Changelog
- [411b17] Cache compiled CEL programs across scanned objects (#2503)
- [6bbccc] Derive cmd/vap policy metadata from the embedded VAP bundle (#2485)
- [1a6cf8] Embed and load VAP YAML from the vendored bundle (#2474)
- [6cb59a] Expand encryption and decryption coverage for resource metadata (#2442)
- [df44c7] Fix air-gapped mode -- thread explicit offline flag to policy getters instead of relying on nil (#2458)
- [949a56] Fix control-inputs fallback to return real local getter instead of unloaded store (#2515)
- [e4ab62] Fix local control cache (#2463)
- [3c4b05] Fix/helm templates plain yaml warnings (#2509)
- [efb658] Vendor the CEL admission policy bundle (#2455)
- [7dbe43] [ LFX 2026] feat(exceptions): honor objectSelector.matchExpressions via PostureExceptionPolicy.ObjectSelector (#2480)
- [8a2e1a] [Fix] : severity-based image exceptions in JSON, SARIF, and patch output -- use filtered Matches instead of RemainingMatches (#2522)
- [5afd77] add unit tests for GetPreReqCmd and kubeconfig flag (#2486)
- [21e2db] core: Add test coverage for Kubescape.Diff pretty-printer output path (#2467)
- [55df2b] docs(cli): document report protection workflow (#2508)
- [ef6574] docs(cli): improve report protection help and examples (#2510)
- [80191c] feat(anonymizer): support reversible container metadata transformation (#2473)
- [3f29f0] feat(mcp): Add headless OPAProcessor for low-latency Network Policy s… (#2512)
- [062d9c] feat(mcp): implement headless OPAProcessor rbac scanner (#2492)
- [f68fdc] feat(operator): add quarantine action to remediate CLI subcommand (#2461)
- [29928b] feat(patch): add support for OCI and Local exports (#2471)
- [79ae44] feat(printer): add GitLab SAST report output format (#2505)
- [df6830] feat(reportcrypto): add decryption support for encrypted resource metadata (#2493)
- [b83028] feat: add container profile tools and resources to MCP server (#2479)
- [575741] feat: implement AWS ECR vulnerability adaptor (#2488)
- [20b5a8] feat: introduce Container Image Vulnerability (CIV) Adaptor interfaces (#2482)
- [9ea839] feat: run CEL controls as part of the scan (#2525)
- [f7e805] fix(httphandler): add missing panic recovery to Metrics handler (#2465)
- [05e3cc] fix(httphandler): decouple prometheus metrics scan from request context (#2451)
- [8d5d0d] fix(httphandler): populate report in synchronous scan response (#2483)
- [4d80ab] fix(imagescan): preserve matches on metadata lookup errors (#2519)
- [5b9306] fix(mcp): add double-checked mutex locking to k8sClient lazy init (#2506)
- [0b3d0f] fix(printer): don't append .txt to /dev/null in PrettyPrinter.SetWriter (#2502)
- [6ba3a1] fix(sarif): don't os.Exit on unencodable fix, avoid empty SARIF file (#2499)
- [ef6b60] fix(sarif): surface PrettyWrite errors instead of silently writing empty file (#2497)
- [8fb2eb] fix(scan): don't let --exceptions/--controls-config/--attack-tracks trigger air-gapped mode (#2532)
- [497f08] fix(scan): restore root PersistentPreRun for kubescape scan invocations (#2530)
- [2adea9] fix(vap): deploy-library serves the embedded bundle, downloads only via --from-release (#2507) (#2514)
- [82dd34] fix: preserve explicit exceptions/inputs with use-artifacts-from (#2490)
- [81617e] fix: support namespace/kind/name workload format (#2459) (#2460)
- [85933c] rbac file todo to check api version is resolved (#2523)
- [5bffdd] refactor: decompose monolithic Results API handler (#2477)
- [11a05e] test(core): cover Kubescape.Download unknown-target error path (#2468)
Released by GoReleaser.