Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package kubescape for openSUSE:Factory checked in at 2026-10-15 12:21:46 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/kubescape (Old) and /work/SRC/openSUSE:Factory/.kubescape.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "kubescape" Thu Oct 15 12:21:46 2026 rev:49 rq:1384920 version:4.0.16 Changes: -------- --- /work/SRC/openSUSE:Factory/kubescape/kubescape.changes 2026-10-01 16:47:33.434328736 +0200 +++ /work/SRC/openSUSE:Factory/.kubescape.new.3698736/kubescape.changes 2026-10-15 12:21:52.521423998 +0200 @@ -1,0 +2,211 @@ +Thu Oct 15 05:02:34 UTC 2026 - Johannes Kastl <[email protected]> + +- Update to version 4.0.16: + * fix(scan): measure full call in fleet timeout test (#4155) + * perf(mcpserver): deduplicate concurrent analysis requests + (#4146) + * fix(exposure): resolve HTTP backend Service ports (#4151) + * fix(imagescan): select newest Azure scan assessment (#4152) + * fix(imagescan): preserve Quay redirect trust across callbacks + (#4150) + * fix(mcpserver): serve MCP initialize before the policy bundle + loads (#4144) + * docs(security-insights): add contribution review policy (#4145) + * test: add unit tests for DeleteCachedConfig selective deletion + (#4139) + * fix(imagescan): guard Harbor and GitLab redirect origins + (#4147) + * fix(networkpolicy): evaluate ipBlock peers against every IP of + a dual-stack pod (#4140) + * fix(imagescan): retain GCP findings on discovery errors (#4149) + * fix(imagescan): validate Harbor image registry ownership + (#4148) + * feat(scan): add --kube-version and --api-versions for Helm + rendering (#4143) + * fix(imagescan): keep Quay credentials within their registry + origin (#4134) + * fix(scan): read SecurityException CRDs only on cluster scans + (#4125) + * feat(mcpserver): add secret exposure detection tool (#4099) + * ci: bump github.com/docker/cli from 29.7.2+incompatible to + 29.9.0+incompatible (#4130) + * ci: bump github.com/kubescape/rbac-utils from 0.0.21 to 0.0.22 + (#4127) + * ci: bump golang.org/x/term from 0.46.0 to 0.47.0 (#4128) + * fix(imagescan): query ECR scans in the image registry region + (#4132) + * ci: bump helm/kind-action from 1.15.0 to 1.15.1 (#4137) + * ci: bump actions/upload-artifact from 7.0.1 to 7.0.2 (#4136) + * ci: bump github.com/quay/claircore from 1.5.54 to 1.6.1 (#4129) + * ci: bump github.com/kubescape/regolibrary/v2 from 2.0.36 to + 2.0.38 (#4126) + * ci: bump mikepenz/action-junit-report from 6.5.0 to 6.6.1 + (#4133) + * ci: bump github/codeql-action/upload-sarif from 4.38.2 to + 4.38.3 (#4135) + * Feat/rbac parity differential testing (#4076) + * fix(deps): upgrade Trivy to address Dependabot alerts (#4131) + * fix(download): include security view frameworks in download + artifacts (#4119) + * feat(mcp): log tool-call metadata at debug level (#4123) + * fix(imagescan): match GitLab findings to exact image identity + (#4122) + * Honor control exclusions in HTTP scans (#4116) + * fix(exposure): respect Gateway listener protocol compatibility + (#4120) + * fix(imagescan): resolve GitLab registry project boundaries + (#4121) + * fix(httphandler): dynamically reload TLS key pair on file + update (#4105) + * feat(fleet): retry clusters whose API server never answered + [LFX 2026] (#4113) + * fix(rbacgraph): handle an empty name in resourceNames as the + authorizer does (#4117) + * fix(mcpserver): harmonize tool argument validation with + structured errors (#4100) + * docs: use the real --values flag for Helm chart scans (#4114) + * ci: skip PR scanner jobs per job instead of by paths-ignore + (#4098) + * test(printer): add regression coverage for secure report file + permissions (#4092) + * feat(mcp): add list_admission_policies tool (#4112) + * fix(exposure): honor Gateway parent listener ports (#4102) + * fix(predict): sort SARIF rules for determinism and improve + report compatibility (#4097) + * fix(exposure): ignore zero-weight Gateway backends (#4101) + * docs(fix): document every --output-dir refusal, and + --interactive (#4110) + * test(pss): expand upstream parity coverage (#4093) + * fix(httphandler): cancel scan on client disconnect in + /v1/metrics (#4039) + * fix(rbacgraph): keep resourceNames restrictions literal (#4088) + * fix(imagescan): query the ECR image owner account (#4090) + * fix(csv): include delete paths in the failed paths column + (#4086) + * fix(exposure): honor Gateway listener hostname intersection + (#4089) + * fix(imagescan): add scan status to vulnerability reports + (#4074) + * fix(predict): create output directories and restrict file + permissions to 0600 (#4083) + * ci: bump google.golang.org/api from 0.297.0 to 0.300.0 (#3961) + * chore(deps): bump github.com/kubescape/go-logger from 0.0.34 to + 0.0.35 (#4084) + * chore(resultshandling): remove dead legacy wrappers superseded + by ResourceCatalog (#4082) + * feat(imagescan): add Red Hat Quay vulnerability adaptor (#4081) + * fix(mcpserver): harden argument validation and bounds for + advanced tools (#4075) + * feat(vulnexposure): account for external exposure in + vulnerability analysis (#4064) + * chore(containerscan): remove unused core/pkg/containerscan + package (#4069) + * docs: document build prerequisites, dependency tracking and + release cadence (#4070) + * fix(install): handle null user PATH and add non-interactive + flags in install.ps1 (#4065) + * fix(cel): collect Namespace context beyond workload filters + (#4062) + * fix(deps): upgrade containerd, cilium and OpenTelemetry to + patched releases (#4066) + * feat(pss): add PSS compliance predictor CLI (#4055) + * fix(e2e): get the E2E run ID from the dispatch response (#4068) + * Fix file permission gosec warnings in httphandler tests (#3924) + * fix(networkpolicy): report hostNetwork pods as unknown instead + of isolated (#4060) + * fix(printer): keep multi-line control remediation inside the + markdown report blockquote (#4061) + * feat(mcpserver): expose scan report comparison via diff_reports + tool (#4040) + * ci(security-insights): migrate to Security Insights v2.2.0 + (#4059) + * fix(storage): skip results with non-RBAC related objects + instead of aborting persistence (#4057) + * fix(imagescan): inspect complete GCP scan status (#4051) + * fix(storage): clear remediated findings on later scans (#4044) + * ci: bump + go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc + from 1.45.0 to 1.47.0 (#4047) + * fix(fix): fix multi-input scans outside git and recreate their + tree under --output-dir (#4054) + * ci: bump sigs.k8s.io/kustomize/kyaml from 0.21.1 to 0.21.2 + (#4049) + * fix(rbacgraph): resolve a ServiceAccount subject without a + namespace in its RoleBinding's namespace (#4053) + * fix(imagescan): keep latest Harbor scan status (#4052) + * ci: bump anchore/sbom-action/download-syft from 0.24.2 to + 0.24.3 (#4050) + * ci: bump github.com/sirupsen/logrus from 1.10.1 to 1.10.2 + (#4045) + * fix(pss): match the Kubernetes Pod Security Standards evaluator + (#4036) + * fix(fleet): report a cluster as unreachable only when it never + answered (#4022) + * fix(opaprocessor): keep rules that compare input objects out of + the incremental cache (#4021) + * feat(printer): include skipped and unevaluated controls in + junit report (#4014) (#4015) + * test: guard against premature Azure ACR DescribeRepositories + mapping (#3972) + * perf(opaprocessor): cache prepared rego evaluation queries to + reduce scan overhead (#4030) + * fix(imagescan): normalize RHSA severity labels in Quay adaptor + (#4035) + * fix(kustomize): allow only builtin plugins when rendering + Kustomizations (#4031) + * fix(mcpserver): reject cross-origin requests to the SSE + transport (#4032) + * fix(httphandler): create scan result files with 0600 and redact + paths from scan errors (#4016) + * fix(policyreport): surface cluster-wide skipped controls and + diagnostics in ClusterPolicyReport (#3989) (#3990) + * feat(mcpserver): add PSS compliance prediction tool (#4011) + * style(fixhandler): gofmt the UnfixedControl struct (#4019) + * fix(prometheus): emit kubescape_resource_count_controls_passed + metric (#4013) + * fix(prometheus): omit complianceScore metric when score is + unset (#4017) (#4018) + * test(ghworkflows): guard go.mod replace directives (#3992) + * fix(httphandler): read metrics results from the prometheus .txt + path (#3981) + * fix(baseline): handle CloseWriter error on success path in + writeBaselineHeadReport (#4006) + * fix(scan): honor --output /dev/null in --kube-contexts fleet + scans (#3846) + * feat(fix): add interactive mode for granular remediation + (#3914) + * fix(image): fail loudly on --exceptions with non-registry + inputs (#3824) + * feat(pss): add Pod Security Standards evaluation library + (#4003) + * fix(core): respect context cancellation in credential retry + loop (#3998) + * fix(imagescan): apply exponential backoff on Quay HTTP 429 when + Retry-After is omitted (#3996) + * feat(printer): surface attack-path priority score and severity + in SARIF result properties (#4004) + * fix(imagescan): record resolved manifest digest into + ImageID.Hash for Quay scans (#3994) + * fix(scan-integrity): fail closed on whole-cluster verify parity + mismatch (#4000) + * fix(partitionstore): prevent critical file descriptor leak in + fdPool.closeAll on flush failure (#3988) + * fix(kustomize): report Kustomize sources relative to the repo + root (#3954) + * feat(printer): add scan coverage to PDF and docs (#3977) + * fix(config): reject empty config set values instead of silently + keeping the old value (#3986) + * feat(pdf): report scan coverage and skipped-control diagnostics + (#3958) (#3959) + * docs: remove deprecated package manager install methods (#3980) + * fix(core): reuse initialized Kubernetes client across scan + interfaces (#3979) + * perf(partitionstore): avoid redundant DeepCopy before disk + serialization in DiskStore.Put (#3971) + * docs: add report metadata protection examples (#3969) + * feat(diff): compare image scan reports to surface new and + resolved vulnerabilities (#3957) + * ci(workflows): remove Codium-ai pr-agent (#3973) + * ci: bump docker/setup-buildx-action from 4.3.0 to 4.4.1 (#3898) + +------------------------------------------------------------------- Old: ---- kubescape-4.0.15.obscpio New: ---- kubescape-4.0.16.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ kubescape.spec ++++++ --- /var/tmp/diff_new_pack.Rx2Kh2/_old 2026-10-15 12:21:56.375585271 +0200 +++ /var/tmp/diff_new_pack.Rx2Kh2/_new 2026-10-15 12:21:56.377585354 +0200 @@ -17,7 +17,7 @@ Name: kubescape -Version: 4.0.15 +Version: 4.0.16 Release: 0 Summary: Tool providing a multi-cloud K8s single pane of glass License: Apache-2.0 ++++++ _service ++++++ --- /var/tmp/diff_new_pack.Rx2Kh2/_old 2026-10-15 12:21:56.426587405 +0200 +++ /var/tmp/diff_new_pack.Rx2Kh2/_new 2026-10-15 12:21:56.431587614 +0200 @@ -3,7 +3,7 @@ <param name="url">https://github.com/armosec/kubescape.git</param> <param name="scm">git</param> <param name="exclude">.git</param> - <param name="revision">refs/tags/v4.0.15</param> + <param name="revision">refs/tags/v4.0.16</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> <param name="changesgenerate">enable</param> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.Rx2Kh2/_old 2026-10-15 12:21:56.462588911 +0200 +++ /var/tmp/diff_new_pack.Rx2Kh2/_new 2026-10-15 12:21:56.466589079 +0200 @@ -3,6 +3,6 @@ <param name="url">https://github.com/armosec/kubescape</param> <param name="changesrevision">002e791cd39fed51dd4a86b321c6d184fa672349</param></service><service name="tar_scm"> <param name="url">https://github.com/armosec/kubescape.git</param> - <param name="changesrevision">16cfe102f11551a6455fe9bf8e37d7083da90484</param></service></servicedata> + <param name="changesrevision">d0ea07bcd9d7ab1640dcd6527d0e68a34f10da0e</param></service></servicedata> (No newline at EOF) ++++++ kubescape-4.0.15.obscpio -> kubescape-4.0.16.obscpio ++++++ ++++ 53962 lines of diff (skipped) ++++++ kubescape.obsinfo ++++++ --- /var/tmp/diff_new_pack.Rx2Kh2/_old 2026-10-15 12:21:59.437713401 +0200 +++ /var/tmp/diff_new_pack.Rx2Kh2/_new 2026-10-15 12:21:59.441713569 +0200 @@ -1,5 +1,5 @@ name: kubescape -version: 4.0.15 -mtime: 1790660939 -commit: 16cfe102f11551a6455fe9bf8e37d7083da90484 +version: 4.0.16 +mtime: 1791974598 +commit: d0ea07bcd9d7ab1640dcd6527d0e68a34f10da0e ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/kubescape/vendor.tar.gz /work/SRC/openSUSE:Factory/.kubescape.new.3698736/vendor.tar.gz differ: char 15, line 1
