Kubescape Files

Changelog

• [6849ab] Cel engine docs (#2756)
• [0b25d7] Guard against unresolvable group/version in resource handler (#2609)
• [68b6a7] Increase test coverage for GetWriter and LogOutputFile functions (#2586)
• [2a2253] Propagate printer and command errors (#2908)
• [9e9884] Recover from panics in readJsonFile (#2604)
• [95a70f] Refactor: remove Getters and PolicyIdentifier from ScanInfo (#2768)
• [e79237] Refactor: use distribution/reference for image parsing (#2776)
• [61a805] Remove Helm binary dependency from kustomize tests (#2926)
• [2763c2] Remove stale "Add score" TODO from processorhandlerutils.go (#2924)
• [957998] Removed dead code in urlloader and urlloader_test and add some test c… (#2590)
• [4cc055] Security/batch dependency fixes 2 (#2897)
• [5b4f1a] Support scoped registry auth for image scans (#2696)
• [2088a8] Test case added for validation (#2585)
• [fad6e6] Unify scan stdin input handling (#2875)
• [dd9850] [fix] : non-deterministic namespace bucketing caused by mid-scan resource count mutation (#2587)
• [6561a4] [fix] : streaming collector dropping host-sensor fallback, silently passing controls it never evaluated (#2797)
• [1abd9d] anonymizer: pin and document the intentional cross-prefix hash-suffix sharing (was: hash prefix+value) (#2687)
• [6bab3d] cautils: test: cover test for readYamlFile and readJsonFile (#2526)
• [1b93a7] chore(ci): update pinned GitHub Actions off deprecated Node 20 releases (#2973)
• [d23abb] chore(deps): tidy go.mod for backoff import (#3022)
• [bb83cd] chore(printer): remove the unused v1 PrometheusPrinter (#2985)
• [a6a089] chore: evaluate rego with RegoV1 (drop v0 compat shim) (#2359)
• [ca0d57] chore: remove dead Float16ToInt function (#2643)
• [4a1d82] chore: remove dead code loadConfigFromData (#2948)
• [4363b2] chore: remove deprecated SA2WLIDmap from RBAC utils (#2957)
• [64915f] chore: remove orphaned firstNonEmpty doc comment (#2945)
• [bbf918] ci: run unit tests on every PR, not just tag pushes (#2606)
• [2e0d1a] enhancement: propagate context.Context in getter interfaces (#2775)
• [39752e] feat : add DELETE /v1/scan to cancel an in-flight scan (#2562)
• [9a9190] feat(cautils): add ParseDurationEnvVar (#2779)
• [b3192b] feat(context): propagate context through tenant config initialization and Kubernetes API calls (#2739)
• [881ba3] feat(core): implement concurrent and deduplicated image scan pipeline (KS-ADV-02) (#2759)
• [b3f154] feat(csv): add remediation path evidence columns to CSV scan output (#2900)
• [77aca1] feat(exceptions): prefer cloud exceptions over CRD (#2317)
• [5c6fb2] feat(hostsensor): optimize query with paging, rate limits, and cache (#2864)
• [53899b] feat(html): show current field values in evidence paths (#3032)
• [5bdca1] feat(imagescan): support scanning local offline tarball images (#2995)
• [29aefd] feat(mcp): add headless framework security scanner tool (#2528)
• [1d2709] feat(mcp): add local IaC scanner tool (#2545)
• [b5bf09] feat(mcpserver): add scan_container_image tool for on-demand vulnerability scanning (KS-INT-03) (#2708)
• [dbd32e] feat(patch): support all image scan output formats (#2910)
• [cbf381] feat(printer): add markdown output format (#3025)
• [de8d7a] feat(printer): surface current field value alongside failed paths in scan output (#2882)
• [531ab6] feat(resourcesprioritization): support configurable workload kinds and dynamic pod template spec detection (#2720)
• [eed57f] feat(scan): add --api-version flag to workload scan command (#2829)
• [1201b1] feat(scan): add --label-selector flag to filter collected resources (#2830)
• [051352] feat(scan): support parsing apiVersion in workload identifier (#2581)
• [830ede] feat(streaming): Add resource streaming for large clusters to reduce memory usage (#2645)
• [122514] feat(version): add --output json flag (#2793)
• [0a8dac] feat: Automated In-Cluster Private Registry Credential Resolver (#2832)
• [164d22] feat: add --only-fixable flag to gate scan image severity threshold on fix availability (#2891)
• [8a4912] feat: add Azure AKS support to ListEntitiesForPolicies resource mapping (#3012)
• [9c9c83] feat: add CSV output format printer for scan results (#2743)
• [9b69c8] feat: add YAML output format to kubescape list (#2852)
• [03d0f7] feat: add configurable config view output formats (#2987)
• [64b54e] feat: add csv output for list command (#2989)
• [143187] feat: add fallback support for OpenShift external registry routes (#2576)
• [f73b3a] feat: give CEL findings the remediation paths their Rego equivalents carry (#2533)
• [2121da] feat: implement Runtime Profile Drift Detection and Remediation (KS-ADV-01) (#2803)
• [c22523] feat: introduce Container Image Vulnerability (CIV) Adaptor for Azure Container Registry (#2778)
• [d5cd5e] feat: introduce native GCP Artifact Registry vulnerability adaptor (Phase 2) (#2801)
• [cc8308] feat: scan kubernetes_manifest resources in Terraform files (#2947)
• [b1071c] feat: scan typed kubernetes_* resources in Terraform files (#719) (#3019)
• [d3e90b] feat: spend one CEL cost budget per policy the way admission does (#2560)
• [053ca1] feat: support all output formats for image scans (#2786)
• [f6ff89] feat: support yaml as an output format (#2625)
• [9387a7] fix(anonymizer): replace broken type assertions with IWorkload-based container deserialization (#2991)
• [5afb9c] fix(cache): publish policy files atomically (#2878)
• [2ff422] fix(cautils): add warning log for invalid useUntilKubescapeVersion semver (#2703)
• [715efa] fix(cautils): avoid standalone renders of owned Helm dependencies (#2849)
• [3cb0df] fix(cautils): clone trailing remote inputs for local-first scans (#2933)
• [a10dce] fix(cautils): expand offline Kubernetes list envelopes (#2820)
• [595134] fix(cautils): propagate marshal error in updateConfigFile (#2766)
• [88d24b] fix(cautils): record individual formats in scan metadata (#2932)
• [4f4a86] fix(cautils): remove dead nil-check in setHeaders (#2682)
• [dfc838] fix(cautils): report the bound port from GetPortForwardLocalhost (#2761)
• [a48e3f] fix(cautils): resolve git metadata when scanning from a linked worktree (#2721)
• [b9c2fc] fix(cautils): return error when worktree root cannot be resolved in NewLocalGitRepository (#2651)
• [0ee5c1] fix(cautils): return non-NotFound errors from legacy ConfigMap lookup (#3018)
• [8f5407] fix(cautils): sort copies in StringSlicesAreEqual to avoid mutating caller slices (#2750)
• [b45925] fix(cautils): stop LocalGitRepository exposing a nil-embedded panic to callers (#2722)
• [cbc5d2] fix(cautils): stop Policies.Set from mutating the caller's frameworks slice (#2681)
• [0f7e72] fix(cautils): stop ReportV2ToV1 from mutating the caller's shared resources (#2837)
• [9f55d1] fix(cautils): stop conflating insecureSkipTLS with plainHTTP in helm registry client (#2690)
• [45362e] fix(cautils): synchronize access to global KSCloudAPIConnector to resolve data race (#2767)
• [fab61c] fix(cautils): use filesystem check instead of .json string heuristic in setUseArtifactsFrom (#3009)
• [529e87] fix(cel): guard optional field paths so valid workloads are evaluated, not skipped (#2535)
• [111444] fix(cel): resolve namespaceObject from collected namespaces and honor admission scoping offline (#2713)
• [b72199] fix(cel): select remediation paths by workload kind (#2564)
• [9a26b8] fix(cel): use messageExpression for CEL message bodies, verify bundleControlIDs both ways (#2610)
• [884cd0] fix(cmd): close temporary file handle after streaming stdin in scan commands (#2799)
• [247caf] fix(config): preserve higher-priority tenant settings (#2876)
• [293140] fix(core): add timeout to HTTP client in OperatorAdapter to prevent connection hang (#2827)
• [af7bf7] fix(core): align scan attribution with explicit kubeconfig (#2841)
• [032455] fix(core): allow operator scan with multiple app=operator pods (#2593)
• [1bd379] fix(core): cancel streaming producer context on early evaluation error (#2814) (#2815)
• [fa48ee] fix(core): correct grammar in download empty-response errors (#2642)
• [2816cd] fix(core): correct unknown command error message in List() (#2621)
• [aa46ae] fix(core): detect multipart SBOM output collisions (#2930)
• [10e16a] fix(core): download --output bare .json path no longer falls back to ~/.kubescape (#2818)
• [1cf701] fix(core): escape inner quotes in FixPathToValidYamlExpression string values (#2670)
• [0408fe] fix(core): expand ScanAll frameworks before resolving cache paths (#2792)
• [8db604] fix(core): ignore unusable image pull secret credentials (#2927)
• [8b973a] fix(core): limit ScanAll expansion to framework scans and dedupe UseFrom (#2795)
• [f21246] fix(core): log swallowed errors when loading cached/cluster config (#2736)
• [06aec0] fix(core): make ProgressHandler.Stop() complete the progress bar (#2738)
• [1be5e2] fix(core): parse digest-pinned image references correctly for exceptions (#2686)
• [a102e7] fix(core): preserve non-zero risk score rounding in HTML report (#2727) (#2733)
• [1e24a1] fix(core): prevent sub-100 compliance scores formatting as 100.00 (#2728) (#2740)
• [414fce] fix(core): recurse convertYamlToJson into map[string]any values (#2834)
• [4df639] fix(core): remove racy re-check of global cluster connection state (#2617)
• [0e6ea5] fix(core): reset HostSensorEnabled when explicit host scanner fails to init (#2819)
• [ebb29b] fix(core): return cluster connection failures from Scan instead of terminating (#2788)
• [5011ad] fix(core): return error when io.ReadAll fails in NewFixHandler (#2706)
• [0767f5] fix(core): shut down the exception event broadcaster after each scan (#2762)
• [2cda81] fix(core): skip image scanner initialization when no images (#2845)
• [e8b95c] fix(core): stop nilling global os.Stdout/os.Stderr during copa patch (#2638)
• [6aea45] fix(core): stop port-forward when startup fails to avoid goroutine leak (#2835)
• [d9061d] fix(core): treat closed/non-interactive stdin as refusal in userConfirmed to prevent CPU spin (#2712)
• [d07136] fix(core): use restrictive permissions for created output directories (#2648)
• [40cdc5] fix(core): wire --address flag into buildkit client options for patch (#2735)
• [9b1011] fix(coverage): sort partial GVR pull diagnostics (#2934)
• [982d37] fix(csv): guarantee a flush attempt on every ActionPrint exit path (#2981)
• [f4a102] fix(diff): reject invalid scan reports (#2877)
• [b069df] fix(diff): sort ChangeSet buckets so diff output is reproducible (#2734)
• [89e13e] fix(downloader): add 10-minute timeout to background context to prevent hangs (#3014)
• [f16991] fix(downloader): add bounded retry with backoff for artifact downloads (#3016)
• [bb653f] fix(downloader): aggregate errors in download loop to catch swallowed failures (#3011)
• [2f506d] fix(downloader): exit non-zero on download failures (#2969)
• [f73750] fix(downloader): exit non-zero when an artifact download fails (#2918)
• [c83e43] fix(fixhandler): guard nil resource lookup and off-by-one slice bound (#2597)
• [8ceb00] fix(fixhandler): preserve accepted base path spelling (#2678)
• [ba2537] fix(fixhandler): prevent path traversal when resolving resource paths (#2637)
• [4de213] fix(fixhandler): quote NaN and Inf fix values so yq expressions parse (#2714)
• [adcce9] fix(fixhandler): skip document node when resolving a line to replace (#2896)
• [9eb525] fix(git): make remote workspaces concurrency safe (#2548)
• [cfea0f] fix(git): support detached HEAD repository metadata (#2567)
• [7f266c] fix(hostsensor): avoid mutating shared Kubernetes config (#2938)
• [354d69] fix(hostsensor): key cache by cluster identity and gate it behind opt-in TTL (#2914)
• [9d6122] fix(http): bound scan admission and request bodies (#2547)
• [f57642] fix(httphandler): advertise Allow: GET on Metrics 405 response (#2647)
• [fcc38a] fix(httphandler): harden metrics query handling (#2635)
• [63c1e5] fix(httphandler): make pprof debug server opt-in and loopback-only (#2639)
• [7fbd47] fix(httphandler): preserve non-JSON HTTP scan results (#2936)
• [a1dd01] fix(httphandler): retain scan ID in synchronous responses (#2931)
• [193352] fix(httphandler): stop sending wrong HTTP status from Status handler (#2649)
• [ccfdcf] fix(imagescan): close the previous gRPC client on repeated GCP Login calls (#2982)
• [f0af65] fix(imagescan): prevent gRPC connection leak in GCP adaptor (#2954)
• [7ab5cd] fix(imagescan): properly reject unsupported token credentials in cloud adaptors (#2943)
• [a7105f] fix(imagescan): scope pull secrets to cluster scans (#2964)
• [1c848e] fix(imagescan): standardize partial-failure handling across cloud adaptors (#2941)
• [2de921] fix(imagescan): support enhanced ECR scan findings (#2966)
• [5a1933] fix(junit): report compliance scores in test suites (#2565)
• [893152] fix(listener): fail fast when server port is busy (#2636)
• [68baa8] fix(locationresolver): add context to yaml evaluation errors (#2615)
• [f8e152] fix(locationresolver): guard nil candidateNodes.Back() (#2583)
• [2b37fa] fix(locationresolver): split fix paths on the first '=' rather than the last (#2850)
• [9be4cf] fix(mcp): graceful error handling for legacy MCP tools (#2748)
• [0b285e] fix(mcpserver): handle malformed tool arguments safely (#2566)
• [ba0ef2] fix(mcpserver): reject empty resource URI segments (#2616)
• [a2cad4] fix(mcpserver): retry client init instead of caching first error (#2629)
• [e5fde5] fix(opaprocessor): keep resource snapshot stable during rules (#2667)
• [dd5c4a] fix(opaprocessor): register OPA builtins once per process, not once per scan (#2624)
• [7c2f0b] fix(opaprocessor): resolve namespaceObject for CEL admission evaluation (#2603)
• [2ed133] fix(opaprocessor): scrub stringData field in Secret resources (#2757)
• [5bb04b] fix(operator): make GetRequestPayload side-effect-free, default --frameworks to all at the flag (#3006)
• [2e1677] fix(operator): propagate --namespace flag to scan subcommands- [#2] (#2591)
• [ed8a7b] fix(operator): resolve cluster name after context selection (#2939)
• [d5f104] fix(operator): scope examples to the scan subcommand (#2915)
• [7eb555] fix(output): drop truncated image label from scan hints (#2568)
• [bfd14e] fix(patch): surface package install failures instead of exporting an empty image (#2574)
• [3b0df5] fix(paths): anchor reported paths to the git root when git metadata is unusable (#2600)
• [ffbdcb] fix(policyhandler): bound registry growth with idle eviction (#2909)
• [d5d0fb] fix(policyhandler): reset the PolicyHandler singleton when clusterName changes (#2742)
• [70465c] fix(prerequisites): exit non-zero when cluster data collection fails (#2997)
• [3b79e4] fix(printer): avoid perfect score rounding (#2665)
• [1852bd] fix(printer): clean temp dir in fallback tests (#2634)
• [d63fe8] fix(printer): handle GetContainers errors when resolving container names (#2539)
• [a70e74] fix(printer): keep PDF footnote markers consistent between table and legend (#3004)
• [4b2af0] fix(printer): keep yaml compliance score below perfect (#2726)
• [8145c4] fix(printer): label the report with the context the scan actually used (#2898)
• [948098] fix(printer): parse SARIF doc index on the last colon, not the second field (#2685)
• [7f7a83] fix(printer): prevent nil-pointer panics and report truncation when resources are missing (#2700)
• [70c147] fix(printer): prevent silent data loss on CSV write errors (#2959)
• [90041c] fix(printer): separate name and version in package score map key (#2692)
• [5f14bb] fix(printer): write leading newline to the configured output writer (#2595)
• [3a20a2] fix(prometheus): group metric samples by family in the exposition output (#3021)
• [ad8ed8] fix(prometheus): report compliance scores in gauges (#2580)
• [661a00] fix(reportcrypto): stop rewriting plaintext values during decryption (#2998)
• [3ce2e7] fix(resourcehandler): check HTTP status code in httpGet (dead-code hardening) (#2674)
• [fa6daa] fix(resourcehandler): classify missing LIST resources using typed Kubernetes errors (#2903)
• [a9b8ee] fix(resourcehandler): count returned items in cluster size estimate (#2886)
• [e55c8c] fix(resourcehandler): discover nested Kustomize directories in broad scans (#2888)
• [fba88c] fix(resourcehandler): honor discovered scope when streaming resources (#2821)
• [5c11f2] fix(resourcehandler): let Kustomize own referenced Helm charts (#2855)
• [cf467d] fix(resourcehandler): log warnings on directory discovery errors in LoadResourcesFromNestedKustomizeDirectories (#2906)
• [fbe6a0] fix(resourcehandler): propagate file stream cancellation (#2935)
• [080d7e] fix(resourcehandler): propagate streaming LIST failures (#2771)
• [6fa40d] fix(resourcehandler): render nested Kustomize configurations (#2860)
• [935fd0] fix(resourcehandler): repair NewOPASessionObj call broken by merge (#2783)
• [67644b] fix(resourcehandler): resolve offline resources from manifests (#2752)
• [c94cf6] fix(resourcehandler): scan Agent Sandbox and Substrate CRDs consistently (#2618)
• [1dd1a1] fix(results): preserve enrichment in programmatic and HTTP output (#2862)
• [caf9bf] fix(resultshandling): handle unscored score sentinel in summary table compliance column (#2791)
• [675fa7] fix(resultshandling): make finalized report ordering deterministic (#2773)
• [421a3a] fix(sarif): avoid image output stdout deadlock (#2967)
• [1e6f19] fix(sarif): guard delta walk against out-of-range line and segment indexes (#2865)
• [82fd59] fix(sarif): render and patch image scan SARIF in memory instead of reopening the writer (#2984)
• [a4d84f] fix(sarif): use rune count for multi-byte line length in fix regions (#2552)
• [a01225] fix(scan): accept local inputs for workload scans (#2746)
• [a3b91f] fix(scan): dynamically build supported formats error message (#2870)
• [2d455b] fix(scan): enforce image thresholds in explicit subcommands (#2929)
• [8ff9e3] fix(scan): honor only-fixable in combined image scans (#2928)
• [70e1b1] fix(scan): remove unreachable code branch in scan command RunE (#3040)
• [37c6a9] fix(scan): return errors instead of using logger.Fatal (#2857)
• [c9f1b7] fix(scan): surface manifest loading failures (#2546)
• [faaa41] fix(scan): validate threshold ranges in scan control command (#2916)
• [d0b6c8] fix(shared): prioritize auth conflict error over missing password (#3042)
• [d4c60d] fix(storage): propagate workload scan update errors (#2937)
• [adf94a] fix(streaming): initialize cluster metadata before policy planning (#2956)
• [f53ed2] fix(streaming): restore host-sensor InfoMap and namespace resource counting in streaming collector (#2808) (#2809)
• [72bf96] fix(tableprinter): truncate control/resource names on a rune boundary (#2676)
• [04b0dc] fix(vap): bound deploy-library downloads with a default timeout (#3001)
• [2ee6fa] fix: (#2631)
• [4badc2] fix: add epsilon tolerance to Float32ToIntFloor for float32 precision loss (#2669)
• [816cd7] fix: change break to continue in helm workloads loader (#2605)
• [ec9397] fix: correct grammar in download empty-response errors (#2644)
• [66d031] fix: correct typos in variable names and filenames (#2744)
• [871dbd] fix: count returned items in cluster-size estimates (#2847)
• [16cc4e] fix: don't crash or auto-submit when no backend is configured (#2556)
• [f9fa23] fix: enforce image severity threshold on combined scans (#2894)
• [2f4ee3] fix: include initContainers and ephemeralContainers in image scan (#2979) (#2980)
• [1f020a] fix: mark CRD-only controls not evaluated after partial discovery failure (#2839)
• [6153bb] fix: populate ClusterName in JSON reports (#2866)
• [4c0cf7] fix: register deprecated flags to prevent unknown flag errors (#2868)
• [d21b1f] fix: remove double space in download control error message (#2664)
• [82a6d2] fix: replace control merge loops with assignment to clear stale controls (#3049) (#3051)
• [699e25] fix: resolve CRD exception deduplication dropping non-overlapping policies (#2805)
• [b786bf] fix: resolve HTTPPost connection leak on error by draining response body (#2807)
• [20f0e6] fix: resolve data race in display spinner (#2975) (#2978)
• [6730f7] fix: resolve review feedback for CycloneDX/SPDX SBOM output formats (#2883)
• [95c2e8] fix: return error when control inputs are nil or empty (#2601)
• [87824e] fix: return values for IKubescape List and Download (#2794)
• [f15bf0] fix: use %w for standard error wrapping (#2823)
• [feb530] fix: wrap DEK error, enforce image severity thresholds, and refactor error formats (#2902)
• [2f0d55] perf(opaprocessor): index a scope's resources once instead of per rule (#2976)
• [08b8bd] perf(sarif): cache per-file work when collecting fixes and locations (#2921)
• [191d3d] refactor(cautils): simplify StringSlicesAreEqual and assert its result in the non-mutation test (#2755)
• [95055a] refactor(core): expose cluster connection failure as a sentinel error (#2810)
• [15896c] refactor(core): simplify grouping logic and add test coverage (#2679)
• [d5318c] refactor(policyhandler): make PolicyHandler stateless per request to eliminate scanMu blocking (#2899)
• [0ec303] refactor(resourcehandler): use canonical path containment for kustomize exclusion (#2907)
• [814a2b] refactor(scan): deduplicate flag validation boilerplate (#3047)
• [176fd4] refactor(scan): remove deprecated flags and update documentation (#2608)
• [4faa7d] refactor: remove dead count variable and simplify insertControls (#2753)
• [469969] remove duplicate tests
• [3b1ba0] remove unused PostRun hook from scan command (#2661)
• [1afd53] security: batch dependency vulnerability fixes (Batch 1 + 2) (#2895)
• [c61755] test(cautils): cover tenant configuration lifecycle (#2550)
• [5b6bf8] test(cautils): fix path-quoting and permission-bit assumptions on Windows (#2952)
• [658f1b] test(cautils): remove Helm binary dependency in kustomize tests (#2983)
• [9a4783] test(cautils): resolve symlinks on temp dirs used as expected paths (#2977)
• [332915] test(cautils): use t.Setenv so env vars are restored between runs (#2785)
• [02f71f] test(core): cover Fix() orchestration end to end (#2614)
• [e8f6bc] test(core): cover NewOperatorAdapter, httpPostOperatorScanRequest, OperatorScan (#2613)
• [a0a1ac] test(core): expand image patch helper coverage (#2543)
• [32f789] test(hostsensorutils): cover CRD resource collection and CollectResources (#2588)
• [1bfc94] test(junit): add integration test for compliance score through ActionPrint (#2572)
• [978017] test(mcpserver): cover tool and resource dispatch (#2541)
• [441660] test(printer): add coverage for JSON printer v1 ActionPrint, Score, CloseWriter (#2558)
• [950c5d] test(printer): cover pretty-printer behavior (#2549)
• [aafee2] test(printer): keep pretty writer outputs in tempdir (#2718)
• [e9f11a] test(reportcrypto): cover container metadata decryption (#2542)
• [dc6ac2] test(resourcehandler): cover Kubernetes resource lookup (#2551)
• [795f86] test(scan): explicitly test file-path without chart-path (#3044)
• [c9372e] test-core-download-coverage (#2571)
• [99a66c] test-httphandler-listener-setup-coverage (#2570)

Released by GoReleaser.