What kubescape/kubescape shipped
Generated by FoxPlug from public activity — not affiliated with Kubescape.
Week of September 14, 2026
What shipped
- Added `--fleet-report` flag to write a combined report across multiple `--kube-contexts` scans instead of separate reports per context. Pull request #3815
- Fleet reports now highlight which controls clusters disagree on, making it easier to spot divergence in a fleet. Pull request #3878
- Fleet reports now include a fleet-wide compliance rollup score instead of requiring manual calculation from per-cluster figures. Pull request #3852
- Introduced partition and spill store engine to bound memory usage during streaming resource collection on disk. Pull request #3818
- Wired partition store into streaming collector so resource batches no longer all accumulate in heap memory at once. Pull request #3863
- Image scanning now supports full Azure credential chain for ACR authentication including service principals, managed identity, and workload federation. Pull request #3853
- Updated embedded CEL admission-policy bundle from v0.14 to v0.15 with new Agent Runtime policies for Sandbox and Substrate resources. Pull request #3871
- Fleet reports are now written atomically to prevent corruption if a write fails partway through. Pull request #3849
- Added line number resolution for delete and review paths in `--show-evidence` output, completing coverage of all three remediation path types. Pull request #3830
- Fixed stalled pagination loops when Kubernetes API servers return the same continuation token multiple times. Pull request #3859
Why it matters
Fleet scanning now has dedicated reporting that shows agreement and disagreement across clusters at a glance, addressing a major pain point for multi-cluster operators. Memory efficiency improvements enable scanning very large clusters without unbounded heap growth. Image scanning gains better credential support and stricter vulnerability validation.
Changelog entry
- Add `--fleet-report` flag to generate a single combined report across multiple Kubernetes contexts Pull request #3815
- Fleet reports now identify which controls clusters disagree on Pull request #3878
- Fleet reports include fleet-wide compliance score rollup Pull request #3852
- Introduce partition and spill store engine for bounded memory in streaming collection Pull request #3818
- Integrate partition store into streaming collector to reduce heap pressure Pull request #3863
- Support Azure DefaultAzureCredential chain for ACR image authentication Pull request #3853
- Update CEL admission-policy bundle to v0.15 with Agent Runtime policies Pull request #3871
- Write fleet reports atomically to prevent corruption on write failures Pull request #3849
- Resolve line numbers for delete and review remediation paths in evidence output Pull request #3830
- Fix infinite pagination loops from duplicate Kubernetes API continuation tokens Pull request #3859
- Support nested Harbor repository paths in image scanning Pull request #3860
- Warn when incompatible flags combine with anonymized source paths in evidence Pull request #3830
- Skip evidence lines when source paths are anonymized Pull request #3830
- Persist workload scan report timestamps to spec.metadata.report.createdAt Pull request #3869
- Fix panic from negative nodeIndex values in location resolver Pull request #3874
- Fix misleading skip log and severity loop break in image processing Pull request #3848
- Restore fleet context after runner panic instead of leaving stale context Pull request #3856
- Stop printing usage text when patch severity threshold validation fails Pull request #3857
- Skip IaC scan tests when offline policies are missing to prevent CI failures Pull request #3806
Fleet scanning gets its first dedicated reports: see compliance rollup, control disagreement, and per-cluster findings in one file. Memory now bounded during large scans. Azure ACR auth chain and stricter CVE validation for images.
Kubescape fleet scanning now has dedicated multi-cluster reports showing fleet-wide compliance, which controls clusters disagree on, and per-cluster detail—no more opening individual files to compare. Streaming resource collection now bounds memory with partition storage. Image scans validate vulnerability freshness and unknown-severity CVEs. Azure Container Registry gains full credential chain support.