chore(deps): update helm release kubescape-operator to v1.40.4

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change
kubescape-operator (source)	patch	1.40.1 → 1.40.4

---

Release Notes

kubescape/helm-charts (kubescape-operator)

v1.40.4

Compare Source

Kubescape is an E2E Kubernetes cluster security platform

What's Changed

• docs: remove dead kubescape.submit value from README by @​matthyx in #​886
• Bump storage image to v0.0.298 and ignore local CLI files by @​matthyx in #​887
• feat: expose defaultFrameworks in kubescape-operator chart by @​manumathon in #​890
• feat(node-agent): auto-set super_t on Bottlerocket node groups by @​slashben in #​880
• bump operator to v0.2.162 for the bottlerocket detection by @​matthyx in #​892
• feat(kubescape): add opt-in RBAC for agent runtime posture by @​dakshhhhh16 in #​893
• feat(storage): allow running the APIServer on the host network by @​ahauserv in #​894
• fix(kubescape): stop masking the baked policy library when downloads are off by @​ahauserv in #​895
• fix: drop all Linux capabilities in workload container securityContexts by @​ahauserv in #​897
• fix: mount CA certificates into the sbom-scanner sidecar by @​matthyx in #​898
• fix(storage): omit the empty annotations key on the seccompprofiles CRD by @​ahauserv in #​900
• feat(autoupdater): support pod metadata overrides by @​AnvayKharb in #​903
• Drop pods/delete RBAC for node-agent by @​matthyx in #​904
• fix(node-agent): enable Prometheus OTEL exporter by @​khuswant18 in #​907
• [LFX 2026] feat(crds): align SecurityException vulnerability schema with the kubevuln types by @​yugal07 in #​909
• fix(kubescape): mount config.json as a file, not over the whole policy directory by @​matthyx in #​908
• feat(node-agent): remove ClamAV and move malware detection to the hash sensor by @​AlonLiwsky in #​910
• fix: pin runAsGroup wherever the chart pins runAsUser by @​ahauserv in #​912
• fix: bump kubescape scanner to v4.0.12 to unbreak standalone configuration scanning by @​slashben in #​914
• feat: add options to disable exec and open tracing by @​ystkfujii in #​906
• move extra node-agent configuration to extra by @​matthyx in #​884
• prepare next release by @​matthyx in #​905
• kubescape/kubescape@v4.0.11...v4.0.13
  • fix(prettyprinter): stop treating resource-derived text as a format string by @​magic-peach in kubescape/kubescape#3333
  • fix(printer): add container names to HTML/SARIF evidence paths by @​manumathon in kubescape/kubescape#3301
  • fix: embed HTML report logo instead of loading it from GitHub by @​doraem-on in kubescape/kubescape#3336
  • feat(rules): add weak-namespace-token-access-v1 by @​aryanghai12 in kubescape/kubescape#3339
  • fix(imagescan): tighten gitlab imageMatches suffix check by @​magic-peach in kubescape/kubescape#3340
  • chore(deps): bump github.com/mark3labs/mcp-go from 0.29.0 to 0.57.0 by @​dependabot[bot] in kubescape/kubescape#3168
  • chore(deps): bump github.com/kubescape/rbac-utils from 0.0.21-0.20230806101615-07e36f555520 to 0.0.21 by @​dependabot[bot] in kubescape/kubescape#3170
  • fix(gomod): bump module path to /v4 to match release tags by @​aryanghai12 in kubescape/kubescape#3350
  • fix(cel): match CRD plurals the kind guess spells wrong by @​parthdagia05 in kubescape/kubescape#3355
  • fix(resourcehandler): skip discovered resources that do not support list by @​parthdagia05 in kubescape/kubescape#3346
  • fix(release): sign release assets with keyless cosign by @​arp1traj in kubescape/kubescape#3344
  • Keep CRD exceptions that a narrower cloud exception does not actually cover by @​parthdagia05 in kubescape/kubescape#3351
  • fix: compare --output file extensions case-insensitively by @​doraem-on in kubescape/kubescape#3334
  • feat(scan): extend --min-severity to all output formats and add --max-severity by @​Nakshatra480 in kubescape/kubescape#3337
  • perf(opaprocessor): cache LARGE_CLUSTER_SIZE threshold per OPAProcessor by @​karthik120710 in kubescape/kubescape#3342
  • fix: Terraform loader now recurses into subdirectories, like Helm/Kustomize by @​doraem-on in kubescape/kubescape#3349
  • chore(goreleaser): embed E2E hook as single script by @​AnouarMohamed in kubescape/kubescape#3299
  • fix: repair master build breaks (stale v3 import + jsonprinter test arg) by @​matthyx in kubescape/kubescape#3361
  • feat: surface vulnerability DB freshness in image-scan results by @​AdeshDeshmukh in kubescape/kubescape#3356
  • test(httphandler): skip directory permission test on Windows by @​Kayd-06 in kubescape/kubescape#3380
  • fix: a scope-less cloud exception now subsumes CRD exceptions for the same control by @​doraem-on in kubescape/kubescape#3370
  • feat: emit exception-match events for file/cloud exceptions too by @​doraem-on in kubescape/kubescape#3373
  • fix: count manual-control exceptions in the exception audit by @​doraem-on in kubescape/kubescape#3371
  • fix(printer): resolve indexed paths when lists are []map[string]any by @​manumathon in kubescape/kubescape#3357
  • fix(printer): format N/A and percentage compliance score correctly in… by @​NaitikRishu in kubescape/kubescape#3362
  • fix(printer): dedupe enriched failed paths against bare delete paths by @​adity1raut in kubescape/kubescape#3358
  • fix(printer): prevent out-of-bounds slice index panic in getSortedControlsIDs (#​3363) by @​NaitikRishu in kubescape/kubescape#3365
  • fix(reportcrypto): derive the report master key with Argon2id by @​arp1traj in kubescape/kubescape#3382
  • feat(rules): add approve-csr-v1 by @​AnouarMohamed in kubescape/kubescape#3298
  • feat: baseline drift detection for live cluster scans (--baseline) by @​mohityadav8 in kubescape/kubescape#3353
  • fix(diff): emit CI regression artifacts by @​AnvayKharb in kubescape/kubescape#3379
  • fix(printer): show assisted-remediation paths in control-view resource list by @​manumathon in kubescape/kubescape#3359
  • fix(krew): make .krew.yaml renderable and match published asset names by @​arp1traj in kubescape/kubescape#3389
  • fix(resultshandling): filter per-resource findings by severity, not the unused Report.Results field by @​Ady0333 in kubescape/kubescape#3388
  • fix(vap): reject a resource rule the bound policy can never match by @​parthdagia05 in kubescape/kubescape#3394
  • fix(preflight): skip Kubescape-served resources in dry-run access review by @​parthdagia05 in kubescape/kubescape#3391
  • test(cautils): skip helm chart symlink test when symlinks are unavailable by @​adity1raut in kubescape/kubescape#3398
  • fix(printer): normalize resource object before evidence path extraction by @​adity1raut in kubescape/kubescape#3397
  • fix(printer): aggregate multiple image scan runs in SARIF report printer (#​3395) by @​NaitikRishu in kubescape/kubescape#3396
  • feat(imagescan): scan the correct platform for multi-arch images by @​dakshhhhh16 in kubescape/kubescape#3345
  • feat(scan): add --include-kinds and --exclude-kinds resource kind filters by @​Nakshatra480 in kubescape/kubescape#3372
  • fix(scan): apply the resource kind filters before collection, not after by @​parthdagia05 in kubescape/kubescape#3411
  • fix: PolicyReportPrinter.CloseWriter now returns the close error by @​doraem-on in kubescape/kubescape#3408
  • fix: check SetWriter's error in writeBaselineHeadReport by @​doraem-on in kubescape/kubescape#3410
  • fix: diff --severity-threshold fails closed on unresolvable severity by @​doraem-on in kubescape/kubescape#3406
  • feat(opaprocessor): add inline exception suppression via resource annotations by @​karthik120710 in kubescape/kubescape#3392
  • fix(anonymizer): transform env var names referencing secrets/configmaps by @​shivv23 in kubescape/kubescape#3364
  • fix: accept key==value label selectors in vap create-policy-binding by @​doraem-on in kubescape/kubescape#3404
  • feat(imagescan): add --skip-db-update flag for offline image scanning by @​AdeshDeshmukh in kubescape/kubescape#3387
  • fix: Add chunked pagination to SecurityException CRD retrieval by @​shivansh-gohem in kubescape/kubescape#3393
  • feat(anonymizer): detect pseudo-ID collisions in Mapping.GetOrCreate by @​arp1traj in kubescape/kubescape#3417
  • fix(reportcrypto): bind AEAD ciphertexts to the report that owns them by @​arp1traj in kubescape/kubescape#3414
  • fix(cautils): propagate scan errors from splitYAMLDocuments instead of truncating silently by @​arp1traj in kubescape/kubescape#3423
  • ci: pin golangci-lint to v2.12.2 to avoid v2.13.0 timeout regression by @​matthyx in kubescape/kubescape#3429
  • ci: bound pr-scanner job runtime with timeout-minutes by @​doraem-on in kubescape/kubescape#3431
  • fix(vapreconcile): credit admission enforcement to the policy a binding names by @​parthdagia05 in kubescape/kubescape#3433
  • core: add ScanContext, an explicit-context scan entry point by @​doraem-on in kubescape/kubescape#3432
  • feat(scan): add --exclude-path and .kubescapeignore for local scans by @​Nakshatra480 in kubescape/kubescape#3422
  • feat(getter): support --custom-rules for user-authored Rego rules by @​karthik120710 in kubescape/kubescape#3419
  • fix(resultshandling): recompute score and counters after severity filtering by @​AdeshDeshmukh in kubescape/kubescape#3436
  • feat(coverage): flag frameworks scored 100% purely from irrelevant controls by @​Ady0333 in kubescape/kubescape#3421
  • fix: enforce per-file size limit on file-scan path by @​arp1traj in kubescape/kubescape#3453
  • feat: Implement global chunked pagination for Kubernetes resource retrieval by @​shivansh-gohem in kubescape/kubescape#3428
  • feat: incremental scan caching to skip unchanged resources (--incremental) by @​mohityadav8 in kubescape/kubescape#3412
  • feat: support downloading all controls when no ID is specified by @​Kayd-06 in kubescape/kubescape#3435
  • core: add ScanImageContext, closing the last explicit-context gap from #​3237 by @​doraem-on in kubescape/kubescape#3443
  • fix(resourcehandler): resolve the core API group spelling on live cluster scans by @​parthdagia05 in kubescape/kubescape#3426
  • feat: Streaming OpenVEX / CSAF Attestation Engine by @​Rucha0901 in kubescape/kubescape#3294
  • fix(printer): support multiple image SBOM generation in CycloneDX and SPDX printers (#​3399) by @​NaitikRishu in kubescape/kubescape#3400
  • feat(scan): add --exclude-controls to drop controls from a framework scan by @​Nakshatra480 in kubescape/kubescape#3441
  • fix(mcpserver): guard getPolicyGetter's lazy init, matching its siblings by @​doraem-on in kubescape/kubescape#3445
  • fix(resourcehandler): treat an undecided access review as unchecked, not denied by @​parthdagia05 in kubescape/kubescape#3446
  • fix(printer): printTopComponents corrupts output when a package has no recorded severities by @​doraem-on in kubescape/kubescape#3451
  • ci(comments): gate pr_agent on trusted commenter author_association by @​arp1traj in kubescape/kubescape#3449
  • fix: implement chunked pagination for namespace counting by @​shivansh-gohem in kubescape/kubescape#3467
  • fix(scan): fail explicitly on unmatched severity threshold by @​arp1traj in kubescape/kubescape#3456
  • fix(anonymizer): anonymize container names and images on scanned workloads by @​Nakshatra480 in kubescape/kubescape#3463
  • fix(resultshandling): apply severity filters to framework control maps by @​Nakshatra480 in kubescape/kubescape#3455
  • fix(scan): clarify --min-severity is output-only and warn about thresholds by @​arp1traj in kubescape/kubescape#3458
  • fix(vap): stop create-policy-binding silently rewriting the label selector it was given by @​parthdagia05 in kubescape/kubescape#3468
  • fix(install): quote paths and limit cleanup to canonical locations by @​arp1traj in kubescape/kubescape#3464
  • feat: Add context-aware VAP for ActorTemplate and WorkerPool by @​Rucha0901 in kubescape/kubescape#3466
  • fix(imagescan): stop stalled GitLab pagination by @​dakshhhhh16 in kubescape/kubescape#3472
  • Fix memory allocation spikes during opa evaluations by @​Rucha0901 in kubescape/kubescape#2920
  • fix: remove secrets from cluster size estimation to tighten RBAC by @​shivansh-gohem in kubescape/kubescape#3478
  • feat(scan): add --skip-controls and --include-controls filtering by @​karthik120710 in kubescape/kubescape#3480
  • feat(operator): add findings-driven targeting to the remediate CLI by @​yugal07 in kubescape/kubescape#3474
  • fix(anonymizer): anonymize env var names referencing fieldRef and resourceFieldRef by @​manoj-1407 in kubescape/kubescape#3484
  • fix(printer): sanitize cluster and namespace identifiers in PolicyReport names and labels (#​3469) by @​NaitikRishu in kubescape/kubescape#3470
  • fix(printer): centralize output path resolution by @​AnvayKharb in kubescape/kubescape#3492
  • fix(httphandler): add optional bearer auth and trust boundary docs for /v1 endpoints by @​arp1traj in kubescape/kubescape#3461
  • fix(imagescan): bound registry API responses by @​dakshhhhh16 in kubescape/kubescape#3473
  • fix(opaprocessor): stop caching rules that read resource status by @​Nakshatra480 in kubescape/kubescape#3482
  • feat(mcpserver): add SSE transport and advanced MCP tools for LLMs by @​Rucha0901 in kubescape/kubescape#3375
  • fix(cel): refuse a control whose paramKind the scan has no binding to resolve by @​parthdagia05 in kubescape/kubescape#3495
  • fix(printer): restore missing strings import in policyreportprinter.go by @​adity1raut in kubescape/kubescape#3503
  • feat(policy): add kubescape policy test to run rule fixtures against the real evaluator by @​Ady0333 in kubescape/kubescape#3477
  • fix(opaprocessor): make scope-less exceptions apply to resource-backed findings too by @​adity1raut in kubescape/kubescape#3427
  • chore(deps): bump opa-utils to v0.0.309 to pick up the NewScore singleton fix by @​doraem-on in kubescape/kubescape#3416
  • feat: Add GCP and Azure support for DescribeRepositories and ListEnti… by @​dolliecoder in kubescape/kubescape#2573
  • feat(scan): validate repository scan contracts by @​dakshhhhh16 in kubescape/kubescape#3481
  • fix(printer): unify output path resolution across all printers by @​axolotl5165 in kubescape/kubescape#3493
  • fix(metrics): export ResetForTest so external packages can rebind instruments by @​shivv23 in kubescape/kubescape#3483
  • fix(hostsensor): enforce bounded decompression read in cache to prevent OOM (CWE-400) by @​axolotl5165 in kubescape/kubescape#3490
  • fix(mcpserver): scan_resource_slice returns [] not null for an empty result set by @​doraem-on in kubescape/kubescape#3506
  • docs(cel): correct the authorizer skip scope and make the verification recipe reproducible by @​Sanchit2662 in kubescape/kubescape#3496
  • fix(opaprocessor): honor namespace scope on incremental cache hits by @​Ady0333 in kubescape/kubescape#3501
  • fix: initialize all vulnerability severities with placeholders by @​Kayd-06 in kubescape/kubescape#3498
  • fix(opaprocessor): make --skip-controls and --include-controls case-insensitive by @​doraem-on in kubescape/kubescape#3508
  • fix(vap): refuse a parameter reference that does not match the bound policy's paramKind by @​parthdagia05 in kubescape/kubescape#3511
  • fix(opaprocessor): apply --skip-controls/--include-controls on the streaming path by @​Ady0333 in kubescape/kubescape#3520
  • feat(telemetry): export scan traces and metrics to an OTLP collector by @​Nakshatra480 in kubescape/kubescape#3521
  • fix(scan): validate --label-selector in ValidateCommonScanFlags by @​manoj-1407 in kubescape/kubescape#3502
  • feat(scan): wire CEL ValidatingAdmissionPolicy evaluation into the scan pipeline by @​karthik120710 in kubescape/kubescape#3513
  • ci: bump rajatjindal/krew-release-bot from 0.0.47 to 0.0.51 by @​dependabot[bot] in kubescape/kubescape#3536
  • feat(scan): add generic webhook notifications by @​thuanlm215 in kubescape/kubescape#3504
  • chore(deps): bump k8s.io/apimachinery from 0.36.3 to 0.36.4 in /httphandler by @​dependabot[bot] in kubescape/kubescape#3527
  • ci: bump mikepenz/action-junit-report from 5.6.2 to 6.4.2 by @​dependabot[bot] in kubescape/kubescape#3533
  • ci: bump helm/kind-action from 1.10.0 to 1.14.0 by @​dependabot[bot] in kubescape/kubescape#3532
  • fix(core): close output writers when Scan fails by @​ye11oc4t in kubescape/kubescape#3232
  • chore(deps): bump github.com/armosec/armoapi-go from 0.0.751 to 0.0.754 in /httphandler by @​dependabot[bot] in kubescape/kubescape#3526
  • fix(config): make config set keys case-insensitive and accept kebab-c… by @​NaitikRishu in kubescape/kubescape#3541
  • fix(opaprocessor): hard error when --include-controls matches no known control by @​arp1traj in kubescape/kubescape#3552
  • fix(junit): distinguish image scan platforms by @​AnvayKharb in kubescape/kubescape#3544
  • ci: bump docker/setup-buildx-action from 4.2.0 to 4.3.0 by @​dependabot[bot] in kubescape/kubescape#3534
  • chore(deps): bump github.com/kubescape/go-logger from 0.0.33 to 0.0.34 in /httphandler by @​dependabot[bot] in kubescape/kubescape#3522
  • fix: scope cluster size estimation to included namespaces by @​shivansh-gohem in kubescape/kubescape#3538
  • fix(resourcehandler): a namespace filter naming no namespace silently skips every namespaced query by @​parthdagia05 in kubescape/kubescape#3539
  • chore(deps): bump github.com/kubescape/opa-utils from 0.0.309 to 0.0.310 in /httphandler by @​dependabot[bot] in kubescape/kubescape#3524
  • ci: bump Codium-ai/pr-agent from 0.35.0 to 0.43.0 by @​dependabot[bot] in kubescape/kubescape#3535
  • fix(storage): recover missing workload posture controls by @​ye11oc4t in kubescape/kubescape#3545
  • ci: bump github.com/stretchr/testify from 1.11.1 to 1.12.1 in /httphandler by @​dependabot[bot] in kubescape/kubescape#3525
  • test(printer): add edge case coverage for AssistedRemediationPathsToS… by @​karthik120710 in kubescape/kubescape#3548
  • test(policy): validate all in-tree rule fixtures in CI by @​ye11oc4t in kubescape/kubescape#3546
  • chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.8 to 6.8.3 by @​dependabot[bot] in kubescape/kubescape#3530
  • chore(deps): bump github.com/owenrumney/go-sarif/v2 from 2.2.0 to 2.3.3 by @​dependabot[bot] in kubescape/kubescape#3523
  • chore(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.32.17 to 1.32.38 by @​dependabot[bot] in kubescape/kubescape#3528
  • chore(deps): bump github.com/zclconf/go-cty from 1.17.0 to 1.19.0 by @​dependabot[bot] in kubescape/kubescape#3531
  • chore(deps): bump github.com/kubescape/go-git-url from 0.0.31 to 0.0.33 by @​dependabot[bot] in kubescape/kubescape#3529
  • feat(scan): apply repository scan contracts by @​dakshhhhh16 in kubescape/kubescape#3537
  • feat(getter): load custom rules from the standard rule directory layout by @​Nakshatra480 in kubescape/kubescape#3553
  • chore(printer): clarify strings import dependency in policyreportprinter.go by @​arp1traj in kubescape/kubescape#3550
  • fix(opaprocessor): quote inline exception designator attributes by @​Ady0333 in kubescape/kubescape#3558
  • fix(opaprocessor): honor ResourceEnumerator output in scan path by @​arp1traj in kubescape/kubescape#3559
  • fix(scan-coverage): surface skipped manifests in coverage and fail gate by @​arp1traj in kubescape/kubescape#3555
  • feat(vapreconcile): add per-resource VAPBinding scope coverage by @​doraem-on in kubescape/kubescape#3570
  • fix(imagescan): bound GCP GetImagesScanStatus pagination loop by @​doraem-on in kubescape/kubescape#3566
  • fix(opaprocessor): guard InfoMap read against concurrent writes in hasUnreachableDependency by @​AdeshDeshmukh in kubescape/kubescape#3563
  • fix(hostsensorutils): record a status when reported CRD items cannot be read by @​parthdagia05 in kubescape/kubescape#3561
  • chore(cel): bump the pinned CEL policy library to v0.14 and sync the bundle by @​Sanchit2662 in kubescape/kubescape#3556
  • feat(mcpserver): add apply_remediation tool for deterministic AI auto-patching by @​dolliecoder in kubescape/kubescape#3568
  • fix(mcpserver): prefer ScanCoverage over the seeded summary when flagging unevaluated controls by @​dolliecoder in kubescape/kubescape#3574
  • feat(markdown): support image scan reports by @​AnvayKharb in kubescape/kubescape#3573
  • feat(printer): generate a posture exceptions baseline from scan results by @​Nakshatra480 in kubescape/kubescape#3560
  • fix(cel): resolve a cluster-scoped paramRef, and refuse one that selects params by @​parthdagia05 in kubescape/kubescape#3575
  • feat(printer): support initContainers and ephemeralContainers in assisted remediation paths by @​karthik120710 in kubescape/kubescape#3578
  • feat(version): add yaml output format support (#​3542) by @​NaitikRishu in kubescape/kubescape#3543
  • fix(anonymizer): restore reference-backed env var name anonymization by @​doraem-on in kubescape/kubescape#3579
  • feat(scan): add Slack webhook notifications by @​thuanlm215 in kubescape/kubescape#3571
  • fix(fixhandler): check the error from closing a fixed file, not just writing it by @​adity1raut in kubescape/kubescape#3580
  • feat(list): show the control configuration a scan evaluates against by @​Nakshatra480 in kubescape/kubescape#3586
  • feat(image): surface VEX status in reports by @​AnvayKharb in kubescape/kubescape#3594
  • fix(resultshandling): deterministic AssociatedControls ordering across scans by @​AdeshDeshmukh in kubescape/kubescape#3590
  • fix(patch): filesystem-safe intermediate filenames and update-all nil guard by @​AdeshDeshmukh in kubescape/kubescape#3596
  • fix(vapreconcile): correct binding-scope coverage for cluster-scoped resources and Namespaces by @​parthdagia05 in kubescape/kubescape#3592
  • test(printer): add regression test for sensitive data exposure in res… by @​karthik120710 in kubescape/kubescape#3582
  • feat(containerscan): validate layers, layer hashes, and vulnerability names in ScanResultReport.Validate() by @​karthik120710 in kubescape/kubescape#3591
  • feat(cel): honor VAP spec.failurePolicy for validation expression errors by @​karthik120710 in kubescape/kubescape#3583
  • feat(coverage): report resource kinds no control examined by @​Ady0333 in kubescape/kubescape#3588
  • fix: deduplicate included namespaces in splitNamespaces by @​shivansh-gohem in kubescape/kubescape#3599
  • refactor: remove deprecated FailedPath from codebase by @​Kayd-06 in kubescape/kubescape#3598
  • fix(vap): report a namespace selector that cannot narrow a policy's cluster-scoped resources by @​parthdagia05 in kubescape/kubescape#3597
  • feat(networkpolicy): add real NetworkPolicy reachability engine by @​doraem-on in kubescape/kubescape#3601
  • [LFX 2026] chore(deps): bump opa-utils to v0.0.312 for alertOnly exception semantics by @​yugal07 in kubescape/kubescape#3615
  • fix(resourcehandler): do not report a kind's other served versions as unexamined by @​parthdagia05 in kubescape/kubescape#3609
  • feat(fixhandler): apply fixes to JSON manifests by @​Nakshatra480 in kubescape/kubescape#3608
  • fix(scan): enforce compliance-threshold in scan workload (#​3610) by @​NaitikRishu in kubescape/kubescape#3612
  • fix(anonymizer): hide scan path, host and cluster identity under --hide and --encrypt by @​Nakshatra480 in kubescape/kubescape#3611
  • refactor(resourcehandler): partition streaming collector items as the pager yields them by @​aryanghai12 in kubescape/kubescape#3613
  • fix: validate URLs in config set by @​Rucha0901 in kubescape/kubescape#3585
  • feat(mapreconcile): add MutatingAdmissionPolicy discovery and impact matching by @​doraem-on in kubescape/kubescape#3606
  • feat(scan): add contract report provenance by @​dakshhhhh16 in kubescape/kubescape#3607
  • feat: support --format json for the update command by @​Rucha0901 in kubescape/kubescape#3617
  • fix(cel): matchConditions short-circuit on false skips evaluating later conditions by @​doraem-on in kubescape/kubescape#3630
  • feat(list): filter controls by framework and search by @​AnvayKharb in kubescape/kubescape#3624
  • fix(anonymizer): anonymize Secret/ConfigMap names referenced via spec.volumes by @​doraem-on in kubescape/kubescape#3619
  • feat(telemetry): report image DB freshness by @​AnvayKharb in kubescape/kubescape#3604
  • refactor: migrate gorilla/mux to net/http ServeMux by @​shivansh-gohem in kubescape/kubescape#3620
  • feat(diff): add aggregate summary outputs by @​AnvayKharb in kubescape/kubescape#3626
  • feat(policy): scaffold custom Rego rules and refresh test fixtures from rule output by @​Nakshatra480 in kubescape/kubescape#3635
  • fix(opaprocessor): evaluate rules against full input after enumeration by @​Ady0333 in kubescape/kubescape#3628
  • feat(scan): add SARIF contract validation output by @​AnvayKharb in kubescape/kubescape#3622
  • feat(printer): add github-actions output format for inline PR annotations by @​AdeshDeshmukh in kubescape/kubescape#3637
  • feat(sarif): add stable scan fingerprints by @​AnvayKharb in kubescape/kubescape#3639
  • fix(mapreconcile): match the subresource form of a resource rule by @​parthdagia05 in kubescape/kubescape#3646
  • feat(config): support --format / -f flag in config view (#​3641) by @​NaitikRishu in kubescape/kubescape#3642
  • fix(scancache): reset dirty flag after Flush writes cache file by @​shivv23 in kubescape/kubescape#3515
  • feat(networkpolicy,vulnexposure): correlate vulnerabilities with NetworkPolicy exposure by @​doraem-on in kubescape/kubescape#3632
  • fix(fixhandler): cross-control fix promotion checks the value, not just the path by @​doraem-on in kubescape/kubescape#3634
  • fix(resourcesprioritization): don't drop attack tracks when a resource matches more than one by @​doraem-on in kubescape/kubescape#3659
  • fix(mapreconcile): a policy gated by matchConditions is not a confirmed match by @​parthdagia05 in kubescape/kubescape#3654
  • fix(download): accept plural and alias target arguments (#​3666) by @​NaitikRishu in kubescape/kubescape#3667
  • fix(cel): honor an equivalent matchPolicy when scoping a policy to a scanned object by @​parthdagia05 in kubescape/kubescape#3673
  • fix(anonymizer): pseudonymize image-scan results under --hide/--encrypt by @​arp1traj in kubescape/kubescape#3661
  • feat(mcpserver): add scan_workload tool for single-resource scanning by @​dolliecoder in kubescape/kubescape#3669
  • feat(config): add cached config validation by @​AnvayKharb in kubescape/kubescape#3663
  • feat(notification): add Microsoft Teams Adaptive Card support for --notify webhooks by @​Nakshatra480 in kubescape/kubescape#3645
  • fix(opaprocessor): match CIS section numbers in --skip-controls/--include-controls by @​arp1traj in kubescape/kubescape#3658
  • feat(scan): record contract runner input digests by @​dakshhhhh16 in kubescape/kubescape#3640
  • test(cel): compare Rego and CEL verdicts for the converted controls by @​Sanchit2662 in kubescape/kubescape#3603
  • test(resourcehandler): add a synthetic-cluster collector memory harness by @​aryanghai12 in kubescape/kubescape#3614
  • feat(exposure): model external exposure via Ingress, Gateway API, and Service type by @​doraem-on in kubescape/kubescape#3648
  • feat(scan): scan multiple images in one run sharing the vulnerability database by @​Nakshatra480 in kubescape/kubescape#3682
  • feat(resourcehandler): collect via namespaced endpoints under --include-namespaces by @​Ady0333 in kubescape/kubescape#3683
  • feat(vap): list embedded admission policies and the controls they implement by @​Nakshatra480 in kubescape/kubescape#3674
  • perf: stream JSON outputs instead of massive byte array allocations in memory by @​shivansh-gohem in kubescape/kubescape#3670
  • fix(core): ensure OpenTelemetry spans are ended across all exit and error paths by @​khuswant18 in kubescape/kubescape#3665
  • feat(printer): surface failed-path evidence values in JSON/YAML output by @​adity1raut in kubescape/kubescape#3256
  • feat(printer): include evidence paths in GitHub Actions annotation messages by @​manoj-1407 in kubescape/kubescape#3677
  • fix(getter): give custom rules a base score instead of leaving it zero by @​arp1traj in kubescape/kubescape#3676
  • ci: bump golangci/golangci-lint-action from 9.2.0 to 9.3.0 by @​dependabot[bot] in kubescape/kubescape#3693
  • chore(deps): bump github.com/kubescape/go-logger from 0.0.28 to 0.0.34 by @​dependabot[bot] in kubescape/kubescape#3695
  • chore(deps): bump github.com/armosec/armoapi-go from 0.0.754 to 0.0.757 in /httphandler by @​dependabot[bot] in kubescape/kubescape#3686
  • chore(deps): bump k8s.io/apimachinery from 0.36.4 to 0.37.0 in /httphandler by @​dependabot[bot] in kubescape/kubescape#3687
  • chore(deps): bump github.com/mark3labs/mcp-go from 0.57.0 to 0.58.0 by @​dependabot[bot] in kubescape/kubescape#3692
  • feat(scan): emit CycloneDX and SPDX SBOMs from posture scans wit

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Published Crossplane Package

The following Crossplane package was published as part of this PR:

Package: ghcr.io/hops-ops/security-stack:pr-10-48248e05d467456396cb84cd77e06a6e86ecab4a

View Package

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: f38aa31b-12b5-45dc-850a-952447eb0d0a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.