Changelog
- [960d6c] chore(crd): remove orphan, uninstallable SecurityException CRD and its test (#2403)
- [778ec1] feat(operator): add
operator remediateCLI subcommand (annotate + dry-run) (#2448) - [7542e4] fix(httphandler): surface async scan failures via Results endpoint (#2339)
- [bef62c] Add CEL env builder for the VAP engine (#2416)
- [d31fc8] Add CEL evaluator (#2443)
- [695c8d] Add encryption transformer integration tests (#2351)
- [932cd5] Add offline request stub for the CEL engine (#2439)
- [820fa3] Docs: add circleci integration guide (#2385)
- [34f531] Emit security-severity on SARIF rules (#2398)
- [191798] Fail closed on repo metadata transformation errors (#2353)
- [ffc7f9] Fix nil pointer panic on image scan when ScanData is nil (#2431)
- [6a44d6] Fix panic parsing image names without an organization (#2397)
- [80fa30] Fix relative path and Name typo (#2343)
- [add18b] Integrate report encryption metadata and DEK wrapping into anonymization workflow (#2380)
- [ccadbb] Set HTTP timeouts on the scan listener server (#2396)
- [f8ae04] [ LFX 2026 ] Fixes bugs found before implementation of LFX 1982 (#2366)
- [f2e42c] [feat] : add scan coverage score to measure and report scan co… (#2410)
- [554dd6] [fix] : Fall back to bundled defaults and surface degradation when control-inputs fetch fails (#2395)
- [cd5dba] anonymizer: hide service account names in pod specs (#2333)
- [865b03] backend: imagescan: add missing unit tests for getMatchers and newScanServiceIntegration (#2427)
- [e4a8f7] backend: ksinit: add success case for CreateKsObjectConnection (#2429)
- [f69c88] chore: modernize codebase to Go 1.26 (#2415)
- [f95650] feat(httphandler): add SSRF-hardened scan-completion webhook callback (#2447)
- [1f2e83] feat(opaprocessor): add per-control evaluation timeout (#2375)
- [fed74d] feat(opaprocessor): wire CEL language dispatch with stub evaluator (#2405)
- [827497] feat(report): add encrypted report decryption (#2425)
- [494b0e] feat(reportcrypto): decrypt resource source metadata in reports (#2440)
- [273a92] feat: add SLSA build provenance attestation to release workflow (#2346)
- [1c7e2e] feat: add encrypted repo metadata workflow (#2365)
- [38bb51] fix(anonymizer): detect separator-less sensitive env variable names t… (#2367)
- [b66104] fix(coverage) : penalise silent failed GVR pulls in coverage score (#2420)
- [cc88b0] fix(diff): move --fail-on-new exit to cmd layer so output writer is closed (#2434)
- [bf4f79] fix(diff): validate format input and clean up status handling (#2438)
- [8c2443] fix(hostsensorutils): normalize infoMap keys using ResourceGroupToString (#2360)
- [9baa4e] fix(httphandler): add panic recovery to scan execution goroutine (#2352)
- [ee4a4b] fix(httphandler): log persistence failure as warning, return valid result (#2342)
- [ab5d74] fix(list): emit JSON objects for list controls --format json (#2401)
- [ddc278] fix(offline): dynamically populate allcontrols framework and fix loadpolicy search (#2338)
- [6349ae] fix(opa): fail fast on cancelled cosign verification contexts (#2368)
- [741b24] fix(opaprocessor) : discard partial results from timed-out controls (#2404)
- [d6bdc2] fix(opaprocessor): count timed-out controls as 0 in compliance score (#2424)
- [8af7c8] fix(opaprocessor): stop processing after context cancellation (#2386)
- [7f13c3] fix(portforwarder): avoid blocking on repeated stop signals (#2381)
- [e23bdb] fix(resourcehandler): dedup resources found by different providers (#2336)
- [f91a79] fix(resourcehandler): fail fast on cancelled contexts after resource pulls (#2372)
- [1f7cb7] fix(resourcehandler): merge host-sensor infoMap instead of replacing it (#2349)
- [fb151f] fix(resourcehandler): trim spaces from namespaces in field selectors (#2382)
- [c9ff48] fix(sarif): resolve correct line numbers for absolute-path file scans (#2406)
- [387537] fix(scan): reject invalid format values before scanning (#2370)
- [c6781c] fix(storage): skip orphaned RoleBinding instead of aborting scan persistence (#2392)
- [3d6a65] fix(vap): add missing C-0199, C-0200, C-0201 to control ID map (#2371)
- [f0f07b] fix(vap): require params for configurable controls (#2334)
- [55fb13] fix: anonymize LocalRootPath in hidden report output (#2344)
- [a60d9b] fix: prevent silent output overwrite when multiple formats share one path (#2414)
- [7dd401] fix: read severity from summaryDetails instead of missing controls field (#2412)
- [c2e612] fix: restrict config.json permissions to owner-only (#2340)
- [96a764] fix: return clear error when wrong JSON structure passed to kubescape fix (#2358)
- [bb5a7a] fix: return error when related RBAC objects share the same category (#2422)
- [d577fc] fix: typos in core and cmd directories (#2356)
- [93bacb] fix: use filepath.Join instead of path.Join for filesystem paths (#2407)
- [c53c8c] refactor: eliminate package-level mutable state in workload command (#2379)
- [674b5f] refactor: introduce transformer abstraction for repo metadata (#2347)
- [c07092] refactor: upgrade to standard error wrapping (%w) in MCP server (#2377)
- [1ca0da] reportcrypto: add DEK wrapping support (#2374)
- [72d0bc] test(opaprocessor): improve temporary resource cleanup (#2388)
Released by GoReleaser.