kubescape-operator-1.40.4

Kubescape is an E2E Kubernetes cluster security platform

What's Changed

• docs: remove dead kubescape.submit value from README by @matthyx in #886
• Bump storage image to v0.0.298 and ignore local CLI files by @matthyx in #887
• feat: expose defaultFrameworks in kubescape-operator chart by @manumathon in #890
• feat(node-agent): auto-set super_t on Bottlerocket node groups by @slashben in #880
• bump operator to v0.2.162 for the bottlerocket detection by @matthyx in #892
• feat(kubescape): add opt-in RBAC for agent runtime posture by @dakshhhhh16 in #893
• feat(storage): allow running the APIServer on the host network by @ahauserv in #894
• fix(kubescape): stop masking the baked policy library when downloads are off by @ahauserv in #895
• fix: drop all Linux capabilities in workload container securityContexts by @ahauserv in #897
• fix: mount CA certificates into the sbom-scanner sidecar by @matthyx in #898
• fix(storage): omit the empty annotations key on the seccompprofiles CRD by @ahauserv in #900
• feat(autoupdater): support pod metadata overrides by @AnvayKharb in #903
• Drop pods/delete RBAC for node-agent by @matthyx in #904
• fix(node-agent): enable Prometheus OTEL exporter by @khuswant18 in #907
• [LFX 2026] feat(crds): align SecurityException vulnerability schema with the kubevuln types by @yugal07 in #909
• fix(kubescape): mount config.json as a file, not over the whole policy directory by @matthyx in #908
• feat(node-agent): remove ClamAV and move malware detection to the hash sensor by @AlonLiwsky in #910
• fix: pin runAsGroup wherever the chart pins runAsUser by @ahauserv in #912
• fix: bump kubescape scanner to v4.0.12 to unbreak standalone configuration scanning by @slashben in #914
• feat: add options to disable exec and open tracing by @ystkfujii in #906
• move extra node-agent configuration to extra by @matthyx in #884
• prepare next release by @matthyx in #905
• kubescape/kubescape@v4.0.11...v4.0.13
  • fix(prettyprinter): stop treating resource-derived text as a format string by @magic-peach in kubescape/kubescape#3333
  • fix(printer): add container names to HTML/SARIF evidence paths by @manumathon in kubescape/kubescape#3301
  • fix: embed HTML report logo instead of loading it from GitHub by @doraem-on in kubescape/kubescape#3336
  • feat(rules): add weak-namespace-token-access-v1 by @aryanghai12 in kubescape/kubescape#3339
  • fix(imagescan): tighten gitlab imageMatches suffix check by @magic-peach in kubescape/kubescape#3340
  • chore(deps): bump github.com/mark3labs/mcp-go from 0.29.0 to 0.57.0 by @dependabot[bot] in kubescape/kubescape#3168
  • chore(deps): bump github.com/kubescape/rbac-utils from 0.0.21-0.20230806101615-07e36f555520 to 0.0.21 by @dependabot[bot] in kubescape/kubescape#3170
  • fix(gomod): bump module path to /v4 to match release tags by @aryanghai12 in kubescape/kubescape#3350
  • fix(cel): match CRD plurals the kind guess spells wrong by @parthdagia05 in kubescape/kubescape#3355
  • fix(resourcehandler): skip discovered resources that do not support list by @parthdagia05 in kubescape/kubescape#3346
  • fix(release): sign release assets with keyless cosign by @arp1traj in kubescape/kubescape#3344
  • Keep CRD exceptions that a narrower cloud exception does not actually cover by @parthdagia05 in kubescape/kubescape#3351
  • fix: compare --output file extensions case-insensitively by @doraem-on in kubescape/kubescape#3334
  • feat(scan): extend --min-severity to all output formats and add --max-severity by @Nakshatra480 in kubescape/kubescape#3337
  • perf(opaprocessor): cache LARGE_CLUSTER_SIZE threshold per OPAProcessor by @karthik120710 in kubescape/kubescape#3342
  • fix: Terraform loader now recurses into subdirectories, like Helm/Kustomize by @doraem-on in kubescape/kubescape#3349
  • chore(goreleaser): embed E2E hook as single script by @AnouarMohamed in kubescape/kubescape#3299
  • fix: repair master build breaks (stale v3 import + jsonprinter test arg) by @matthyx in kubescape/kubescape#3361
  • feat: surface vulnerability DB freshness in image-scan results by @AdeshDeshmukh in kubescape/kubescape#3356
  • test(httphandler): skip directory permission test on Windows by @Kayd-06 in kubescape/kubescape#3380
  • fix: a scope-less cloud exception now subsumes CRD exceptions for the same control by @doraem-on in kubescape/kubescape#3370
  • feat: emit exception-match events for file/cloud exceptions too by @doraem-on in kubescape/kubescape#3373
  • fix: count manual-control exceptions in the exception audit by @doraem-on in kubescape/kubescape#3371
  • fix(printer): resolve indexed paths when lists are []map[string]any by @manumathon in kubescape/kubescape#3357
  • fix(printer): format N/A and percentage compliance score correctly in… by @NaitikRishu in kubescape/kubescape#3362
  • fix(printer): dedupe enriched failed paths against bare delete paths by @adity1raut in kubescape/kubescape#3358
  • fix(printer): prevent out-of-bounds slice index panic in getSortedControlsIDs (#3363) by @NaitikRishu in kubescape/kubescape#3365
  • fix(reportcrypto): derive the report master key with Argon2id by @arp1traj in kubescape/kubescape#3382
  • feat(rules): add approve-csr-v1 by @AnouarMohamed in kubescape/kubescape#3298
  • feat: baseline drift detection for live cluster scans (--baseline) by @mohityadav8 in kubescape/kubescape#3353
  • fix(diff): emit CI regression artifacts by @AnvayKharb in kubescape/kubescape#3379
  • fix(printer): show assisted-remediation paths in control-view resource list by @manumathon in kubescape/kubescape#3359
  • fix(krew): make .krew.yaml renderable and match published asset names by @arp1traj in kubescape/kubescape#3389
  • fix(resultshandling): filter per-resource findings by severity, not the unused Report.Results field by @Ady0333 in kubescape/kubescape#3388
  • fix(vap): reject a resource rule the bound policy can never match by @parthdagia05 in kubescape/kubescape#3394
  • fix(preflight): skip Kubescape-served resources in dry-run access review by @parthdagia05 in kubescape/kubescape#3391
  • test(cautils): skip helm chart symlink test when symlinks are unavailable by @adity1raut in kubescape/kubescape#3398
  • fix(printer): normalize resource object before evidence path extraction by @adity1raut in kubescape/kubescape#3397
  • fix(printer): aggregate multiple image scan runs in SARIF report printer (#3395) by @NaitikRishu in kubescape/kubescape#3396
  • feat(imagescan): scan the correct platform for multi-arch images by @dakshhhhh16 in kubescape/kubescape#3345
  • feat(scan): add --include-kinds and --exclude-kinds resource kind filters by @Nakshatra480 in kubescape/kubescape#3372
  • fix(scan): apply the resource kind filters before collection, not after by @parthdagia05 in kubescape/kubescape#3411
  • fix: PolicyReportPrinter.CloseWriter now returns the close error by @doraem-on in kubescape/kubescape#3408
  • fix: check SetWriter's error in writeBaselineHeadReport by @doraem-on in kubescape/kubescape#3410
  • fix: diff --severity-threshold fails closed on unresolvable severity by @doraem-on in kubescape/kubescape#3406
  • feat(opaprocessor): add inline exception suppression via resource annotations by @karthik120710 in kubescape/kubescape#3392
  • fix(anonymizer): transform env var names referencing secrets/configmaps by @shivv23 in kubescape/kubescape#3364
  • fix: accept key==value label selectors in vap create-policy-binding by @doraem-on in kubescape/kubescape#3404
  • feat(imagescan): add --skip-db-update flag for offline image scanning by @AdeshDeshmukh in kubescape/kubescape#3387
  • fix: Add chunked pagination to SecurityException CRD retrieval by @shivansh-gohem in kubescape/kubescape#3393
  • feat(anonymizer): detect pseudo-ID collisions in Mapping.GetOrCreate by @arp1traj in kubescape/kubescape#3417
  • fix(reportcrypto): bind AEAD ciphertexts to the report that owns them by @arp1traj in kubescape/kubescape#3414
  • fix(cautils): propagate scan errors from splitYAMLDocuments instead of truncating silently by @arp1traj in kubescape/kubescape#3423
  • ci: pin golangci-lint to v2.12.2 to avoid v2.13.0 timeout regression by @matthyx in kubescape/kubescape#3429
  • ci: bound pr-scanner job runtime with timeout-minutes by @doraem-on in kubescape/kubescape#3431
  • fix(vapreconcile): credit admission enforcement to the policy a binding names by @parthdagia05 in kubescape/kubescape#3433
  • core: add ScanContext, an explicit-context scan entry point by @doraem-on in kubescape/kubescape#3432
  • feat(scan): add --exclude-path and .kubescapeignore for local scans by @Nakshatra480 in kubescape/kubescape#3422
  • feat(getter): support --custom-rules for user-authored Rego rules by @karthik120710 in kubescape/kubescape#3419
  • fix(resultshandling): recompute score and counters after severity filtering by @AdeshDeshmukh in kubescape/kubescape#3436
  • feat(coverage): flag frameworks scored 100% purely from irrelevant controls by @Ady0333 in kubescape/kubescape#3421
  • fix: enforce per-file size limit on file-scan path by @arp1traj in kubescape/kubescape#3453
  • feat: Implement global chunked pagination for Kubernetes resource retrieval by @shivansh-gohem in kubescape/kubescape#3428
  • feat: incremental scan caching to skip unchanged resources (--incremental) by @mohityadav8 in kubescape/kubescape#3412
  • feat: support downloading all controls when no ID is specified by @Kayd-06 in kubescape/kubescape#3435
  • core: add ScanImageContext, closing the last explicit-context gap from #3237 by @doraem-on in kubescape/kubescape#3443
  • fix(resourcehandler): resolve the core API group spelling on live cluster scans by @parthdagia05 in kubescape/kubescape#3426
  • feat: Streaming OpenVEX / CSAF Attestation Engine by @Rucha0901 in kubescape/kubescape#3294
  • fix(printer): support multiple image SBOM generation in CycloneDX and SPDX printers (#3399) by @NaitikRishu in kubescape/kubescape#3400
  • feat(scan): add --exclude-controls to drop controls from a framework scan by @Nakshatra480 in kubescape/kubescape#3441
  • fix(mcpserver): guard getPolicyGetter's lazy init, matching its siblings by @doraem-on in kubescape/kubescape#3445
  • fix(resourcehandler): treat an undecided access review as unchecked, not denied by @parthdagia05 in kubescape/kubescape#3446
  • fix(printer): printTopComponents corrupts output when a package has no recorded severities by @doraem-on in kubescape/kubescape#3451
  • ci(comments): gate pr_agent on trusted commenter author_association by @arp1traj in kubescape/kubescape#3449
  • fix: implement chunked pagination for namespace counting by @shivansh-gohem in kubescape/kubescape#3467
  • fix(scan): fail explicitly on unmatched severity threshold by @arp1traj in kubescape/kubescape#3456
  • fix(anonymizer): anonymize container names and images on scanned workloads by @Nakshatra480 in kubescape/kubescape#3463
  • fix(resultshandling): apply severity filters to framework control maps by @Nakshatra480 in kubescape/kubescape#3455
  • fix(scan): clarify --min-severity is output-only and warn about thresholds by @arp1traj in kubescape/kubescape#3458
  • fix(vap): stop create-policy-binding silently rewriting the label selector it was given by @parthdagia05 in kubescape/kubescape#3468
  • fix(install): quote paths and limit cleanup to canonical locations by @arp1traj in kubescape/kubescape#3464
  • feat: Add context-aware VAP for ActorTemplate and WorkerPool by @Rucha0901 in kubescape/kubescape#3466
  • fix(imagescan): stop stalled GitLab pagination by @dakshhhhh16 in kubescape/kubescape#3472
  • Fix memory allocation spikes during opa evaluations by @Rucha0901 in kubescape/kubescape#2920
  • fix: remove secrets from cluster size estimation to tighten RBAC by @shivansh-gohem in kubescape/kubescape#3478
  • feat(scan): add --skip-controls and --include-controls filtering by @karthik120710 in kubescape/kubescape#3480
  • feat(operator): add findings-driven targeting to the remediate CLI by @yugal07 in kubescape/kubescape#3474
  • fix(anonymizer): anonymize env var names referencing fieldRef and resourceFieldRef by @manoj-1407 in kubescape/kubescape#3484
  • fix(printer): sanitize cluster and namespace identifiers in PolicyReport names and labels (#3469) by @NaitikRishu in kubescape/kubescape#3470
  • fix(printer): centralize output path resolution by @AnvayKharb in kubescape/kubescape#3492
  • fix(httphandler): add optional bearer auth and trust boundary docs for /v1 endpoints by @arp1traj in kubescape/kubescape#3461
  • fix(imagescan): bound registry API responses by @dakshhhhh16 in kubescape/kubescape#3473
  • fix(opaprocessor): stop caching rules that read resource status by @Nakshatra480 in kubescape/kubescape#3482
  • feat(mcpserver): add SSE transport and advanced MCP tools for LLMs by @Rucha0901 in kubescape/kubescape#3375
  • fix(cel): refuse a control whose paramKind the scan has no binding to resolve by @parthdagia05 in kubescape/kubescape#3495
  • fix(printer): restore missing strings import in policyreportprinter.go by @adity1raut in kubescape/kubescape#3503
  • feat(policy): add kubescape policy test to run rule fixtures against the real evaluator by @Ady0333 in kubescape/kubescape#3477
  • fix(opaprocessor): make scope-less exceptions apply to resource-backed findings too by @adity1raut in kubescape/kubescape#3427
  • chore(deps): bump opa-utils to v0.0.309 to pick up the NewScore singleton fix by @doraem-on in kubescape/kubescape#3416
  • feat: Add GCP and Azure support for DescribeRepositories and ListEnti… by @dolliecoder in kubescape/kubescape#2573
  • feat(scan): validate repository scan contracts by @dakshhhhh16 in kubescape/kubescape#3481
  • fix(printer): unify output path resolution across all printers by @axolotl5165 in kubescape/kubescape#3493
  • fix(metrics): export ResetForTest so external packages can rebind instruments by @shivv23 in kubescape/kubescape#3483
  • fix(hostsensor): enforce bounded decompression read in cache to prevent OOM (CWE-400) by @axolotl5165 in kubescape/kubescape#3490
  • fix(mcpserver): scan_resource_slice returns [] not null for an empty result set by @doraem-on in kubescape/kubescape#3506
  • docs(cel): correct the authorizer skip scope and make the verification recipe reproducible by @Sanchit2662 in kubescape/kubescape#3496
  • fix(opaprocessor): honor namespace scope on incremental cache hits by @Ady0333 in kubescape/kubescape#3501
  • fix: initialize all vulnerability severities with placeholders by @Kayd-06 in kubescape/kubescape#3498
  • fix(opaprocessor): make --skip-controls and --include-controls case-insensitive by @doraem-on in kubescape/kubescape#3508
  • fix(vap): refuse a parameter reference that does not match the bound policy's paramKind by @parthdagia05 in kubescape/kubescape#3511
  • fix(opaprocessor): apply --skip-controls/--include-controls on the streaming path by @Ady0333 in kubescape/kubescape#3520
  • feat(telemetry): export scan traces and metrics to an OTLP collector by @Nakshatra480 in kubescape/kubescape#3521
  • fix(scan): validate --label-selector in ValidateCommonScanFlags by @manoj-1407 in kubescape/kubescape#3502
  • feat(scan): wire CEL ValidatingAdmissionPolicy evaluation into the scan pipeline by @karthik120710 in kubescape/kubescape#3513
  • ci: bump rajatjindal/krew-release-bot from 0.0.47 to 0.0.51 by @dependabot[bot] in kubescape/kubescape#3536
  • feat(scan): add generic webhook notifications by @thuanlm215 in kubescape/kubescape#3504
  • chore(deps): bump k8s.io/apimachinery from 0.36.3 to 0.36.4 in /httphandler by @dependabot[bot] in kubescape/kubescape#3527
  • ci: bump mikepenz/action-junit-report from 5.6.2 to 6.4.2 by @dependabot[bot] in kubescape/kubescape#3533
  • ci: bump helm/kind-action from 1.10.0 to 1.14.0 by @dependabot[bot] in kubescape/kubescape#3532
  • fix(core): close output writers when Scan fails by @ye11oc4t in kubescape/kubescape#3232
  • chore(deps): bump github.com/armosec/armoapi-go from 0.0.751 to 0.0.754 in /httphandler by @dependabot[bot] in kubescape/kubescape#3526
  • fix(config): make config set keys case-insensitive and accept kebab-c… by @NaitikRishu in kubescape/kubescape#3541
  • fix(opaprocessor): hard error when --include-controls matches no known control by @arp1traj in kubescape/kubescape#3552
  • fix(junit): distinguish image scan platforms by @AnvayKharb in kubescape/kubescape#3544
  • ci: bump docker/setup-buildx-action from 4.2.0 to 4.3.0 by @dependabot[bot] in kubescape/kubescape#3534
  • chore(deps): bump github.com/kubescape/go-logger from 0.0.33 to 0.0.34 in /httphandler by @dependabot[bot] in kubescape/kubescape#3522
  • fix: scope cluster size estimation to included namespaces by @shivansh-gohem in kubescape/kubescape#3538
  • fix(resourcehandler): a namespace filter naming no namespace silently skips every namespaced query by @parthdagia05 in kubescape/kubescape#3539
  • chore(deps): bump github.com/kubescape/opa-utils from 0.0.309 to 0.0.310 in /httphandler by @dependabot[bot] in kubescape/kubescape#3524
  • ci: bump Codium-ai/pr-agent from 0.35.0 to 0.43.0 by @dependabot[bot] in kubescape/kubescape#3535
  • fix(storage): recover missing workload posture controls by @ye11oc4t in kubescape/kubescape#3545
  • ci: bump github.com/stretchr/testify from 1.11.1 to 1.12.1 in /httphandler by @dependabot[bot] in kubescape/kubescape#3525
  • test(printer): add edge case coverage for AssistedRemediationPathsToS… by @karthik120710 in kubescape/kubescape#3548
  • test(policy): validate all in-tree rule fixtures in CI by @ye11oc4t in kubescape/kubescape#3546
  • chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.8 to 6.8.3 by @dependabot[bot] in kubescape/kubescape#3530
  • chore(deps): bump github.com/owenrumney/go-sarif/v2 from 2.2.0 to 2.3.3 by @dependabot[bot] in kubescape/kubescape#3523
  • chore(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.32.17 to 1.32.38 by @dependabot[bot] in kubescape/kubescape#3528
  • chore(deps): bump github.com/zclconf/go-cty from 1.17.0 to 1.19.0 by @dependabot[bot] in kubescape/kubescape#3531
  • chore(deps): bump github.com/kubescape/go-git-url from 0.0.31 to 0.0.33 by @dependabot[bot] in kubescape/kubescape#3529
  • feat(scan): apply repository scan contracts by @dakshhhhh16 in kubescape/kubescape#3537
  • feat(getter): load custom rules from the standard rule directory layout by @Nakshatra480 in kubescape/kubescape#3553
  • chore(printer): clarify strings import dependency in policyreportprinter.go by @arp1traj in kubescape/kubescape#3550
  • fix(opaprocessor): quote inline exception designator attributes by @Ady0333 in kubescape/kubescape#3558
  • fix(opaprocessor): honor ResourceEnumerator output in scan path by @arp1traj in kubescape/kubescape#3559
  • fix(scan-coverage): surface skipped manifests in coverage and fail gate by @arp1traj in kubescape/kubescape#3555
  • feat(vapreconcile): add per-resource VAPBinding scope coverage by @doraem-on in kubescape/kubescape#3570
  • fix(imagescan): bound GCP GetImagesScanStatus pagination loop by @doraem-on in kubescape/kubescape#3566
  • fix(opaprocessor): guard InfoMap read against concurrent writes in hasUnreachableDependency by @AdeshDeshmukh in kubescape/kubescape#3563
  • fix(hostsensorutils): record a status when reported CRD items cannot be read by @parthdagia05 in kubescape/kubescape#3561
  • chore(cel): bump the pinned CEL policy library to v0.14 and sync the bundle by @Sanchit2662 in kubescape/kubescape#3556
  • feat(mcpserver): add apply_remediation tool for deterministic AI auto-patching by @dolliecoder in kubescape/kubescape#3568
  • fix(mcpserver): prefer ScanCoverage over the seeded summary when flagging unevaluated controls by @dolliecoder in kubescape/kubescape#3574
  • feat(markdown): support image scan reports by @AnvayKharb in kubescape/kubescape#3573
  • feat(printer): generate a posture exceptions baseline from scan results by @Nakshatra480 in kubescape/kubescape#3560
  • fix(cel): resolve a cluster-scoped paramRef, and refuse one that selects params by @parthdagia05 in kubescape/kubescape#3575
  • feat(printer): support initContainers and ephemeralContainers in assisted remediation paths by @karthik120710 in kubescape/kubescape#3578
  • feat(version): add yaml output format support (#3542) by @NaitikRishu in kubescape/kubescape#3543
  • fix(anonymizer): restore reference-backed env var name anonymization by @doraem-on in kubescape/kubescape#3579
  • feat(scan): add Slack webhook notifications by @thuanlm215 in kubescape/kubescape#3571
  • fix(fixhandler): check the error from closing a fixed file, not just writing it by @adity1raut in kubescape/kubescape#3580
  • feat(list): show the control configuration a scan evaluates against by @Nakshatra480 in kubescape/kubescape#3586
  • feat(image): surface VEX status in reports by @AnvayKharb in kubescape/kubescape#3594
  • fix(resultshandling): deterministic AssociatedControls ordering across scans by @AdeshDeshmukh in kubescape/kubescape#3590
  • fix(patch): filesystem-safe intermediate filenames and update-all nil guard by @AdeshDeshmukh in kubescape/kubescape#3596
  • fix(vapreconcile): correct binding-scope coverage for cluster-scoped resources and Namespaces by @parthdagia05 in kubescape/kubescape#3592
  • test(printer): add regression test for sensitive data exposure in res… by @karthik120710 in kubescape/kubescape#3582
  • feat(containerscan): validate layers, layer hashes, and vulnerability names in ScanResultReport.Validate() by @karthik120710 in kubescape/kubescape#3591
  • feat(cel): honor VAP spec.failurePolicy for validation expression errors by @karthik120710 in kubescape/kubescape#3583
  • feat(coverage): report resource kinds no control examined by @Ady0333 in kubescape/kubescape#3588
  • fix: deduplicate included namespaces in splitNamespaces by @shivansh-gohem in kubescape/kubescape#3599
  • refactor: remove deprecated FailedPath from codebase by @Kayd-06 in kubescape/kubescape#3598
  • fix(vap): report a namespace selector that cannot narrow a policy's cluster-scoped resources by @parthdagia05 in kubescape/kubescape#3597
  • feat(networkpolicy): add real NetworkPolicy reachability engine by @doraem-on in kubescape/kubescape#3601
  • [LFX 2026] chore(deps): bump opa-utils to v0.0.312 for alertOnly exception semantics by @yugal07 in kubescape/kubescape#3615
  • fix(resourcehandler): do not report a kind's other served versions as unexamined by @parthdagia05 in kubescape/kubescape#3609
  • feat(fixhandler): apply fixes to JSON manifests by @Nakshatra480 in kubescape/kubescape#3608
  • fix(scan): enforce compliance-threshold in scan workload (#3610) by @NaitikRishu in kubescape/kubescape#3612
  • fix(anonymizer): hide scan path, host and cluster identity under --hide and --encrypt by @Nakshatra480 in kubescape/kubescape#3611
  • refactor(resourcehandler): partition streaming collector items as the pager yields them by @aryanghai12 in kubescape/kubescape#3613
  • fix: validate URLs in config set by @Rucha0901 in kubescape/kubescape#3585
  • feat(mapreconcile): add MutatingAdmissionPolicy discovery and impact matching by @doraem-on in kubescape/kubescape#3606
  • feat(scan): add contract report provenance by @dakshhhhh16 in kubescape/kubescape#3607
  • feat: support --format json for the update command by @Rucha0901 in kubescape/kubescape#3617
  • fix(cel): matchConditions short-circuit on false skips evaluating later conditions by @doraem-on in kubescape/kubescape#3630
  • feat(list): filter controls by framework and search by @AnvayKharb in kubescape/kubescape#3624
  • fix(anonymizer): anonymize Secret/ConfigMap names referenced via spec.volumes by @doraem-on in kubescape/kubescape#3619
  • feat(telemetry): report image DB freshness by @AnvayKharb in kubescape/kubescape#3604
  • refactor: migrate gorilla/mux to net/http ServeMux by @shivansh-gohem in kubescape/kubescape#3620
  • feat(diff): add aggregate summary outputs by @AnvayKharb in kubescape/kubescape#3626
  • feat(policy): scaffold custom Rego rules and refresh test fixtures from rule output by @Nakshatra480 in kubescape/kubescape#3635
  • fix(opaprocessor): evaluate rules against full input after enumeration by @Ady0333 in kubescape/kubescape#3628
  • feat(scan): add SARIF contract validation output by @AnvayKharb in kubescape/kubescape#3622
  • feat(printer): add github-actions output format for inline PR annotations by @AdeshDeshmukh in kubescape/kubescape#3637
  • feat(sarif): add stable scan fingerprints by @AnvayKharb in kubescape/kubescape#3639
  • fix(mapreconcile): match the subresource form of a resource rule by @parthdagia05 in kubescape/kubescape#3646
  • feat(config): support --format / -f flag in config view (#3641) by @NaitikRishu in kubescape/kubescape#3642
  • fix(scancache): reset dirty flag after Flush writes cache file by @shivv23 in kubescape/kubescape#3515
  • feat(networkpolicy,vulnexposure): correlate vulnerabilities with NetworkPolicy exposure by @doraem-on in kubescape/kubescape#3632
  • fix(fixhandler): cross-control fix promotion checks the value, not just the path by @doraem-on in kubescape/kubescape#3634
  • fix(resourcesprioritization): don't drop attack tracks when a resource matches more than one by @doraem-on in kubescape/kubescape#3659
  • fix(mapreconcile): a policy gated by matchConditions is not a confirmed match by @parthdagia05 in kubescape/kubescape#3654
  • fix(download): accept plural and alias target arguments (#3666) by @NaitikRishu in kubescape/kubescape#3667
  • fix(cel): honor an equivalent matchPolicy when scoping a policy to a scanned object by @parthdagia05 in kubescape/kubescape#3673
  • fix(anonymizer): pseudonymize image-scan results under --hide/--encrypt by @arp1traj in kubescape/kubescape#3661
  • feat(mcpserver): add scan_workload tool for single-resource scanning by @dolliecoder in kubescape/kubescape#3669
  • feat(config): add cached config validation by @AnvayKharb in kubescape/kubescape#3663
  • feat(notification): add Microsoft Teams Adaptive Card support for --notify webhooks by @Nakshatra480 in kubescape/kubescape#3645
  • fix(opaprocessor): match CIS section numbers in --skip-controls/--include-controls by @arp1traj in kubescape/kubescape#3658
  • feat(scan): record contract runner input digests by @dakshhhhh16 in kubescape/kubescape#3640
  • test(cel): compare Rego and CEL verdicts for the converted controls by @Sanchit2662 in kubescape/kubescape#3603
  • test(resourcehandler): add a synthetic-cluster collector memory harness by @aryanghai12 in kubescape/kubescape#3614
  • feat(exposure): model external exposure via Ingress, Gateway API, and Service type by @doraem-on in kubescape/kubescape#3648
  • feat(scan): scan multiple images in one run sharing the vulnerability database by @Nakshatra480 in kubescape/kubescape#3682
  • feat(resourcehandler): collect via namespaced endpoints under --include-namespaces by @Ady0333 in kubescape/kubescape#3683
  • feat(vap): list embedded admission policies and the controls they implement by @Nakshatra480 in kubescape/kubescape#3674
  • perf: stream JSON outputs instead of massive byte array allocations in memory by @shivansh-gohem in kubescape/kubescape#3670
  • fix(core): ensure OpenTelemetry spans are ended across all exit and error paths by @khuswant18 in kubescape/kubescape#3665
  • feat(printer): surface failed-path evidence values in JSON/YAML output by @adity1raut in kubescape/kubescape#3256
  • feat(printer): include evidence paths in GitHub Actions annotation messages by @manoj-1407 in kubescape/kubescape#3677
  • fix(getter): give custom rules a base score instead of leaving it zero by @arp1traj in kubescape/kubescape#3676
  • ci: bump golangci/golangci-lint-action from 9.2.0 to 9.3.0 by @dependabot[bot] in kubescape/kubescape#3693
  • chore(deps): bump github.com/kubescape/go-logger from 0.0.28 to 0.0.34 by @dependabot[bot] in kubescape/kubescape#3695
  • chore(deps): bump github.com/armosec/armoapi-go from 0.0.754 to 0.0.757 in /httphandler by @dependabot[bot] in kubescape/kubescape#3686
  • chore(deps): bump k8s.io/apimachinery from 0.36.4 to 0.37.0 in /httphandler by @dependabot[bot] in kubescape/kubescape#3687
  • chore(deps): bump github.com/mark3labs/mcp-go from 0.57.0 to 0.58.0 by @dependabot[bot] in kubescape/kubescape#3692
  • feat(scan): emit CycloneDX and SPDX SBOMs from posture scans with --scan-images by @Nakshatra480 in kubescape/kubescape#3698
  • ci: bump actions/setup-python from 5.6.0 to 7.0.0 by @dependabot[bot] in kubescape/kubescape#3688
  • ci: bump github/codeql-action/upload-sarif from 4.37.7 to 4.37.9 by @dependabot[bot] in kubescape/kubescape#3691
  • fix(score): route dead telemetry scorer output to logger.L().Debug by @arp1traj in kubescape/kubescape#3702
  • ci: bump anchore/sbom-action/download-syft from 0.24.0 to 0.24.2 by @dependabot[bot] in kubescape/kubescape#3689
  • feat(fix): support cluster scan reports by printing patched manifests by @dolliecoder in kubescape/kubescape#3705
  • fix(ci): prevent shell injection in tag-action composite action by @arp1traj in kubescape/kubescape#3700
  • chore(deps): bump github.com/kubescape/backend from 0.0.46 to 0.0.48 in /httphandler by @dependabot[bot] in kubescape/kubescape#3684
  • chore(deps): bump github.com/go-openapi/runtime from 0.33.0 to 0.33.1 in /httphandler by @dependabot[bot] in kubescape/kubescape#3685
  • refactor: consolidate httphandler into root Go module by @matthyx in kubescape/kubescape#3706
  • chore(deps): bump github.com/maruel/natural from 1.1.1 to 1.3.0 by @dependabot[bot] in kubescape/kubescape#3696
  • chore(deps): bump google.golang.org/protobuf from 1.36.12-0.20260120151049-f2248ac996af to 1.36.12 by @dependabot[bot] in kubescape/kubescape#3690
  • fix(exposure): model spec.externalIPs, flag unconfirmed cross-namespace backendRef as unclear by @doraem-on in kubescape/kubescape#3679
  • feat(scan): wire up sequential multi-cluster scanning via --kube-contexts by @doraem-on in kubescape/kubescape#3438
  • feat(rbacgraph): model multi-hop RBAC privilege-escalation paths by @doraem-on in kubescape/kubescape#3681
  • feat(scan): add per-namespace compliance rollup by @Ady0333 in kubescape/kubescape#3704
  • ci: bump mikepenz/action-junit-report from 6.4.2 to 6.5.0 by @dependabot[bot] in kubescape/kubescape#3708
  • Add URL context to repository scanner error messages by @karthik120710 in kubescape/kubescape#3650
  • chore(deps): bump github.com/mattn/go-isatty from 0.0.21 to 0.0.24 by @dependabot[bot] in kubescape/kubescape#3710
  • chore(deps): bump github.com/aws/aws-sdk-go-v2 from 1.43.7 to 1.45.1 by @dependabot[bot] in kubescape/kubescape#3711
  • fix(printer): include the scanned platform in GitLab finding ids by @AnshulPatil2005 in kubescape/kubescape#3713
  • test: add vulnerability identity and deduplication test coverage by @karthik120710 in kubescape/kubescape#3653
  • feat(fix): select which controls to remediate with --include-controls and --skip-controls by @Nakshatra480 in kubescape/kubescape#3714
  • chore(deps): fix Dependabot security vulnerabilities with available patches by @matthyx in kubescape/kubescape#3715
• kubescape/http-request@v0.2.20...v0.2.23
  • feat: add attestations: write permission for image provenance attestation by @Varadraj75 in kubescape/http-request#27
  • fix: don't drop headers whose value contains a colon by @magic-peach in kubescape/http-request#28
  • Bump Go builder to 1.26.7 by @matthyx in kubescape/http-request#29
  • docs: add package doc comment to request.go by @matthyx in kubescape/http-request#30
• kubescape/kubevuln@v0.3.159...v0.3.430
  • test: key ctxCapturing sub-client wrappers by namespace by @NaitikRishu in kubescape/kubevuln#442
  • fix: propagate ctx to backend HTTP retries and gate chunk dispatch on summary success (#446) by @bhuvan-somisetty in kubescape/kubevuln#451
  • fix: gate ScanCP image pulls on the too-many-requests backoff cache by @bhuvan-somisetty in kubescape/kubevuln#457
  • fix(securityexception): keep under-investigation vulnerabilities visible by @h30s in kubescape/kubevuln#432
  • fix: classify gRPC codes.DeadlineExceeded as ReasonScanTimeout by @AdeshDeshmukh in kubescape/kubevuln#445
  • fix: propagate SecurityException aliases into vulnerability exception… by @AdeshDeshmukh in kubescape/kubevuln#464
  • fix: bound graceful shutdown drain time instead of blocking indefinitely by @bhuvan-somisetty in kubescape/kubevuln#468
  • fix: remove sidecar RPC-wide lock, fix Version() cache poisoning, and bound retryCount growth by @bhuvan-somisetty in kubescape/kubevuln#474
  • fix: fetch the full summary in StoreCVESummaryStub so the data-preservation guard works by @AdeshDeshmukh in kubescape/kubevuln#476
  • fix: copy container profile labels before enriching the relevancy scan by @AdeshDeshmukh in kubescape/kubevuln#466
  • fix: skip grype offline-db tests instead of panicking when Docker is unavailable by @rootp1 in kubescape/kubevuln#472
  • test: expand context propagation test coverage (#436) by @NaitikRishu in kubescape/kubevuln#460
  • fix(core): reconcile cached manifests with the current SecurityException set by @AdeshDeshmukh in kubescape/kubevuln#470
  • feat: expose GET /metrics endpoint via OTel Prometheus exporter by @rootp1 in kubescape/kubevuln#459
  • fix(adapters): key relevancy merge by (cve, package) by @AdeshDeshmukh in kubescape/kubevuln#480
  • feat: sweep stale stereoscope temp dirs at startup by @AdeshDeshmukh in kubescape/kubevuln#491
  • fix: resolve vendor advisory links by @aaa-aashna in kubescape/kubevuln#462
  • fix: propagate K8s API list failures from GetSecurityExceptions instead of swallowing them by @bhuvan-somisetty in kubescape/kubevuln#479
  • fix: allow retries on 500 Internal Server Error in shouldRetryReport by @doraem-on in kubescape/kubevuln#487
  • fix(repositories): include IgnoredMatches in VEX statement generation and updates (#497) by @bhuvan-somisetty in kubescape/kubevuln#498
  • fix(core): enable storage, exception filtering, and VEX generation in ScanRegistry (#484) by @bhuvan-somisetty in kubescape/kubevuln#485
  • fix: include SecurityException-suppressed CVEs in generated VEX document by @h30s in kubescape/kubevuln#482
  • test(adapters): add unit tests for syft_utils hash helpers by @AHS0003 in kubescape/kubevuln#509
  • fix(repositories): cache SecurityException/ClusterSecurityException List() results by @bhuvan-somisetty in kubescape/kubevuln#511
  • feat: add metric for degraded exception fetching by @Shreya2005-2005 in kubescape/kubevuln#508
  • feat(adapters): surface suppression provenance for security exceptions by @rootp1 in kubescape/kubevuln#495
  • fix: resolve TOCTOU race condition in sidecar version cache by @doraem-on in kubescape/kubevuln#494
  • fix(services): pass filtered manifests to StoreVEX in ScanCP (#501) by @bhuvan-somisetty in kubescape/kubevuln#502
  • refactor: simplify postResults error handling by @aaa-aashna in kubescape/kubevuln#461
  • fix(services): unify rate-limit cache key normalization and add ScanRegistry execution guard (#503) by @bhuvan-somisetty in kubescape/kubevuln#504
  • refactor(sbomscanner): make registry auth fallback pluggable by @rootp1 in kubescape/kubevuln#500
  • fix(adapters): wire WithPlatform() into syft.GetSource() calls by @rootp1 in kubescape/kubevuln#513
  • fix: prevent panic on non-string ScanCVE args in SubmitCVE by @doraem-on in kubescape/kubevuln#517
  • fix: skip SBOM regeneration on ScanCVE cache hit by @doraem-on in kubescape/kubevuln#522
  • fix(repositories): enforce nil CVEManifest.Content consistently in VEX generation by @bhuvan-somisetty in kubescape/kubevuln#519
  • docs: add scan failure reporting doc by @kooomix in kubescape/kubevuln#523
  • fix(repositories): guard nil CVEManifest.Content in parseSeverities by @bhuvan-somisetty in kubescape/kubevuln#525
  • fix(services): walk filterSBOM's relationship graph to a fixed point by @bhuvan-somisetty in kubescape/kubevuln#515
  • fix(adapters): pass platform to syft GetSource in in-process SBOM path by @nitishmalang in kubescape/kubevuln#506
  • fix(adapters): guard nil error and check context cancellation in ReportError/SendStatus (#538) by @NaitikRishu in kubescape/kubevuln#539
  • feat(adapters): emit K8s Events for suppressed CVEs on SecurityExceptions by @bhuvan-somisetty in kubescape/kubevuln#537
  • docs+fix: document per-pod cache tradeoff and tighten exceptionsCache TTL by @bhuvan-somisetty in kubescape/kubevuln#531
  • fix(services): report GenerateSBOM SBOM-status failures and add reason label to scan metrics by @bhuvan-somisetty in kubescape/kubevuln#544
  • test: modernize APIServer fake storage harness by @rootp1 in kubescape/kubevuln#532
  • feat(securityexception): support per-vulnerability expiresAt override by @AnshulPatil2005 in kubescape/kubevuln#541
  • fix(adapters): share one fix-state predicate across suppression paths by @AnshulPatil2005 in kubescape/kubevuln#533
  • Add a local verify workflow for contributors by @rootp1 in kubescape/kubevuln#535
  • fix(metrics): export scan fallback counters by @rootp1 in kubescape/kubevuln#546
  • fix(sbom): resolve platform end-to-end, fix pod-less fallback, record resolved platform, classify platform mismatches by @rootp1 in kubescape/kubevuln#530
  • fix: include credentials in rate-limit cache key to prevent cross-tenant DoS by @doraem-on in kubescape/kubevuln#527
  • feat(securityexception): add affected status with actionStatement and typed response by @AnshulPatil2005 in kubescape/kubevuln#543
  • test(repositories): add unit tests for NoOpSecurityExceptionRepository by @AHS0003 in kubescape/kubevuln#558
  • feat(metrics): add Prometheus metrics for SecurityException matched/expired/active exceptions by @bhuvan-somisetty in kubescape/kubevuln#553
  • fix: keep sidecar transport failures out of the OOM path by @rootp1 in kubescape/kubevuln#552
  • fix(config): warn when storage is enabled but riskAcceptance isn't, document both undocumented fields by @bhuvan-somisetty in kubescape/kubevuln#564
  • feat(registryauth): resolve ECR credentials from the ambient AWS identity by @AnshulPatil2005 in kubescape/kubevuln#563
  • chore(deps): bump kubescape/storage to v0.0.302, unblocking #554 by @matthyx in kubescape/kubevuln#556
  • fix(config): avoid mutating default HTTP client by @rootp1 in kubescape/kubevuln#561
  • feat(securityexception): scope vulnerability entries to packages with subcomponents by @AnshulPatil2005 in kubescape/kubevuln#542
  • fix(services): generate VEX on every CVE-scan path, not two of five by @AnshulPatil2005 in kubescape/kubevuln#559
  • feat: populate IgnoreRule provenance fields, not just log them by @Shreya2005-2005 in kubescape/kubevuln#570
  • Add GitHub Actions wiring for diff-based lint checks by @rootp1 in kubescape/kubevuln#568
  • fix(registryauth): cache and dedupe GCP/ECR credential fetches across both SBOM paths by @bhuvan-somisetty in kubescape/kubevuln#571
  • fix(adapters): clamp the SBOM size limit sent to the sidecar scanner by @AnshulPatil2005 in kubescape/kubevuln#585
  • fix(adapters): match an exception policy at most once per CVE by @AnshulPatil2005 in kubescape/kubevuln#579
  • fix(sbomscanner): stop the abandoned Syft goroutine racing the handler by @AnshulPatil2005 in kubescape/kubevuln#581
  • fix: honor caller cancellation in security-exception and label lookups by @rootp1 in kubescape/kubevuln#577
  • fix(config): honor env-only trustedVendors/proxyRegistryMap overrides by @bhuvan-somisetty in kubescape/kubevuln#593
  • fix(sbomscanner): round the scan timeout up when sending it to the sidecar by @AnshulPatil2005 in kubescape/kubevuln#587
  • fix(adapters): use the shared ignore predicate in Summarize by @AnshulPatil2005 in kubescape/kubevuln#573
  • Fix fallback label for TooLarge status without annotations by @doraem-on in kubescape/kubevuln#575
  • fix: respect parent context and apply scanTimeout in SyftAdapter.CreateSBOM by @NaitikRishu in kubescape/kubevuln#583
  • fix(tools): stop SanitizeLabel producing labels that get dropped by @AnshulPatil2005 in kubescape/kubevuln#590
  • fix: make updateVEX author-aware to prevent overwriting external VEX by @h30s in kubescape/kubevuln#595
  • fix: log expired security exceptions by @aaa-aashna in kubescape/kubevuln#550
  • fix(backend): capture non-200 response body snippet and fix dead 429 logging (#596) by @bhuvan-somisetty in kubescape/kubevuln#597
  • docs: note the sidecar's SBOM size ceiling and timeout granularity by @AnshulPatil2005 in kubescape/kubevuln#603
  • docs: add the three instruments missing from the API metrics table by @AnshulPatil2005 in kubescape/kubevuln#604
  • Add diagnostics endpoint for scan mode and backend versions by @rootp1 in kubescape/kubevuln#599
  • fix(services): route ScanRegistry's SBOM lookup through getSBOM by @AnshulPatil2005 in kubescape/kubevuln#609
  • fix(adapters): stop the abandoned Syft goroutine racing CreateSBOM by @AnshulPatil2005 in kubescape/kubevuln#601
  • feat: deduplicate concurrent SBOM generation with singleflight in ScanService (#605) by @NaitikRishu in kubescape/kubevuln#610
  • fix(services): key the SBOM singleflight on the image, not the tag by @AnshulPatil2005 in kubescape/kubevuln#629
  • fix(services): count only the scans singleflight spared, not the leader by @AnshulPatil2005 in kubescape/kubevuln#631
  • fix(repositories): do not let an external VEX statement suppress our own by @AnshulPatil2005 in kubescape/kubevuln#633
  • fix(adapters): log the SBOM size limit under its own name by @AnshulPatil2005 in kubescape/kubevuln#616
  • fix: bound the sbom-scanner sidecar's graceful shutdown with a timeout by @bhuvan-somisetty in kubescape/kubevuln#634
  • fix: decode the Auth field when converting registry credentials by @bhuvan-somisetty in kubescape/kubevuln#612
  • chore(repositories): give the timestamp annotation key a constant by @AnshulPatil2005 in kubescape/kubevuln#621
  • fix(adapters): pin platform in SBOM tests for arch-stable fixtures by @rootp1 in kubescape/kubevuln#625
  • fix: give ParseImageManifest the same LayerOrder indexing as parseLayersPayload by @bhuvan-somisetty in kubescape/kubevuln#626
  • feat: honor Retry-After header in HTTP retry logic by @Shreya2005-2005 in kubescape/kubevuln#637
  • fix(services): persist TooLarge SBOM markers and stop double-storing by @AnshulPatil2005 in kubescape/kubevuln#623
  • fix(registryauth): count upstream credential fetches, not missed lookups by @AnshulPatil2005 in kubescape/kubevuln#619
  • fix(adapters): key relevancy on the package version too, not just its name by @AnshulPatil2005 in kubescape/kubevuln#659
  • fix: match VEX statements across all products/subcomponents, not just the first by @Shreya2005-2005 in kubescape/kubevuln#666
  • fix(repositories): invalidate SecurityException cache on CRD changes by @rootp1 in kubescape/kubevuln#653
  • fix(adapters): normalize trusted vendor slugs before matching distros by @AnshulPatil2005 in kubescape/kubevuln#651
  • fix(services): match relevant-file paths that carry a wildcard placeholder by @AnshulPatil2005 in kubescape/kubevuln#646
  • fix(adapters): resolve IntroducedInLayer for packages outside the base layer by @AnshulPatil2005 in kubescape/kubevuln#644
  • fix(adapters): give the summary a stable severity stats order by @AnshulPatil2005 in kubescape/kubevuln#648
  • fix(config): bind env for the keys that have no default by @AnshulPatil2005 in kubescape/kubevuln#640
  • fix: report actual SecurityException integration state in Diagnostics, not raw config flag by @AHS0003 in kubescape/kubevuln#662
  • refactor: extract the duplicated cache-hit exception reconciliation into reconcileCachedCVE by @bhuvan-somisetty in kubescape/kubevuln#641
  • fix: preserve VEX metadata on no-op rescans by @rootp1 in kubescape/kubevuln#661
  • feat: add SafeFetch, an SSRF-guarded HTTP fetcher by @Shreya2005-2005 in kubescape/kubevuln#549
  • Align lint verification with the intended diff-based workflow by @rootp1 in kubescape/kubevuln#567
  • fix: preserve SecurityException VEX semantics by @rootp1 in kubescape/kubevuln#657
  • fix: add scan status endpoint by @rootp1 in kubescape/kubevuln#636
  • feat(metrics): add Prometheus metrics for rate-limit retry attempts and outcomes (#654) by @NaitikRishu in kubescape/kubevuln#655
  • fix: preserve external VEX statements without IDs by @h30s in kubescape/kubevuln#664
  • fix: report every singleflight waiter's own SBOM-creation failure by @bhuvan-somisetty in kubescape/kubevuln#649
  • test(adapters): gate network-dependent syft tests behind integration tag by @rootp1 in kubescape/kubevuln#678
  • test(domain): add unit tests for ScanError by @AHS0003 in kubescape/kubevuln#668
  • Fix/external vex masking by @h30s in kubescape/kubevuln#671
  • perf(sbom): index the Syft metadata reattachment instead of scanning by @AnshulPatil2005 in kubescape/kubevuln#675
  • refactor(repositories): build the local VEX statement in one place by @AnshulPatil2005 in kubescape/kubevuln#689
  • fix(services): count a singleflight waiter even when the creation failed by @AnshulPatil2005 in kubescape/kubevuln#684
  • perf(adapters): index CVE exceptions once per scan instead of per match by @rootp1 in kubescape/kubevuln#694
  • test(adapters): cover mock failure-injection and limit-getter paths by @rootp1 in kubescape/kubevuln#695
  • refactor(registryauth): share the registry auth fallback ladder by @AnshulPatil2005 in kubescape/kubevuln#686
  • fix(tools): bound a Retry-After so a registry cannot park a scan by @AnshulPatil2005 in kubescape/kubevuln#679
  • fix: key ID-less matches in IgnoredMatchKeys so cache-diff republish detects them by @rootp1 in kubescape/kubevuln#696
  • fix(repositories): index VEX statements instead of rescanning by @rootp1 in kubescape/kubevuln#673
  • fix(repositories): adopt the VEX statements we wrote before #595 by @AnshulPatil2005 in kubescape/kubevuln#682
  • feat(adapters): add exponential backoff retry for transient 429 rate limit responses (#613) by @NaitikRishu in kubescape/kubevuln#614
  • fix(adapters): document and test isExpired's now-equality boundary by @rootp1 in kubescape/kubevuln#710
  • fix: record all matching exception policies in AppliedIgnoreRules (#715) by @bhuvan-somisetty in kubescape/kubevuln#716
  • fix: remove dead code and ineffectual assignment by @rootp1 in kubescape/kubevuln#717
  • refactor: remove dead isGlobal parameter from incrementCounter by @doraem-on in kubescape/kubevuln#706
  • refactor(repositories): share the create-or-update sequence in StoreSBOM by @AnshulPatil2005 in kubescape/kubevuln#725
  • fix: restore silenced Syft conversion warnings by @doraem-on in kubescape/kubevuln#703
  • refactor(services): store the filtered CVE in one place by @AnshulPatil2005 in kubescape/kubevuln#723
  • fix: omit empty repository_url query parameter in createProductStructForImageAndPackage by @bhuvan-somisetty in kubescape/kubevuln#719
  • fix(controllers): stop copying HTTPController's sync.Once by value by @AnshulPatil2005 in kubescape/kubevuln#727
  • fix(controllers): fix copylocks violation on HTTPController method receivers (#720) by @NaitikRishu in kubescape/kubevuln#721
  • Security: remediate dependency CVEs in kubevuln by @sagarkhandagre998 in kubescape/kubevuln#700
  • security: remediate gosec SAST findings in kubevuln by @sagarkhandagre998 in kubescape/kubevuln#704
  • fix: release pullMutex only when abandoned Syft goroutine finishes by @bhuvan-somisetty in kubescape/kubevuln#690
  • fix: restore deduplicateErrors helper in adapters/v1 by @matthyx in kubescape/kubevuln#739
  • fix(repositories): stop calling cloud exception suppressions external VEX by @AnshulPatil2005 in kubescape/kubevuln#714
  • test(adapters): point the exception lookup tests at the live implementation by @AnshulPatil2005 in kubescape/kubevuln#712
  • fix: prevent RestoreSuppressedMatches from undoing VEX suppressions by @h30s in kubescape/kubevuln#701
  • fix: sweep stale stereoscope temp dirs periodically, not once at startup by @bhuvan-somisetty in kubescape/kubevuln#669
  • fix: bound the sbom-scanner sidecar's image pull by the request timeout by @bhuvan-somisetty in kubescape/kubevuln#743
  • fix: close TOCTOU race between SecurityException cache invalidation and in-flight List() by @bhuvan-somisetty in kubescape/kubevuln#734
  • refactor(adapters): convert a grype match in one place by @AnshulPatil2005 in kubescape/kubevuln#741
  • fix(repositories): report the summary's own name when storing it fails by @AnshulPatil2005 in kubescape/kubevuln#745
  • refactor(controllers): share the tracked-scan submit sequence by @AnshulPatil2005 in kubescape/kubevuln#738
  • fix: support storing CVE summary for workloads with empty WLID (#697) by @bhuvan-somisetty in kubescape/kubevuln#698
  • test(adapters): cover deduplicateErrors so it does not read as dead code again by @AnshulPatil2005 in kubescape/kubevuln#730
  • fix(adapters): restore cloud-sourced suppressions again by @AnshulPatil2005 in kubescape/kubevuln#747
  • chore(tools): drop RemoveContainerFromSlug, which nothing calls by @AnshulPatil2005 in kubescape/kubevuln#736
  • fix(adapters): implement deduplicateErrors in domain_to_syft (#728) by @NaitikRishu in kubescape/kubevuln#731
  • fix: bound the HTTP controller's scan queue with admission control by @bhuvan-somisetty in kubescape/kubevuln#749
  • fix(controllers): close the race between a scan request's Submit and Shutdown by @bhuvan-somisetty in kubescape/kubevuln#759
  • fix(adapters): stop a zero Retry-After turning a retry into a hot loop by @AnshulPatil2005 in kubescape/kubevuln#755
  • fix(adapters): stop metadata-only history entries claiming a layer's order by @AnshulPatil2005 in kubescape/kubevuln#752
  • refactor(controllers): bind the scan command in one place by @AnshulPatil2005 in kubescape/kubevuln#757
  • fix(services): stop dropping registry credentials that carry only half a pair by @AnshulPatil2005 in kubescape/kubevuln#766
  • fix(safefetch): block IPv4 addresses carried inside an IPv6 one by @AnshulPatil2005 in kubescape/kubevuln#762
  • feat: add a safe temp-file writer for VEX documents by @Shreya2005-2005 in kubescape/kubevuln#764
  • fix(registryauth): evict expired entries from the credential cache by @magic-peach in kubescape/kubevuln#767
  • fix(repositories): canonicalize a VEX component's maps in sorted order by @AnshulPatil2005 in kubescape/kubevuln#775
  • fix(repositories): make GetSBOM's version-freshness check symmetric by @bhuvan-somisetty in kubescape/kubevuln#771
  • refactor(controllers): drop the sort before deleting every evicted record by @AnshulPatil2005 in kubescape/kubevuln#782
  • fix(tools,adapters): join filesystem paths with filepath, not path by @AnshulPatil2005 in kubescape/kubevuln#788
  • docs(development): fix debug-logging instructions that do nothing by @AnshulPatil2005 in kubescape/kubevuln#783
  • docs(api): document the /v1/diagnostics endpoint by @AnshulPatil2005 in kubescape/kubevuln#789
  • fix(controllers): stop scan status lookups from sweeping the whole store by @bhuvan-somisetty in kubescape/kubevuln#791
  • docs(architecture): document the sidecar SBOM scanner and the missing packages by @AnshulPatil2005 in kubescape/kubevuln#777
  • fix(registryauth): bound the credential cache with a size-capped LRU by @bhuvan-somisetty in kubescape/kubevuln#753
  • test(vexdoc): skip the permission assertion on Windows by @AnshulPatil2005 in kubescape/kubevuln#781
  • refactor: share the Syft source setup between both SBOM paths by @AnshulPatil2005 in kubescape/kubevuln#793
  • fix(config): say why clusterData.json was rejected instead of only that it is missing by @AnshulPatil2005 in kubescape/kubevuln#795
  • fix(repositories): copy the caller's maps when enriching a summary object by @AnshulPatil2005 in kubescape/kubevuln#787
  • fix(adapters,sbomscanner): guard the pull, not just cataloguing, against the temp-dir sweep by @bhuvan-somisetty in kubescape/kubevuln#797
  • Fix/vex canonical hash determinism by @h30s in kubescape/kubevuln#770
  • fix(build): fail the offline-db build when a download fails by @AnshulPatil2005 in kubescape/kubevuln#805
  • ci: declare permissions on the two workflows that had none by @AnshulPatil2005 in kubescape/kubevuln#802
  • docs(api): document maxQueueDepth's 503 admission-control response by @bhuvan-somisetty in kubescape/kubevuln#811
  • test(domain): cover the scan phase updater, which had none by @AnshulPatil2005 in kubescape/kubevuln#807
  • docs(config): document what deploying the SBOM scanner sidecar requires by @AnshulPatil2005 in kubescape/kubevuln#809
  • fix(adapters): give cloud exceptions precedence over CRD ones on overlap by @bhuvan-somisetty in kubescape/kubevuln#813
  • ci: pin the two small third-party actions and stop one inheriting write scopes by @AnshulPatil2005 in kubescape/kubevuln#803
  • ci: give golangci-lint headroom over its actual runtime by @AnshulPatil2005 in kubescape/kubevuln#799
  • fix(repositories): treat a dropped SecurityException as an incomplete set by @AnshulPatil2005 in kubescape/kubevuln#773
  • feat: resolve CSAF composite product IDs to real purls by @Shreya2005-2005 in kubescape/kubevuln#815
  • fix(services): make ScanCP's summary totals agree with every other scan flow by @bhuvan-somisetty in kubescape/kubevuln#820
  • fix(services): report a failed container scan from ScanCP instead of nil by @bhuvan-somisetty in kubescape/kubevuln#817
  • fix(ci): isolate release workflow concurrency by @rootp1 in kubescape/kubevuln#821
  • chore(ci): narrow PR image build triggers by @rootp1 in kubescape/kubevuln#823
  • docs: document what VEX generation actually produces by @AnshulPatil2005 in kubescape/kubevuln#833
  • ci: ignore markdown changes across all subdirectories in PR workflows by @NaitikRishu in kubescape/kubevuln#826
  • refactor(platform): share the platform helpers both SBOM paths duplicate by @AnshulPatil2005 in kubescape/kubevuln#829
  • test(safefetch): cover the SSRF guards the package documents but never exercised by @AnshulPatil2005 in kubescape/kubevuln#831
  • test: add coverage for remaining BrokenStore methods by @AHS0003 in kubescape/kubevuln#827
  • fix(repositories): resolve workload namespace in APIServerStore.GetCVESummary by @bhuvan-somisetty in kubescape/kubevuln#825
  • test(tools): fix the racy stop assertion in the periodic sweep test by @AnshulPatil2005 in kubescape/kubevuln#849
  • fix(adapters): pick the nearest fix version, never a downgrade by @bhuvan-somisetty in https://github.com/kubescape/kubevuln/pull/845
  • fix(services): stop ScanRegistry handing the CVE scanner a nil SBOM by @AnshulPatil2005 in https://github.com/kubescape/kubevuln/pull/847
  • fix(vexdoc): drop the error crypto/rand.Read cannot return, and cover the one that happens by @AnshulPatil2005 in https://github.com/kubescape/kubevuln/pull/841
  • test(metrics): cover the three recorders with no test and the unpinned outcome labels by @AnshulPatil2005 in https://github.com/kubescape/kubevuln/pull/837
  • fix(repositories): stop MemoryStore answering a manifest read with a summary write by @AnshulPatil2005 in https://github.com/kubescape/kubevuln/pull/839
  • fix: avoid VEX ignored match key collisions by @jijo-OO7 in https://github.com/kubescape/kubevuln/pull/843
  • fix(tools): support short reference patterns in ReferenceMatchForms (#834) by @bhuvan-somisetty in https://github.com/kubescape/kubevuln/pull/835
  • ci: add govulncheck vulnerability scan by @bhuvan-somisetty in https://github.com/kubescape/kubevuln/pull/855
  • fix: reject a scan jobID that already has an active scan in progress by @bhuvan-somisetty in https://github.com/kubescape/kubevuln/pull/857
  • fix(adapters): report unknown, not empty, when no fix version is above installed by @AnshulPatil2005 in https://github.com/kubescape/kubevuln/pull/859
  • fix(repositories): align APIServerStore.GetCVESummary resource name resolution for non-workload scans (#860) by @bhuvan-somisetty in https://github.com/kubescape/kubevuln/pull/861
  • chore: clear the standing lint findings so make lint-all exits clean by @AnshulPatil2005 in https://github.com/kubescape/kubevuln/pull/865
  • fix(adapters,repositories): recover actionStatement/response for affected SecurityExceptions by @bhuvan-somisetty in https://github.com/kubescape/kubevuln/pull/867
  • fix(adapters): match a SecurityException pattern that names Docker Hub non-canonically by @AnshulPatil2005 in https://github.com/kubescape/kubevuln/pull/864
  • docs: correct SecurityException CRD apiVersion to v1beta1 by @slashben in https://github.com/kubescape/kubevuln/pull/868
  • fix(ci): update vulnerable dependencies on main by @matthyx in https://github.com/kubescape/kubevuln/pull/869
  • chore(deps): bump github.com/moby/go-archive from 0.1.0 to 0.3.0 by @dependabot[bot] in https://github.com/kubescape/kubevuln/pull/870
  • fix(repositories): give an affected SecurityException precedence when multiple exceptions match by @bhuvan-somisetty in https://github.com/kubescape/kubevuln/pull/872
  • fix: honor CPE matching off mode for stock matcher by @jijo-OO7 in https://github.com/kubescape/kubevuln/pull/874
  • fix(adapters): check subcomponent scope before excluding a CRD exception for cloud precedence by @bhuvan-somisetty in https://github.com/kubescape/kubevuln/pull/876
  • fix(tools): reject a Retry-After value that would overflow time.Duration by @bhuvan-somisetty in https://github.com/kubescape/kubevuln/pull/879
  • fix(adapters): don't let the docker.io/index.docker.io alias override a more specific entry by @bhuvan-somisetty in https://github.com/kubescape/kubevuln/pull/884
  • feat(diagnostics): report worker pool queue depth by @rootp1 in https://github.com/kubescape/kubevuln/pull/882
  • chore(ci): pin GitHub workflow refs by @rootp1 in https://github.com/kubescape/kubevuln/pull/822
  • chore(deps): bump docker/setup-buildx-action from 3.9.0 to 4.3.0 by @dependabot[bot] in https://github.com/kubescape/kubevuln/pull/885
  • chore(deps): bump docker/setup-qemu-action from 3.7.0 to 4.2.0 by @dependabot[bot] in https://github.com/kubescape/kubevuln/pull/889
  • chore(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 by @dependabot[bot] in https://github.com/kubescape/kubevuln/pull/887
  • chore(deps): bump docker/login-action from 3.7.0 to 4.6.0 by @dependabot[bot] in https://github.com/kubescape/kubevuln/pull/888
  • chore(deps): bump github/codeql-action/upload-sarif from 3.37.7 to 4.37.8 by @dependabot[bot] in https://github.com/kubescape/kubevuln/pull/886
  • docs(config): match the duration schema pattern to what LoadConfig actually accepts by @bhuvan-somisetty in https://github.com/kubescape/kubevuln/pull/891
  • feat: add vexvalidate to check a fetched document is genuinely OpenVEX by @Shreya2005-2005 in https://github.com/kubescape/kubevuln/pull/880
  • fix(sbomscanner): return syftToDomain's error instead of a nil the caller dereferences by @AnshulPatil2005 in https://github.com/kubescape/kubevuln/pull/895
  • test(tools): cover DeleteContents and the default retry config, drop two dead helpers by @AnshulPatil2005 in https://github.com/kubescape/kubevuln/pull/897
  • test(repositories): check our own VEX statements against go-vex's rules by @AnshulPatil2005 in https://github.com/kubescape/kubevuln/pull/903
  • fix(adapters): recover the grype DB updater when a load hangs past its timeout by @bhuvan-somisetty in https://github.com/kubescape/kubevuln/pull/901
  • refactor(sbom): share the two functions both SBOM paths still duplicate by @AnshulPatil2005 in https://github.com/kubescape/kubevuln/pull/915
  • test(repositories): make the fake storage clientset honour ResourceVersion: metadata by @bhuvan-somisetty in https://github.com/kubescape/kubevuln/pull/911
  • fix(adapters): normalize underscore delimiters in CleanDigestAlgorith… by @NaitikRishu in https://github.com/kubescape/kubevuln/pull/899
  • services: mark hash.Hash.Write's error as intentionally ignored by @AHS0003 in https://github.com/kubescape/kubevuln/pull/907
  • fix(services): classify HTTP 404, NAME_UNKNOWN, and BLOB_UNKNOWN registry errors as ImageNotFound (#908) by @NaitikRishu in https://github.com/kubescape/kubevuln/pull/909
  • fix(config): reject a non-positive maxImageSize or maxSBOMSize by @AnshulPatil2005 in https://github.com/kubescape/kubevuln/pull/913
  • fix(adapters): return syftToDomain's error instead of nil-derefing Content in the log by @bhuvan-somisetty in https://github.com/kubescape/kubevuln/pull/905
  • services: classify UNAUTHORIZED and NAME_UNKNOWN registry error codes by @AHS0003 in https://github.com/kubescape/kubevuln/pull/906
  • docs,test: apply the two review nits from #913 and #903 by @AnshulPatil2005 in https://github.com/kubescape/kubevuln/pull/918
  • fix(repositories,adapters): deduplicate concurrent SecurityException/exceptions cache misses by @bhuvan-somisetty in https://github.com/kubescape/kubevuln/pull/917
  • fix(repositories): cache GetWorkloadLabels/GetNamespaceLabels results by @bhuvan-somisetty in https://github.com/kubescape/kubevuln/pull/920
  • chore(ci): bump ossf/scorecard-action from v2.4.0 to v2.4.4 by @AHS0003 in https://github.com/kubescape/kubevuln/pull/928
  • fix(registryauth): only fall back to anonymous on a repeated auth denial by @bhuvan-somisetty in https://github.com/kubescape/kubevuln/pull/922
  • fix(repositories): emit an empty statements array, not null, for a clean image by @AnshulPatil2005 in https://github.com/kubescape/kubevuln/pull/926
  • fix(ci): pin actions/checkout and actions/setup-go to commit SHA in govulncheck.yaml by @AHS0003 in https://github.com/kubescape/kubevuln/pull/931
  • fix(repositories): start security exception informer only when risk acceptance is enabled by @matthyx in https://github.com/kubescape/kubevuln/pull/932
• kubescape/node-agent@v0.3.158...v0.3.219
  • fix(sbommanager): decouple shared-data wait from single-worker pool to stop node-wide SBOM stall (#850) by @Aaradhya-07 in https://github.com/kubescape/node-agent/pull/859
  • fix Test 33 projection of wildcardIdentifier in Path entries as patterns not values by @entlein in https://github.com/kubescape/node-agent/pull/863
  • test(component): add Test_34 NetworkNeighbors CIDR collapse e2e to Matthias CIDR Collapse by @entlein in https://github.com/kubescape/node-agent/pull/861
  • feat(cel): expose the exec controlling terminal to rules (hasTty, tty, ttyMajor, ttyMinor) by @slashben in https://github.com/kubescape/node-agent/pull/868
  • docs(utils): document why fieldCaches is keyed by EventType (release trigger) by @slashben in https://github.com/kubescape/node-agent/pull/869
  • fix(containerprofile): split oversized chunks on HTTP 413 instead of ending learning by @rotemamsa in https://github.com/kubescape/node-agent/pull/866
  • feat(processtree): populate the process start time (SUB-7845) by @AlonLiwsky in https://github.com/kubescape/node-agent/pull/873
  • addon fix for the old issue to /proc full paths not being recorded by @entlein in https://github.com/kubescape/node-agent/pull/872
  • fix(processtree): correct the exit-cleanup lifecycle under shutdown and pid reuse (SUB-7847, SUB-7846) by @AlonLiwsky in https://github.com/kubescape/node-agent/pull/876
  • feat(otel): add pod-level memory metric, harden cgroup scope resolution by @matthyx in https://github.com/kubescape/node-agent/pull/883
  • feat(networkstream): process attribution on the network stream (SUB-7786) by @AlonLiwsky in https://github.com/kubescape/node-agent/pull/879
  • fix(node-agent): fix ContainerProfile size accounting in ReportSyscall and ReportNetworkEvent by @aryanghai12 in https://github.com/kubescape/node-agent/pull/882
  • fix(sbom): classify sidecar oversized images as TooLarge by @manumathon in https://github.com/kubescape/node-agent/pull/880
  • fix(containerprofilemanager): repair timestamp chain on LRU eviction and retry exhaustion by @aryanghai12 in https://github.com/kubescape/node-agent/pull/884
  • fix(rulebinding): exact namespace match and skip invalid selectors by @manumathon in https://github.com/kubescape/node-agent/pull/878
  • test(utils): attribute missing /proc prefixes to tracer or normalization layer by @aryanghai12 in https://github.com/kubescape/node-agent/pull/886
  • fix(networkstream): key stream entities by container ID outside Kubernetes by @AlonLiwsky in https://github.com/kubescape/node-agent/pull/887
  • Chore/retire headless proc regex in favor of opens-gadget fix -- remove band-aid from last week by @entlein in https://github.com/kubescape/node-agent/pull/889
  • fix rule failure runtime alert path handling by @khuswant18 in https://github.com/kubescape/node-agent/pull/892
  • ci: support component tests for fork PRs by @Namanbhatt-01 in https://github.com/kubescape/node-agent/pull/898
  • chore: deprecate old profiletypes in favor of containerprofiles by @entlein in https://github.com/kubescape/node-agent/pull/864
  • ci: fix stale/missing component-tests matrix entries and storage image version drift by @matthyx in https://github.com/kubescape/node-agent/pull/900
  • feat(cel): restore ap./nn. namespace aliases for backward compatibility by @matthyx in https://github.com/kubescape/node-agent/pull/901
  • fix: addon to opens-gadget there was still a missing piece. Also adding the bitnami images to Test27 (they generate evidence) by @entlein in https://github.com/kubescape/node-agent/pull/893
  • fix(hostsensormanager): stop matching decoy release files as os-release by @magic-peach in https://github.com/kubescape/node-agent/pull/904
  • fix(tracers): bounded retry for DNSTracer gadget startup by @matthyx in https://github.com/kubescape/node-agent/pull/906
  • Chore(deps): Bump google.golang.org/grpc from 1.80.0 to 1.82.1 by @dependabot[bot] in https://github.com/kubescape/node-agent/pull/907
  • fix(deps): drop cilium/ebpf fork, pin real upstream v0.22.0 by @matthyx in https://github.com/kubescape/node-agent/pull/909
  • feat(rulemanager): add rule filtering based on context by @khuswant18 in https://github.com/kubescape/node-agent/pull/911
  • fix(rulemanager): scope monitorContainer exit to its own registration by @matthyx in https://github.com/kubescape/node-agent/pull/920
  • test: add unit tests for malwaremanager, healthmanager, and nodeprofilemanager by @khuswant18 in https://github.com/kubescape/node-agent/pull/914
  • fix(seccomp): drop unrecognized syscall numbers instead of recording "unknown" by @rotemamsa in https://github.com/kubescape/node-agent/pull/916
  • chore: bump inspektor-gadget fork to latest main by @matthyx in https://github.com/kubescape/node-agent/pull/921
  • fix(containerprofile): reduce syscall loss window on container termination by @matthyx in https://github.com/kubescape/node-agent/pull/924
  • build: switch inspektor-gadget fork from matthyx to kubescape by @matthyx in https://github.com/kubescape/node-agent/pull/925
  • ci: guard against a stale inspektor-gadget replace pin by @matthyx in https://github.com/kubescape/node-agent/pull/929
  • fix: tighten NOTE-marker detection in check-inspektor-gadget-pin.sh to avoid substring false positives by @matthyx in https://github.com/kubescape/node-agent/pull/930
  • fix: prevent malware manager lifecycle race by @khuswant18 in https://github.com/kubescape/node-agent/pull/926
  • fix: hard-fail check-ig-pin on a definitive 404/422 from the compare API by @matthyx in https://github.com/kubescape/node-agent/pull/931
  • fix(syscall): stop dropping host-process events for consumers that need them by @matthyx in https://github.com/kubescape/node-agent/pull/932
  • feat(malwaremanager): remove the ClamAV scanner by @AlonLiwsky in https://github.com/kubescape/node-agent/pull/927
  • fix: harden check-inspektor-gadget-pin.sh against 404/block-form/narrow-NOTE gaps by @matthyx in https://github.com/kubescape/node-agent/pull/933
  • feat(benchmark): capture heap/allocs/cpu pprof profiles and gate Peak CPU on p95 by @matthyx in https://github.com/kubescape/node-agent/pull/934
  • perf(http,processtree): pool HTTP readers and eliminate redundant process tree allocations by @matthyx in https://github.com/kubescape/node-agent/pull/936
  • perf(rulemanager,metrics): accelerate path lookup, remove pprof labels, and gate OTEL init by @matthyx in https://github.com/kubescape/node-agent/pull/938
  • fix(exporters): keep limiting after the first dropped alert by @AlonLiwsky in https://github.com/kubescape/node-agent/pull/928
  • fix(dnsmanager): scope IP-to-domain resolution cache per container by @matthyx in https://github.com/kubescape/node-agent/pull/939
  • fix(deps): update vulnerable dependencies to patched versions by @matthyx in https://github.com/kubescape/node-agent/pull/940
• kubescape/operator@v0.2.159...v0.2.169
  • feat: honor install-time defaultFrameworks for posture scans by @manumathon in https://github.com/kubescape/operator/pull/398
  • feat(autoscaler): auto-detect Bottlerocket and set super_t by @slashben in https://github.com/kubescape/operator/pull/393
  • fix(rulebinding): match namespaces by exact name, not String() substring by @manumathon in https://github.com/kubescape/operator/pull/402
  • fix: bump kubescape/storage to v0.0.301 to resolve CRD schema drift by @doraem-on in https://github.com/kubescape/operator/pull/404
  • fix: log the actual kubescape response body on scan errors by @magic-peach in https://github.com/kubescape/operator/pull/406
  • fix(remediation): honour selector.namespace when resolving findings-driven targets by @yugal07 in https://github.com/kubescape/operator/pull/407
  • Honour continuousScanning.matchingRules.namespaces by @arpitjain099 in https://github.com/kubescape/operator/pull/405
  • refactor: migrate gorilla/mux to net/http ServeMux by @shivansh-gohem in https://github.com/kubescape/operator/pull/408
  • chore(deps): fix open Dependabot vulnerabilities with available patches by @matthyx in https://github.com/kubescape/operator/pull/409
• kubescape/storage@v0.0.297...v0.0.331
  • collapse dedup (also known as "greedy bucket") by @entlein in https://github.com/kubescape/storage/pull/349
  • Add CIDR-based collapsing for NetworkNeighbors by @matthyx in https://github.com/kubescape/storage/pull/348
  • fix: use /128 CIDR for single IPv6 peers instead of /32 by @ArneshBanerjee in https://github.com/kubescape/storage/pull/353
  • fix: parse IPv6 hosts correctly in AnalyzeURL by @ArneshBanerjee in https://github.com/kubescape/storage/pull/354
  • fix: validate OpenVulnerabilityExchangeContainer spec (#355) by @Shreya2005-2005 in https://github.com/kubescape/storage/pull/356
  • feat: add suppression provenance fields to IgnoreRule (#357) by @Shreya2005-2005 in https://github.com/kubescape/storage/pull/358
  • chore: deprecate old profiletypes in favor of containerprofiles by @entlein in https://github.com/kubescape/storage/pull/351
  • fix: don't fork the consolidation chain on duplicate report rows by @magic-peach in https://github.com/kubescape/storage/pull/361
  • feat: support label selectors for list operations by @ystkfujii in https://github.com/kubescape/storage/pull/362
  • feat(network): serviceRef/serviceSelector/entity selectors on NetworkNeighbor by @entlein in https://github.com/kubescape/storage/pull/364
  • fix storage restore namespace admission and fix sqlite timeout by @entlein in https://github.com/kubescape/storage/pull/366
  • fix(cleanup): reclaim container profiles under singular kind segment by @kxxil01 in https://github.com/kubescape/storage/pull/367
  • fix(storage): dry-run panic on every resource; finalizer-delete silently not persisted by @matthyx in https://github.com/kubescape/storage/pull/372
  • fix(storage): enable namespace-scoped watches; Create/Update out param now carries Spec by @matthyx in https://github.com/kubescape/storage/pull/374
  • fix(storage): Phase 1 lock fixes -- connection-before-lock ordering (RC1) and migration-exec-in-lock (RC3) by @matthyx in https://github.com/kubescape/storage/pull/375
  • fix(storage): release pool connection between GetList's internal pages by @matthyx in https://github.com/kubescape/storage/pull/380
  • feat(storage): single dedicated writer + priority queue (gated prototype), Phase 0 observability by @matthyx in https://github.com/kubescape/storage/pull/379
  • fix(storage): scope GetList's tracing span to the whole call by @matthyx in https://github.com/kubescape/storage/pull/381
  • fix(storage): single-writer path can't upsert missing keys, drops finalizer-delete updates by @matthyx in https://github.com/kubescape/storage/pull/382
  • feat(registry): generic rest.Storage, add openvulnerabilityexchange as second Phase 4 resource by @matthyx in https://github.com/kubescape/storage/pull/373
  • feat(registry): generic rest.Storage for containerprofiles, third Phase 4 resource by @matthyx in https://github.com/kubescape/storage/pull/377
  • feat(registry): generic rest.Storage for the remaining 8 Phase 4 resources by @matthyx in https://github.com/kubescape/storage/pull/378
  • fix(storage): unpaginated GetList no longer truncates to 500 items by @matthyx in https://github.com/kubescape/storage/pull/384
  • fix(build): cross-compile delve correctly in Dockerfile.debug for arm64 by @matthyx in https://github.com/kubescape/storage/pull/386
  • fix: generate metadata.uid for new ContainerProfiles by @matthyx in https://github.com/kubescape/storage/pull/388
  • fix(deps): bump vulnerable dependencies to fix Dependabot alerts by @matthyx in https://github.com/kubescape/storage/pull/389
  • fix: correct vulnerability summary package name by @ystkfujii in https://github.com/kubescape/storage/pull/391
  • fix(registry): apply selectors to generated list results by @ystkfujii in https://github.com/kubescape/storage/pull/390
  • chore: update pull request template by @ystkfujii in https://github.com/kubescape/storage/pull/392
  • Add CUSTOM_REST_ENABLED env var for Phase 4 REST migration by @matthyx in https://github.com/kubescape/storage/pull/387
  • feat(storage): enable single writer by default and harden pool timeout by @matthyx in https://github.com/kubescape/storage/pull/393
  • fix: prevent deadlock in PreSave metadata read and fix single-writer lock ordering by @matthyx in https://github.com/kubescape/storage/pull/394
• kubescape/synchronizer@v0.0.155...v0.0.160
  • feat(backend): add SASL/TLS support to the Kafka message queue backend by @harshitg927 in https://github.com/kubescape/synchronizer/pull/167
  • fix(backend): fail fast on unreachable kafka brokers and add e2e cove… by @harshitg927 in https://github.com/kubescape/synchronizer/pull/169
  • fix(backend): skip self-produced kafka records and close startup sign… by @harshitg927 in https://github.com/kubescape/synchronizer/pull/170
  • fix(utils): stop cooldown queue eviction from panicking after Stop by @magic-peach in https://github.com/kubescape/synchronizer/pull/171
  • fix(deps): bump dependencies to resolve Dependabot alerts by @matthyx in https://github.com/kubescape/synchronizer/pull/172
• Bump prometheus-exporter from v0.2.22 to v0.2.23

Full Changelog: kubescape-operator-1.40.3...kubescape-operator-1.40.4