Changelog

• 960d6ce chore(crd): remove orphan, uninstallable SecurityException CRD and its test (#2403)
• 778ec11 feat(operator): add operator remediate CLI subcommand (annotate + dry-run) (#2448)
• 7542e40 fix(httphandler): surface async scan failures via Results endpoint (#2339)
• bef62c9 Add CEL env builder for the VAP engine (#2416)
• d31fc8b Add CEL evaluator (#2443)
• 695c8d1 Add encryption transformer integration tests (#2351)
• 932cd5b Add offline request stub for the CEL engine (#2439)
• 820fa31 Docs: add circleci integration guide (#2385)
• 34f531a Emit security-severity on SARIF rules (#2398)
• 1917984 Fail closed on repo metadata transformation errors (#2353)
• ffc7f92 Fix nil pointer panic on image scan when ScanData is nil (#2431)
• 6a44d6c Fix panic parsing image names without an organization (#2397)
• 80fa300 Fix relative path and Name typo (#2343)
• add18bf Integrate report encryption metadata and DEK wrapping into anonymization workflow (#2380)
• ccadbba Set HTTP timeouts on the scan listener server (#2396)
• f8ae044 [ LFX 2026 ] Fixes bugs found before implementation of LFX 1982 (#2366)
• f2e42ca [feat] : add scan coverage score to measure and report scan co… (#2410)
• 554dd66 [fix] : Fall back to bundled defaults and surface degradation when control-inputs fetch fails (#2395)
• cd5dba9 anonymizer: hide service account names in pod specs (#2333)
• 865b036 backend: imagescan: add missing unit tests for getMatchers and newScanServiceIntegration (#2427)
• e4a8f7d backend: ksinit: add success case for CreateKsObjectConnection (#2429)
• f69c88b chore: modernize codebase to Go 1.26 (#2415)
• f956507 feat(httphandler): add SSRF-hardened scan-completion webhook callback (#2447)
• 1f2e83a feat(opaprocessor): add per-control evaluation timeout (#2375)
• fed74dc feat(opaprocessor): wire CEL language dispatch with stub evaluator (#2405)
• 8274975 feat(report): add encrypted report decryption (#2425)
• 494b0e5 feat(reportcrypto): decrypt resource source metadata in reports (#2440)
• 273a92e feat: add SLSA build provenance attestation to release workflow (#2346)
• 1c7e2e8 feat: add encrypted repo metadata workflow (#2365)
• 38bb518 fix(anonymizer): detect separator-less sensitive env variable names t… (#2367)
• b66104d fix(coverage) : penalise silent failed GVR pulls in coverage score (#2420)
• cc88b0f fix(diff): move --fail-on-new exit to cmd layer so output writer is closed (#2434)
• bf4f796 fix(diff): validate format input and clean up status handling (#2438)
• 8c24435 fix(hostsensorutils): normalize infoMap keys using ResourceGroupToString (#2360)
• 9baa4e9 fix(httphandler): add panic recovery to scan execution goroutine (#2352)
• ee4a4bc fix(httphandler): log persistence failure as warning, return valid result (#2342)
• ab5d74b fix(list): emit JSON objects for list controls --format json (#2401)
• ddc278f fix(offline): dynamically populate allcontrols framework and fix loadpolicy search (#2338)
• 6349ae6 fix(opa): fail fast on cancelled cosign verification contexts (#2368)
• 741b243 fix(opaprocessor) : discard partial results from timed-out controls (#2404)
• d6bdc28 fix(opaprocessor): count timed-out controls as 0 in compliance score (#2424)
• 8af7c84 fix(opaprocessor): stop processing after context cancellation (#2386)
• 7f13c3e fix(portforwarder): avoid blocking on repeated stop signals (#2381)
• e23bdbb fix(resourcehandler): dedup resources found by different providers (#2336)
• f91a798 fix(resourcehandler): fail fast on cancelled contexts after resource pulls (#2372)
• 1f7cb75 fix(resourcehandler): merge host-sensor infoMap instead of replacing it (#2349)
• fb151f6 fix(resourcehandler): trim spaces from namespaces in field selectors (#2382)
• c9ff488 fix(sarif): resolve correct line numbers for absolute-path file scans (#2406)
• 387537a fix(scan): reject invalid format values before scanning (#2370)
• c6781c1 fix(storage): skip orphaned RoleBinding instead of aborting scan persistence (#2392)
• 3d6a657 fix(vap): add missing C-0199, C-0200, C-0201 to control ID map (#2371)
• f0f07ba fix(vap): require params for configurable controls (#2334)
• 55fb134 fix: anonymize LocalRootPath in hidden report output (#2344)
• a60d9bc fix: prevent silent output overwrite when multiple formats share one path (#2414)
• 7dd401a fix: read severity from summaryDetails instead of missing controls field (#2412)
• c2e6123 fix: restrict config.json permissions to owner-only (#2340)
• 96a764d fix: return clear error when wrong JSON structure passed to kubescape fix (#2358)
• bb5a7a9 fix: return error when related RBAC objects share the same category (#2422)
• d577fca fix: typos in core and cmd directories (#2356)
• 93bacb5 fix: use filepath.Join instead of path.Join for filesystem paths (#2407)
• c53c8c9 refactor: eliminate package-level mutable state in workload command (#2379)
• 674b5f3 refactor: introduce transformer abstraction for repo metadata (#2347)
• c070927 refactor: upgrade to standard error wrapping (%w) in MCP server (#2377)
• 1ca0da2 reportcrypto: add DEK wrapping support (#2374)
• 72d0bce test(opaprocessor): improve temporary resource cleanup (#2388) Released by GoReleaser.