Baixar kubescape 4.0.17 per a Windows

Changelog
- 5a9d63b Feat/mcp apply remediation report items from posture reports (#4163)
- bed990c Fix/cel variable cycle detection (#4315)
- 94760fe Fix/rbacgraph workload controller serviceaccount (#4181)
- 233a5c8 Fix/runtime profile drift safety (#4169)
- 6acf0bb Fix/scan reject include and exclude namespaces (#4194)
- 2997108 Test/cel upstream parity timestamp (#4314)
- 4f0d4f9 chore(deps): bump github.com/kubescape/backend to v0.0.53 (#4259)
- 0fc78a6 chore(docs): remove unused CLI color screenshots (#4338)
- 849fe56 chore: remove unused policy color screenshots (#4380)
- 16e066d ci: bump actions/create-github-app-token from 3.2.0 to 3.3.0 (#4250)
- a14b41b ci: bump actions/setup-python from 7.0.0 to 7.1.0 (#4367)
- 69d36ea ci: bump docker/login-action from 4.6.0 to 4.7.0 (#4368)
- 357ad45 ci: bump github.com/Azure/azure-sdk-for-go/sdk/azidentity (#4247)
- d1a3825 ci: bump github.com/aws/aws-sdk-go-v2/config from 1.32.39 to 1.33.9 (#4252)
- fee57e6 ci: bump github.com/bmatcuk/doublestar/v4 from 4.10.0 to 4.10.3 (#4366)
- 66be9e2 ci: bump github.com/go-chi/chi/v5 from 5.3.0 to 5.4.0 (#4401)
- 121f9d4 ci: bump github.com/go-git/go-git/v5 from 5.19.2 to 5.19.3 (#4246)
- 3a2bd47 ci: bump github.com/go-openapi/runtime from 0.33.2 to 0.33.3 (#4253)
- ad4b83b ci: bump github.com/santhosh-tekuri/jsonschema/v6 from 6.0.2 to 6.0.3 (#4364)
- abb1dca ci: bump github/codeql-action/upload-sarif from 4.38.3 to 4.39.0 (#4251)
- 577a5ac ci: bump github/codeql-action/upload-sarif from 4.39.0 to 4.39.1 (#4369)
- e394b27 ci: bump goreleaser/goreleaser-action from 7.2.3 to 7.3.0 (#4249)
- 27c5759 ci: bump ossf/scorecard-action from 2.4.4 to 2.5.0 (#4248)
- 6f531e2 docs(mcp): remove documentation for the deleted scan_container_image tool (#4159)
- f3baa42 feat(attackpath): Phase 1 – shared input adapter and resolvers (no CLI changes) (#3944)
- 57b15bd feat(clustercomponents): build a normalized inventory of cluster components (#4216)
- 4319ba4 feat(diff): add semantic ANSI color highlights to image vulnerability diff output (#4376)
- 8ade5fc feat(diff): add semantic ANSI colors to human-readable output (#4310)
- d5e0556 feat(exposure): evaluate Gateway API ReferenceGrants for cross-namespace backends (#4217)
- fb0cc23 feat(fix): add Helm --output-post-renderer and harden overlay staging & boundaries (#4393)
- 404dd35 feat(fix): emit Kustomize JSON6902 patches for Helm-rendered resources (#4034)
- 7f277d4 feat(fleet): graded exit codes for fleet runs (#4184)
- c5c79f4 feat(fleet): read fleet settings from a config file [lfx 2026] (#4288)
- f1b17fc feat(helm): render charts for the newest Kubernetes version their kubeVersion allows (#4162)
- 1786546 feat(imagescan): expose package-list matching for non-image scans (#4215)
- 43022aa feat(k8scveindex): attribute Kubernetes CVEs to components using the official feed (#4225)
- 3caf513 feat(list): add semantic ANSI colors to list tables and configurations (#4324)
- da0d55d feat(mcp): add include_identity to analyze_vulnerability_exposure (#4191)
- 11b6cff feat(mcpserver): add create_admission_policy_binding tool (#4260)
- 32da7c7 feat(mcpserver): add list_configuration_security_scan_summaries (#4301)
- 3daca05 feat(mcpserver): add list_sboms and list_sbom_packages tools (#4229)
- 46d7014 feat(mcpserver): add validate_scan_selection and share control resolution (#4281)
- fce8115 feat(mcpserver): count unchanged findings in diff_reports and list them only on request (#4270)
- ce7ffee feat(mcpserver): filter and page list_vulnerabilities_in_manifest (#4187)
- bc0d496 feat(mcpserver): filter controls in get_configuration_security_scan_manifest (#4199)
- 5ed7634 feat(mcpserver): filter list_controls by framework (#4212)
- 76defa3 feat(mcpserver): paginate list_controls responses (#4389)
- d338e45 feat(opa): let C-0236 look up signatures in a configured Rekor (#4403)
- f797d06 feat(policy): add semantic ANSI colors to policy test and init commands (#4361)
- b92d6c6 feat(predict): read local manifests from stdin with "-" (#4418)
- eb7028f feat(printer): show CISA KEV and EPSS in image scan output (#4207)
- dd3df9a feat(sarif): keep exception audit trail in SARIF results (#4208)
- 1af7686 feat(scan): add --notify webhook support for image scans (#4230)
- 60e6fcf fix(analysis): honor automatic namespace name labels (#4174)
- 512c130 fix(attackpath): preserve ServiceAccount index snapshot semantics (#4295)
- a9ca401 fix(cautils): carry delete/review paths and fix command into v1 reports (#3985)
- 2d37c41 fix(cautils): correct account ID error typo (#4330)
- 5ee2e31 fix(cel): apply a scoped binding's paramRef to the objects it binds (#4278) (#4279)
- f98d84c fix(cel): normalize namespaceObject nulls like the typed decode (#4303)
- b393a02 fix(cel): treat empty yaml fields as unset (#4289)
- 67e5f13 fix(cel): use namespaceselector for binding scope matching (#4326) (#4327)
- 4639ef2 fix(cel): warn on validation evaluation errors (#4337)
- 6f51c4a fix(cli): name the flag and valid range in out-of-range threshold errors (#4343)
- a6d9db4 fix(cmd): propagate root context and cancellation to subcommands (#4079)
- 7333791 fix(completion): honor command output and return write errors (#4189)
- fc205ca fix(config): report a failure to delete the cached config (#4384)
- 42c0b1c fix(config): require a UUID accountID in config set and config validate (#4168)
- d455fec fix(core): match imagePullSecret registry keys the way the kubelet does (#4396)
- 49a9b2b fix(diff): accept .yml extension case insensitively in diffOutputPath (#4238)
- 583c2d7 fix(diff): bound and validate report file reads (#4180)
- 0044760 fix(diff): dispatch unreadable report pairings with vulnerability reports to vulnerability loader (#4411)
- 5752177 fix(diff): distinguish vulnerability package namespaces (#4407)
- 0fe9171 fix(diff): neutralize spreadsheet formula injection in summary CSV output (#4243)
- 4bbc842 fix(diff): only treat coverage gaps that affect the control as inconclusive (#4258)
- a0b30e6 fix(diff): write a diff file inside a --output directory (#4172)
- d8f0778 fix(download): match the --output .json extension case-insensitively (#4274)
- b703511 fix(exposure): apply framework-scoped exceptions in per-resource output and fix (#4219)
- b0415d3 fix(exposure): include active Gateway request mirrors (#4175)
- 172c1a7 fix(fix): drop a placeholder fix that shadows a concrete fix (#4183)
- f8daefe fix(fleetscan): detect case-insensitive output path collisions across contexts (#4357)
- cb139ae fix(getter): resolve control section numbers in GetControl (#4263)
- 6679005 fix(gitlab-sast): report scan coverage gaps in scan.messages (#4206)
- db78f25 fix(helm): scan only vendored chart dependencies (#4020)
- 4535766 fix(httphandler): keep storing posture results after a build error (#4241)
- b6b9566 fix(httphandler): remove markdown and exceptions results on cleanup (#4254)
- 764442a fix(imagescan): clear Azure session state when login fails (#4282)
- 4ad3285 fix(imagescan): clear ECR session before login attempts (#4292)
- c1a2c90 fix(imagescan): clear GCP session before validating a new login (#4297)
- 09d0f50 fix(imagescan): clear GitLab session state when login fails (#4286)
- 0d30554 fix(imagescan): clear Harbor session state when login fails (#4302)
- b5bff4b fix(imagescan): exclude closed ECR enhanced findings (#4294)
- c381e1e fix(imagescan): identify GCP vulnerabilities by their Grafeas notes (#4283)
- 48cff2b fix(imagescan): keep untriaged findings at unknown severity (#4409)
- 5532425 fix(imagescan): reject incomplete Harbor vulnerability reports (#4284)
- 74539db fix(imagescan): report incomplete Azure vulnerability results (#4416)
- 2959d98 fix(imagescan): report incomplete GCP occurrence results (#4415)
- 130bd09 fix(imagescan): retain partial GitLab vulnerability data (#4204)
- 8930f64 fix(list): neutralize spreadsheet formula injection in CSV output (#4275)
- 2ecf642 fix(list): reject an unknown --framework instead of listing nothing (#4382)
- c39cfc8 fix(list): validate controls config target (#4422)
- 508f238 fix(list): validate format flag upfront before querying policies (#4383)
- 018c173 fix(mapreconcile): account for equivalent exclusion rules (#4235)
- 7d92c16 fix(mapreconcile): infer immutable namespace-name labels (#4417)
- 2dc2663 fix(mcp): handle marshal errors in advanced tools (#4262)
- 3beddbc fix(mcpserver): add missing workload kinds to advanced tools (#4223)
- 955138f fix(mcpserver): classify RBAC escalation list failures (#4317)
- fba406b fix(mcpserver): classify advanced tool API errors correctly (#4322)
- 80f6820 fix(mcpserver): classify errors in list admission policies (#4387)
- 5f81a18 fix(mcpserver): classify forbidden and timeout errors in analyze_mutating_admission_policy_impact (#4318)
- 92e6fa9 fix(mcpserver): detect secrets in ConfigMap binary content (#4265)
- 0385707 fix(mcpserver): find the namespace by name in get tools when none is given (#4306)
- 7d8d968 fix(mcpserver): keep vulnerability package URLs distinct (#4313)
- 46e5842 fix(mcpserver): list configuration scans in all namespaces by default (#4299)
- 137d07d fix(mcpserver): shut down the SSE transport gracefully on SIGINT/SIGTERM (#4178)
- cd54dd8 fix(mcpserver): support dot-separated keys in secret exposure detection (#4308)
- 3c815b3 fix(mcpserver): support patch_type in dry_run_remediation (#4321)
- 4b7f6a4 fix(mcpserver): suppress URI credential exposure when parts are variable references (#4201)
- 87f16a6 fix(mcpserver): switch scan response to cautils.ResourceStatus (#4350)
- f7cd3a9 fix(mcpserver): use structured argument helpers in analyze_rbac_escalation_paths (#4221)
- 081b11d fix(mcpserver): validate mutating policy impact arguments (#4197)
- 4fa11cf fix(operator): remove duplicate withCapturableLogger test helper (#4426)
- acd1322 fix(patch): allow omitted format flag in patch command (#4345)
- 2e5d64b fix(policy): load YAML fixtures regardless of extension casing (#4421)