Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package kubescape for openSUSE:Factory checked in at 2026-11-06 19:51:46 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/kubescape (Old) and /work/SRC/openSUSE:Factory/.kubescape.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "kubescape" Fri Nov 6 19:51:46 2026 rev:51 rq:1395867 version:4.0.20 Changes: -------- --- /work/SRC/openSUSE:Factory/kubescape/kubescape.changes 2026-10-29 16:10:45.034158740 +0100 +++ /work/SRC/openSUSE:Factory/.kubescape.new.3759290/kubescape.changes 2026-11-06 19:59:07.649071748 +0100 @@ -1,0 +2,247 @@ +Fri Nov 06 13:48:03 UTC 2026 - Johannes Kastl <[email protected]> + +- Update to version 4.0.20: + * fix(exceptions): emit ExceptionMatched events only when allowed + to (#4616) + * fix(cautils): apply positive LARGE_CLUSTER_SIZE fallback to + streaming auto-enable check (#4613) + * fix(vap): bound downloaded CEL policy response body to prevent + DoS (CWE-400) (#4615) + * fix(diff): prevent diff output from overwriting input reports + and validate arguments (#4604) + * fix(version,update): check nil kubescape interface and empty + format validation (#4587) + * fix(scan): reject null entries in contract string lists (#4598) + * fix(policy): treat nil and empty response lists as equal in + policy test (#4612) + * fix(rules): match RBAC subresource grants the way the + authorizer does (#4610) + * fix(rules): stop reporting cluster-scoped grants made through + RoleBindings (#4611) + * fix(resourcehandler): bound HTTP response body in httpGet to + prevent DoS (CWE-400) (#4594) + * fix(imagescan): preserve source selectors in registry fallback + (#4600) + * fix(config): enforce Cobra argument bounds on config set + command (#4590) + * fix(fixhandler): bound and validate report file reads to + prevent DoS (CWE-400) (#4592) + * fix(scan): reject Helm and file-path flags on image scans + (#4588) + * fix(scan): reject namespace and resource kind filter flags on + workload scan (#4602) + * fix(scan): prevent contract validation from overwriting input + (#4596) + * fix(scan): prepare local inputs and validate stdin for root and + security view scans (#4584) + +------------------------------------------------------------------- +Thu Nov 05 18:33:43 UTC 2026 - Johannes Kastl <[email protected]> + +- Update to version 4.0.19 (.18 was not released): + * chore(security): declare secret-scanning tooling in + security-insights.yml (#4581) + * fix(opaprocessor): harden incremental cache correctness (#4580) + * fix(rbac): require an authorized username for group + impersonation (#4578) + * fix(mcpserver): collect complete vulnerability payloads for + exposure analysis (#4579) + * fix: prevent resource loss across multiple scan input roots + (#4575) + * fix: clean up exceptions temp files on rejected REST scans + (#4574) + * feat(mcpserver): enforce workspace boundary containment for + local IaC scans (#4558) + * fix(download): reject extraneous positional arguments and + enhance tests (#4547) + * ci: bump mikepenz/action-junit-report from 6.6.1 to 6.6.2 + (#4569) + * fix(scan): reject conflicting --file-path flag with positional + paths in framework and control scans (#4571) + * ci: bump k8s.io/pod-security-admission (#4564) + * ci: bump sigs.k8s.io/controller-runtime from 0.24.0 to 0.25.2 + (#4566) + * fix(fix): honor command output writer in cluster fixes and add + nil-safety check (#4570) + * ci: bump + go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp + (#4568) + * ci: bump github.com/schollz/progressbar/v3 from 3.13.0 to + 3.19.1 (#4567) + * ci: bump github.com/kubescape/regolibrary/v2 from 2.0.38 to + 2.0.39 (#4565) + * ci: bump sigs.k8s.io/kustomize/kyaml from 0.21.2 to 0.21.3 + (#4363) + * feat(httphandler): require service-account tokens, authorize + with RBAC (#4546) + * refactor(pathcontainment): extract canonical workspace + containment engine and symlink validation (#4533) + * feat(printer): add KEV and EPSS to SARIF, JUnit and Prometheus + image output (#4520) + * fix(diff): honor command output writer and propagate + destination writer (#4556) + * fix(scan): route fleet scan summary output through configurable + writer (#4554) + * fix(download): reject extraneous positional arguments across + policy targets (#4555) + * fix(patch): standardize positional argument validation with + cobra.NoArgs (#4553) + * fix(scan): validate --control-timeout against --scan-timeout + and reject posture control flags on image scan (#4563) + * fix(helm): include install-only resources in chart scans + (#4559) + * ci: bump github.com/open-policy-agent/opa from 1.19.0 to 1.22.0 + (#4527) + * fix(scan): reject namespace, kind, label, incremental, and + dry-run flags on image scans (#4551) + * feat(componentvulns): assess node kernels against distro + advisories (#4552) + * fix(operator): reject unexpected arguments in operator scan + commands (#4561) + * feat(fix): colorize expected patch preview, resource labels, + and unfi… (#4519) + * fix(scan): require --baseline for baseline flags and validate + granularity upfront (#4549) + * feat(operator-scan): trigger through OperatorCommand CRs + (#4545) + * ci(security-insights): add OSPS Baseline scanner (#4094) + (#4544) + * fix(scan): validate and normalize output format in + validate-contract (#4542) + * ci: publish OSPS Baseline results to grc.store (#4094) (#4543) + * docs: clarify private vulnerability reporting for CRA readiness + (#4227) + * fix(prerequisites): reject extraneous positional arguments and + enhance command tests (#4537) + * fix(scan): reject coverage, degraded-config, controls-config, + and baseline-granularity flags on image scans (#4539) + * fix(predict): honor command output writer and normalize format + in predict pss (#4535) + * fix(list): normalize policy target aliases, singular forms, and + case-insensitivity (#4540) + * fix(prerequisites): reject unexpected positional arguments + (#4536) + * fix(kustomize): enforce output safety, atomic publication, + namespace matching, and value parity (#4412) + * fix(policy): don't overwrite existing files in policy init + without --… (#4502) + * feat(policy): read control inputs from a case's data.json in + policy test (#4531) + * fix(list): honor command output writer and reject unexpected + arguments (#4529) + * Remove unused cliinterfaces package (#4530) + * test(getter): add unit tests for control identifier matching + (#4493) + * fix(vap): normalize and validate output format in list-policies + (#4485) + * feat(imagescan): add --fail-on-kev and --epss-threshold risk + gates (#4453) + * fix(imagescan): invalidate ECR sessions during teardown (#4513) + * fix(fix): reject --output-post-renderer without + --output-kustomize (#4504) + * fix(scan): keep the source of a single JSON or Terraform file + (#4515) + * test(getter): add unit tests for default control inputs (#4495) + * ci: bump actions/upload-artifact from 7.0.1 to 7.0.2 (#4526) + * fix(vap): honor command output writer, reject unexpected + arguments, and validate non-negative timeout (#4483) + * test(fix): add tests for control-selection flags (#4481) + (#4484) + * feat(rules): add modify-admission-webhooks-v1 (#4509) + * fix(imagescan): report missing GitLab vulnerability connections + (#4512) + * fix(policy): report the flagged field of scaffolded rules in + deletePaths (#4505) + * fix(config): honor command output writer and reject unexpected + arguments (#4517) + * ci: bump the kubernetes group with 4 updates (#4522) + * fix(version): reject extraneous arguments and normalize output + format (#4486) + * fix: propagate labels and annotations in scan_resource_slice + (#4497) + * ci: bump github.com/mark3labs/mcp-go from 1.0.0 to 1.4.0 + (#4523) + * fix(policy): read JSON fixture inputs in policy test (#4506) + * test(cautils): add unit tests for scan-contract provenance + helpers (#4491) + * docs(fleet): measure fleet scans of 1, 5 and 10 clusters [LFX + 2026] (#4487) + * test(anonymizer): cover mapping transformer (#4508) + * fix(scan): reject baseline and compliance threshold flags on + image scans (#4499) + * ci: bump revanite-io/osps-baseline-action from 1.5.3 to 1.5.4 + (#4525) + * ci: bump github.com/gabriel-vasile/mimetype from 1.4.13 to + 1.4.16 (#4524) + * fix: isolate exception and control input caches by source + (#4489) + * fix(scan): normalize output formats and allow case-insensitive + formats (#4521) + * fix(policy): don't print usage when policy test or init fails + (#4507) + * fix(imagescan): reject missing Quay security reports (#4511) + * docs(cli-reference): document missing scan, fix, patch, list + and vap … (#4385) + * feat(vap): colorize list-policies table headers, control IDs, + and parameter badges (#4476) + * feat(cli): highlight version badges, commit hashes, and update + notices (#4473) + * test: cover skipped workload ordering (#4480) + * test: cover vulnerability fix availability combinations (#4478) + * fix(predict): locate local PSS findings in their manifest files + in SARIF (#4465) + * test: cover vulnerability severity sort order (#4459) + * feat(componentvulns): expose cluster component vulnerabilities + as external resources (#4466) + * Fix typos in swagger descriptions, comments and GCP example + script (#4462) + * test: cover deterministic finding ordering (#4461) + * fix: apply image scan severity filters (#4455) + * test: cover negligible vulnerability severity filtering (#4457) + * fix(diff): normalize and validate output format and severity + threshold (#4463) + * fix(update): honor command output writer, normalize format, and + reject extraneous arguments (#4471) + * fix(imagescan): keep Azure scan sessions consistent (#4445) + * fix(imagescan): protect GCP clients while scans are active + (#4447) + * fix: try all matching image pull secret credentials (#4452) + * docs: fix dead links in README, MCP server, getting started and + Krew docs (#4469) + * fix(config): trim whitespace around keys in config view and + delete (#4474) + * feat(opa): add cosign.verify_keyless for keyless-signed images + in C-0236 (#4449) + * fix(mcpserver): validate arguments, port range, and transport + early (#4468) + * fix(mapreconcile): honor definite exclusions before unknown + labels (#4446) + * fix(scan): validate --view flag and reject for image scans + (#4442) + * test(fleet): end to end fleet scans against fake clusters + (#4451) + * feat(config): colorize config validate overall status and + diagnostic checks (#4437) + * test(scancache): cover version key part boundaries (#4428) + * fix(predict): protect PSS input manifests from report + overwrites (#4448) + * fix(pss): match local workloads by API group as well as kind + (#4433) + * fix(update): report up-to-date releases and "dev" builds + correctly (#4434) + * fix(imagescan): protect GCP sessions during active scans + (#4444) + * fix(scan): stop a timed out scan during setup (#4431) + * fix(scan): reject posture control and rule flags on image scans + (#4440) + * fix(printer): normalize Windows paths in CI outputs (#4439) + * fix(download): validate and trim identifier whitespace (#4432) + * fix(imagescan): keep Azure scans on one authenticated session + (#4443) + * feat(config): add cyan keys, white values, and yellow secret + masks to config view (#4406) + * fix(scan): preserve inline YAML document starts (#4414) + * ci: run the OSPS Baseline scan on push to master and weekly + (#4425) + +------------------------------------------------------------------- Old: ---- kubescape-4.0.17.obscpio New: ---- kubescape-4.0.20.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ kubescape.spec ++++++ --- /var/tmp/diff_new_pack.fu5pnX/_old 2026-11-06 19:59:12.837288930 +0100 +++ /var/tmp/diff_new_pack.fu5pnX/_new 2026-11-06 19:59:12.841289098 +0100 @@ -17,14 +17,14 @@ Name: kubescape -Version: 4.0.17 +Version: 4.0.20 Release: 0 Summary: Tool providing a multi-cloud K8s single pane of glass License: Apache-2.0 URL: https://github.com/armosec/kubescape Source: kubescape-%{version}.tar.gz Source1: vendor.tar.gz -BuildRequires: go1.26 >= 1.26.10 +BuildRequires: go1.27 >= 1.27.3 %description Kubescape is a K8s open-source tool providing a multi-cloud K8s single pane of ++++++ _service ++++++ --- /var/tmp/diff_new_pack.fu5pnX/_old 2026-11-06 19:59:12.917292279 +0100 +++ /var/tmp/diff_new_pack.fu5pnX/_new 2026-11-06 19:59:12.924292572 +0100 @@ -3,7 +3,7 @@ <param name="url">https://github.com/armosec/kubescape.git</param> <param name="scm">git</param> <param name="exclude">.git</param> - <param name="revision">refs/tags/v4.0.17</param> + <param name="revision">refs/tags/v4.0.20</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> <param name="changesgenerate">enable</param> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.fu5pnX/_old 2026-11-06 19:59:12.981294958 +0100 +++ /var/tmp/diff_new_pack.fu5pnX/_new 2026-11-06 19:59:12.990295335 +0100 @@ -3,6 +3,6 @@ <param name="url">https://github.com/armosec/kubescape</param> <param name="changesrevision">002e791cd39fed51dd4a86b321c6d184fa672349</param></service><service name="tar_scm"> <param name="url">https://github.com/armosec/kubescape.git</param> - <param name="changesrevision">254e33777f12c729132b2d78d549a2ff9c881cec</param></service></servicedata> + <param name="changesrevision">ec65d3184f6bab7d1ad6e5db9d970d452316d253</param></service></servicedata> (No newline at EOF) ++++++ kubescape-4.0.17.obscpio -> kubescape-4.0.20.obscpio ++++++ ++++ 44896 lines of diff (skipped) ++++++ kubescape.obsinfo ++++++ --- /var/tmp/diff_new_pack.fu5pnX/_old 2026-11-06 19:59:17.964503559 +0100 +++ /var/tmp/diff_new_pack.fu5pnX/_new 2026-11-06 19:59:17.973503936 +0100 @@ -1,5 +1,5 @@ name: kubescape -version: 4.0.17 -mtime: 1793181813 -commit: 254e33777f12c729132b2d78d549a2ff9c881cec +version: 4.0.20 +mtime: 1793968987 +commit: ec65d3184f6bab7d1ad6e5db9d970d452316d253 ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/kubescape/vendor.tar.gz /work/SRC/openSUSE:Factory/.kubescape.new.3759290/vendor.tar.gz differ: char 13, line 1
