Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package kubescape for openSUSE:Factory checked in at 2026-08-13 13:15:47 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/kubescape (Old) and /work/SRC/openSUSE:Factory/.kubescape.new.17972 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "kubescape" Thu Aug 13 13:15:47 2026 rev:46 rq:1370845 version:4.0.12 Changes: -------- --- /work/SRC/openSUSE:Factory/kubescape/kubescape.changes 2026-07-23 23:13:47.775552056 +0200 +++ /work/SRC/openSUSE:Factory/.kubescape.new.17972/kubescape.changes 2026-08-13 13:16:46.687883976 +0200 @@ -1,0 +2,476 @@ +Wed Aug 12 11:13:28 UTC 2026 - Johannes Kastl <[email protected]> + +- Update to version 4.0.12: + * remove duplicate tests + * feat(html): show current field values in evidence paths (#3032) + * refactor(scan): deduplicate flag validation boilerplate (#3047) + * fix(downloader): exit non-zero when an artifact download fails + (#2918) + * fix: replace control merge loops with assignment to clear stale + controls (#3049) (#3051) + * fix(scan): remove unreachable code branch in scan command RunE + (#3040) + * chore(deps): tidy go.mod for backoff import (#3022) + * fix(shared): prioritize auth conflict error over missing + password (#3042) + * test(scan): explicitly test file-path without chart-path + (#3044) + * feat(printer): add markdown output format (#3025) + * fix(prometheus): group metric samples by family in the + exposition output (#3021) + * feat: add configurable config view output formats (#2987) + * feat: add csv output for list command (#2989) + * fix(resourcehandler): render nested Kustomize configurations + (#2860) + * fix: count returned items in cluster-size estimates (#2847) + * fix(core): skip image scanner initialization when no images + (#2845) + * fix(cautils): return non-NotFound errors from legacy ConfigMap + lookup (#3018) + * fix(downloader): add bounded retry with backoff for artifact + downloads (#3016) + * feat: scan typed kubernetes_* resources in Terraform files + (#719) (#3019) + * fix(cautils): use filesystem check instead of .json string + heuristic in setUseArtifactsFrom (#3009) + * fix(operator): make GetRequestPayload side-effect-free, default + --frameworks to all at the flag (#3006) + * feat: add Azure AKS support to ListEntitiesForPolicies resource + mapping (#3012) + * fix(downloader): aggregate errors in download loop to catch + swallowed failures (#3011) + * fix(printer): keep PDF footnote markers consistent between + table and legend (#3004) + * fix(downloader): add 10-minute timeout to background context to + prevent hangs (#3014) + * fix(sarif): render and patch image scan SARIF in memory instead + of reopening the writer (#2984) + * fix(csv): guarantee a flush attempt on every ActionPrint exit + path (#2981) + * test(cautils): remove Helm binary dependency in kustomize tests + (#2983) + * fix: include initContainers and ephemeralContainers in image + scan (#2979) (#2980) + * fix(streaming): restore host-sensor InfoMap and namespace + resource counting in streaming collector (#2808) (#2809) + * fix(reportcrypto): stop rewriting plaintext values during + decryption (#2998) + * fix(imagescan): close the previous gRPC client on repeated GCP + Login calls (#2982) + * feat(imagescan): support scanning local offline tarball images + (#2995) + * test(cautils): resolve symlinks on temp dirs used as expected + paths (#2977) + * fix(vap): bound deploy-library downloads with a default timeout + (#3001) + * fix(prerequisites): exit non-zero when cluster data collection + fails (#2997) + * chore(ci): update pinned GitHub Actions off deprecated Node 20 + releases (#2973) + * chore(printer): remove the unused v1 PrometheusPrinter (#2985) + * fix(anonymizer): replace broken type assertions with + IWorkload-based container deserialization (#2991) + * perf(opaprocessor): index a scope's resources once instead of + per rule (#2976) + * refactor(policyhandler): make PolicyHandler stateless per + request to eliminate scanMu blocking (#2899) + * fix: resolve data race in display spinner (#2975) (#2978) + * feat(patch): support all image scan output formats (#2910) + * feat: scan kubernetes_manifest resources in Terraform files + (#2947) + * fix(imagescan): prevent gRPC connection leak in GCP adaptor + (#2954) + * Remove stale "Add score" TODO from `processorhandlerutils.go` + (#2924) + * Remove Helm binary dependency from kustomize tests (#2926) + * fix(imagescan): support enhanced ECR scan findings (#2966) + * fix(imagescan): scope pull secrets to cluster scans (#2964) + * fix(streaming): initialize cluster metadata before policy + planning (#2956) + * fix(sarif): avoid image output stdout deadlock (#2967) + * test(cautils): fix path-quoting and permission-bit assumptions + on Windows (#2952) + * chore: remove orphaned firstNonEmpty doc comment (#2945) + * chore: remove dead code loadConfigFromData (#2948) + * fix(printer): prevent silent data loss on CSV write errors + (#2959) + * chore: remove deprecated SA2WLIDmap from RBAC utils (#2957) + * fix(downloader): exit non-zero on download failures (#2969) + * perf(sarif): cache per-file work when collecting fixes and + locations (#2921) + * fix(hostsensor): key cache by cluster identity and gate it + behind opt-in TTL (#2914) + * fix(scan): validate threshold ranges in scan control command + (#2916) + * fix(imagescan): properly reject unsupported token credentials + in cloud adaptors (#2943) + * fix(imagescan): standardize partial-failure handling across + cloud adaptors (#2941) + * fix(operator): scope examples to the scan subcommand (#2915) + * security: batch dependency vulnerability fixes (Batch 1 + 2) + (#2895) + * fix(scan): enforce image thresholds in explicit subcommands + (#2929) + * fix(httphandler): retain scan ID in synchronous responses + (#2931) + * fix(httphandler): preserve non-JSON HTTP scan results (#2936) + * fix(resourcehandler): propagate file stream cancellation + (#2935) + * fix(core): detect multipart SBOM output collisions (#2930) + * fix(storage): propagate workload scan update errors (#2937) + * fix(coverage): sort partial GVR pull diagnostics (#2934) + * fix(operator): resolve cluster name after context selection + (#2939) + * fix(cautils): clone trailing remote inputs for local-first + scans (#2933) + * fix(hostsensor): avoid mutating shared Kubernetes config + (#2938) + * fix(scan): honor only-fixable in combined image scans (#2928) + * fix(core): ignore unusable image pull secret credentials + (#2927) + * fix(cautils): record individual formats in scan metadata + (#2932) + * Security/batch dependency fixes 2 (#2897) + * fix: wrap DEK error, enforce image severity thresholds, and + refactor error formats (#2902) + * fix(printer): separate name and version in package score map + key (#2692) + * Propagate printer and command errors (#2908) + * refactor(resourcehandler): use canonical path containment for + kustomize exclusion (#2907) + * feat(csv): add remediation path evidence columns to CSV scan + output (#2900) + * fix(fixhandler): skip document node when resolving a line to + replace (#2896) + * fix(sarif): guard delta walk against out-of-range line and + segment indexes (#2865) + * fix(policyhandler): bound registry growth with idle eviction + (#2909) + * fix(printer): label the report with the context the scan + actually used (#2898) + * fix: enforce image severity threshold on combined scans + (#2894) + * fix(resourcehandler): log warnings on directory discovery + errors in LoadResourcesFromNestedKustomizeDirectories (#2906) + * feat: add --only-fixable flag to gate scan image severity + threshold on fix availability (#2891) + * fix(resourcehandler): classify missing LIST resources using + typed Kubernetes errors (#2903) + * fix(mcpserver): retry client init instead of caching first + error (#2629) + * fix: resolve review feedback for CycloneDX/SPDX SBOM output + formats (#2883) + * Unify scan stdin input handling (#2875) + * fix(opaprocessor): resolve namespaceObject for CEL admission + evaluation (#2603) + * fix(core): wire --address flag into buildkit client options for + patch (#2735) + * feat(printer): surface current field value alongside failed + paths in scan output (#2882) + * fix(resourcehandler): discover nested Kustomize directories in + broad scans (#2888) + * fix(resourcehandler): count returned items in cluster size + estimate (#2886) + * fix(scan): dynamically build supported formats error message + (#2870) + * feat(scan): add --label-selector flag to filter collected + resources (#2830) + * fix(cache): publish policy files atomically (#2878) + * fix(diff): reject invalid scan reports (#2877) + * feat(hostsensor): optimize query with paging, rate limits, and + cache (#2864) + * fix: populate ClusterName in JSON reports (#2866) + * fix(config): preserve higher-priority tenant settings (#2876) + * feat: implement Runtime Profile Drift Detection and Remediation + (KS-ADV-01) (#2803) + * fix(scan): accept local inputs for workload scans (#2746) + * fix: register deprecated flags to prevent unknown flag errors + (#2868) + * fix(scan): return errors instead of using logger.Fatal (#2857) + * fix(core): align scan attribution with explicit kubeconfig + (#2841) + * feat: support all output formats for image scans (#2786) + * fix: mark CRD-only controls not evaluated after partial + discovery failure (#2839) + * fix(cautils): avoid standalone renders of owned Helm + dependencies (#2849) + * feat: Automated In-Cluster Private Registry Credential Resolver + (#2832) + * fix(resourcehandler): let Kustomize own referenced Helm charts + (#2855) + * fix(core): add timeout to HTTP client in OperatorAdapter to + prevent connection hang (#2827) + * fix(core): cancel streaming producer context on early + evaluation error (#2814) (#2815) + * fix(core): stop port-forward when startup fails to avoid + goroutine leak (#2835) + * fix(cautils): expand offline Kubernetes list envelopes (#2820) + * fix(locationresolver): split fix paths on the first '=' rather + than the last (#2850) + * docs: mention MegaLinter in the CI/CD integrations table + (#2859) + * feat: add YAML output format to kubescape list (#2852) + * fix(core): reset HostSensorEnabled when explicit host scanner + fails to init (#2819) + * fix(resourcehandler): honor discovered scope when streaming + resources (#2821) + * fix(cautils): stop ReportV2ToV1 from mutating the caller's + shared resources (#2837) + * fix(core): recurse convertYamlToJson into map[string]any values + (#2834) + * feat(scan): add --api-version flag to workload scan command + (#2829) + * fix(results): preserve enrichment in programmatic and HTTP + output (#2862) + * fix: use %w for standard error wrapping (#2823) + * fix(core): download --output bare .json path no longer falls + back to ~/.kubescape (#2818) + * feat: introduce native GCP Artifact Registry vulnerability + adaptor (Phase 2) (#2801) + * refactor(core): expose cluster connection failure as a sentinel + error (#2810) + * fix: resolve HTTPPost connection leak on error by draining + response body (#2807) + * fix: resolve CRD exception deduplication dropping + non-overlapping policies (#2805) + * feat: add CSV output format printer for scan results (#2743) + * feat(core): implement concurrent and deduplicated image scan + pipeline (KS-ADV-02) (#2759) + * fix: return values for IKubescape List and Download (#2794) + * feat(version): add --output json flag (#2793) + * [fix] : streaming collector dropping host-sensor fallback, + silently passing controls it never evaluated (#2797) + * fix(cmd): close temporary file handle after streaming stdin in + scan commands (#2799) + * fix(core): limit ScanAll expansion to framework scans and + dedupe UseFrom (#2795) + * feat: introduce Container Image Vulnerability (CIV) Adaptor for + Azure Container Registry (#2778) + * feat(cautils): add ParseDurationEnvVar (#2779) + * fix(core): expand ScanAll frameworks before resolving cache + paths (#2792) + * fix(resultshandling): handle unscored score sentinel in summary + table compliance column (#2791) + * fix(core): return cluster connection failures from Scan instead + of terminating (#2788) + * fix(resourcehandler): repair NewOPASessionObj call broken by + merge (#2783) + * test(cautils): use t.Setenv so env vars are restored between + runs (#2785) + * enhancement: propagate context.Context in getter interfaces + (#2775) + * Refactor: remove Getters and PolicyIdentifier from ScanInfo + (#2768) + * fix(resourcehandler): propagate streaming LIST failures (#2771) + * fix(resultshandling): make finalized report ordering + deterministic (#2773) + * fix(core): shut down the exception event broadcaster after each + scan (#2762) + * Refactor: use distribution/reference for image parsing (#2776) + * fix(cautils): synchronize access to global KSCloudAPIConnector + to resolve data race (#2767) + * fix(cautils): propagate marshal error in updateConfigFile + (#2766) + * fix(cautils): report the bound port from + GetPortForwardLocalhost (#2761) + * fix(opaprocessor): scrub stringData field in Secret resources + (#2757) + * refactor: remove dead count variable and simplify + insertControls (#2753) + * Cel engine docs (#2756) + * refactor(cautils): simplify StringSlicesAreEqual and assert its + result in the non-mutation test (#2755) + * fix(resourcehandler): resolve offline resources from manifests + (#2752) + * test: add table-driven test for getGroupNVersion (#2754) + * fix(mcp): graceful error handling for legacy MCP tools (#2748) + * feat(context): propagate context through tenant config + initialization and Kubernetes API calls (#2739) + * feat(mcpserver): add scan_container_image tool for on-demand + vulnerability scanning (KS-INT-03) (#2708) + * fix(core): prevent sub-100 compliance scores formatting as + 100.00 (#2728) (#2740) + * fix(core): preserve non-zero risk score rounding in HTML report + (#2727) (#2733) + * fix(diff): sort ChangeSet buckets so diff output is + reproducible (#2734) + * feat(resourcesprioritization): support configurable workload ++++ 179 more lines (skipped) ++++ between /work/SRC/openSUSE:Factory/kubescape/kubescape.changes ++++ and /work/SRC/openSUSE:Factory/.kubescape.new.17972/kubescape.changes Old: ---- kubescape-4.0.11.obscpio New: ---- kubescape-4.0.12.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ kubescape.spec ++++++ --- /var/tmp/diff_new_pack.6bE3FT/_old 2026-08-13 13:16:49.151995837 +0200 +++ /var/tmp/diff_new_pack.6bE3FT/_new 2026-08-13 13:16:49.155996018 +0200 @@ -17,7 +17,7 @@ Name: kubescape -Version: 4.0.11 +Version: 4.0.12 Release: 0 Summary: Tool providing a multi-cloud K8s single pane of glass License: Apache-2.0 ++++++ _service ++++++ --- /var/tmp/diff_new_pack.6bE3FT/_old 2026-08-13 13:16:49.223999105 +0200 +++ /var/tmp/diff_new_pack.6bE3FT/_new 2026-08-13 13:16:49.231999469 +0200 @@ -3,7 +3,7 @@ <param name="url">https://github.com/armosec/kubescape.git</param> <param name="scm">git</param> <param name="exclude">.git</param> - <param name="revision">refs/tags/v4.0.11</param> + <param name="revision">refs/tags/v4.0.12</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> <param name="changesgenerate">enable</param> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.6bE3FT/_old 2026-08-13 13:16:49.284001830 +0200 +++ /var/tmp/diff_new_pack.6bE3FT/_new 2026-08-13 13:16:49.300002556 +0200 @@ -3,6 +3,6 @@ <param name="url">https://github.com/armosec/kubescape</param> <param name="changesrevision">002e791cd39fed51dd4a86b321c6d184fa672349</param></service><service name="tar_scm"> <param name="url">https://github.com/armosec/kubescape.git</param> - <param name="changesrevision">8fb2eb1db185637c5ea5365dd4c05bea4f165741</param></service></servicedata> + <param name="changesrevision">469969f6bebf46bef5e808b91a4bb46fb2bbf4ed</param></service></servicedata> (No newline at EOF) ++++++ kubescape-4.0.11.obscpio -> kubescape-4.0.12.obscpio ++++++ ++++ 70352 lines of diff (skipped) ++++++ kubescape.obsinfo ++++++ --- /var/tmp/diff_new_pack.6bE3FT/_old 2026-08-13 13:16:57.888392437 +0200 +++ /var/tmp/diff_new_pack.6bE3FT/_new 2026-08-13 13:16:57.896392800 +0200 @@ -1,5 +1,5 @@ name: kubescape -version: 4.0.11 -mtime: 1784729633 -commit: 8fb2eb1db185637c5ea5365dd4c05bea4f165741 +version: 4.0.12 +mtime: 1786522719 +commit: 469969f6bebf46bef5e808b91a4bb46fb2bbf4ed ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/kubescape/vendor.tar.gz /work/SRC/openSUSE:Factory/.kubescape.new.17972/vendor.tar.gz differ: char 27, line 1
