What kubescape/kubescape shipped

Kubescape v4.0.20 is out. Scan, diff, fix and validate-contract outputs no longer overwrite the inputs they read, RBAC rules match subresource grants the way the authorizer does, and delete paths show their current value with --show-evidence.

Kubescape v4.0.20 is out. This week's changes focus on protecting the files you already have: scan, diff, fix and validate-contract outputs are now checked so they cannot overwrite input manifests, reports, exceptions files, custom rules or Helm values. Other changes include bounded reads for report and downloaded policy data, RBAC rules that match subresource grants the way the authorizer does, no more cluster-scoped RoleBinding grants reported by node-proxy-access-v1 and create-persistentvolumes-v1, no external IP path on headless or ExternalName Services, and current values for delete paths in show-evidence. A JSON schema for the fleet report was also added.

V4.0.17 is out. Also this week: image scans try all matching pull secrets and honor severity filters, predict pss writes SARIF that GitHub Code Scanning can ingest, scan timeouts stop during setup, and C-0236 gains keyless cosign verification.

Kubescape v4.0.17 is released. This week's changes also cover several scan and predict fixes: image scans now try every matching pull secret credential and apply min-severity and max-severity filters to printed findings, predict pss produces SARIF with physical locations for GitHub Code Scanning and no longer overwrites its input manifests, and a timed out scan stops during setup instead of waiting on slow cluster requests. On the feature side, component vulnerability scanning exposes cluster components as external resources, and C-0236 gains a cosign.verify_keyless builtin with a trustedCosignIdentities control input.

This week: a library-only attack-path package, fleet settings from a config file, and EPSS plus CISA KEV in image scan output. Fixes cover dropped manifests in repository scans, coverage that ignored policy selectors, closed ECR findings still reported, and CEL recursion detectio

This week's changes to Kubescape include new library work: a shared attack-path analysis package with no CLI changes, fleet settings that can be read from a config file, and EPSS scores plus CISA KEV status in image scan output. The release also fixes several cases where results were quietly wrong. Repository scans no longer discard an independent manifest when a Kustomize output shares its identity. Resource coverage now honors policy selectors, not only binding selectors. Image scanning no longer reports ECR enhanced findings marked CLOSED. CEL evaluation treats empty YAML fields as unset and detects recursive variable references instead of recursing.

This week: Helm chart scans no longer build dependencies implicitly, conflicting include and exclude namespace flags are rejected, CSV reports neutralize formula cells, and v1 JSON reports are deterministic. Fleet runs now use graded exit codes.

This week in Kubescape: Helm chart scanning no longer invokes Helm's dependency manager, so scans stop fetching remote dependencies and writing into the scanned checkout. kubescape scan now rejects conflicting include and exclude namespace flags. CSV reports neutralize cells that begin with formula characters, and pretty, markdown, HTML and v1 JSON reports are emitted in a stable order. kubescape diff validates report files and caps reads at 64 MiB. JSON and YAML results resolve evidence from delete and review paths, and v1 reports carry those paths again. Fleet runs with kube-contexts now report graded exit codes so CI can tell a failed gate from a cluster that was never scanned.

This week: kubescape predict pss for Pod Security Standards, a Quay image vulnerability adaptor, external exposure in vulnerability analysis, hostNetwork pods reported as unknown, and patched containerd, cilium and OpenTelemetry. Plus stricter Kustomize plugin rendering and 0600

This week in Kubescape: a new kubescape predict pss command predicts Pod Security Standards compliance for namespaces and workloads with pretty, table, JSON, SARIF and JUnit output. A Red Hat Quay adaptor joins container image vulnerability scanning, and vulnerability exposure analysis now counts workloads reachable externally through a Service, Ingress or Gateway API route. NetworkPolicy reachability reports hostNetwork pods as unknown rather than isolated, and containerd, cilium and OpenTelemetry were upgraded to patched releases. On the hardening side, Kustomization rendering now allows only builtin plugins and scan output files are created with 0600 permissions.

V4.0.15 ships Pod Security Standards evaluation, Quay registry scanning, image report diffing, interactive fix mode, and fixes for file descriptor leaks and O(N²) bottlenecks in image scanning.

Kubescape v4.0.15 is out. This release introduces Pod Security Standards evaluation for Kubernetes v1.31, production-grade Quay registry scanning, and the ability to diff image vulnerability reports. We also added interactive remediation mode, fixed critical resource leaks and performance bottlenecks in image scanning, and improved whole-cluster policy verification to fail safely on parity mismatches.

Kubescape improved scan reliability this week: fixed incremental cache reuse bugs, added fleet scan summaries, strengthened image signature verification, and enabled runtime namespace filter updates without restarts.

This week's Kubescape updates focus on reliability and operational improvements. Critical fixes prevent incremental scans from reusing verdicts incorrectly when policies read status fields or when scan context changes. Fleet scans now print human-readable summaries. Image signature verification now validates digest matching. Namespace filters reload at runtime. Network policy analysis correctly requires matching ports. These changes ensure scan results stay consistent and accurate across different contexts.

Fleet scanning gets its first dedicated reports: see compliance rollup, control disagreement, and per-cluster findings in one file. Memory now bounded during large scans. Azure ACR auth chain and stricter CVE validation for images.

Kubescape fleet scanning now has dedicated multi-cluster reports showing fleet-wide compliance, which controls clusters disagree on, and per-cluster detail—no more opening individual files to compare. Streaming resource collection now bounds memory with partition storage. Image scans validate vulnerability freshness and unknown-severity CVEs. Azure Container Registry gains full credential chain support.