Kubescape Files

Changelog

• [5a9d63] Feat/mcp apply remediation report items from posture reports (#4163)
• [bed990] Fix/cel variable cycle detection (#4315)
• [94760f] Fix/rbacgraph workload controller serviceaccount (#4181)
• [233a5c] Fix/runtime profile drift safety (#4169)
• [6acf0b] Fix/scan reject include and exclude namespaces (#4194)
• [299710] Test/cel upstream parity timestamp (#4314)
• [4f0d4f] chore(deps): bump github.com/kubescape/backend to v0.0.53 (#4259)
• [0fc78a] chore(docs): remove unused CLI color screenshots (#4338)
• [849fe5] chore: remove unused policy color screenshots (#4380)
• [16e066] ci: bump actions/create-github-app-token from 3.2.0 to 3.3.0 (#4250)
• [a14b41] ci: bump actions/setup-python from 7.0.0 to 7.1.0 (#4367)
• [69d36e] ci: bump docker/login-action from 4.6.0 to 4.7.0 (#4368)
• [357ad4] ci: bump github.com/Azure/azure-sdk-for-go/sdk/azidentity (#4247)
• [d1a382] ci: bump github.com/aws/aws-sdk-go-v2/config from 1.32.39 to 1.33.9 (#4252)
• [fee57e] ci: bump github.com/bmatcuk/doublestar/v4 from 4.10.0 to 4.10.3 (#4366)
• [66be9e] ci: bump github.com/go-chi/chi/v5 from 5.3.0 to 5.4.0 (#4401)
• [121f9d] ci: bump github.com/go-git/go-git/v5 from 5.19.2 to 5.19.3 (#4246)
• [3a2bd4] ci: bump github.com/go-openapi/runtime from 0.33.2 to 0.33.3 (#4253)
• [ad4b83] ci: bump github.com/santhosh-tekuri/jsonschema/v6 from 6.0.2 to 6.0.3 (#4364)
• [abb1dc] ci: bump github/codeql-action/upload-sarif from 4.38.3 to 4.39.0 (#4251)
• [577a5a] ci: bump github/codeql-action/upload-sarif from 4.39.0 to 4.39.1 (#4369)
• [e394b2] ci: bump goreleaser/goreleaser-action from 7.2.3 to 7.3.0 (#4249)
• [27c575] ci: bump ossf/scorecard-action from 2.4.4 to 2.5.0 (#4248)
• [6f531e] docs(mcp): remove documentation for the deleted scan_container_image tool (#4159)
• [f3baa4] feat(attackpath): Phase 1 – shared input adapter and resolvers (no CLI changes) (#3944)
• [57b15b] feat(clustercomponents): build a normalized inventory of cluster components (#4216)
• [4319ba] feat(diff): add semantic ANSI color highlights to image vulnerability diff output (#4376)
• [8ade5f] feat(diff): add semantic ANSI colors to human-readable output (#4310)
• [d5e055] feat(exposure): evaluate Gateway API ReferenceGrants for cross-namespace backends (#4217)
• [fb0cc2] feat(fix): add Helm --output-post-renderer and harden overlay staging & boundaries (#4393)
• [404dd3] feat(fix): emit Kustomize JSON6902 patches for Helm-rendered resources (#4034)
• [7f277d] feat(fleet): graded exit codes for fleet runs (#4184)
• [c5c79f] feat(fleet): read fleet settings from a config file [lfx 2026] (#4288)
• [f1b17f] feat(helm): render charts for the newest Kubernetes version their kubeVersion allows (#4162)
• [178654] feat(imagescan): expose package-list matching for non-image scans (#4215)
• [43022a] feat(k8scveindex): attribute Kubernetes CVEs to components using the official feed (#4225)
• [3caf51] feat(list): add semantic ANSI colors to list tables and configurations (#4324)
• [da0d55] feat(mcp): add include_identity to analyze_vulnerability_exposure (#4191)
• [11b6cf] feat(mcpserver): add create_admission_policy_binding tool (#4260)
• [32da7c] feat(mcpserver): add list_configuration_security_scan_summaries (#4301)
• [3daca0] feat(mcpserver): add list_sboms and list_sbom_packages tools (#4229)
• [46d701] feat(mcpserver): add validate_scan_selection and share control resolution (#4281)
• [fce811] feat(mcpserver): count unchanged findings in diff_reports and list them only on request (#4270)
• [ce7ffe] feat(mcpserver): filter and page list_vulnerabilities_in_manifest (#4187)
• [bc0d49] feat(mcpserver): filter controls in get_configuration_security_scan_manifest (#4199)
• [5ed763] feat(mcpserver): filter list_controls by framework (#4212)
• [76defa] feat(mcpserver): paginate list_controls responses (#4389)
• [d338e4] feat(opa): let C-0236 look up signatures in a configured Rekor (#4403)
• [f797d0] feat(policy): add semantic ANSI colors to policy test and init commands (#4361)
• [b92d6c] feat(predict): read local manifests from stdin with "-" (#4418)
• [eb7028] feat(printer): show CISA KEV and EPSS in image scan output (#4207)
• [dd3df9] feat(sarif): keep exception audit trail in SARIF results (#4208)
• [1af768] feat(scan): add --notify webhook support for image scans (#4230)
• [60e6fc] fix(analysis): honor automatic namespace name labels (#4174)
• [512c13] fix(attackpath): preserve ServiceAccount index snapshot semantics (#4295)
• [a9ca40] fix(cautils): carry delete/review paths and fix command into v1 reports (#3985)
• [2d37c4] fix(cautils): correct account ID error typo (#4330)
• [5ee2e3] fix(cel): apply a scoped binding's paramRef to the objects it binds (#4278) (#4279)
• [f98d84] fix(cel): normalize namespaceObject nulls like the typed decode (#4303)
• [b393a0] fix(cel): treat empty yaml fields as unset (#4289)
• [67e5f1] fix(cel): use namespaceselector for binding scope matching (#4326) (#4327)
• [4639ef] fix(cel): warn on validation evaluation errors (#4337)
• [6f51c4] fix(cli): name the flag and valid range in out-of-range threshold errors (#4343)
• [a6d9db] fix(cmd): propagate root context and cancellation to subcommands (#4079)
• [733379] fix(completion): honor command output and return write errors (#4189)
• [fc205c] fix(config): report a failure to delete the cached config (#4384)
• [42c0b1] fix(config): require a UUID accountID in config set and config validate (#4168)
• [d455fe] fix(core): match imagePullSecret registry keys the way the kubelet does (#4396)
• [49a9b2] fix(diff): accept .yml extension case insensitively in diffOutputPath (#4238)
• [583c2d] fix(diff): bound and validate report file reads (#4180)
• [004476] fix(diff): dispatch unreadable report pairings with vulnerability reports to vulnerability loader (#4411)
• [575217] fix(diff): distinguish vulnerability package namespaces (#4407)
• [0fe917] fix(diff): neutralize spreadsheet formula injection in summary CSV output (#4243)
• [4bbc84] fix(diff): only treat coverage gaps that affect the control as inconclusive (#4258)
• [a0b30e] fix(diff): write a diff file inside a --output directory (#4172)
• [d8f077] fix(download): match the --output .json extension case-insensitively (#4274)
• [b70351] fix(exposure): apply framework-scoped exceptions in per-resource output and fix (#4219)
• [b0415d] fix(exposure): include active Gateway request mirrors (#4175)
• [172c1a] fix(fix): drop a placeholder fix that shadows a concrete fix (#4183)
• [f8daef] fix(fleetscan): detect case-insensitive output path collisions across contexts (#4357)
• [cb139a] fix(getter): resolve control section numbers in GetControl (#4263)
• [667900] fix(gitlab-sast): report scan coverage gaps in scan.messages (#4206)
• [db78f2] fix(helm): scan only vendored chart dependencies (#4020)
• [453576] fix(httphandler): keep storing posture results after a build error (#4241)
• [b6b956] fix(httphandler): remove markdown and exceptions results on cleanup (#4254)
• [764442] fix(imagescan): clear Azure session state when login fails (#4282)
• [4ad328] fix(imagescan): clear ECR session before login attempts (#4292)
• [c1a2c9] fix(imagescan): clear GCP session before validating a new login (#4297)
• [09d0f5] fix(imagescan): clear GitLab session state when login fails (#4286)
• [0d3055] fix(imagescan): clear Harbor session state when login fails (#4302)
• [b5bff4] fix(imagescan): exclude closed ECR enhanced findings (#4294)
• [c381e1] fix(imagescan): identify GCP vulnerabilities by their Grafeas notes (#4283)
• [48cff2] fix(imagescan): keep untriaged findings at unknown severity (#4409)
• [553242] fix(imagescan): reject incomplete Harbor vulnerability reports (#4284)
• [74539d] fix(imagescan): report incomplete Azure vulnerability results (#4416)
• [2959d9] fix(imagescan): report incomplete GCP occurrence results (#4415)
• [130bd0] fix(imagescan): retain partial GitLab vulnerability data (#4204)
• [8930f6] fix(list): neutralize spreadsheet formula injection in CSV output (#4275)
• [2ecf64] fix(list): reject an unknown --framework instead of listing nothing (#4382)
• [c39cfc] fix(list): validate controls config target (#4422)
• [508f23] fix(list): validate format flag upfront before querying policies (#4383)
• [018c17] fix(mapreconcile): account for equivalent exclusion rules (#4235)
• [7d92c1] fix(mapreconcile): infer immutable namespace-name labels (#4417)
• [2dc266] fix(mcp): handle marshal errors in advanced tools (#4262)
• [3beddb] fix(mcpserver): add missing workload kinds to advanced tools (#4223)
• [955138] fix(mcpserver): classify RBAC escalation list failures (#4317)
• [fba406] fix(mcpserver): classify advanced tool API errors correctly (#4322)
• [80f682] fix(mcpserver): classify errors in list admission policies (#4387)
• [5f81a1] fix(mcpserver): classify forbidden and timeout errors in analyze_mutating_admission_policy_impact (#4318)
• [92e6fa] fix(mcpserver): detect secrets in ConfigMap binary content (#4265)
• [038570] fix(mcpserver): find the namespace by name in get tools when none is given (#4306)
• [7d8d96] fix(mcpserver): keep vulnerability package URLs distinct (#4313)
• [46e584] fix(mcpserver): list configuration scans in all namespaces by default (#4299)
• [137d07] fix(mcpserver): shut down the SSE transport gracefully on SIGINT/SIGTERM (#4178)
• [cd54dd] fix(mcpserver): support dot-separated keys in secret exposure detection (#4308)
• [3c815b] fix(mcpserver): support patch_type in dry_run_remediation (#4321)
• [4b7f6a] fix(mcpserver): suppress URI credential exposure when parts are variable references (#4201)
• [87f16a] fix(mcpserver): switch scan response to cautils.ResourceStatus (#4350)
• [f7cd3a] fix(mcpserver): use structured argument helpers in analyze_rbac_escalation_paths (#4221)
• [081b11] fix(mcpserver): validate mutating policy impact arguments (#4197)
• [4fa11c] fix(operator): remove duplicate withCapturableLogger test helper (#4426)
• [acd132] fix(patch): allow omitted format flag in patch command (#4345)
• [2e5d64] fix(policy): load YAML fixtures regardless of extension casing (#4421)
• [806933] fix(policy): sort equal-path fixes by value during fixture comparison (#4388)
• [5e4e7c] fix(predict): report the running kubescape version in PSS SARIF output (#4419)
• [125740] fix(printer): break attack tree score ties by resource ID (#4296)
• [f5e8b0] fix(printer): ensure deterministic output ordering in pretty and markdown printers (#4190)
• [28ea38] fix(printer): fallback to Source.Path when RelativePath is empty in JUnit and resource table (#4222)
• [ff2a47] fix(printer): fix HTML report table syntax and ensure deterministic resource ordering (#4173)
• [7fdeb9] fix(printer): keep parent components of a --output directory (#4177)
• [e8f514] fix(printer): neutralize spreadsheet formula injection in CSV report output (#4195)
• [b76920] fix(printer): preserve symlink parent paths in GetWriter and GetWriterNoStdoutFallback (#4233)
• [8e6726] fix(printer): reject mixed GitLab posture and image reports (#4157)
• [509ec2] fix(printer): resolve JSON/YAML evidence from delete and review paths (#3984)
• [a1c110] fix(printer): return GitHub Actions output write errors (#4156)
• [0e5db0] fix(printer): write the default report inside a --output directory (#4166)
• [81e6a1] fix(prometheus): emit control, framework, and multi-image metrics in deterministic order (#4287)
• [33f04a] fix(prometheus): emit resource and image metrics in deterministic order (#4285)
• [c668db] fix(pss): decode local manifests case-sensitively (#4331)
• [65c6ea] fix(pss): evaluate every workload in local JSON streams (#4237)
• [244e83] fix(pss): evaluate local ReplicationController and PodTemplate manifests (#4391)
• [7806de] fix(pss): follow workload list continuation tokens (#4205)
• [d00573] fix(pss): preserve distinct child workload violations (#4266)
• [3f5402] fix(pss): preserve workload namespaces in prediction reports (#4312)
• [1f1212] fix(pss): reject empty container specs during decoding (#4276)
• [de2ae2] fix(pss): reject malformed Kubernetes List members (#4311)
• [e4a2b7] fix(pss): scope owner deduplication to the workload namespace (#4293)
• [70e29c] fix(rbac): separate impersonation targets from permission grants (#4176)
• [6ddc0f] fix(report): emit v1 ControlReports and RuleReports in deterministic order (#4185)
• [709280] fix(reports): preserve int64 values during anonymization and decryption (#4408)
• [d4f079] fix(resourcehandler): collect APIServerInfo on every cluster scan (#4272)
• [3927b7] fix(resourcehandler): preserve independent manifest sources (#4335)
• [baa50e] fix(resourcehandler): resolve a wildcard version to the registered one instead of an empty one (#4290)
• [48952b] fix(scan): check every output path before opening any report file (#4342)
• [773f28] fix(scan): detect output path collisions when output is whitespace or directory (#4307)
• [26b2d3] fix(scan): do not dereference a nil envelope returned by NewObject (#4325)
• [1c6f9a] fix(scan): exclude computed status lookups from incremental caching (#4236)
• [b9fb80] fix(scan): reject a whitespace-only --format (#4354)
• [d32d8c] fix(scan): resolve exclusion roots above wildcard directories (#4348)
• [6dbe65] fix(scan): validate empty and whitespace-only policy names in framework and control args (#4424)
• [a490ed] fix(scan): validate items only in Kubernetes list envelopes (#4351)
• [36edcb] fix(scancache): isolate cached control verdicts (#4203)
• [623975] fix(storage): delete posture records the latest full scan no longer reports (#4267)
• [9560b8] fix(v2): add nil safety guards for vulnerability metadata (#4339)
• [8288ae] fix(v2): add nil-safety guards for summary and report objects (#4328)
• [cb7147] fix(vap): neutralize spreadsheet formula injection in CSV output (#4280)
• [46ccc1] fix(vap): use GetWriterNoFallback in writeOutput (#4268)
• [b948f8] fix(vapreconcile): evaluate control status with framework awareness in coverage (#4359)
• [f8ac0d] fix(vapreconcile): honor policy selectors in resource coverage (#4291)
• [605a49] fix(vapreconcile): resolve immutable namespace-name selectors (#4277)
• [e68ab6] fix: isolate framework-scoped exceptions in scan results (#3867)
• [f99ced] fix: keep scores below 100 from printing as 100 (#4244)
• [009338] fix: reject extra fix command arguments (#4256)
• [62e62f] fix: trim whitespace in severity thresholds (#4240)
• [2ced2f] perf(core): skip redundant k8s dial in getInterfaces when account ID is provided (#4008)
• [0e6ca7] perf(mcpserver): deduplicate concurrent secret exposure analysis (#4158)
• [139023] refactor(sarif): pass framework names straight into FilterExceptionsByFrameworks (#4379)
• [7328a0] test(cautils): add unit tests for framework control filtering and effective control ID resolution (#4395)
• [6f9730] test(config): add unit tests for config delete and config delete cache subcommands (#4333)
• [27a69c] test(core): cover init and ephemeral container images in --scan-images (#4193)
• [031427] test(download): add unit tests for empty name validation and error handling (#4358)
• [419465] test(fixhandler): remove redundant and zero-behavior kustomize tests (#4404)
• [29c0fb] test(mcpserver): enforce an input-schema contract on every registered tool (#4316)
• [399f94] test(mcpserver): wait for the prior execution to retire in the shutdown lifecycle test (#4264)
• [14b7e6] test(networkpolicy): cover an empty podSelector peer, alone and with a namespaceSelector (#4226)
• [ce3b32] test(networkpolicy): cover the namespace half of a combined namespace and pod selector peer (#4192)
• [254e33] test(opaprocessor): cover cosignRekorURL from rule metadata to a verified Rekor entry (#4429)
• [04e41d] test(operator): add unit tests for configuration scan command execution, flags, and error handling (#4398)
• [f6e85f] test(operator): add unit tests for remediation command payload validation, warnings, and error handling (#4400)
• [12a23b] test(operator): add unit tests for vulnerability scan command execution, flags, and error handling (#4399)
• [6712da] test(pss): cover user-namespace policy relaxation boundaries (#4160)
• [70cc51] test(rbac): verify binding scope and subject identity against kube-apiserver (#4179)
• [54bce7] test(rbac): verify verb, apiGroup and resource matching against kube-apiserver (#4210)
• [9d8bed] test(root): add unit tests for root command execution, environment discovery errors, logger validation, and krew plugin mode (#4378)
• [548cea] test(shared): add unit tests for registry credential helpers in cmd/shared (#4353)
• [7ca920] test(update): add unit tests for development version, release check failure, and output formatting (#4374)

Released by GoReleaser.