Baixar kubescape 4.0.16 per a Windows

Changelog
- 02cd407 Feat/rbac parity differential testing (#4076)
- 58b7c1e Fix file permission gosec warnings in httphandler tests (#3924)
- 4a3ccb4 Honor control exclusions in HTTP scans (#4116)
- b83f2bd chore(containerscan): remove unused core/pkg/containerscan package (#4069)
- a396043 chore(deps): bump github.com/kubescape/go-logger from 0.0.34 to 0.0.35 (#4084)
- d740964 chore(resultshandling): remove dead legacy wrappers superseded by ResourceCatalog (#4082)
- a111524 ci(security-insights): migrate to Security Insights v2.2.0 (#4059)
- 839c9fc ci(workflows): remove Codium-ai pr-agent (#3973)
- 9dbcc00 ci: bump actions/upload-artifact from 7.0.1 to 7.0.2 (#4136)
- 76b23b8 ci: bump anchore/sbom-action/download-syft from 0.24.2 to 0.24.3 (#4050)
- b0c1708 ci: bump docker/setup-buildx-action from 4.3.0 to 4.4.1 (#3898)
- d6623ff ci: bump github.com/docker/cli from 29.7.2+incompatible to 29.9.0+incompatible (#4130)
- 42456aa ci: bump github.com/kubescape/rbac-utils from 0.0.21 to 0.0.22 (#4127)
- 0909d9a ci: bump github.com/kubescape/regolibrary/v2 from 2.0.36 to 2.0.38 (#4126)
- e1d3528 ci: bump github.com/quay/claircore from 1.5.54 to 1.6.1 (#4129)
- 74164da ci: bump github.com/sirupsen/logrus from 1.10.1 to 1.10.2 (#4045)
- df2becc ci: bump github/codeql-action/upload-sarif from 4.38.2 to 4.38.3 (#4135)
- d145b20 ci: bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc from 1.45.0 to 1.47.0 (#4047)
- af5ce76 ci: bump golang.org/x/term from 0.46.0 to 0.47.0 (#4128)
- bddb17d ci: bump google.golang.org/api from 0.297.0 to 0.300.0 (#3961)
- 6682619 ci: bump helm/kind-action from 1.15.0 to 1.15.1 (#4137)
- a9f1920 ci: bump mikepenz/action-junit-report from 6.5.0 to 6.6.1 (#4133)
- d01c1de ci: bump sigs.k8s.io/kustomize/kyaml from 0.21.1 to 0.21.2 (#4049)
- 5c63ca9 ci: skip PR scanner jobs per job instead of by paths-ignore (#4098)
- e7f54b2 docs(fix): document every --output-dir refusal, and --interactive (#4110)
- 8489794 docs(security-insights): add contribution review policy (#4145)
- 8936552 feat(diff): compare image scan reports to surface new and resolved vulnerabilities (#3957)
- 3b7b90e feat(fix): add interactive mode for granular remediation (#3914)
- 48d62cf feat(fleet): retry clusters whose API server never answered [LFX 2026] (#4113)
- 0506387 feat(imagescan): add Red Hat Quay vulnerability adaptor (#4081)
- 4d883d0 feat(mcp): add list_admission_policies tool (#4112)
- 071a01a feat(mcp): log tool-call metadata at debug level (#4123)
- 2e978a7 feat(mcpserver): add PSS compliance prediction tool (#4011)
- 856e477 feat(mcpserver): add secret exposure detection tool (#4099)
- f96a146 feat(mcpserver): expose scan report comparison via diff_reports tool (#4040)
- 0d924df feat(pdf): report scan coverage and skipped-control diagnostics (#3958) (#3959)
- fdc3449 feat(printer): add scan coverage to PDF and docs (#3977)
- 5b7739d feat(printer): include skipped and unevaluated controls in junit report (#4014) (#4015)
- 8b3fe4b feat(printer): surface attack-path priority score and severity in SARIF result properties (#4004)
- aff6091 feat(pss): add PSS compliance predictor CLI (#4055)
- 5a0b79e feat(pss): add Pod Security Standards evaluation library (#4003)
- 46931e9 feat(scan): add --kube-version and --api-versions for Helm rendering (#4143)
- 3649b06 feat(vulnexposure): account for external exposure in vulnerability analysis (#4064)
- 6b8f6cf fix(baseline): handle CloseWriter error on success path in writeBaselineHeadReport (#4006)
- c012bad fix(cel): collect Namespace context beyond workload filters (#4062)
- 3b5f86e fix(config): reject empty config set values instead of silently keeping the old value (#3986)
- 01ce227 fix(core): respect context cancellation in credential retry loop (#3998)
- 1b91910 fix(core): reuse initialized Kubernetes client across scan interfaces (#3979)
- 9c4acdd fix(csv): include delete paths in the failed paths column (#4086)
- 30937b0 fix(deps): upgrade Trivy to address Dependabot alerts (#4131)
- 6421283 fix(deps): upgrade containerd, cilium and OpenTelemetry to patched releases (#4066)
- fe9d1b0 fix(download): include security view frameworks in download artifacts (#4119)
- 3524f77 fix(e2e): get the E2E run ID from the dispatch response (#4068)
- c612b89 fix(exposure): honor Gateway listener hostname intersection (#4089)
- 61860a7 fix(exposure): honor Gateway parent listener ports (#4102)
- 47c6c5f fix(exposure): ignore zero-weight Gateway backends (#4101)
- beeb553 fix(exposure): resolve HTTP backend Service ports (#4151)
- 4a5e351 fix(exposure): respect Gateway listener protocol compatibility (#4120)
- f476ba0 fix(fix): fix multi-input scans outside git and recreate their tree under --output-dir (#4054)
- 5ce9475 fix(fleet): report a cluster as unreachable only when it never answered (#4022)
- 388a234 fix(httphandler): cancel scan on client disconnect in /v1/metrics (#4039)
- d90f773 fix(httphandler): create scan result files with 0600 and redact paths from scan errors (#4016)
- 1bba0ba fix(httphandler): dynamically reload TLS key pair on file update (#4105)
- d6914ce fix(httphandler): read metrics results from the prometheus .txt path (#3981)
- 0307d8f fix(image): fail loudly on --exceptions with non-registry inputs (#3824)
- 369227d fix(imagescan): add scan status to vulnerability reports (#4074)
- dbcf548 fix(imagescan): apply exponential backoff on Quay HTTP 429 when Retry-After is omitted (#3996)
- 805f9ec fix(imagescan): guard Harbor and GitLab redirect origins (#4147)
- a3959bb fix(imagescan): inspect complete GCP scan status (#4051)
- c63a898 fix(imagescan): keep Quay credentials within their registry origin (#4134)
- 7123217 fix(imagescan): keep latest Harbor scan status (#4052)
- 726ed5c fix(imagescan): match GitLab findings to exact image identity (#4122)
- b658271 fix(imagescan): normalize RHSA severity labels in Quay adaptor (#4035)
- c3a833b fix(imagescan): preserve Quay redirect trust across callbacks (#4150)
- 2195735 fix(imagescan): query ECR scans in the image registry region (#4132)
- 99621ce fix(imagescan): query the ECR image owner account (#4090)
- 1a12f87 fix(imagescan): record resolved manifest digest into ImageID.Hash for Quay scans (#3994)
- 2d6c5c3 fix(imagescan): resolve GitLab registry project boundaries (#4121)
- 17e6da0 fix(imagescan): retain GCP findings on discovery errors (#4149)
- d79180b fix(imagescan): select newest Azure scan assessment (#4152)
- 0d76fed fix(imagescan): validate Harbor image registry ownership (#4148)
- ea63662 fix(install): handle null user PATH and add non-interactive flags in install.ps1 (#4065)
- ba6e27a fix(kustomize): allow only builtin plugins when rendering Kustomizations (#4031)
- 640d826 fix(kustomize): report Kustomize sources relative to the repo root (#3954)
- 4b4af2f fix(mcpserver): harden argument validation and bounds for advanced tools (#4075)
- 59a11c2 fix(mcpserver): harmonize tool argument validation with structured errors (#4100)
- 8ba0d9c fix(mcpserver): reject cross-origin requests to the SSE transport (#4032)
- 2c8b4a4 fix(mcpserver): serve MCP initialize before the policy bundle loads (#4144)
- bb4ebe1 fix(networkpolicy): evaluate ipBlock peers against every IP of a dual-stack pod (#4140)
- 15346b8 fix(networkpolicy): report hostNetwork pods as unknown instead of isolated (#4060)
- 12526c8 fix(opaprocessor): keep rules that compare input objects out of the incremental cache (#4021)
- 210af85 fix(partitionstore): prevent critical file descriptor leak in fdPool.closeAll on flush failure (#3988)
- 8e4f2ff fix(policyreport): surface cluster-wide skipped controls and diagnostics in ClusterPolicyReport (#3989) (#3990)
- c44b4c4 fix(predict): create output directories and restrict file permissions to 0600 (#4083)
- e5f6aa8 fix(predict): sort SARIF rules for determinism and improve report compatibility (#4097)
- bf42abb fix(printer): keep multi-line control remediation inside the markdown report blockquote (#4061)
- 64ff26a fix(prometheus): emit kubescape_resource_count_controls_passed metric (#4013)
- 230d2a9 fix(prometheus): omit complianceScore metric when score is unset (#4017) (#4018)
- 3bb8dfc fix(pss): match the Kubernetes Pod Security Standards evaluator (#4036)
- ebc2fc6 fix(rbacgraph): handle an empty name in resourceNames as the authorizer does (#4117)
- 2bfda3a fix(rbacgraph): keep resourceNames restrictions literal (#4088)
- c999349 fix(rbacgraph): resolve a ServiceAccount subject without a namespace in its RoleBinding's namespace (#4053)
- 6017cc0 fix(scan): honor --output /dev/null in --kube-contexts fleet scans (#3846)
- d0ea07b fix(scan): measure full call in fleet timeout test (#4155)
- af7a944 fix(scan): read SecurityException CRDs only on cluster scans (#4125)
- 4ccc405 fix(scan-integrity): fail closed on whole-cluster verify parity mismatch (#4000)
- 80cbaa3 fix(storage): clear remediated findings on later scans (#4044)
- c5e20d9 fix(storage): skip results with non-RBAC related objects instead of aborting persistence (#4057)
- b1726ab perf(mcpserver): deduplicate concurrent analysis requests (#4146)
- 041bce0 perf(opaprocessor): cache prepared rego evaluation queries to reduce scan overhead (#4030)
- 88db8bd perf(partitionstore): avoid redundant DeepCopy before disk serialization in DiskStore.Put (#3971)
- 6fd7b78 style(fixhandler): gofmt the UnfixedControl struct (#4019)
- 22afdf7 test(ghworkflows): guard go.mod replace directives (#3992)
- 1cf4055 test(printer): add regression coverage for secure report file permissions (#4092)
- 65639c4 test(pss): expand upstream parity coverage (#4093)
Released by GoReleaser.