kubescape: vanhemmat versiot ja versiohistoria

Changelog
- 02cd407 Feat/rbac parity differential testing (#4076)
- 58b7c1e Fix file permission gosec warnings in httphandler tests (#3924)
- 4a3ccb4 Honor control exclusions in HTTP scans (#4116)
- b83f2bd chore(containerscan): remove unused core/pkg/containerscan package (#4069)
- a396043 chore(deps): bump github.com/kubescape/go-logger from 0.0.34 to 0.0.35 (#4084)
- d740964 chore(resultshandling): remove dead legacy wrappers superseded by ResourceCatalog (#4082)
- a111524 ci(security-insights): migrate to Security Insights v2.2.0 (#4059)
- 839c9fc ci(workflows): remove Codium-ai pr-agent (#3973)
- 9dbcc00 ci: bump actions/upload-artifact from 7.0.1 to 7.0.2 (#4136)
- 76b23b8 ci: bump anchore/sbom-action/download-syft from 0.24.2 to 0.24.3 (#4050)
- b0c1708 ci: bump docker/setup-buildx-action from 4.3.0 to 4.4.1 (#3898)
- d6623ff ci: bump github.com/docker/cli from 29.7.2+incompatible to 29.9.0+incompatible (#4130)
- 42456aa ci: bump github.com/kubescape/rbac-utils from 0.0.21 to 0.0.22 (#4127)
- 0909d9a ci: bump github.com/kubescape/regolibrary/v2 from 2.0.36 to 2.0.38 (#4126)
- e1d3528 ci: bump github.com/quay/claircore from 1.5.54 to 1.6.1 (#4129)
- 74164da ci: bump github.com/sirupsen/logrus from 1.10.1 to 1.10.2 (#4045)
- df2becc ci: bump github/codeql-action/upload-sarif from 4.38.2 to 4.38.3 (#4135)
- d145b20 ci: bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc from 1.45.0 to 1.47.0 (#4047)
- af5ce76 ci: bump golang.org/x/term from 0.46.0 to 0.47.0 (#4128)
- bddb17d ci: bump google.golang.org/api from 0.297.0 to 0.300.0 (#3961)
- 6682619 ci: bump helm/kind-action from 1.15.0 to 1.15.1 (#4137)
- a9f1920 ci: bump mikepenz/action-junit-report from 6.5.0 to 6.6.1 (#4133)
- d01c1de ci: bump sigs.k8s.io/kustomize/kyaml from 0.21.1 to 0.21.2 (#4049)
- 5c63ca9 ci: skip PR scanner jobs per job instead of by paths-ignore (#4098)
- e7f54b2 docs(fix): document every --output-dir refusal, and --interactive (#4110)
- 8489794 docs(security-insights): add contribution review policy (#4145)
- 8936552 feat(diff): compare image scan reports to surface new and resolved vulnerabilities (#3957)
- 3b7b90e feat(fix): add interactive mode for granular remediation (#3914)
- 48d62cf feat(fleet): retry clusters whose API server never answered [LFX 2026] (#4113)
- 0506387 feat(imagescan): add Red Hat Quay vulnerability adaptor (#4081)
- 4d883d0 feat(mcp): add list_admission_policies tool (#4112)
- 071a01a feat(mcp): log tool-call metadata at debug level (#4123)
- 2e978a7 feat(mcpserver): add PSS compliance prediction tool (#4011)
- 856e477 feat(mcpserver): add secret exposure detection tool (#4099)
- f96a146 feat(mcpserver): expose scan report comparison via diff_reports tool (#4040)
- 0d924df feat(pdf): report scan coverage and skipped-control diagnostics (#3958) (#3959)
- fdc3449 feat(printer): add scan coverage to PDF and docs (#3977)
- 5b7739d feat(printer): include skipped and unevaluated controls in junit report (#4014) (#4015)
- 8b3fe4b feat(printer): surface attack-path priority score and severity in SARIF result properties (#4004)
- aff6091 feat(pss): add PSS compliance predictor CLI (#4055)
- 5a0b79e feat(pss): add Pod Security Standards evaluation library (#4003)
- 46931e9 feat(scan): add --kube-version and --api-versions for Helm rendering (#4143)
- 3649b06 feat(vulnexposure): account for external exposure in vulnerability analysis (#4064)
- 6b8f6cf fix(baseline): handle CloseWriter error on success path in writeBaselineHeadReport (#4006)
- c012bad fix(cel): collect Namespace context beyond workload filters (#4062)
- 3b5f86e fix(config): reject empty config set values instead of silently keeping the old value (#3986)
- 01ce227 fix(core): respect context cancellation in credential retry loop (#3998)
- 1b91910 fix(core): reuse initialized Kubernetes client across scan interfaces (#3979)
- 9c4acdd fix(csv): include delete paths in the failed paths column (#4086)
- 30937b0 fix(deps): upgrade Trivy to address Dependa

Changelog
- 77d80e1 Refactor: Move getReadableID out of filesloaderutils (#3862)
- ac7749e chore: bump regolibrary to v2.0.36 (#3893)
- 3d195ba chore: ignore every result file the smoke test writes (#3936)
- 0ed2ec6 ci: bump docker/setup-qemu-action from 4.3.0 to 4.4.0 (#3899)
- 087343d ci: bump github.com/Azure/azure-sdk-for-go/sdk/azcore (#3962)
- 59543f3 ci: bump github.com/anchore/clio (#3834)
- b685324 ci: bump github.com/anubhav06/copa-grype (#3837)
- 4343cf6 ci: bump github.com/deckarep/golang-set/v2 from 2.8.0 to 2.9.0 (#3835)
- 85ec580 ci: bump github.com/hashicorp/hcl/v2 from 2.24.0 to 2.25.0 (#3894)
- 3ce372a ci: bump github.com/johnfercher/maroto/v2 from 2.2.2 to 2.4.2 (#3836)
- 0eaf4d7 ci: bump github.com/moby/buildkit from 0.31.1 to 0.33.0 (#3895)
- 15fdfc5 ci: bump github.com/project-copacetic/copacetic from 0.10.0 to 0.15.0 (#3763)
- f59fe46 ci: bump github/codeql-action/upload-sarif from 4.37.9 to 4.38.0 (#3838)
- ce00b88 ci: bump github/codeql-action/upload-sarif from 4.38.0 to 4.38.1 (#3897)
- e25088c ci: bump github/codeql-action/upload-sarif from 4.38.1 to 4.38.2 (#3965)
- 6f9fcd9 ci: bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp (#3963)
- 81484b3 ci: bump golang.org/x/mod from 0.40.0 to 0.41.0 (#3896)
- a7f3a75 ci: bump the kubernetes group with 4 updates (#3960)
- 913a156 feat(cautils): introduce ResourceCatalog and replace direct AllResources accesses (#3868)
- a07aa9f feat(config): Filter configurations by key in kubescape config view (#3644)
- d4b2879 feat(evidence): warn on incompatible flags and skip lines for anonymized source path (#3864)
- d52269c feat(fix): honour --output-dir for file-based reports (#3880)
- 7360e44 feat(fleet): add the compliance rollup to the fleet report (#3852)
- 4910049 feat(fleet): print a fleet summary after a multi-context scan [LFX 2026] (#3929)
- 0b03ed0 feat(fleet): report the controls clusters disagree on (#3878)
- a4a82a6 feat(helm): thread the document index through chart rendering (#3911)
- dc77396 feat(httphandler): reload namespace filters without restarting (#3925)
- 3a7778a feat(imagescan): support Quay vulnerability scanning (#3917)
- f7533fc feat(imagescan): support full Azure credential chain for ACR image pulls (#3853)
- 2adae0d feat(locationresolver): resolve bracketed-key paths by building yq expressions from parsed segments (#3816)
- 0372433 feat(opa): let C-0236 accept key-signed images without a transparency log entry (#3967)
- ef5333f feat(opaprocessor): define execution policies for whole-cluster controls (#3877)
- 16cfe10 feat(printer): add scan coverage to markdown, HTML, and CSV (#3937)
- 028c488 feat(printer): report degraded scan coverage and skipped controls (#3926)
- d411dda feat(printer): resolve fix-path line numbers in --show-evidence output (#3786)
- 765d368 feat(printer): resolve line numbers for delete and review paths in --show-evidence (#3845)
- 61eea48 feat(resourcehandler): introduce partition and spill store engine (#3818)
- 2a649ff feat(resourcehandler): wire partition store into streaming collector (#3235) (#3863)
- 4ab599f feat(scan): add --fleet-report to write one combined report across --kube-contexts (#3815)
- 4e03922 feat(vap): include complete Agent Runtime policy set (#3871)
- 3401a49 feat: add support for deleting specific configuration keys (#3672)
- 78b5fef feat: use mmap and fastjson for manifest parsing (#3500)
- c79a1fc fix(anonymizer): keep failed transformations from corrupting reports (#3888)
- 38679a1 fix(cautils): do not carry tenant identity across --kube-contexts scans (#3813)
- 26cca65 fix(cautils): recurse nested JSON arrays and ignore non-manifest JSON values (#3817)
- 904bfaf fix(cautils): skip non-regular manifest files instead of reading them (#3931)
- 876554f fix(cel): avoid false findings when Namespace data is unavailable (#3920)
- 0da362d fix(ci): build and test master on push, not only inside a pull request (#3910)
- de3088b fix(diff): extract failedPath evidence in granul

Changelog
- fbe710b chore(deps): bump github.com/mark3labs/mcp-go from 0.58.0 to 1.0.0 (#3747)
- c2dbab1 chore(deps): bump golang.org/x/crypto from 0.55.0 to 0.56.0 (#3746)
- 74269b7 chore(deps): bump helm.sh/helm/v3 from 3.20.2 to 3.21.4 (#3748)
- dc42aab chore: remove unused 1.png (#3772)
- f95fd72 ci: bump Codium-ai/pr-agent from 0.43.0 to 0.44.0 (#3749)
- 9b6f31a ci: bump Codium-ai/pr-agent from 0.44.0 to 0.45.0 (#3765)
- 6e57aff ci: bump docker/setup-qemu-action from 4.2.0 to 4.3.0 (#3750)
- 50c7742 ci: bump github.com/armosec/armoapi-go from 0.0.757 to 0.0.760 (#3766)
- 7ab40bc ci: bump github.com/quay/claircore from 1.5.35 to 1.5.54 (#3764)
- 94dbf45 ci: bump go.opentelemetry.io/otel/exporters/otlp/otlptrace (#3762)
- f55f4a5 ci: bump google.golang.org/api from 0.280.0 to 0.297.0 (#3761)
- 78c2987 ci: bump helm/kind-action from 1.14.0 to 1.15.0 (#3751)
- 24af8fa ci: bump k8s.io/apimachinery from 0.36.2 to 0.37.0 (#3709)
- 0b3d016 feat(fleet): add cross-cluster control matrix and fleet report types (#3774)
- 299509d feat(list): add --framework and --search filters to list controls (#3623) (#3718)
- 6a97de1 feat(mcpserver): introduce structured machine-readable error responses (#3776)
- 10d4c96 feat(rules): add host-users-root-workload-v1 rule prototype (#3754)
- 153e9d9 feat(rules): detect Azure AKS Workload Identity in provider-iam-assumption-v1 (#3724)
- ddbd0ac feat(scan): extend --kube-contexts fleet mode to framework/control/workload (#3440)
- 483a570 fix(diff): do not print usage when --fail-on-new fails (#3756)
- a696bda fix(exposure): model GRPCRoute exposure paths with v1beta1 fallback (#3728)
- 4a949f3 fix(fix): warn when --output-dir is ignored for file-based reports (#3767)
- 33c1475 fix(git): use hex encoding for hashRepoURL instead of raw bytes (#3720)
- 194d7ab fix(httphandler): gracefully shut down HTTP server and scan worker (#3769)
- e7b3dfb fix(mcpserver): return explicit error for unsupported resource_kind in scan_resource_slice (#3740)
- 031cd40 fix(opaprocessor): fix AllResources data race in celParamObjectFinder (#3787)
- 8850cc5 fix(policyhandler): route mixed Framework/Control scan identifiers by their own kind (#3768)
- 5324639 fix(printer): generalize evidence redaction beyond Secret-kind-only (#3752)
- d3c0138 fix(printer): honor --show-evidence in control and resource views (#3775)
- 7817ea5 fix(printer): route SARIF, GitLab-SAST, HTML, and CSV fix-path values through --show-secrets redaction (#3759)
- 023d128 fix(rbacgraph): order escalation results instead of reading map order (#3739)
- 75e9d0b fix(resourcehandler): retrieve single workload via Get instead of List (#3722)
- 20053d7 fix(resultshandling): rebuild namespace rollup after severity filtering (#3726)
- 13849cb fix(scan): normalize kind case and support short names in workload scan (#3730)
- 074bf30 fix: do not print scan usage when --severity-threshold fails (#3716) (#3717)
- f8cb183 test(cel): check the vendored bundle against the digests pinned in the Makefile (#3742)
Released by GoReleaser.

Changelog
- 88f24cc Add C-0298: detect subjects that can attach ephemeral containers to pods (#3017)
- 6bc13df Add RBAC-police rules for issue #916: impersonate, token-mint, escalate, bind, node-proxy, PV create (#3093)
- 437bd63 Add URL context to repository scanner error messages (#3650)
- 321b6c0 Add opt-in audit for posture exceptions (#3095)
- 80bddbb Fix memory allocation spikes during opa evaluations (#2920)
- 07bab27 Keep CRD exceptions that a narrower cloud exception does not actually cover (#3351)
- c90ae81 [LFX 2026] chore(deps): bump opa-utils to v0.0.312 for alertOnly exception semantics (#3615)
- e6fa8bf chore(cel): bump the pinned CEL policy library to v0.14 and sync the bundle (#3556)
- cfc1db5 chore(deps): bump github.com/armosec/armoapi-go in /httphandler (#3161)
- 16b28e2 chore(deps): bump github.com/armosec/armoapi-go in /httphandler (#3526)
- 66df915 chore(deps): bump github.com/armosec/armoapi-go in /httphandler (#3686)
- 6f0b303 chore(deps): bump github.com/aws/aws-sdk-go-v2 from 1.43.7 to 1.45.1 (#3711)
- 7dbd0b6 chore(deps): bump github.com/aws/aws-sdk-go-v2/config (#3528)
- 1824b77 chore(deps): bump github.com/go-openapi/runtime in /httphandler (#3685)
- 351e4c0 chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.8 to 6.8.3 (#3530)
- 43588f5 chore(deps): bump github.com/kubescape/backend in /httphandler (#3684)
- e4868d9 chore(deps): bump github.com/kubescape/go-git-url from 0.0.31 to 0.0.33 (#3529)
- 97aa966 chore(deps): bump github.com/kubescape/go-logger from 0.0.28 to 0.0.34 (#3695)
- 42158fd chore(deps): bump github.com/kubescape/go-logger in /httphandler (#3522)
- 9646cfd chore(deps): bump github.com/kubescape/k8s-interface in /httphandler (#3166)
- 6b90911 chore(deps): bump github.com/kubescape/opa-utils in /httphandler (#3524)
- 41a952c chore(deps): bump github.com/kubescape/rbac-utils from 0.0.21-0.20230806101615-07e36f555520 to 0.0.21 (#3170)
- 6cf53be chore(deps): bump github.com/mark3labs/mcp-go from 0.29.0 to 0.57.0 (#3168)
- b5bd334 chore(deps): bump github.com/mark3labs/mcp-go from 0.57.0 to 0.58.0 (#3692)
- 03814d5 chore(deps): bump github.com/maruel/natural from 1.1.1 to 1.3.0 (#3696)
- 336432c chore(deps): bump github.com/mattn/go-isatty from 0.0.21 to 0.0.24 (#3710)
- 80bbc86 chore(deps): bump github.com/open-policy-agent/opa from 1.14.1 to 1.19.0 (#3167)
- 285affd chore(deps): bump github.com/owenrumney/go-sarif/v2 from 2.2.0 to 2.3.3 (#3523)
- 4f0229f chore(deps): bump github.com/zclconf/go-cty from 1.17.0 to 1.19.0 (#3531)
- b586004 chore(deps): bump go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux (#3169)
- 7dc067b chore(deps): bump go.opentelemetry.io/otel in /httphandler (#3163)
- 40ee29c chore(deps): bump go.opentelemetry.io/otel/sdk/metric (#3164)
- 44af76c chore(deps): bump google.golang.org/protobuf (#3690)
- aecc40c chore(deps): bump k8s.io/apimachinery in /httphandler (#3165)
- 76485e5 chore(deps): bump k8s.io/apimachinery in /httphandler (#3527)
- f7e4d10 chore(deps): bump k8s.io/apimachinery in /httphandler (#3687)
- 29682f6 chore(deps): bump opa-utils to v0.0.309 to pick up the NewScore singleton fix (#3416)
- 614497b chore(deps): bump sigs.k8s.io/kustomize/api from 0.20.1 to 0.21.1 (#3162)
- cc91fb2 chore(deps): fix Dependabot security vulnerabilities in Go dependencies (#3715)
- a26f55b chore(goreleaser): embed E2E hook as single script (#3299)
- 8581f00 chore(hostsensor): delete leftover empty json.go file (#3121)
- 0f17e1c chore(printer): clarify strings import dependency in policyreportprinter.go (#3550)
- 0c10758 ci(comments): gate pr_agent on trusted commenter author_association (#3449)
- bf9a1e4 ci: bound pr-scanner job runtime with timeout-minutes (#3431)
- a85802c ci: bump Codium-ai/pr-agent from 0.35.0 to 0.43.0 (#3535)
- b7f4f6f ci: bump actions/attest-build-provenance from 2.4.0 to 4.2.2 (#3320)
- 3ff3505 ci: bump actions/create-github-app-token from 1.12.0 to 3.2.0 (#3322)
- 5625548 ci: bump actions/setup-go from 5.6.0 to

Changelog
- 6849abb Cel engine docs (#2756)
- 0b25d70 Guard against unresolvable group/version in resource handler (#2609)
- 68b6a71 Increase test coverage for GetWriter and LogOutputFile functions (#2586)
- 2a2253a Propagate printer and command errors (#2908)
- 9e98840 Recover from panics in readJsonFile (#2604)
- 95a70f2 Refactor: remove Getters and PolicyIdentifier from ScanInfo (#2768)
- e79237c Refactor: use distribution/reference for image parsing (#2776)
- 61a8054 Remove Helm binary dependency from kustomize tests (#2926)
- 2763c21 Remove stale "Add score" TODO from processorhandlerutils.go (#2924)
- 957998b Removed dead code in urlloader and urlloader_test and add some test c… (#2590)
- 4cc055e Security/batch dependency fixes 2 (#2897)
- 5b4f1a6 Support scoped registry auth for image scans (#2696)
- 2088a8c Test case added for validation (#2585)
- fad6e64 Unify scan stdin input handling (#2875)
- dd98504 [fix] : non-deterministic namespace bucketing caused by mid-scan resource count mutation (#2587)
- 6561a47 [fix] : streaming collector dropping host-sensor fallback, silently passing controls it never evaluated (#2797)
- 1abd9d8 anonymizer: pin and document the intentional cross-prefix hash-suffix sharing (was: hash prefix+value) (#2687)
- 6bab3de cautils: test: cover test for readYamlFile and readJsonFile (#2526)
- 1b93a71 chore(ci): update pinned GitHub Actions off deprecated Node 20 releases (#2973)
- d23abbf chore(deps): tidy go.mod for backoff import (#3022)
- bb83cd6 chore(printer): remove the unused v1 PrometheusPrinter (#2985)
- a6a0898 chore: evaluate rego with RegoV1 (drop v0 compat shim) (#2359)
- ca0d57b chore: remove dead Float16ToInt function (#2643)
- 4a1d822 chore: remove dead code loadConfigFromData (#2948)
- 4363b2b chore: remove deprecated SA2WLIDmap from RBAC utils (#2957)
- 64915fe chore: remove orphaned firstNonEmpty doc comment (#2945)
- bbf9183 ci: run unit tests on every PR, not just tag pushes (#2606)
- 2e0d1a9 enhancement: propagate context.Context in getter interfaces (#2775)
- 39752e1 feat : add DELETE /v1/scan to cancel an in-flight scan (#2562)
- 9a91904 feat(cautils): add ParseDurationEnvVar (#2779)
- b3192bc feat(context): propagate context through tenant config initialization and Kubernetes API calls (#2739)
- 881ba33 feat(core): implement concurrent and deduplicated image scan pipeline (KS-ADV-02) (#2759)
- b3f1542 feat(csv): add remediation path evidence columns to CSV scan output (#2900)
- 77aca1e feat(exceptions): prefer cloud exceptions over CRD (#2317)
- 5c6fb28 feat(hostsensor): optimize query with paging, rate limits, and cache (#2864)
- 53899b7 feat(html): show current field values in evidence paths (#3032)
- 5bdca12 feat(imagescan): support scanning local offline tarball images (#2995)
- 29aefd1 feat(mcp): add headless framework security scanner tool (#2528)
- 1d2709e feat(mcp): add local IaC scanner tool (#2545)
- b5bf09a feat(mcpserver): add scan_container_image tool for on-demand vulnerability scanning (KS-INT-03) (#2708)
- dbd32e8 feat(patch): support all image scan output formats (#2910)
- cbf3818 feat(printer): add markdown output format (#3025)
- de8d7a1 feat(printer): surface current field value alongside failed paths in scan output (#2882)
- 531ab67 feat(resourcesprioritization): support configurable workload kinds and dynamic pod template spec detection (#2720)
- eed57f0 feat(scan): add --api-version flag to workload scan command (#2829)
- 1201b17 feat(scan): add --label-selector flag to filter collected resources (#2830)
- 0513520 feat(scan): support parsing apiVersion in workload identifier (#2581)
- 830edec feat(streaming): Add resource streaming for large clusters to reduce memory usage (#2645)
- 1225145 feat(version): add --output json flag (#2793)
- 0a8dacf feat: Automated In-Cluster Private Registry Credential Resolver (#2832)
- 164d228 feat: add --only-fixable flag to gate scan image severity threshold on fix availability (#2891)
- 8a49128 feat: add Azure AK

Changelog
- 411b179 Cache compiled CEL programs across scanned objects (#2503)
- 6bbcccd Derive cmd/vap policy metadata from the embedded VAP bundle (#2485)
- 1a6cf89 Embed and load VAP YAML from the vendored bundle (#2474)
- 6cb59a4 Expand encryption and decryption coverage for resource metadata (#2442)
- df44c79 Fix air-gapped mode -- thread explicit offline flag to policy getters instead of relying on nil (#2458)
- 949a569 Fix control-inputs fallback to return real local getter instead of unloaded store (#2515)
- e4ab628 Fix local control cache (#2463)
- 3c4b059 Fix/helm templates plain yaml warnings (#2509)
- efb658f Vendor the CEL admission policy bundle (#2455)
- 7dbe430 [ LFX 2026] feat(exceptions): honor objectSelector.matchExpressions via PostureExceptionPolicy.ObjectSelector (#2480)
- 8a2e1a2 [Fix] : severity-based image exceptions in JSON, SARIF, and patch output -- use filtered Matches instead of RemainingMatches (#2522)
- 5afd77b add unit tests for GetPreReqCmd and kubeconfig flag (#2486)
- 21e2db5 core: Add test coverage for Kubescape.Diff pretty-printer output path (#2467)
- 55df2bd docs(cli): document report protection workflow (#2508)
- ef65747 docs(cli): improve report protection help and examples (#2510)
- 80191c7 feat(anonymizer): support reversible container metadata transformation (#2473)
- 3f29f09 feat(mcp): Add headless OPAProcessor for low-latency Network Policy s… (#2512)
- 062d9cf feat(mcp): implement headless OPAProcessor rbac scanner (#2492)
- f68fdc0 feat(operator): add quarantine action to remediate CLI subcommand (#2461)
- 29928b8 feat(patch): add support for OCI and Local exports (#2471)
- 79ae44e feat(printer): add GitLab SAST report output format (#2505)
- df68301 feat(reportcrypto): add decryption support for encrypted resource metadata (#2493)
- b830283 feat: add container profile tools and resources to MCP server (#2479)
- 5757418 feat: implement AWS ECR vulnerability adaptor (#2488)
- 20b5a83 feat: introduce Container Image Vulnerability (CIV) Adaptor interfaces (#2482)
- 9ea839a feat: run CEL controls as part of the scan (#2525)
- f7e805a fix(httphandler): add missing panic recovery to Metrics handler (#2465)
- 05e3cc9 fix(httphandler): decouple prometheus metrics scan from request context (#2451)
- 8d5d0d7 fix(httphandler): populate report in synchronous scan response (#2483)
- 4d80ab4 fix(imagescan): preserve matches on metadata lookup errors (#2519)
- 5b93069 fix(mcp): add double-checked mutex locking to k8sClient lazy init (#2506)
- 0b3d0f6 fix(printer): don't append .txt to /dev/null in PrettyPrinter.SetWriter (#2502)
- 6ba3a1d fix(sarif): don't os.Exit on unencodable fix, avoid empty SARIF file (#2499)
- ef6b608 fix(sarif): surface PrettyWrite errors instead of silently writing empty file (#2497)
- 8fb2eb1 fix(scan): don't let --exceptions/--controls-config/--attack-tracks trigger air-gapped mode (#2532)
- 497f086 fix(scan): restore root PersistentPreRun for kubescape scan invocations (#2530)
- 2adea95 fix(vap): deploy-library serves the embedded bundle, downloads only via --from-release (#2507) (#2514)
- 82dd34d fix: preserve explicit exceptions/inputs with use-artifacts-from (#2490)
- 81617ed fix: support namespace/kind/name workload format (#2459) (#2460)
- 85933c9 rbac file todo to check api version is resolved (#2523)
- 5bffddf refactor: decompose monolithic Results API handler (#2477)
- 11a05e1 test(core): cover Kubescape.Download unknown-target error path (#2468)
Released by GoReleaser.

Changelog
- 960d6ce chore(crd): remove orphan, uninstallable SecurityException CRD and its test (#2403)
- 778ec11 feat(operator): add operator remediate CLI subcommand (annotate + dry-run) (#2448)
- 7542e40 fix(httphandler): surface async scan failures via Results endpoint (#2339)
- bef62c9 Add CEL env builder for the VAP engine (#2416)
- d31fc8b Add CEL evaluator (#2443)
- 695c8d1 Add encryption transformer integration tests (#2351)
- 932cd5b Add offline request stub for the CEL engine (#2439)
- 820fa31 Docs: add circleci integration guide (#2385)
- 34f531a Emit security-severity on SARIF rules (#2398)
- 1917984 Fail closed on repo metadata transformation errors (#2353)
- ffc7f92 Fix nil pointer panic on image scan when ScanData is nil (#2431)
- 6a44d6c Fix panic parsing image names without an organization (#2397)
- 80fa300 Fix relative path and Name typo (#2343)
- add18bf Integrate report encryption metadata and DEK wrapping into anonymization workflow (#2380)
- ccadbba Set HTTP timeouts on the scan listener server (#2396)
- f8ae044 [ LFX 2026 ] Fixes bugs found before implementation of LFX 1982 (#2366)
- f2e42ca [feat] : add scan coverage score to measure and report scan co… (#2410)
- 554dd66 [fix] : Fall back to bundled defaults and surface degradation when control-inputs fetch fails (#2395)
- cd5dba9 anonymizer: hide service account names in pod specs (#2333)
- 865b036 backend: imagescan: add missing unit tests for getMatchers and newScanServiceIntegration (#2427)
- e4a8f7d backend: ksinit: add success case for CreateKsObjectConnection (#2429)
- f69c88b chore: modernize codebase to Go 1.26 (#2415)
- f956507 feat(httphandler): add SSRF-hardened scan-completion webhook callback (#2447)
- 1f2e83a feat(opaprocessor): add per-control evaluation timeout (#2375)
- fed74dc feat(opaprocessor): wire CEL language dispatch with stub evaluator (#2405)
- 8274975 feat(report): add encrypted report decryption (#2425)
- 494b0e5 feat(reportcrypto): decrypt resource source metadata in reports (#2440)
- 273a92e feat: add SLSA build provenance attestation to release workflow (#2346)
- 1c7e2e8 feat: add encrypted repo metadata workflow (#2365)
- 38bb518 fix(anonymizer): detect separator-less sensitive env variable names t… (#2367)
- b66104d fix(coverage) : penalise silent failed GVR pulls in coverage score (#2420)
- cc88b0f fix(diff): move --fail-on-new exit to cmd layer so output writer is closed (#2434)
- bf4f796 fix(diff): validate format input and clean up status handling (#2438)
- 8c24435 fix(hostsensorutils): normalize infoMap keys using ResourceGroupToString (#2360)
- 9baa4e9 fix(httphandler): add panic recovery to scan execution goroutine (#2352)
- ee4a4bc fix(httphandler): log persistence failure as warning, return valid result (#2342)
- ab5d74b fix(list): emit JSON objects for list controls --format json (#2401)
- ddc278f fix(offline): dynamically populate allcontrols framework and fix loadpolicy search (#2338)
- 6349ae6 fix(opa): fail fast on cancelled cosign verification contexts (#2368)
- 741b243 fix(opaprocessor) : discard partial results from timed-out controls (#2404)
- d6bdc28 fix(opaprocessor): count timed-out controls as 0 in compliance score (#2424)
- 8af7c84 fix(opaprocessor): stop processing after context cancellation (#2386)
- 7f13c3e fix(portforwarder): avoid blocking on repeated stop signals (#2381)
- e23bdbb fix(resourcehandler): dedup resources found by different providers (#2336)
- f91a798 fix(resourcehandler): fail fast on cancelled contexts after resource pulls (#2372)
- 1f7cb75 fix(resourcehandler): merge host-sensor infoMap instead of replacing it (#2349)
- fb151f6 fix(resourcehandler): trim spaces from namespaces in field selectors (#2382)
- c9ff488 fix(sarif): resolve correct line numbers for absolute-path file scans (#2406)
- 387537a fix(scan): reject invalid format values before scanning (#2370)
- c6781c1 fix(storage): skip orphaned RoleBinding instead of aborting scan persistence (#2392)
- 3d6a657 fix(vap):

Changelog
- ff48571 fix(resourcehandler): surface partial GVR collection failures instead of silently suppressing them
- 7da1924 Accept advertised base URI format in vulnerability manifest parser
- b503153 Add BoolPtrFlag unit tests
- 46f5695 Add image command RunE tests (#2182)
- e435fde Add threshold bounds unit tests
- fdf58c8 Add workload identifier parsing tests
- de1b3a1 Avoid nil source dereference in report marshal logging
- 969470d Emit SecurityException events for posture exception matches (#2291)
- d4d4d38 Feat/vap enforcement reconcile (#2307)
- 94ae647 Fix control scan validator error
- 0282a3e Fix false-positive master node taint classification
- a1a50ee Fix field selector state carryover across resource queries
- 1666f7b Fix inverted keepResults cleanup logic
- eedf923 Fix lint baseline issues
- 4ac5a3e Improve validation and error handling for config set
- 4bb74d3 Merge branch 'master' into test/imagescan-db-load-validation-pr
- 5d70480 Merge branch 'master' into test/imagescan-db-load-validation-pr
- 93bb574 Merge branch 'master' into test/imagescan-default-db-config-validation
- 07ea4bb Merge branch 'master' into test/listener-tls-key-error-cases
- 2437c87 Merge branch 'master' into test/rootutils-logger-env
- 5c2ad60 Merge branch 'master' of https://github.com/kubescape/kubescape into 2185
- 9e2990f Merge branch 'master' of https://github.com/kubescape/kubescape into fix/pdf-html-default-output-file
- 35874cb Merge pull request #2062 from pfarikrispy/master
- ce8aa66 Merge pull request #2067 from Shreya2005-2005/docs/fix-operator-vulnerabilities-short-description
- 126add7 Merge pull request #2069 from Sanchit2662/feat/scan-coverage-not-evaluated
- 5347768 Merge pull request #2070 from Shreya2005-2005/fix/patch-buildchannel-goroutine-leak
- c69b285 Merge pull request #2072 from Shreya2005-2005/fix/findfile-walkfn-error-handling
- 04e9228 Merge pull request #2074 from Varadraj75/test/results-compliance-score-coverage
- c82ca31 Merge pull request #2076 from kimjune01/fix/vulnerability-manifest-uri-parsing
- f44d7ee Merge pull request #2077 from yugal07/2065
- c0788db Merge pull request #2078 from Sanchit2662/fix/bump-k8s-interface-multi-group-clean
- 34bf98b Merge pull request #2079 from Mujib-Ahasan/format-output
- 2b13b27 Merge pull request #2081 from kubescape/dependabot/go_modules/github.com/in-toto/in-toto-golang-0.11.0
- 8243904 Merge pull request #2082 from kubescape/dependabot/go_modules/httphandler/github.com/in-toto/in-toto-golang-0.11.0
- b79ec88 Merge pull request #2085 from Varadraj75/test/compliance-results-comprehensive
- 9f210ac Merge pull request #2088 from Shreya2005-2005/docs/fix-patch-format-flag-description
- 983dfa3 Merge pull request #2090 from jijo-OO7/feat/anonymize-resource-metadata
- 04c6953 Merge pull request #2091 from Shreya2005-2005/feat/junit-skip-message-from-status-info
- 0fdacad Merge pull request #2093 from Shreya2005-2005/fix/list-policy-type-requeued-typo
- 0ac1f21 Merge pull request #2094 from anxovatomica/fix/typo-requeued-required
- 1879192 Merge pull request #2095 from looooown2006/fix/list-policy-type-required-2092
- 658df04 Merge pull request #2098 from Shreya2005-2005/fix/remove-unreachable-args-check-and-fix-typo
- 8c0a6de Merge pull request #2100 from Sanchit2662/feat/fail-coverage-below
- 51a3f0c Merge pull request #2101 from yugal07/fix/junit-output-spec-compliance
- 70f2cd2 Merge pull request #2103 from Ridhi-03Kumari/refactor/replace-context-todo-initutils-test
- 8b91c03 Merge pull request #2105 from Ridhi-03Kumari/refactor/replace-context-todo-downloader
- 9661b0d Merge pull request #2106 from workwithsarang/fix/krew-release-template
- 7669efa Merge pull request #2107 from workwithsarang/fix/junit-skip-message
- e62afd0 Merge pull request #2109 from ThakurUjjwal1706/fix-results-idor-security
- 85dcb5f Merge pull request #2112 from Shreya2005-2005/fix/mcpserver-marshal-error-handling
- e61b7f1 Merge pull request #2114 from Shreya2005-2005/test/anonymizer-packa

Changelog
- 610154a Coderabbit findings
- a70db61 Fix: back-propagate connector URLs to configObj in initializeCloudAPI
- 70f095f Initial plan
- fb367e8 Merge pull request #2021 from manmathbh/feat/vap-timeout
- 48c40f2 Merge pull request #2056 from Ridhi-03Kumari/docs/fix-getting-started-output-formats
- 963ec34 Merge pull request #2060 from yugal07/issue-2059
- d7539c2 Merge pull request #2064 from kubescape/copilot/fix-scan-results-submission
- c8b067c feat(vap): add --timeout flag to deploy-library command
- cfa9161 fix(vap): build MatchLabels from parsed requirements, not raw split
- 00ea5ff fix(vap): create parent directories in writeOutput
- aad2c83 fix(vap): fix K8s name and label selector validation
- 8419ea8 fix(vap): reject DoubleEquals, downstream split on = would break
- dc23f92 fix(vap): restrict label validation to equality selectors only
- 1a618b7 fix(vap): use DNS label validation for namespace names
- cd7ee69 fix(vap): use K8s upstream validation helpers for names and namespaces
- 27fe1fe fix(vap): use k8s labels.Parse for label selector validation
- cfa37ee suppress spurious interrupt signal log on graceful exit
Released by GoReleaser.

Changelog
- e2a8b62 Merge pull request #1960 from kubescape/service-disco
- 4895194 Merge pull request #2018 from sahitya-chandra/fix/portforwarder-trimleft-host
- 3e29e64 Merge pull request #2019 from manmathbh/master
- 7bc1aac Merge pull request #2023 from manmathbh/feat/exception-expiration-filter
- 39b4599 Merge pull request #2029 from Kayd-06/feat/tls-env-vars
- b5977c0 Merge pull request #2031 from Shreya2005-2005/fix/severity-threshold-early-validation
- 6874473 Merge pull request #2032 from Kayd-06/fix/add-warnings-dropped-workloads
- ecaceb5 Merge pull request #2034 from Varadraj75/fix/yaml-parse-fail-open
- 1b65a16 Merge pull request #2036 from sakshar2303/fix/openssf-badge-warnings
- febf84a Merge pull request #2038 from Varadraj75/fix/remove-result-dirs-no-op
- 39746f2 Merge pull request #2040 from Shreya2005-2005/fix/threshold-validation-scan-workload
- 783a9e2 Merge pull request #2042 from manmathbh/feat/control-input-crd
- 336c373 Merge pull request #2044 from Shreya2005-2005/fix/validate-empty-format-flag
- 541abf5 Merge pull request #2046 from Shreya2005-2005/docs/fix-scan-command-long-description
- d3c2638 Merge pull request #2048 from Shreya2005-2005/docs/fix-scan-long-description-targets
- dcc02a5 Merge pull request #2050 from Shreya2005-2005/fix/fix-cmd-directory-error
- 5edaf9c Merge pull request #2054 from Varadraj75/test/opaprocessor-compliance-baseline
- 3b9a221 Merge pull request #2058 from Shreya2005-2005/fix/download-empty-name-validation
- ae3911b feat(httphandler): support TLS key configuration via env vars
- 3925a3e feat(opaprocessor): filter expired exceptions before applying results
- 67b24e9 feat: add ControlInput CRD for in-cluster control configuration
- 50ac127 fix initializeSaaSEnv: restore file fallback, add timeout, degrade gracefully on network errors
- f6708e1 fix(cautils): preserve base path when K8SConfig.Host is a full URL
- 2cc7d0d fix(cautils): use TrimPrefix to strip URL scheme in CreatePortForwarder
- 6db6a8d fix(core): add warning logs for dropped workloads in local file scans
- 292b175 fix(core): reword warning logs for unknown objects and include IDs
- 5d327a7 fix(crdcontrolinputs): remove protobuf content type, probe CRD before selecting
- ebbb4d2 fix(httphandler): add error on partial TLS configuration
- c859dd1 fix(initutils): gate CRD control inputs to live cluster scans only
- 1508f02 fix(scan): gate CRD to live cluster scan mode only
- e82fa81 fix: add early severity-threshold validation in control and framework subcommands
- 23aa401 fix: add early severity-threshold validation in scan workload command
- 19373ba fix: address code review - preserve scanInfo.View and use threshold-only validator
- f5d75ad fix: address error handling warnings for OpenSSF compliance
- 4798644 fix: address review comments on YAML document splitting
- 16676e2 fix: atomically check idle state and delete results under mutex
- ef60fc6 fix: guard delete-all against concurrent scans
- cb98c5e fix: log errors from os.RemoveAll in removeResultDirs
- 8187dd5 fix: only reject empty format when flag is explicitly set
- 2f688ca fix: raise scanner buffer limit and surface scanner errors
- 7ef532e fix: remove out-of-scope ReportID check from fixhandler
- f7ea167 fix: replace byte-split with line scanner for YAML document separation
- fec3f8e fix: replace os.ReadDir with os.RemoveAll in removeResultDirs
- 49fddbb fix: return clear error when directory passed to fix command
- 672dc1a fix: return clear error when wrong JSON structure passed to kubescape fix
- 22c5fec fix: return error when empty name passed to download framework or control
- 96f3195 fix: scope empty-name guard to framework and control targets only
- 28d5512 fix: surface YAML parse errors instead of silently dropping documents
- fd9eae8 fix: use ReportID as sentinel to detect invalid report JSON
- f767270 fix: validate compliance-threshold and fail-threshold in scan and scan workload subcommands
- 621f411 fix: validate empty format flag befor

Changelog
- dd1fba5 fix(opaprocessor): apply namespace filter in failedIDs pre-seed and surface rule eval errors
- 4fa1084 Adding Cloud unavailable message
- a14a698 CodeRabbit Suggestions
- 7b65d41 Fix namespace filter for cluster-scoped resources
- 12251da Initial plan
- 3ce874d Initial plan
- af7c36a Merge branch 'master' into fix/manual-control-exceptions
- 0fabed8 Merge pull request #1979 from raajheshkannaa/fix/ghsa-case-sensitive-exceptions
- 9bf1b3d Merge pull request #1980 from kubescape/fix/ghsa-case-sensitive-exceptions
- dcc1fc8 Merge pull request #1981 from kubescape/dependabot/go_modules/github.com/go-git/go-git/v5-5.18.0
- fa9e34d Merge pull request #1985 from kubescape/copilot/support-kustomize-with-helm
- a59cf0e Merge pull request #1986 from kubescape/copilot/fix-silent-false-negatives
- a50f3b1 Merge pull request #1987 from Sanchit2662/fix/opa-false-negatives-on-eval-error
- f123cad Merge pull request #1990 from kubescape/fix-hostscan
- f9fec96 Merge pull request #1991 from ivaresarthak-cloud/ivaresarthak-cloud-patch-1
- e3b4c92 Merge pull request #1992 from Sanchit2662/fix/opaprocessor-propagate-eval-errors
- 37bcb77 Merge pull request #1993 from kubescape/no-log-bodies
- 4c776b4 Merge pull request #1994 from RohanKaran/fix/manual-control-exceptions
- 27b4175 Merge pull request #1995 from yugal07/cleanup/remove-dead-helm-mapping
- 8b573e6 Merge pull request #1997 from Sanchit2662/fix/surface-partial-resource-collection-errors
- f02dd66 Merge pull request #1999 from pulkitvats2007-crypto/fix-nil-map-panic
- c9ddf92 Merge pull request #2003 from yugal07/fix/airgap-recognize-cloud-describe-unavailable
- 5e3f6c8 Merge pull request #2009 from yugal07/fix/exceptions-json-race
- 53badad Merge pull request #2011 from Sanchit2662/test/partial-resource-collection-errors
- 87e8dcd Merge pull request #2012 from pulkitvats2007-crypto/test-partial-pull-failure
- badfebf Merge pull request #2013 from yugal07/feat/helm-values-overrides-scan
- caa85aa Merge pull request #2015 from Sanchit2662/feat/populate-scan-namespace-metadata
- 6d76df0 Merge pull request #2016 from SAY-5/fix/portforwarder-deadlock-2014
- c36463c Merge pull request #2025 from Kayd-06/fix-repositoryscanner-tests
- 5229b06 Merge pull request #2027 from Varadraj75/fix/copa-patch-goroutine-leak
- f6557a3 Plan for namespace filter fix
- cffe19a Remove accidentally committed test artifact
- 24e2c28 build(deps): Bump github.com/go-git/go-git/v5 from 5.17.1 to 5.18.0
- 6a96b22 chore(deps): bump k8s-interface to v0.0.208 and adopt renamed symbols
- 22c647b chore: plan support for kustomize with helm
- 8d326f2 chore: remove accidental generated test artifact
- 630df67 feat(cautils): populate scanMetadata excluded/include namespaces
- f75fa6b feat(scan): plumb Helm value overrides throug kubescape scan
- 8572a1c feat: Upgrade opa-utils dependency from v0.0.288 to v0.0.293
- d091a24 fix host scans with data retrieved from the CRDs
- e35a504 fix(httphandler): use unique temp file for per-request exceptions
- d70f7b3 fix(httphandler,cautils): clean up exceptions temp file after scan
- c0436de fix(image-scan): normalize vulnerability exceptions across casings
- 40ebc90 fix(opaprocessor): add cluster matching to manual control exceptions
- bbca4d2 fix(opaprocessor): apply exceptions to manual controls in summary
- eefb90e fix(opaprocessor): eliminate false negatives when OPA rule evaluation fails
- c73c6e3 fix(opaprocessor): mark manual controls as passed when exceptions apply
- dfecc50 fix(opaprocessor): propagate OPA eval errors instead of silently dropping resources
- cfbed33 fix(opaprocessor): refine exception matching for manual controls
- a2b03cb fix(opaprocessor): remove redundant string comparison in exception matching
- 9ac82ec fix(opaprocessor): replace processor dependency with explicit control matching
- 2ef9ec3 fix(opaprocessor): simplify applyExceptionsToManualControls signature
- 9fa2daf fix(portforwarder): surface ForwardPorts error and unblock waitForPo

Changelog
- 1d5520f build(deps): update Go version and bump dependencies
Released by GoReleaser.

Changelog
- 5ffa06f Merge pull request #1945 from kubescape/dependabot/go_modules/github.com/go-git/go-git/v5-5.16.5
- 2edf348 Merge pull request #1948 from kubescape/dependabot/go_modules/go.opentelemetry.io/otel/sdk-1.40.0
- b79488d Merge pull request #1949 from Mujib-Ahasan/grype-db-url
- ab97d67 README.md updated
- d989703 build(deps): Bump go.opentelemetry.io/otel/sdk from 1.39.0 to 1.40.0
- eb8dac0 feat: new falg --grype-db-url added to overload the url in kubescape scan command
- d7be453 fix: missing host do not return nil error
- 0372a4f log added in scanImage(): value of scanInfo.ListingURL for reference
Released by GoReleaser.

Changelog
- 93ac65f Merge pull request #1944 from lpmi-13/pass-tag-for-runtime-version
- bb2ef7d Pass tag for the runtime version
- 9aba8e4 build(deps): Bump github.com/go-git/go-git/v5 from 5.16.2 to 5.16.5
Released by GoReleaser.

Changelog
- 9b29321 Enhance version testing in smoke tests to extract and validate output version
- b167435 Merge pull request #1941 from kubescape/semver
- 466a11f fix isRuleKubescapeVersionCompatible bug with version 4.0.0
Released by GoReleaser.

Changelog
- 01bb19b Add krew plugin manifest
- 2759bee Fix broken README anchors
- e0eeb69 Make version smoke test accept bytes and v-prefix
- 222c1ec Merge pull request #1931 from Mujib-Ahasan/readmd-update
- 3b4585a Merge pull request #1932 from kubescape/scan-images
- 427dcca Merge pull request #1934 from kubescape/krew
- 8f009d4 Merge pull request #1935 from kubescape/run_test_from_private_repo
- bd49251 Merge pull request #1936 from kubescape/lint
- c0d4bb4 Merge pull request #1937 from kubescape/dependabot/go_modules/github.com/theupdateframework/go-tuf/v2-2.4.1
- 0841d1d Merge pull request #1939 from kubescape/feat/performance-optimization-phases-1-3
- 25bd51e Replace host sensor with node agent sensing (#1916)
- 7f79bc2 Sort CVEs by severity then ID
- f70d81d add verbose option to scan-images
- dc49218 build(deps): Bump github.com/theupdateframework/go-tuf/v2
- 3623e55 feat: add image column to vulnerability scanning table output
- fbef268 feat: optimize CPU and memory usage for resource-intensive scans
- 57addd4 fix all linter errors
- b97f50f fix version handling and injection
- dc65bd4 force overridden ldflags in goreleaser
- 02790da remove invalid build flag
- 7c0e380 run system test from private repo
- aa9a610 run system test from private repo
- 2f7841b update policy.json testdata
Released by GoReleaser.

What's Changed
- Bump golang.org/x/crypto from 0.41.0 to 0.45.0 in /httphandler by @dependabot[bot] in #1892
- update from Debian 12 to 13 when building container images by @pfarikrispy in #1895
- Revamp documentation by @matthyx in #1897
- always save WorkloadConfigurationScanResultSummaries by @matthyx in #1896
- Bump github.com/cilium/cilium from 1.16.9 to 1.16.17 by @dependabot[bot] in #1898
- Add severity field to controls in JSON output by @Copilot in #1900
- Fix air-gapped mode network access attempts by @Copilot in #1902
- Fix CIS framework metrics not exported to Prometheus /v1/metrics endpoint by @Copilot in #1901
New Contributors
- @pfarikrispy made their first contribution in #1895
- @Copilot made their first contribution in #1900
Full Changelog: v3.0.45...v3.0.46

What's Changed
- Bump github.com/opencontainers/selinux from 1.12.0 to 1.13.0 by @dependabot[bot] in #1890
Full Changelog: v3.0.44...v3.0.45

What's Changed
- Bump github.com/containerd/containerd/v2 from 2.0.5 to 2.0.7 by @dependabot[bot] in #1888
- Bump github.com/containerd/containerd from 1.7.28 to 1.7.29 by @dependabot[bot] in #1889
Full Changelog: v3.0.43...v3.0.44

What's Changed
- Bump github.com/nwaples/rardecode/v2 from 2.1.1 to 2.2.0 by @dependabot[bot] in #1881
- fixed "404" URL issue for command $kubescape scan. by @Mujib-Ahasan in #1884
- host-scanner daemonset installation failure fix by @mandronic in #1886
- fix: --format sarif logs as expected by @Mujib-Ahasan in #1887
New Contributors
- @Mujib-Ahasan made their first contribution in #1884
- @mandronic made their first contribution in #1886
Full Changelog: v3.0.42...v3.0.43

What's Changed
- fix: post release action does not take tag from GITHUB_REF env var by @amirmalka in #1879
- fix: improve error handling in hostscanner pod validation by @matthyx in #1880
Full Changelog: v3.0.41...v3.0.42

What's Changed
- fix post-release workflow by @amirmalka in #1873
- Fixed issue #1800 : Added parameterNotFoundAction in spec.paramRef while creating policy binding by @cx-anjali-deore in #1876
- fix: Don't run scan in installation script by @kkrypt0nn in #1875
- migrate to grype v0.99.1 by @matthyx in #1877
New Contributors
- @kkrypt0nn made their first contribution in #1875
Full Changelog: v3.0.40...v3.0.41

What's Changed
- Bump github.com/ulikunitz/xz from 0.5.12 to 0.5.14 by @dependabot[bot] in #1868
- Issue 1817 fix: Show container name in Assisted remediation by @cx-anjali-deore in #1867
- fix(imagescan): use all targets in exceptions by @htsr in #1869
- replace olekukonko/tablewriter with jedib0t/go-pretty by @matthyx in #1866
- feat: add default matchers option to image scanning by @aadarsh-nagrath in #1857
New Contributors
- @cx-anjali-deore made their first contribution in #1867
- @htsr made their first contribution in #1869
- @aadarsh-nagrath made their first contribution in #1857
Full Changelog: v3.0.39...v3.0.40

What's Changed
- Issue 1284 fix: new approach implemented by @yehudahtor in #1863
- Bump github.com/hashicorp/go-getter from 1.7.8 to 1.7.9 in /httphandler by @dependabot[bot] in #1864
Full Changelog: v3.0.38...v3.0.39

What's Changed
- return error on image when severity threshold exceeded by @matthyx in #1860
- bump helm.sh/helm/v3 to 3.18.5 by @matthyx in #1862
Full Changelog: v3.0.37...v3.0.38

What's Changed
- Fix/update links by @yehudahtor in #1846
- added urls hub.armo --> kubescape.io by @yehudahtor in #1849
- Bump github.com/open-policy-agent/opa from 1.3.0 to 1.4.0 by @dependabot[bot] in #1833
- Bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0 in /httphandler by @dependabot[bot] in #1850
- Bump github.com/cloudflare/circl from 1.5.0 to 1.6.1 by @dependabot[bot] in #1851
- Bump helm.sh/helm/v3 from 3.17.3 to 3.17.4 by @dependabot[bot] in #1852
- Bump github.com/containerd/containerd/v2 from 2.0.4 to 2.0.5 by @dependabot[bot] in #1853
- fix docs URL in tests by @matthyx in #1854
New Contributors
- @yehudahtor made their first contribution in #1846
Full Changelog: v3.0.36...v3.0.37

What's Changed
- check scanInfo.Submit in HandleResults to not submit by default by @matthyx in #1841
- fix: control-plane node taints check by @amirmalka in #1843
- do not fail version if update info cannot be fetched by @matthyx in #1847
- close grype DB at the very end of processing by @matthyx in #1848
Full Changelog: v3.0.35...v3.0.36

What's Changed
- check for nil map in merge methods by @matthyx in #1813
- test: increase test coverage by @pixel365 in #1814
- upgrade open-policy-agent to 1.x by @matthyx in #1820
- merge labels and annotations in RetryOnConflict by @matthyx in #1822
- Bump helm.sh/helm/v3 from 3.14.4 to 3.17.3 by @dependabot in #1824
- Bump golang.org/x/net from 0.37.0 to 0.38.0 by @dependabot in #1829
- fix: Fix stdin restoration in TestUserConfirmed by @shangchengbabaiban in #1827
- Update dir.go by @rash1411 in #1828
- Ensure context cancellation on command execution failure by @pixel365 in #1835
- Make a second sigint terminate kubescape immediately by @ian-fox in #1837
- Feature/mcpserver v1 by @slashben in #1836
New Contributors
- @shangchengbabaiban made their first contribution in #1827
- @rash1411 made their first contribution in #1828
- @ian-fox made their first contribution in #1837
Full Changelog: v3.0.34...v3.0.35

What's Changed
- Bump github.com/golang-jwt/jwt/v5 from 5.2.1 to 5.2.2 by @dependabot in #1812
Full Changelog: v3.0.33...v3.0.34

What's Changed
- Refactor: propagate context from main to avoid redundant context creation by @pixel365 in #1789
- fix: add error handling and context propagation by @pixel365 in #1790
- update prerequisites by @matthyx in #1791
New Contributors
- @pixel365 made their first contribution in #1789
Full Changelog: v3.0.27...v3.0.28

🐞 Fixed issues
- Mask all container data by @dwertent in #1683
- fix yaml handler deleting too many lines during fix by @matthyx in #1685
- Fix scanning unsupported clouds by @dwertent in #1688
Full Changelog: https://github.com/kubescape/kubescape/compare/v3.0.10...v3.0.11