kubescape/helm-charts kubescape-operator-1.40.3

on GitHub

Kubescape is an E2E Kubernetes cluster security platform

What's Changed

• Scope OTEL to node-agent via otelUrl, drop bundled otel-collector by @matthyx in #849
• warn when capability flags are dropped without a backend by @yugal07 in #852
• feat(kubevuln): add configurable proxyRegistryMap to cluster config by @mkm29 in #853
• feat(storage): require Kubernetes >= 1.28 via kubeVersion guard by @matthyx in #856
• operator: enable CEL admission rules by @slashben in #845
• [LFX 2026] feat(crds): add CEL validation to SecurityException CRDs by @yugal07 in #859
• feat: add serviceaccounts to resources synced by synchronizer by @matthyx in #858
• Decouple prometheus-exporter ServiceMonitor from kubescape ServiceMonitor by @Copilot in #861
• feat(operator): add opt-in capabilities.remediation with gated mutating RBAC by @yugal07 in #855
• Fix offline kubescape config mount and keep-local scan defaults by @Copilot in #862
• Align operator node-agent autoscaler mount guard with ConfigMap rendering by @Copilot in #866
• feat(synchronizer): sync containerprofiles to backend by @shanyl9 in #869
• feat(node-agent): target label-less nodes via DoesNotExist affinity by @matthyx in #868
• fix(kubescape-operator): sanitize '+' in app.kubernetes.io/version label by @slashben in #863
• node-agent: bump GKE Autopilot allowlist default to 1.40-v2 by @slashben in #870
• feat(node-agent): expose alertDeduplication.bypass config value by @slashben in #864
• feat: add cveMatchingMode and trustedVendors to kubevuln config by @slashben in #854
• fix(storage): restart storage pod when storage config changes by @matthyx in #872
• feat(synchronizer): register aisandboxheartbeats httpEndpoint resource by @matthyx in #873
• [ LFX 2026 ] feat(kubescape): grant SecurityException read + events RBAC under riskAcceptance by @yugal07 in #875
• GKE Autopilot allowlist drift gate + helper scripts by @slashben in #876
• node-agent: install GKE Autopilot AllowlistSynchronizer when allowlist is enabled by @slashben in #877
• ci: run GKE Autopilot allowlist drift check on PRs by @slashben in #878
• fix(ci): pin Helm in pr-allowlist-drift instead of working around old Helm by @matthyx in #881
• [ LFX 2026 ] fix(kubevuln): grant get on workloads and namespaces for SecurityException selectors by @yugal07 in #879
• prepate release 1.40.3 by @matthyx in #850
• bump few more components by @matthyx in #882
• kubescape/kubescape@v4.0.8...v4.0.11
  • fix: propagate context through httphandler storage API calls by @krrishverma1805-web in kubescape/kubescape#2188
  • test(listener): cover env config helpers by @AnvayKharb in kubescape/kubescape#2212
  • refactor: replace unstructured Warning(err.Error()) with structured helpers.Error(err) across codebase by @Ridhi-03Kumari in kubescape/kubescape#2206
  • fix: add error log when ProcessRulesListener fails in scan.go by @Ridhi-03Kumari in kubescape/kubescape#2214
  • test(opaprocessor): cover manual review summary by @AnvayKharb in kubescape/kubescape#2215
  • test(listener): cover TLS key loading by @AnvayKharb in kubescape/kubescape#2213
  • test(imagescan): cover default DB config by @AnvayKharb in kubescape/kubescape#2209
  • test(cautils): add unit tests for YAML separator, mergeMaps, and splitYAMLDocuments by @AnvayKharb in kubescape/kubescape#2222
  • ci: add Dependabot config for github-actions ecosystem + pin remaining mutable action tag by @ivaresarthak-cloud in kubescape/kubescape#2219
  • test(fixhandler): add unit tests for YAML handler helpers by @dakshhhhh16 in kubescape/kubescape#2224
  • fix: replace read-all with explicit permissions in a-pr-scanner workflow by @Varadraj75 in kubescape/kubescape#2168
  • test(imagescan): cover default matcher config by @AnvayKharb in kubescape/kubescape#2228
  • test(httphandler): add unit tests for RecoverFunc panic handler by @dakshhhhh16 in kubescape/kubescape#2229
  • test(cautils): add unit tests for datastructures helpers by @dakshhhhh16 in kubescape/kubescape#2226
  • test(cmd): cover KS_LOGGER_NAME env by @AnvayKharb in kubescape/kubescape#2231
  • test(cmd): cover initLogger name precedence by @AnvayKharb in kubescape/kubescape#2232
  • feat: make image registry push opt-in via --push flag by @yugal07 in kubescape/kubescape#2199
  • vap: resolve CEL control IDs for policy bindings by @dakshhhhh16 in kubescape/kubescape#2235
  • test(metrics): add unit tests for Init and Update functions by @dakshhhhh16 in kubescape/kubescape#2225
  • test(cautils): add unit tests for operator scan info validation by @dakshhhhh16 in kubescape/kubescape#2227
  • test(imagescan): cover DB load validation by @AnvayKharb in kubescape/kubescape#2201
  • test(cautils): add unit tests for BoolPtrFlag, isHTTPURL, unique, and ScanInfo helpers by @AnvayKharb in kubescape/kubescape#2221
  • test(cmd): cover KS_LOGGER_NAME env by @AnvayKharb in kubescape/kubescape#2230
  • test(cautils): expand floatutils tests by @AnvayKharb in kubescape/kubescape#2242
  • test(cautils): add TestIsFileAndIsDir unit test by @AnvayKharb in kubescape/kubescape#2243
  • test(cautils): expand normalize image name tests by @AnvayKharb in kubescape/kubescape#2241
  • Nil guard for kubernetes client initialisation by @yugal07 in kubescape/kubescape#2266
  • test: add v1 printer coverage by @dakshhhhh16 in kubescape/kubescape#2251
  • fix(crd): use oldSelf in CEL rule for expiresAt to support GitOps reconcilers by @AnvayKharb in kubescape/kubescape#2244
  • fix(opaprocessor): sanitize namespace split parsing by @aaa-aashna in kubescape/kubescape#2263
  • test: add metrics and ksinit coverage by @dakshhhhh16 in kubescape/kubescape#2252
  • test: cover newline replacement without trailing newline by @AnvayKharb in kubescape/kubescape#2267
  • test: cover yml extension detection by @AnvayKharb in kubescape/kubescape#2268
  • test: add hostsensor CRD coverage by @dakshhhhh16 in kubescape/kubescape#2250
  • test: add request and resource handler coverage by @dakshhhhh16 in kubescape/kubescape#2249
  • fix: prometheus output now includes # HELP and # TYPE headers by @Shreya2005-2005 in kubescape/kubescape#2204
  • fix: add # HELP and # TYPE headers to kubescape_score metric by @Shreya2005-2005 in kubescape/kubescape#2257
  • fix: add bounds check before accessing container index in addContainerNameToAssistedRemediation by @Varadraj75 in kubescape/kubescape#2270
  • fix(fixhandler): reconcile unfixed controls against planned YAML edits by @yugal07 in kubescape/kubescape#2281
  • chore(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.0 by @dependabot[bot] in kubescape/kubescape#2285
  • fix(imagescan): harden custom DB URL validation by @aaa-aashna in kubescape/kubescape#2264
  • docs: add Jenkins CI/CD integration guide with Jenkinsfile example by @ivaresarthak-cloud in kubescape/kubescape#2278
  • fix: prevent panic from double-close of stopChan in TimedCache by @Varadraj75 in kubescape/kubescape#2288
  • clarification for score threshold scope by @yugal07 in kubescape/kubescape#2290
  • feat(fix): emit values.yaml guidance for Helm-rendered resources by @yugal07 in kubescape/kubescape#2083
  • feat(diff): add kubescape diff command to compare two scan reports by @Sanchit2662 in kubescape/kubescape#2245
  • fix: normalize mixed-case YAML/JSON manifest extension detection by @SeeyaVhora in kubescape/kubescape#2293
  • fix: resolve TOCTOU race in TimedCache.invalidateTask() by @Varadraj75 in kubescape/kubescape#2295
  • fix: validate threshold ranges in scan image and patch commands by @Shreya2005-2005 in kubescape/kubescape#2274
  • fix(ci): pin Go via go.mod instead of undefined GO_VERSION input by @SeeyaVhora in kubescape/kubescape#2302
  • fix(anonymizer): extend --hide coverage for container config references by @jijo-OO7 in kubescape/kubescape#2300
  • Prevent PR scanner checkout from failing on stale submodule metadata by @Copilot in kubescape/kubescape#2309
  • Feat/vap enforcement reconcile by @Sanchit2662 in kubescape/kubescape#2307
  • Emit SecurityException events for posture exception matches by @AnvayKharb in kubescape/kubescape#2291
  • fix: add --scan-timeout flag and fix context propagation in K8s resource collection by @Varadraj75 in kubescape/kubescape#2305
  • fix(printer): bucket failed controls by their own category, not a hardcoded ID allowlist by @yugal07 in kubescape/kubescape#2306
  • fix: close output file after each printer finishes to prevent file descriptor leak by @Shreya2005-2005 in kubescape/kubescape#2259
  • fix: restore kubescape_resource_* metrics in prometheus output by @Shreya2005-2005 in kubescape/kubescape#2256
  • fix(anonymizer): anonymize annotation values for hidden scans by @jijo-OO7 in kubescape/kubescape#2316
  • fix: nil pointer panic in SARIF, HTML, and JUnit printers when control is missing from summary details by @Varadraj75 in kubescape/kubescape#2315
  • docs: add Gitlab CI/CD Integartion Guide with gitlab-ci.yml example by @ivaresarthak-cloud in kubescape/kubescape#2310
  • chore(deps): bump github.com/containerd/containerd/v2 from 2.2.2 to 2.2.4 by @dependabot[bot] in kubescape/kubescape#2319
  • chore(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 by @dependabot[bot] in kubescape/kubescape#2318
  • fix: propagate context through cosign OPA built-in functions by @krrishverma1805-web in kubescape/kubescape#2191
  • fix(opaprocessor): preserve cluster-scoped paths across namespace iterations by @Sanchit2662 in kubescape/kubescape#2311
  • chore(deps): bump dependencies to fix security advisories by @matthyx in kubescape/kubescape#2324
  • test(opaprocessor): cover mapControlToInfo by @AnvayKharb in kubescape/kubescape#2208
  • Add image command RunE tests by @AnvayKharb in kubescape/kubescape#2182
  • fix(cache): canonicalise framework/control cache filenames by @harshitg927 in kubescape/kubescape#2313
  • test(imagescan): cover severity filtering by @AnvayKharb in kubescape/kubescape#2210
  • anonymize resource source metadata in hidden output by @jijo-OO7 in kubescape/kubescape#2326
  • test(imagescan): cover severity threshold by @AnvayKharb in kubescape/kubescape#2211
  • test: add containerscan unmarshal coverage by @dakshhhhh16 in kubescape/kubescape#2246
  • test: add fixhandler and report conversion coverage by @dakshhhhh16 in kubescape/kubescape#2248
  • fix(imagescan): repair interleaved type definitions in test file by @matthyx in kubescape/kubescape#2328
  • fix(opaprocessor): isolate rego dependency control inputs by @aaa-aashna in kubescape/kubescape#2329
  • anonymizer: hide git repository context metadata by @jijo-OO7 in kubescape/kubescape#2327
  • feat(getter): resolve namespaceSelector for cluster exceptions by @AnvayKharb in kubescape/kubescape#2322
  • fix(cautils): make SetTopWorkloads idempotent by @aaa-aashna in kubescape/kubescape#2330
  • fix: populate generationTime in JSON report and invocations in SARIF by @yugal07 in kubescape/kubescape#2331
  • fix(offline): dynamically populate allcontrols framework and fix loadpolicy search by @matthyx in kubescape/kubescape#2338
  • fix: restrict config.json permissions to owner-only by @Varadraj75 in kubescape/kubescape#2340
  • fix(resourcehandler): dedup resources found by different providers by @harshitg927 in kubescape/kubescape#2336
  • anonymizer: hide service account names in pod specs by @jijo-OO7 in kubescape/kubescape#2333
  • fix(vap): require params for configurable controls by @dakshhhhh16 in kubescape/kubescape#2334
  • fix(httphandler): surface async scan failures via Results endpoint by @Sanchit2662 in kubescape/kubescape#2339
  • fix(httphandler): log persistence failure as warning, return valid result by @Sanchit2662 in kubescape/kubescape#2342
  • Fix relative path and Name typo by @CygnusMaximillian in kubescape/kubescape#2343
  • fix: anonymize LocalRootPath in hidden report output by @jijo-OO7 in kubescape/kubescape#2344
  • docs: add github code scanning integration guide by @ivaresarthak-cloud in kubescape/kubescape#2345
  • feat: add SLSA build provenance attestation to release workflow by @Varadraj75 in kubescape/kubescape#2346
  • refactor: introduce transformer abstraction for repo metadata by @jijo-OO7 in kubescape/kubescape#2347
  • fix(resourcehandler): merge host-sensor infoMap instead of replacing it by @Ady0333 in kubescape/kubescape#2349
  • fix(httphandler): add panic recovery to scan execution goroutine by @Ady0333 in kubescape/kubescape#2352
  • Add encryption transformer integration tests by @jijo-OO7 in kubescape/kubescape#2351
  • fix: typos in core and cmd directories by @CygnusMaximillian in kubescape/kubescape#2356
  • Fail closed on repo metadata transformation errors by @jijo-OO7 in kubescape/kubescape#2353
  • docs: add Harbor integration guide by @ivaresarthak-cloud in kubescape/kubescape#2355
  • fix: return clear error when wrong JSON structure passed to kubescape fix by @harshitg927 in kubescape/kubescape#2358
  • fix(anonymizer): detect separator-less sensitive env variable names t… by @harshitg927 in kubescape/kubescape#2367
  • feat: add encrypted repo metadata workflow by @jijo-OO7 in kubescape/kubescape#2365
  • Feat/opa cosign context propagation by @aaa-aashna in kubescape/kubescape#2368
  • fix(scan): reject invalid format values before scanning by @harshitg927 in kubescape/kubescape#2370
  • add missing C-0199, C-0200, C-0201 to control ID map by @Sanchit2662 in kubescape/kubescape#2371
  • fix(hostsensorutils): normalize infoMap keys using ResourceGroupToString by @Ady0333 in kubescape/kubescape#2360
  • reportcrypto: add DEK wrapping support by @jijo-OO7 in kubescape/kubescape#2374
  • refactor: upgrade to standard error wrapping (%w) in MCP server by @CygnusMaximillian in kubescape/kubescape#2377
  • feat(opaprocessor): add per-control evaluation timeout by @Ady0333 in kubescape/kubescape#2375
  • fix(resourcehandler): fail fast on cancelled contexts after resource pulls by @aaa-aashna in kubescape/kubescape#2372
  • [ LFX 2026 ] Fixes bugs found before implementation of LFX 1982 by @yugal07 in kubescape/kubescape#2366
  • fix(portforwarder): avoid blocking on repeated stop signals by @aaa-aashna in kubescape/kubescape#2381
  • refactor: eliminate package-level mutable state in workload command by @CygnusMaximillian in kubescape/kubescape#2379
  • fix(resourcehandler): trim spaces from namespaces in field selectors by @harshitg927 in kubescape/kubescape#2382
  • Docs: add circleci integration guide by @ivaresarthak-cloud in kubescape/kubescape#2385
  • fix(opaprocessor): stop processing after context cancellation by @aaa-aashna in kubescape/kubescape#2386
  • fix(storage): skip orphaned RoleBinding instead of aborting scan persistence by @Aaradhya-07 in kubescape/kubescape#2392
  • Add security-severity to SARIF rules for Code Scanning by @arpitjain099 in kubescape/kubescape#2398
  • [fix] : Fall back to bundled defaults and surface degradation when control-inputs fetch fails by @Ady0333 in kubescape/kubescape#2395
  • Integrate report encryption metadata and DEK wrapping into anonymization workflow by @jijo-OO7 in kubescape/kubescape#2380
  • Fix index-out-of-range panic on image names without an organization by @arpitjain099 in kubescape/kubescape#2397
  • test(opaprocessor): improve temporary resource cleanup by @aaa-aashna in kubescape/kubescape#2388
  • fix(list): emit JSON objects for list controls --format json by @Aaradhya-07 in kubescape/kubescape#2401
  • [LFX 2026 ] Remove orphan, uninstallable SecurityException CRD and its test by @yugal07 in kubescape/kubescape#2403
  • fix(opaprocessor) : discard partial results from timed-out controls by @Ady0333 in kubescape/kubescape#2404
  • Set HTTP timeouts on the scan listener server by @arpitjain099 in kubescape/kubescape#2396
  • feat(opaprocessor): wire CEL language dispatch with stub evaluator by @Sanchit2662 in kubescape/kubescape#2405
  • fix: use filepath.Join instead of path.Join for filesystem paths by @matthyx in kubescape/kubescape#2407
  • fix: read severity from summaryDetails instead of missing controls field by @Varadraj75 in kubescape/kubescape#2412
  • docs: add azure pipelines CI/CD integration guide by @ivaresarthak-cloud in kubescape/kubescape#2408
  • chore: modernize codebase to Go 1.26 by @matthyx in kubescape/kubescape#2415
  • fix: prevent silent output overwrite when multiple formats share one path by @Varadraj75 in kubescape/kubescape#2414
  • [feat] : add scan coverage score to measure and report scan co… by @Ady0333 in kubescape/kubescape#2410
  • fix(sarif): resolve correct line numbers for absolute-path file scans by @harshitg927 in kubescape/kubescape#2406
  • Add CEL env builder for the VAP engine by @Sanchit2662 in kubescape/kubescape#2416
  • Fix nil pointer panic on image scan when ScanData is nil by @yugal07 in kubescape/kubescape#2431
  • backend: ksinit: add success case for CreateKsObjectConnection by @CygnusMaximillian in kubescape/kubescape#2429
  • backend: imagescan: add missing unit tests for getMatchers and newSca… by @CygnusMaximillian in kubescape/kubescape#2427
  • fix(opaprocessor): count timed-out controls as 0 in compliance score by @Ady0333 in kubescape/kubescape#2424
  • fix: return error when related RBAC objects share the same category by @Varadraj75 in kubescape/kubescape#2422
  • fix(diff): move --fail-on-new exit to cmd layer so output writer is closed by @Aaradhya-07 in kubescape/kubescape#2434
  • feat(report): add encrypted report decryption by @jijo-OO7 in kubescape/kubescape#2425
  • test: add missing unit tests for cautils session initialization and scan scope by @CygnusMaximillian in kubescape/kubescape#2436
  • fix(diff): validate format input and clean up status handling by @Aaradhya-07 in kubescape/kubescape#2438
  • Add offline request stub for the CEL engine by @Sanchit2662 in kubescape/kubescape#2439
  • fix(coverage) : penalise silent failed GVR pulls in coverage score by @Ady0333 in kubescape/kubescape#2420
  • feat(reportcrypto): decrypt resource source metadata in reports by @jijo-OO7 in kubescape/kubescape#2440
  • Add CEL evaluator by @Sanchit2662 in kubescape/kubescape#2443
  • feat(operator): add operator remediate CLI subcommand (annotate + dry-run) by @yugal07 in kubescape/kubescape#2448
  • feat(httphandler): add SSRF-hardened scan-completion webhook callback by @Ady0333 in kubescape/kubescape#2447
  • fix(httphandler): decouple prometheus metrics scan from request context by @Ady0333 in kubescape/kubescape#2451
  • Expand encryption and decryption coverage for resource metadata by @jijo-OO7 in kubescape/kubescape#2442
  • Vendor the CEL admission policy bundle by @Sanchit2662 in kubescape/kubescape#2455
  • Fix air-gapped mode -- thread explicit offline flag to policy getters instead of relying on nil by @Ady0333 in kubescape/kubescape#2458
  • fix: support namespace/kind/name workload format (#2459) by @dolliecoder in kubescape/kubescape#2460
  • feat(operator): add quarantine action to remediate CLI subcommand by @yugal07 in kubescape/kubescape#2461
  • fix(httphandler): add missing panic recovery to Metrics handler by @SeeyaVhora in kubescape/kubescape#2465
  • core: Add test coverage for Kubescape.Diff pretty-printer output path by @CygnusMaximillian in kubescape/kubescape#2467
  • Fix local control cache by @dolliecoder in kubescape/kubescape#2463
  • test(core): cover Kubescape.Download unknown-target error path by @CygnusMaximillian in kubescape/kubescape#2468
  • feat(patch): add support for OCI and Local exports by @dolliecoder in kubescape/kubescape#2471
  • [ LFX 2026] feat(exceptions): honor objectSelector.matchExpressions via PostureExceptionPolicy.ObjectSelector by @yugal07 in kubescape/kubescape#2480
  • feat: add container profile tools and resources to MCP server by @dolliecoder in kubescape/kubescape#2479
  • refactor: decompose monolithic Results API handler by @dolliecoder in kubescape/kubescape#2477
  • feat(anonymizer): support reversible container metadata transformation by @jijo-OO7 in kubescape/kubescape#2473
  • Embed and load VAP YAML from the vendored bundle by @Sanchit2662 in kubescape/kubescape#2474
  • feat: introduce Container Image Vulnerability (CIV) Adaptor interfaces by @dolliecoder in kubescape/kubescape#2482
  • fix(httphandler): populate report in synchronous scan response by @Ady0333 in kubescape/kubescape#2483
  • Derive cmd/vap policy metadata from the embedded VAP bundle by @Sanchit2662 in kubescape/kubescape#2485
  • feat : add unit tests for GetPreReqCmd and kubeconfig flag by @karthik120710 in kubescape/kubescape#2486
  • feat: implement AWS ECR vulnerability adaptor by @dolliecoder in kubescape/kubescape#2488
  • fix: preserve explicit exceptions/inputs with use-artifacts-from by @Ady0333 in kubescape/kubescape#2490
  • fix(sarif): surface PrettyWrite errors instead of silently writing empty file by @Aaradhya-07 in kubescape/kubescape#2497
  • docs: add ICS/OT workload scanning guide by @frangelbarrera in kubescape/kubescape#2475
  • feat(reportcrypto): add decryption support for encrypted resource metadata by @jijo-OO7 in kubescape/kubescape#2493
  • fix(printer): don't append .txt to /dev/null in PrettyPrinter.SetWriter by @Aaradhya-07 in kubescape/kubescape#2502
  • fix(sarif): don't os.Exit on unencodable fix, avoid empty SARIF file by @Aaradhya-07 in kubescape/kubescape#2499
  • feat(mcp): implement headless OPAProcessor rbac scanner by @dolliecoder in kubescape/kubescape#2492
  • Cache compiled CEL programs across scanned objects by @Sanchit2662 in kubescape/kubescape#2503
  • fix(mcp): add double-checked mutex locking to k8sClient lazy init by @dolliecoder in kubescape/kubescape#2506
  • feat(printer): add GitLab SAST report output format by @Aaradhya-07 in kubescape/kubescape#2505
  • docs(cli): document report protection workflow by @jijo-OO7 in kubescape/kubescape#2508
  • Fix/helm templates plain yaml warnings by @Aaradhya-07 in kubescape/kubescape#2509
  • feat(mcp): Add headless OPAProcessor for low-latency Network Policy s… by @dolliecoder in kubescape/kubescape#2512
  • docs(cli): improve report protection help and examples by @jijo-OO7 in kubescape/kubescape#2510
  • fix(vap): deploy-library serves the embedded bundle by default by @Sanchit2662 in kubescape/kubescape#2514
  • docs: fix stale KS_CACHE TODO in customerloader.go, point at existing --cache-dir/KS_CACHE_DIR support by @VishalVinayRam in kubescape/kubescape#2516
  • Fix control-inputs fallback to return real local getter instead of unloaded store by @Ady0333 in kubescape/kubescape#2515
  • fix(imagescan): preserve matches on metadata lookup errors by @aaa-aashna in kubescape/kubescape#2519
  • rbac file todo to check api version is resolved by @karthik120710 in kubescape/kubescape#2523
  • [Fix] : severity-based image exceptions in JSON, SARIF, and patch output -- use filtered Matches instead of RemainingMatches by @Ady0333 in kubescape/kubescape#2522
  • feat: run CEL controls as part of the scan by @Sanchit2662 in kubescape/kubescape#2525
  • fix(scan): restore root PersistentPreRun for kubescape scan invocations by @matthyx in kubescape/kubescape#2530
  • fix(scan): don't let --exceptions/--controls-config/--attack-tracks trigger air-gapped mode by @matthyx in kubescape/kubescape#2532
• kubescape/http-request@v0.2.19...v0.2.20
  • Bump Go builder to 1.26.3 to fix stdlib CVEs by @matthyx in kubescape/http-request#26
• kubescape/kubevuln@v0.3.142...v0.3.159
  • chore(deps): Bump github.com/containerd/containerd from 1.7.29 to 1.7.32 by @dependabot[bot] in kubescape/kubevuln#365
  • chore(deps): Bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 by @dependabot[bot] in kubescape/kubevuln#366
  • chore(deps): bump dependencies to fix security advisories by @matthyx in kubescape/kubevuln#367
  • feat(grype): expose useDefaultMatchers on the fixed-DB constructor by @jnathangreeg in kubescape/kubevuln#368
  • fix(scan): classify MANIFEST_SCHEMA_UNSUPPORTED + write per-workload … by @harshitg927 in kubescape/kubevuln#370
  • Adaptive CPE matching for trusted image vendors by @slashben in kubescape/kubevuln#372
  • feat: add attestations: write permission for image provenance attesta… by @Varadraj75 in kubescape/kubevuln#371
  • chore(deps): update go-logger to v0.0.33 by @matthyx in kubescape/kubevuln#373
  • fix: detach HTTP request context from cancellation for background tasks by @matthyx in kubescape/kubevuln#374
  • Fall back to clusterData backend URLs when API service discovery is unavailable by @Copilot in kubescape/kubevuln#376
  • fix(sbomscanner): don't double-normalize an already-normalized image reference by @kooomix in kubescape/kubevuln#377
  • fix(sbomscanner): register sqlite driver for newer RPM databases by @matthyx in kubescape/kubevuln#380
  • fix: raise gRPC client/server message limits on sbom-scanner sidecar channel by @matthyx in kubescape/kubevuln#382
  • [ LFX 2026 ] feat: scope vulnerability SecurityExceptions by match selectors by @yugal07 in kubescape/kubevuln#383
  • chore(deps): Bump github.com/containerd/containerd from 1.7.32 to 1.7.33 by @dependabot[bot] in kubescape/kubevuln#384
  • chore(deps): Bump github.com/cilium/cilium from 1.17.15 to 1.17.16 by @dependabot[bot] in kubescape/kubevuln#385
  • chore(deps): Bump go.mongodb.org/mongo-driver from 1.17.6 to 1.17.7 by @dependabot[bot] in kubescape/kubevuln#386
• kubescape/node-agent@v0.3.119...v0.3.158
  • fix(rbcache): coerce int64/float64 severity to string before unstructured conversion by @matthyx in kubescape/node-agent#819
  • Chore(deps): Bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 by @dependabot[bot] in kubescape/node-agent#820
  • Chore(deps): Bump github.com/containerd/containerd from 1.7.30 to 1.7.32 by @dependabot[bot] in kubescape/node-agent#821
  • fix: deep-copy Data in MakeHttpEvent to prevent nil pointer panic by @matthyx in kubescape/node-agent#804
  • Chore(deps): bump deps to fix security advisories by @matthyx in kubescape/node-agent#824
  • feat: add container meta-context for shared ECS/Kubernetes rules by @matthyx in kubescape/node-agent#822
  • fix(deps): resolve concurrent map writes panic in inspektor-gadget by @matthyx in kubescape/node-agent#826
  • feat(otel): OpenTelemetry traces, logs, drop counters, and OTEL metrics (Phase 1 + 2) by @matthyx in kubescape/node-agent#818
  • fix(cache): release RBCache mutex lock before sending notifications by @matthyx in kubescape/node-agent#828
  • feat: add image provenance attestation to local workflow and caller permissions by @Varadraj75 in kubescape/node-agent#833
  • chore(config): remove unused Config fields with no readers by @matthyx in kubescape/node-agent#836
  • fix(container-watcher): do not close workerChan on Stop (send-on-closed panic) by @matthyx in kubescape/node-agent#837
  • fix: correct IgnoreRuleBindings handling for container monitoring by @matthyx in kubescape/node-agent#839
  • feat(config): add alertDeduplication.bypass master switch by @slashben in kubescape/node-agent#838
  • fix: map network event pktType to direction in CEL rules engine by @matthyx in kubescape/node-agent#841
  • path-wildcards: anchored trailing-* + per-endpoint port + R0040 args by @entlein in kubescape/node-agent#807
  • fix: raise gRPC client/server message limits on sbom-scanner sidecar channel by @matthyx in kubescape/node-agent#842
  • feat(cel/parse): add 3-arg get_exec_path(args, comm, exepath) overload by @matthyx in kubescape/node-agent#843
  • test(rules): sync default-rules.yaml from rulelibrary; add R0040 + Test_32 + lint guard by @matthyx in kubescape/node-agent#844
  • fix(cooldownqueue): eliminate "send on closed channel" panic on shutdown by @matthyx in kubescape/node-agent#845
  • allowing CIDRs, wildcards and Plural in IP and DNS by @entlein in kubescape/node-agent#806
  • fix: validate rootfs diff-ids before use to prevent SBOM panic on digest-less images by @matthyx in kubescape/node-agent#854
  • fix: persist terminal status on generic SBOM-generation failures to stop reprocessing loop by @matthyx in kubescape/node-agent#855
  • fix: stop seccomp-profile watch goroutine leak and zero-backoff re-watch loop by @slashben in kubescape/node-agent#851
  • incluster-comp-pr-merged: use registry cache instead of GHA cache by @lyuval-armosec in kubescape/node-agent#858
  • fix: unify SBOM scan-retry budgets to bound total attempts by @matthyx in kubescape/node-agent#857
  • test(procfs): verify host processes get container ID "host" by @slashben in kubescape/node-agent#860
• kubescape/operator@v0.2.142...v0.2.159
  • fix: suppress version-mismatch warning in daily report by @matthyx in kubescape/operator#375
  • chore(deps): Bump github.com/containerd/containerd from 1.7.30 to 1.7.32 by @dependabot[bot] in kubescape/operator#376
  • fix: bump dependencies to address security advisories by @matthyx in kubescape/operator#377
  • Fix empty-Wlid scan dispatch in operator SBOM watcher by @yugal07 in kubescape/operator#379
  • fix: populate PodUID in admission alerts by @matthyx in kubescape/operator#380
  • feat: add attestations: write permission for image provenance attestation by @Varadraj75 in kubescape/operator#381
  • CRD-driven CEL admission rules with async validator by @slashben in kubescape/operator#374
  • chore(deps): bump armoapi-go to v0.0.719 by @matthyx in kubescape/operator#384
  • chore(deps): Bump go.mongodb.org/mongo-driver from 1.17.4 to 1.17.7 by @dependabot[bot] in kubescape/operator#386
  • feat: handle operatorAction commands (annotate + dry run) by @yugal07 in kubescape/operator#383
  • feat(autoscaler): deploy node-agent on nodes missing the grouping label by @matthyx in kubescape/operator#389
  • feat(remediation): add quarantine action (deny-all NetworkPolicy + dry-run) by @yugal07 in kubescape/operator#388
  • chore(deps): Bump github.com/containerd/containerd from 1.7.32 to 1.7.33 by @dependabot[bot] in kubescape/operator#390
  • operator: findings-driven targeting for operatorAction (resolve selector from stored scan results) by @yugal07 in kubescape/operator#391
  • [ LFX 2026 ] operator: watch SecurityException/ClusterSecurityException CRDs and rescan on change or expiry by @yugal07 in kubescape/operator#392
  • chore(deps): Bump github.com/cilium/cilium from 1.17.15 to 1.17.16 by @dependabot[bot] in kubescape/operator#394
  • fix: look up ContainerProfile by with-container slug, not workload slug by @matthyx in kubescape/operator#396
• kubescape/storage@v0.0.274...v0.0.297
  • path-wildcards: anchored trailing-* + per-endpoint port + R0040 args by @entlein in kubescape/storage#323
  • fix(security): bump vulnerable Go dependencies (May 2026) by @matthyx in kubescape/storage#327
  • allowing wildcards in exec args by @entlein in kubescape/storage#322
  • feat(processor): merge ug- AP/NN into consolidated ContainerProfile by @yugal07 in kubescape/storage#319
  • feat(validation): accept unsupported-schema status in ValidateStatusA… by @harshitg927 in kubescape/storage#329
  • feat: add attestations: write permission for image provenance attestation by @Varadraj75 in kubescape/storage#332
  • feat: support IPv6-only clusters via configurable bind address by @matthyx in kubescape/storage#333
  • feat: surface apiserver logs via KS_LOGGER_LEVEL=debug; document >=1.28 requirement by @matthyx in kubescape/storage#336
  • fix(server): make WatchList=false effective and stop pre-closed watch retry loops by @matthyx in kubescape/storage#330
  • Addon to PR 323: Moving Exec Args from NA to Storage by @entlein in kubescape/storage#328
  • allowing CIDRs, wildcards and Plural in IP and DNS by @entlein in kubescape/storage#324
  • fix: paginate summary aggregation to avoid 500-item truncation (#337) by @matthyx in kubescape/storage#339
  • test: deflake TestCompareDynamic_ZeroAllocHotPath by @matthyx in kubescape/storage#340
  • profile-compaction: CollapseConfig CRD + projection overlay + user-maged lifecycle by @entlein in kubescape/storage#325
  • fix: clean up expired/deleted containerprofile time series database entries by @matthyx in kubescape/storage#338
  • docs: document metadata-only LIST and the fullSpec resourceVersion toggle by @matthyx in kubescape/storage#347
  • fix(storage): fail fast on lock contention instead of hanging to the request timeout by @matthyx in kubescape/storage#342
  • fix(storage): cache the CollapseConfiguration read instead of doing it inside the write lock by @matthyx in kubescape/storage#343
  • fix(storage): stop pinning one connection for the whole ContainerProfile consolidation pass by @matthyx in kubescape/storage#344
  • fix(storage): fail fast on connection-pool exhaustion, not just lock contention by @matthyx in kubescape/storage#345
• kubescape/synchronizer@v0.0.147...v0.0.155
  • fix(deps): bump Go to 1.25.10 and golang.org/x/* deps to fix CVEs by @matthyx in kubescape/synchronizer#157
  • Fix/bump deps vulns by @matthyx in kubescape/synchronizer#158
  • feat: add attestations: write permission for image provenance attestation by @Varadraj75 in kubescape/synchronizer#159
  • refactor(synchronizer): extract shared MQ handler, metrics, and Pulsa… by @harshitg927 in kubescape/synchronizer#160
  • fix(messaging): reject invalid kind strings before object message dis… by @harshitg927 in kubescape/synchronizer#162
  • feat(auth): flag unconfigured Helm credentials in 401 auth-rejection log by @kooomix in kubescape/synchronizer#163
  • fix(backend): repair NewProducerMessage signature + self-loop tagging (unblocks component-tests) by @matthyx in kubescape/synchronizer#165
  • feat(backend): add Kafka message queue backend with franz-go by @harshitg927 in kubescape/synchronizer#166
• Bump prometheus-exporter from v0.2.18 to v0.2.22

Full Changelog: kubescape-operator-1.40.2...kubescape-operator-1.40.3