandler by @​dependabot[bot] in kubescape/kubescape#3527
  • ci: bump mikepenz/action-junit-report from 5.6.2 to 6.4.2 by @​dependabot[bot] in kubescape/kubescape#3533
  • ci: bump helm/kind-action from 1.10.0 to 1.14.0 by @​dependabot[bot] in kubescape/kubescape#3532
  • fix(core): close output writers when Scan fails by @​ye11oc4t in kubescape/kubescape#3232
  • chore(deps): bump github.com/armosec/armoapi-go from 0.0.751 to 0.0.754 in /httphandler by @​dependabot[bot] in kubescape/kubescape#3526
  • fix(config): make config set keys case-insensitive and accept kebab-c… by @​NaitikRishu in kubescape/kubescape#3541
  • fix(opaprocessor): hard error when --include-controls matches no known control by @​arp1traj in kubescape/kubescape#3552
  • fix(junit): distinguish image scan platforms by @​AnvayKharb in kubescape/kubescape#3544
  • ci: bump docker/setup-buildx-action from 4.2.0 to 4.3.0 by @​dependabot[bot] in kubescape/kubescape#3534
  • chore(deps): bump github.com/kubescape/go-logger from 0.0.33 to 0.0.34 in /httphandler by @​dependabot[bot] in kubescape/kubescape#3522
  • fix: scope cluster size estimation to included namespaces by @​shivansh-gohem in kubescape/kubescape#3538
  • fix(resourcehandler): a namespace filter naming no namespace silently skips every namespaced query by @​parthdagia05 in kubescape/kubescape#3539
  • chore(deps): bump github.com/kubescape/opa-utils from 0.0.309 to 0.0.310 in /httphandler by @​dependabot[bot] in kubescape/kubescape#3524
  • ci: bump Codium-ai/pr-agent from 0.35.0 to 0.43.0 by @​dependabot[bot] in kubescape/kubescape#3535
  • fix(storage): recover missing workload posture controls by @​ye11oc4t in kubescape/kubescape#3545
  • ci: bump github.com/stretchr/testify from 1.11.1 to 1.12.1 in /httphandler by @​dependabot[bot] in kubescape/kubescape#3525
  • test(printer): add edge case coverage for AssistedRemediationPathsToS… by @​karthik120710 in kubescape/kubescape#3548
  • test(policy): validate all in-tree rule fixtures in CI by @​ye11oc4t in kubescape/kubescape#3546
  • chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.8 to 6.8.3 by @​dependabot[bot] in kubescape/kubescape#3530
  • chore(deps): bump github.com/owenrumney/go-sarif/v2 from 2.2.0 to 2.3.3 by @​dependabot[bot] in kubescape/kubescape#3523
  • chore(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.32.17 to 1.32.38 by @​dependabot[bot] in kubescape/kubescape#3528
  • chore(deps): bump github.com/zclconf/go-cty from 1.17.0 to 1.19.0 by @​dependabot[bot] in kubescape/kubescape#3531
  • chore(deps): bump github.com/kubescape/go-git-url from 0.0.31 to 0.0.33 by @​dependabot[bot] in kubescape/kubescape#3529
  • feat(scan): apply repository scan contracts by @​dakshhhhh16 in kubescape/kubescape#3537
  • feat(getter): load custom rules from the standard rule directory layout by @​Nakshatra480 in kubescape/kubescape#3553
  • chore(printer): clarify strings import dependency in policyreportprinter.go by @​arp1traj in kubescape/kubescape#3550
  • fix(opaprocessor): quote inline exception designator attributes by @​Ady0333 in kubescape/kubescape#3558
  • fix(opaprocessor): honor ResourceEnumerator output in scan path by @​arp1traj in kubescape/kubescape#3559
  • fix(scan-coverage): surface skipped manifests in coverage and fail gate by @​arp1traj in kubescape/kubescape#3555
  • feat(vapreconcile): add per-resource VAPBinding scope coverage by @​doraem-on in kubescape/kubescape#3570
  • fix(imagescan): bound GCP GetImagesScanStatus pagination loop by @​doraem-on in kubescape/kubescape#3566
  • fix(opaprocessor): guard InfoMap read against concurrent writes in hasUnreachableDependency by @​AdeshDeshmukh in kubescape/kubescape#3563
  • fix(hostsensorutils): record a status when reported CRD items cannot be read by @​parthdagia05 in kubescape/kubescape#3561
  • chore(cel): bump the pinned CEL policy library to v0.14 and sync the bundle by @​Sanchit2662 in kubescape/kubescape#3556
  • feat(mcpserver): add apply_remediation tool for deterministic AI auto-patching by @​dolliecoder in kubescape/kubescape#3568
  • fix(mcpserver): prefer ScanCoverage over the seeded summary when flagging unevaluated controls by @​dolliecoder in kubescape/kubescape#3574
  • feat(markdown): support image scan reports by @​AnvayKharb in kubescape/kubescape#3573
  • feat(printer): generate a posture exceptions baseline from scan results by @​Nakshatra480 in kubescape/kubescape#3560
  • fix(cel): resolve a cluster-scoped paramRef, and refuse one that selects params by @​parthdagia05 in kubescape/kubescape#3575
  • feat(printer): support initContainers and ephemeralContainers in assisted remediation paths by @​karthik120710 in kubescape/kubescape#3578
  • feat(version): add yaml output format support (#​3542) by @​NaitikRishu in kubescape/kubescape#3543
  • fix(anonymizer): restore reference-backed env var name anonymization by @​doraem-on in kubescape/kubescape#3579
  • feat(scan): add Slack webhook notifications by @​thuanlm215 in kubescape/kubescape#3571
  • fix(fixhandler): check the error from closing a fixed file, not just writing it by @​adity1raut in kubescape/kubescape#3580
  • feat(list): show the control configuration a scan evaluates against by @​Nakshatra480 in kubescape/kubescape#3586
  • feat(image): surface VEX status in reports by @​AnvayKharb in kubescape/kubescape#3594
  • fix(resultshandling): deterministic AssociatedControls ordering across scans by @​AdeshDeshmukh in kubescape/kubescape#3590
  • fix(patch): filesystem-safe intermediate filenames and update-all nil guard by @​AdeshDeshmukh in kubescape/kubescape#3596
  • fix(vapreconcile): correct binding-scope coverage for cluster-scoped resources and Namespaces by @​parthdagia05 in kubescape/kubescape#3592
  • test(printer): add regression test for sensitive data exposure in res… by @​karthik120710 in kubescape/kubescape#3582
  • feat(containerscan): validate layers, layer hashes, and vulnerability names in ScanResultReport.Validate() by @​karthik120710 in kubescape/kubescape#3591
  • feat(cel): honor VAP spec.failurePolicy for validation expression errors by @​karthik120710 in kubescape/kubescape#3583
  • feat(coverage): report resource kinds no control examined by @​Ady0333 in kubescape/kubescape#3588
  • fix: deduplicate included namespaces in splitNamespaces by @​shivansh-gohem in kubescape/kubescape#3599
  • refactor: remove deprecated FailedPath from codebase by @​Kayd-06 in kubescape/kubescape#3598
  • fix(vap): report a namespace selector that cannot narrow a policy's cluster-scoped resources by @​parthdagia05 in kubescape/kubescape#3597
  • feat(networkpolicy): add real NetworkPolicy reachability engine by @​doraem-on in kubescape/kubescape#3601
  • [LFX 2026] chore(deps): bump opa-utils to v0.0.312 for alertOnly exception semantics by @​yugal07 in kubescape/kubescape#3615
  • fix(resourcehandler): do not report a kind's other served versions as unexamined by @​parthdagia05 in kubescape/kubescape#3609
  • feat(fixhandler): apply fixes to JSON manifests by @​Nakshatra480 in kubescape/kubescape#3608
  • fix(scan): enforce compliance-threshold in scan workload (#​3610) by @​NaitikRishu in kubescape/kubescape#3612
  • fix(anonymizer): hide scan path, host and cluster identity under --hide and --encrypt by @​Nakshatra480 in kubescape/kubescape#3611
  • refactor(resourcehandler): partition streaming collector items as the pager yields them by @​aryanghai12 in kubescape/kubescape#3613
  • fix: validate URLs in config set by @​Rucha0901 in kubescape/kubescape#3585
  • feat(mapreconcile): add MutatingAdmissionPolicy discovery and impact matching by @​doraem-on in kubescape/kubescape#3606
  • feat(scan): add contract report provenance by @​dakshhhhh16 in kubescape/kubescape#3607
  • feat: support --format json for the update command by @​Rucha0901 in kubescape/kubescape#3617
  • fix(cel): matchConditions short-circuit on false skips evaluating later conditions by @​doraem-on in kubescape/kubescape#3630
  • feat(list): filter controls by framework and search by @​AnvayKharb in kubescape/kubescape#3624
  • fix(anonymizer): anonymize Secret/ConfigMap names referenced via spec.volumes by @​doraem-on in kubescape/kubescape#3619
  • feat(telemetry): report image DB freshness by @​AnvayKharb in kubescape/kubescape#3604
  • refactor: migrate gorilla/mux to net/http ServeMux by @​shivansh-gohem in kubescape/kubescape#3620
  • feat(diff): add aggregate summary outputs by @​AnvayKharb in kubescape/kubescape#3626
  • feat(policy): scaffold custom Rego rules and refresh test fixtures from rule output by @​Nakshatra480 in kubescape/kubescape#3635
  • fix(opaprocessor): evaluate rules against full input after enumeration by @​Ady0333 in kubescape/kubescape#3628
  • feat(scan): add SARIF contract validation output by @​AnvayKharb in kubescape/kubescape#3622
  • feat(printer): add github-actions output format for inline PR annotations by @​AdeshDeshmukh in kubescape/kubescape#3637
  • feat(sarif): add stable scan fingerprints by @​AnvayKharb in kubescape/kubescape#3639
  • fix(mapreconcile): match the subresource form of a resource rule by @​parthdagia05 in kubescape/kubescape#3646
  • feat(config): support --format / -f flag in config view (#​3641) by @​NaitikRishu in kubescape/kubescape#3642
  • fix(scancache): reset dirty flag after Flush writes cache file by @​shivv23 in kubescape/kubescape#3515
  • feat(networkpolicy,vulnexposure): correlate vulnerabilities with NetworkPolicy exposure by @​doraem-on in kubescape/kubescape#3632
  • fix(fixhandler): cross-control fix promotion checks the value, not just the path by @​doraem-on in kubescape/kubescape#3634
  • fix(resourcesprioritization): don't drop attack tracks when a resource matches more than one by @​doraem-on in kubescape/kubescape#3659
  • fix(mapreconcile): a policy gated by matchConditions is not a confirmed match by @​parthdagia05 in kubescape/kubescape#3654
  • fix(download): accept plural and alias target arguments (#​3666) by @​NaitikRishu in kubescape/kubescape#3667
  • fix(cel): honor an equivalent matchPolicy when scoping a policy to a scanned object by @​parthdagia05 in kubescape/kubescape#3673
  • fix(anonymizer): pseudonymize image-scan results under --hide/--encrypt by @​arp1traj in kubescape/kubescape#3661
  • feat(mcpserver): add scan_workload tool for single-resource scanning by @​dolliecoder in kubescape/kubescape#3669
  • feat(config): add cached config validation by @​AnvayKharb in kubescape/kubescape#3663
  • feat(notification): add Microsoft Teams Adaptive Card support for --notify webhooks by @​Nakshatra480 in kubescape/kubescape#3645
  • fix(opaprocessor): match CIS section numbers in --skip-controls/--include-controls by @​arp1traj in kubescape/kubescape#3658
  • feat(scan): record contract runner input digests by @​dakshhhhh16 in kubescape/kubescape#3640
  • test(cel): compare Rego and CEL verdicts for the converted controls by @​Sanchit2662 in kubescape/kubescape#3603
  • test(resourcehandler): add a synthetic-cluster collector memory harness by @​aryanghai12 in kubescape/kubescape#3614
  • feat(exposure): model external exposure via Ingress, Gateway API, and Service type by @​doraem-on in kubescape/kubescape#3648
  • feat(scan): scan multiple images in one run sharing the vulnerability database by @​Nakshatra480 in kubescape/kubescape#3682
  • feat(resourcehandler): collect via namespaced endpoints under --include-namespaces by @​Ady0333 in kubescape/kubescape#3683
  • feat(vap): list embedded admission policies and the controls they implement by @​Nakshatra480 in kubescape/kubescape#3674
  • perf: stream JSON outputs instead of massive byte array allocations in memory by @​shivansh-gohem in kubescape/kubescape#3670
  • fix(core): ensure OpenTelemetry spans are ended across all exit and error paths by @​khuswant18 in kubescape/kubescape#3665
  • feat(printer): surface failed-path evidence values in JSON/YAML output by @​adity1raut in kubescape/kubescape#3256
  • feat(printer): include evidence paths in GitHub Actions annotation messages by @​manoj-1407 in kubescape/kubescape#3677
  • fix(getter): give custom rules a base score instead of leaving it zero by @​arp1traj in kubescape/kubescape#3676
  • ci: bump golangci/golangci-lint-action from 9.2.0 to 9.3.0 by @​dependabot[bot] in kubescape/kubescape#3693
  • chore(deps): bump github.com/kubescape/go-logger from 0.0.28 to 0.0.34 by @​dependabot[bot] in kubescape/kubescape#3695
  • chore(deps): bump github.com/armosec/armoapi-go from 0.0.754 to 0.0.757 in /httphandler by @​dependabot[bot] in kubescape/kubescape#3686
  • chore(deps): bump k8s.io/apimachinery from 0.36.4 to 0.37.0 in /httphandler by @​dependabot[bot] in kubescape/kubescape#3687
  • chore(deps): bump github.com/mark3labs/mcp-go from 0.57.0 to 0.58.0 by @​dependabot[bot] in [kubescape/kubescape

❗ Important

✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.