Changelog

• 6849abb Cel engine docs (#2756)
• 0b25d70 Guard against unresolvable group/version in resource handler (#2609)
• 68b6a71 Increase test coverage for GetWriter and LogOutputFile functions (#2586)
• 2a2253a Propagate printer and command errors (#2908)
• 9e98840 Recover from panics in readJsonFile (#2604)
• 95a70f2 Refactor: remove Getters and PolicyIdentifier from ScanInfo (#2768)
• e79237c Refactor: use distribution/reference for image parsing (#2776)
• 61a8054 Remove Helm binary dependency from kustomize tests (#2926)
• 2763c21 Remove stale "Add score" TODO from processorhandlerutils.go (#2924)
• 957998b Removed dead code in urlloader and urlloader_test and add some test c… (#2590)
• 4cc055e Security/batch dependency fixes 2 (#2897)
• 5b4f1a6 Support scoped registry auth for image scans (#2696)
• 2088a8c Test case added for validation (#2585)
• fad6e64 Unify scan stdin input handling (#2875)
• dd98504 [fix] : non-deterministic namespace bucketing caused by mid-scan resource count mutation (#2587)
• 6561a47 [fix] : streaming collector dropping host-sensor fallback, silently passing controls it never evaluated (#2797)
• 1abd9d8 anonymizer: pin and document the intentional cross-prefix hash-suffix sharing (was: hash prefix+value) (#2687)
• 6bab3de cautils: test: cover test for readYamlFile and readJsonFile (#2526)
• 1b93a71 chore(ci): update pinned GitHub Actions off deprecated Node 20 releases (#2973)
• d23abbf chore(deps): tidy go.mod for backoff import (#3022)
• bb83cd6 chore(printer): remove the unused v1 PrometheusPrinter (#2985)
• a6a0898 chore: evaluate rego with RegoV1 (drop v0 compat shim) (#2359)
• ca0d57b chore: remove dead Float16ToInt function (#2643)
• 4a1d822 chore: remove dead code loadConfigFromData (#2948)
• 4363b2b chore: remove deprecated SA2WLIDmap from RBAC utils (#2957)
• 64915fe chore: remove orphaned firstNonEmpty doc comment (#2945)
• bbf9183 ci: run unit tests on every PR, not just tag pushes (#2606)
• 2e0d1a9 enhancement: propagate context.Context in getter interfaces (#2775)
• 39752e1 feat : add DELETE /v1/scan to cancel an in-flight scan (#2562)
• 9a91904 feat(cautils): add ParseDurationEnvVar (#2779)
• b3192bc feat(context): propagate context through tenant config initialization and Kubernetes API calls (#2739)
• 881ba33 feat(core): implement concurrent and deduplicated image scan pipeline (KS-ADV-02) (#2759)
• b3f1542 feat(csv): add remediation path evidence columns to CSV scan output (#2900)
• 77aca1e feat(exceptions): prefer cloud exceptions over CRD (#2317)
• 5c6fb28 feat(hostsensor): optimize query with paging, rate limits, and cache (#2864)
• 53899b7 feat(html): show current field values in evidence paths (#3032)
• 5bdca12 feat(imagescan): support scanning local offline tarball images (#2995)
• 29aefd1 feat(mcp): add headless framework security scanner tool (#2528)
• 1d2709e feat(mcp): add local IaC scanner tool (#2545)
• b5bf09a feat(mcpserver): add scan_container_image tool for on-demand vulnerability scanning (KS-INT-03) (#2708)
• dbd32e8 feat(patch): support all image scan output formats (#2910)
• cbf3818 feat(printer): add markdown output format (#3025)
• de8d7a1 feat(printer): surface current field value alongside failed paths in scan output (#2882)
• 531ab67 feat(resourcesprioritization): support configurable workload kinds and dynamic pod template spec detection (#2720)
• eed57f0 feat(scan): add --api-version flag to workload scan command (#2829)
• 1201b17 feat(scan): add --label-selector flag to filter collected resources (#2830)
• 0513520 feat(scan): support parsing apiVersion in workload identifier (#2581)
• 830edec feat(streaming): Add resource streaming for large clusters to reduce memory usage (#2645)
• 1225145 feat(version): add --output json flag (#2793)
• 0a8dacf feat: Automated In-Cluster Private Registry Credential Resolver (#2832)
• 164d228 feat: add --only-fixable flag to gate scan image severity threshold on fix availability (#2891)
• 8a49128 feat: add Azure AKS support to ListEntitiesForPolicies resource mapping (#3012)
• 9c9c839 feat: add CSV output format printer for scan results (#2743)
• 9b69c84 feat: add YAML output format to kubescape list (#2852)
• 03d0f73 feat: add configurable config view output formats (#2987)
• 64b54e2 feat: add csv output for list command (#2989)
• 1431870 feat: add fallback support for OpenShift external registry routes (#2576)
• f73b3a7 feat: give CEL findings the remediation paths their Rego equivalents carry (#2533)
• 2121daa feat: implement Runtime Profile Drift Detection and Remediation (KS-ADV-01) (#2803)
• c22523d feat: introduce Container Image Vulnerability (CIV) Adaptor for Azure Container Registry (#2778)
• d5cd5e9 feat: introduce native GCP Artifact Registry vulnerability adaptor (Phase 2) (#2801)
• cc83086 feat: scan kubernetes_manifest resources in Terraform files (#2947)
• b1071ce feat: scan typed kubernetes_* resources in Terraform files (#719) (#3019)
• d3e90b7 feat: spend one CEL cost budget per policy the way admission does (#2560)
• 053ca1d feat: support all output formats for image scans (#2786)
• f6ff896 feat: support yaml as an output format (#2625)
• 9387a73 fix(anonymizer): replace broken type assertions with IWorkload-based container deserialization (#2991)
• 5afb9c3 fix(cache): publish policy files atomically (#2878)
• 2ff4225 fix(cautils): add warning log for invalid useUntilKubescapeVersion semver (#2703)
• 715efa3 fix(cautils): avoid standalone renders of owned Helm dependencies (#2849)
• 3cb0df0 fix(cautils): clone trailing remote inputs for local-first scans (#2933)
• a10dcea fix(cautils): expand offline Kubernetes list envelopes (#2820)
• 5951348 fix(cautils): propagate marshal error in updateConfigFile (#2766)
• 88d24b7 fix(cautils): record individual formats in scan metadata (#2932)
• 4f4a861 fix(cautils): remove dead nil-check in setHeaders (#2682)
• dfc8387 fix(cautils): report the bound port from GetPortForwardLocalhost (#2761)
• a48e3ff fix(cautils): resolve git metadata when scanning from a linked worktree (#2721)
• b9c2fc7 fix(cautils): return error when worktree root cannot be resolved in NewLocalGitRepository (#2651)
• 0ee5c13 fix(cautils): return non-NotFound errors from legacy ConfigMap lookup (#3018)
• 8f54073 fix(cautils): sort copies in StringSlicesAreEqual to avoid mutating caller slices (#2750)
• b45925d fix(cautils): stop LocalGitRepository exposing a nil-embedded panic to callers (#2722)
• cbc5d22 fix(cautils): stop Policies.Set from mutating the caller's frameworks slice (#2681)
• 0f7e72c fix(cautils): stop ReportV2ToV1 from mutating the caller's shared resources (#2837)
• 9f55d1e fix(cautils): stop conflating insecureSkipTLS with plainHTTP in helm registry client (#2690)
• 45362e2 fix(cautils): synchronize access to global KSCloudAPIConnector to resolve data race (#2767)
• fab61c5 fix(cautils): use filesystem check instead of .json string heuristic in setUseArtifactsFrom (#3009)
• 529e872 fix(cel): guard optional field paths so valid workloads are evaluated, not skipped (#2535)
• 111444e fix(cel): resolve namespaceObject from collected namespaces and honor admission scoping offline (#2713)
• b721999 fix(cel): select remediation paths by workload kind (#2564)
• 9a26b8e fix(cel): use messageExpression for CEL message bodies, verify bundleControlIDs both ways (#2610)
• 884cd0a fix(cmd): close temporary file handle after streaming stdin in scan commands (#2799)
• 247caf5 fix(config): preserve higher-priority tenant settings (#2876)
• 293140d fix(core): add timeout to HTTP client in OperatorAdapter to prevent connection hang (#2827)
• af7bf70 fix(core): align scan attribution with explicit kubeconfig (#2841)
• 0324553 fix(core): allow operator scan with multiple app=operator pods (#2593)
• 1bd379e fix(core): cancel streaming producer context on early evaluation error (#2814) (#2815)
• fa48eec fix(core): correct grammar in download empty-response errors (#2642)
• 2816cd1 fix(core): correct unknown command error message in List() (#2621)
• aa46aea fix(core): detect multipart SBOM output collisions (#2930)
• 10e16a2 fix(core): download --output bare .json path no longer falls back to ~/.kubescape (#2818)
• 1cf701f fix(core): escape inner quotes in FixPathToValidYamlExpression string values (#2670)
• 0408fe0 fix(core): expand ScanAll frameworks before resolving cache paths (#2792)
• 8db604a fix(core): ignore unusable image pull secret credentials (#2927)
• 8b973a8 fix(core): limit ScanAll expansion to framework scans and dedupe UseFrom (#2795)
• f212468 fix(core): log swallowed errors when loading cached/cluster config (#2736)
• 06aec0c fix(core): make ProgressHandler.Stop() complete the progress bar (#2738)
• 1be5e2b fix(core): parse digest-pinned image references correctly for exceptions (#2686)
• a102e7b fix(core): preserve non-zero risk score rounding in HTML report (#2727) (#2733)
• 1e24a1e fix(core): prevent sub-100 compliance scores formatting as 100.00 (#2728) (#2740)
• 414fce3 fix(core): recurse convertYamlToJson into map[string]any values (#2834)
• 4df639d fix(core): remove racy re-check of global cluster connection state (#2617)
• 0e6ea57 fix(core): reset HostSensorEnabled when explicit host scanner fails to init (#2819)
• ebb29b1 fix(core): return cluster connection failures from Scan instead of terminating (#2788)
• 5011ad2 fix(core): return error when io.ReadAll fails in NewFixHandler (#2706)
• 0767f52 fix(core): shut down the exception event broadcaster after each scan (#2762)
• 2cda81a fix(core): skip image scanner initialization when no images (#2845)
• e8b95ca fix(core): stop nilling global os.Stdout/os.Stderr during copa patch (#2638)
• 6aea45c fix(core): stop port-forward when startup fails to avoid goroutine leak (#2835)
• d9061d8 fix(core): treat closed/non-interactive stdin as refusal in userConfirmed to prevent CPU spin (#2712)
• d07136a fix(core): use restrictive permissions for created output directories (#2648)