kyverno Release Notes

What's Changed

• fix: limit intermediate certs to mitigate CVE-2026-32280 by @atharrva01 in #15858
• ci: fix cosign releaser step by @lucchmielowski in #15932
• chore(deps): bump github.com/rs/zerolog from 1.35.0 to 1.35.1 by @dependabot[bot] in #15917
• Feat/cli apply cross resource by @SargamPuram in #15846
• automate stale PR updates by @JimBugwadia in #15942
• fix: revert 15880 - support httpAllowList and httpBlockList for cluster-scoped policies by @JimBugwadia in #15960
• fix permissions for pr-branch-updater by @JimBugwadia in #15967
• use existing PR updater token by @JimBugwadia in #15974
• chore(deps): bump goreleaser/goreleaser-action from 7.1.0 to 7.2.1 by @dependabot[bot] in #15976
• chore(deps): bump aquasecurity/trivy-action from 0.35.0 to 0.36.0 by @dependabot[bot] in #15943
• update blocklist to allow in-cluster HTTP calls by @JimBugwadia in #15973
• chore(deps): bump github.com/Azure/go-ntlmssp from 0.0.0-20221128193559-754e69321358 to 0.1.1 by @dependabot[bot] in #15954
• chore(deps): bump github.com/aptible/supercronic from 0.2.43 to 0.2.45 by @dependabot[bot] in #15961
• ci: Fix http conformance test blocklist by @lucchmielowski in #15986
• Add mpol handler gap tests (namespaced, exception, failurePolicy, dry-run, backgroundSA) by @rx18-eng in #15733
• chore: update available versions in issues by @lucchmielowski in #15996
• test: add dpol controller integration tests by @rx18-eng in #15859
• test: add gpol exception and CEL edge case integration tests by @rx18-eng in #15787
• refactor: drop reliance on EnvSet in favor of in-library versioning by @aerosouund in #16014
• fix(jmespath): prevent panic in label_match on nested structures by @pulkitvats2007-crypto in #15827
• fix: retry on conflict when updating policy status by @williamclot in #15754
• fix: restart dynamic watchers in background reporting on 410 by @aerosouund in #16028
• chore: add framework tests github workflow by @aerosouund in #15743
• fix: support cluster-scoped resource generation in GeneratingPolicy by @realshuting in #16018
• fix: pass AdmissionRequest to updaterequests for mutate existing policy by @realshuting in #16050
• fix(cli): fix resource lookup for MutatingPolicy, GeneratingPolicy and DeletingPolicy in test command by @SargamPuram in #15784
• ci: skip framework tests on docs-only and helm-only PRs by @rx18-eng in #16088
• fix(cli): add generatedResources field for GeneratingPolicy multi-resource tests by @SargamPuram in #16034
• Fix/cli multiple json payloads by @SargamPuram in #15584
• feat(cli): add offline mock support for http mock request/response for GET method and global context entries by @SargamPuram in #15948
• chore: add new gpol samples by @realshuting in #16097
• fix: validate name field in globalReference context entry by @atharrva01 in #16003
• fix(gctx): correctly track per-loader load state to avoid skipping LoadData by @liuxu623 in #16099
• fix: skip report creation for subresources with empty name/UID by @realshuting in #16114
• feat: add updaterequest total gauge metric by @realshuting in #16115
• feat(helm): support extraArgs in CRDs migration job by @Suhani95 in #16132
• feat: add non-goals by @realshuting in #16144
• chore: point to security assessments by @realshuting in #16145
• chore: update dependency policy by @realshuting in #16150
• fix(engine/vpol): include CEL validation expression index in policy report properties by @Rohanraj123 in #15916
• feat(helm): add optional PrometheusRule template by @realshuting in #16155
• chore: clarify performance baselines by @realshuting in #16154
• feat: update api docs by @realshuting in #16143
• feat: add NOTICE and embed attribution in container images by @realshuting in #16151
• feat: add opertional runbook by @realshuting in #16149
• feat(cli): add offline mock support for k8sresource-backed global context entries via inline and external resource manifests by @SargamPuram in #16123
• fix(helm): reportsServer.enabled=true fails with "Image tags must be strings" by @yashrajshuklaaa in #16167
• fix(Makefile): wire readiness-checker into local kind dev workflow by @mastersans in #16181
• test: add NewTestEnvWithOptions for opt-in policy type wiring by @rx18-eng in #16005
• fix(namespacedmutatingpolicy): fix crash loop, missing status, and recorder key by @sandert-k8s in #16055
• docs(perf-testing): add v1.18.1 CEL admission latency benchmarks and reorganize perf-testing layout by @realshuting in #16197
• test: add additional dpol controller integration tests by @rx18-eng in #15966
• ci: cache envtest binaries between framework test runs by @rx18-eng in #16110
• fix(dpol): apply namespaceSelector against Namespace resource own labels by @realshuting in #16200
• fix: do not abort required validation on non-matching images by @lucchmielowski in #16208
• fix(cli): allow multiple CRDs in to be in the --crd-path file by @the-technat in #16161
• test(integration): migrate gpol sync-clone scenarios from chainsaw by @rx18-eng in #16206
• fix: add the readiness checker to the ci image archive by @aerosouund in #16220
• fix: add access to clusterroles and bindings in the standard kyverno config by @aerosouund in #16219
• feat: Enable Cosign verbosity debugging by @naseyro in #16207
• chore: regenerate CRDs and docs after GHSA-79gf-7frw-68m9 API bump by @realshuting in #16241
• ci: bump codecov-action to v6.0.2 to fix uploader GPG key verification by @rx18-eng in #16273
• fix: support cel exception in cli apply 'exceptions-within-resources' by @bakito in #16178
• docs: fix duplicated word in cleanuppolicy validateAuth comment by @s3onghyun in #16279
• return correct results for NotEquals type mismatch cases by @7se7en72025 in #16276
• feat(cli): support multiple CRD paths and hook CRD processor into test command by @asiyani in #15824
• fix: wire gpolEngine and gpolProvider into policyController by @yashrajshuklaaa in #16171
• fix: nil pointer panic in getGpolTriggers on ListResource error by @senutpal in #16245
• chore(deps): bump github/codeql-action from 4.35.2 to 4.35.4 by @dependabot[bot] in #16045
• Fix UR regression by @avoidik in #16280
• Fix context and SyncWatchers race conditions in GeneratingPolicy by @Aneesh-Hegde in #16041
• feat(pss-helm): add image to allowed volumetypes by @yehlo in #15906
• fix(generate): batch UpdateRequests to avoid etcd size limit by @vmsilvamolina in #15872
• fix(policy): apply orphanDownstreamOnPolicyDelete to clone cleanup by @realshuting in #16329
• fix(background): remove dead watcher entry on goroutine exit by @Ebraam-Ashraf in #16130
• fix(deps): bump golang.org/x/crypto to v0.53.0 and x/net to v0.56.0 to resolve security CVEs by @realshuting in #16340
• fix(generate): support NamespacedGeneratingPolicy end-to-end by @realshuting in #16338
• feat: honor expired CEL PolicyExceptions by @realshuting in #16299
• fix(background): scan NamespacedImageValidatingPolicy resources too by @Proximyst in #16301
• fix: validate stdin across apply paths by @karthikmanam in #16347
• feat(cli): add CEL http.Post mocking test fixtures, duplicate validation check, and integration tests by @SargamPuram in #16297
• fix(helm): serialize gh-pages publishes to prevent missing kyverno-policies releases by @ANAMASGARD in #16291
• chore(deps): bump actions/cache from 5.0.3 to 6.1.0 by @dependabot[bot] in #16371
• fix: upgrade go toolchain to 1.26.3 to resolve CVE-2026-39836 by @aditip149209 in #16361
• fix(deps): upgrade ristretto to v2 by @chimanjain in #16360
• fix: unblock ko image publish by replacing escaping kodata symlinks by @realshuting in #16381
• chore(workflow): dynamically discover active branches for Trivy issue sync by @realshuting in #16377
• fix CEL autogen namespace replacement by @dag-andersen in #16039
• fix(gpol): support mixed-type aggregate literals in CEL variables by @realshuting in #16339
• docs: fix README workflow badge and AI policy link by @ObaidAbdullah16 in #16162
• fix(deps): bump rekor and in-toto-golang for codeql alerts by @realshuting in #16394
• test: fix webhook registration typo by @ObaidAbdullah16 in #16164
• feat: support skipBackgroundRequests for CEL mpol/gpol by @realshuting in #16369
• test(chainsaw): fix NIVP background + clone-multiple-targets setup by @realshuting in #16399
• chore: update pond dependency to v2 by @chimanjain in #16379
• chore(deps): bump goreleaser/goreleaser-action from 7.2.1 to 7.2.3 by @dependabot[bot] in #16402
• Update backoff v7 by @khiemdoan in #16405
• Don't initialize rekor client for key or certificate based scenarios by @aerosouund in #16415
• chore(deps): bump fluxcd/flux2 from 2.8.5 to 2.8.6 by @dependabot[bot] in #15939
• test(chainsaw): fix clone-multiple-targets dynamic lookup fixture by @realshuting in #16414
• chore(deps): bump github.com/onsi/gomega from 1.39.1 to 1.40.0 by @dependabot[bot] in #15991
• chore(deps): bump golang.org/x/net from 0.48.0 to 0.55.0 in /hack/controller-gen by @dependabot[bot] in #16420
• test(integration): add YAML fixture loaders for the framework by @rx18-eng in #16229
• fix: preserve cluster-scoped generated resources by @Suhani95 in #16362
• fix(deps): patch ORAS and sigstore CodeQL vulnerabilities by @realshuting in #16426
• feat(gpol): support useServerSideApply for GeneratingPolicy by @realshuting in #16403
• fix(api): use allPath instead of anyPath in m.All validation loop by @Utkal059 in #16296
• fix: prevent ivpol webhook reconciliation loop on platforms that normalize namespaceSelector Fixes #16256 by @pyd-07 in #16258
• fix(ci): use server-side apply for conformance CRD refresh by @realshuting in #16429
• fix: add sorting for ivpol targets by @1vanden in #16252
• fix(webhook): sort fine-grained policies to prevent continuous shuffle to the WebhookConfiguration's order by @InsomniaCoder in #15865
• fix(ci): force conflicts when server-side applying conformance CRDs by @realshuting in #16432
• fix(background-controller): wire MutatingPolicy and NamespacedMutatingPolicy into background scan by @sandert-k8s in #16255
• fix(reports): correct label prefix for mpol/dpol policies by @atharrva01 in #16452
• fix: ImageValidatingPolicy fails in air-gapped environments with insecureIgnoreTlog by @hugolevino in #16298
• fix(cli): surface GeneratingPolicy CEL errors when metadata.uid is missing by @ANAMASGARD in #16287
• chore(deps): bump github/codeql-action/upload-sarif from 4.35.4 to 4.36.3 by @dependabot[bot] in #16442
• chore(deps): bump fossas/fossa-action from 1.9.0 to 2.0.0 by @dependabot[bot] in #16441
• fix: resolve context leak in dynamic resource watcher by @AftAb-25 in #16087
• feat(gpol): add auditAnnotations support to GeneratingPolicy by @realshuting in #16505
• fix: add policies.kyverno.io resources to aggregate policy roles by @volantebjb in #16239
• fix: address open CodeQL security vulnerabilities by @realshuting in #16528
• chore(deps): bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.0 by @dependabot[bot] in #16516
• chore(deps): bump actions/labeler from 6.0.1 to 6.2.0 by @dependabot[bot] in #16515
• Migrate yaml package gopkg.in/yaml.v2 to go.yaml.in/yaml/v3 by @chimanjain in #16511
• fix: skip reports RBAC check when background scanning is disabled by @p-fruck in #16490
• fix(readiness-checker): guard nil EndpointConditions.Ready to prevent panic by @rootp1 in #16544
• chore(deps): bump cbrgm/cleanup-stale-branches-action from 1.2.8 to 1.2.9 by @dependabot[bot] in #16010
• chore(deps): bump the otel group across 1 directory with 4 updates by @dependabot[bot] in #16539
• chore(deps): bump Homebrew/actions/limit-pull-requests from 9ceb7934560eb61d131dde205a6c2d77b2e1529d to 18fcb8e3e06b4247c676c506750dc95ea7226479 by @dependabot[bot] in #16562
• Test(conformance): pin Sigstore scaffolding version and remove redundant UR cleanup by @Suhani95 in #16572
• fix: resolve wildcard apiVersions GVR to GVK mapping failure in getGpolTriggers by @Karthikk-18 in #16525
• chore(deps): bump fluxcd/flux2/action from 2.8.6 to 2.9.2 by @dependabot[bot] in #16573
• chore(deps): bump github.com/google/cel-go from 0.28.0 to 0.29.2 by @dependabot[bot] in #16575
• fix(chart): wire cleanup controller core extra resources by @Suhani95 in #16165
• fix(admissionpolicy): set a background user so CEL request.userInfo.username is available during scans by @rx18-eng in #16561
• chore(deps): bump cbrgm/cleanup-stale-branches-action from 1.2.9 to 1.2.11 by @dependabot[bot] in #16574
• fix: avoid mutating policy webhook name collisions by @realshuting in #16578
• fix: add missing reportProperties to v2beta1 Rule by @zyzzmohit in #15564
• test(integration): single-pass report aggregation helper + flagship test by @rx18-eng in #16244
• ci: add Semgrep SAST workflow by @IceCodeBear in #16464
• fix(helm): handle null image tags in _image.tpl and fix reports-server defaultTag by @AftAb-25 in #16063
• chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by @dependabot[bot] in #16576
• fix: key generate test clone sources by policy by @Suhani95 in #16450
• Fix: require --resource for migrate command by @Suhani95 in #16471
• fix(admissionpolicy): default userInfo groups and uid during background scans by @rx18-eng in #16592
• chore(deps): bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.0 by @dependabot[bot] in #16598
• fix: handle whitespace in mpol autogen Object constructor by @santhil-cyber in #16292
• chore(deps): bump github.com/aptible/supercronic from 0.2.45 to 0.2.47 by @dependabot[bot] in #16599
• chore(deps): bump github.com/sigstore/sigstore-go from 1.1.4 to 1.2.2 by @dependabot[bot] in #16600
• fix: suppress PolicyReport skip entries for ValidatingPolicy matchConditions non-matches by @pyd-07 in #16588
• fix(mpol): handle DELETE target expression using oldObject by @realshuting in #16610
• fix(webhook): serve NamespacedImageValidatingPolicy admission at right paths by @rx18-eng in #16611
• fix(perf-testing): eliminate data race on shared err variable in pod creation goroutines by @Goutham-Annem in #16630
• fix: add subtests and fix typo in ext/wildcard/match_test.go by @Iqrima in #16625
• fix: resolve error shadowing in SplitDocuments signature by @Iqrima in #16632
• fix: CustomNamespaceLister.List honors the label selector by @7se7en72025 in #16628
• chore(deps): bump github.com/dgraph-io/ristretto/v2 from 2.4.0 to 2.4.2 by @dependabot[bot] in #16621
• chore(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.1 by @dependabot[bot] in #16619
• ci: migrate pr-branch-updater to GitHub App auth by @JimBugwadia in #16662
• chore(deps): bump github.com/cyphar/filepath-securejoin from 0.6.1 to 0.7.0 by @dependabot[bot] in #16620
• fix(mpol): allow ApplyConfiguration to mutate atomic lists and structs by @rx18-eng in #16509
• chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 by @dependabot[bot] in #16669
• chore(deps): bump github.com/onsi/gomega from 1.40.0 to 1.42.1 by @dependabot[bot] in #16670
• refactor: add context propagation to background util functions by @farhan11166 in #16643
• cleanup: remove dead fakeContext code by @aerosouund in #16675
• feat: support MutatingPolicy target conditions and subresource targets by @realshuting in #16614
• fix(webhook): scope namespaced policies to their own namespace by @rx18-eng in #16615
• chore(deps): bump sigs.k8s.io/structured-merge-diff/v6 from 6.3.2 to 6.4.2 by @dependabot[bot] in #16684
• chore(deps): bump Homebrew/actions/limit-pull-requests from 2026.07.13.1 to 2026.07.20.1 by @dependabot[bot] in #16681
• chore: bump controller-tools by @eddycharly in #16687
• fix: make file extension checks case-insensitive by @Iqrima in #16689
• chore(deps): bump actions/setup-python from 6.2.0 to 7.0.0 by @dependabot[bot] in #16668
• fix(ivpol): add debug logging for CEL image verification functions by @amarkdotdev in #16305
• test: point ivpol cosign tests at the kyverno test-images registry by @rx18-eng in #16695
• feat: reuse image verification cache for ImageValidatingPolicy by @bhuvan-somisetty in #16694
• fix: enforce MutatingPolicy evaluation mode semantics by @realshuting in #16686
• ci: assign release milestone to PRs automatically at release time by @JimBugwadia in #16661
• chore(deps): bump actions/labeler from 6.2.0 to 7.0.0 by @dependabot[bot] in #16679
• chore(deps): bump actions/checkout from 6.0.2 to 7.0.1 by @dependabot[bot] in #16680
• chore(deps): bump github/codeql-action/upload-sarif from 4.37.1 to 4.37.3 by @dependabot[bot] in #16697
• fix: validate MAP-incompatible MutatingPolicy match conditions by @realshuting in #16698
• fix(policycache): surface audit-rule warnings for mixed audit and enforce policies by @rx18-eng in #16594
• fix(generate): reject stale trigger UIDs when live resource does not match by @ANAMASGARD in #16603
• Image verification credential handling refactor by @aerosouund in #16439
• fix(ivpol): support private Sigstore/Fulcio instances for keyless verification by @JimBugwadia in #16666
• feat: add YAML template mode for GeneratingPolicy with optional CEL interpolation by @realshuting in #16699
• feat: support MutatingAdmissionPolicy v1 on Kubernetes 1.36 by @realshuting in #16703
• fix: strip cross-namespace ownerReferences in CEL-based generation by @realshuting in #16716
• Fix DeletingPolicy objectSelector test results by @Prachidg in #16431
• feat(cel): add regex.replace extension function by @tendinginfinity24 in #16438
• fix: align dpol CLI reporting for constraint-excluded resources with vpol/mpol by @realshuting in #16727
• fix(ivpol): harden validation, cover ephemeral subresource, and serialize sigstore TUF access by @JimBugwadia in #16663
• fix(verification): use sigstore-go TUF client and fallback to trusted_root.json by @rseleven in #16591
• fix(ivpol): keep autogen variants per-policy to prevent cross-policy clobbering by @rx18-eng in #16731
• test(integration): add ImageValidatingPolicy support to the framework by @rx18-eng in #16730
• feat(mpol): add auditAnnotations support to MutatingPolicy by @realshuting in #16721
• fix: preserve namespaceSelector during policy autogen by @pyd-07 in #16476
• fix: align policy metrics for new policy formats by @aditip149209 in #16359
• fix: validate DeletingPolicy cron schedule at admission by @Jayashanker-Padishala in #16728
• [Feature] add optional cache bounds via --maxGlobalContextEntries by @IceCodeBear in #16560
• fix(webhook): add excludeBootstrapResources flag to skip Node and CSR on Fail webhooks by @rx18-eng in #16397
• fix(webhook): don't mark policies not ready or clear webhooks while health is unknown by @rx18-eng in #16434
• fix: prevent GlobalContextEntry informer failure from deadlocking the reconcile worker by @realshuting in #16739
• fix(helm): use request.namespace for vpolExclude matchConditions by @swastikCommits in #16751
• test(integration): align ivpol framework tests with single-phase image verification by @rx18-eng in #16741
• feat(helm): expose maxGlobalContextEntries in the Kyverno chart by @IceCodeBear in #16749
• chore(deps): bump github.com/prometheus/client_golang from 1.23.2 to 1.24.1 by @dependabot[bot] in #16770
• chore(deps): bump docker/login-action from 4.1.0 to 4.5.1 by @dependabot[bot] in #16767
• chore(deps): bump the kubernetes group across 3 directories with 7 updates by @dependabot[bot] in #16737
• chore(deps): bump github.com/sigstore/cosign/v3 from 3.0.6 to 3.1.2 by @dependabot[bot] in #16738
• restrict issue self-assignment to good first issues for non-members by @realshuting in #16776
• chore(deps): bump fluxcd/flux2/action from 2.9.2 to 2.9.3 by @dependabot[bot] in #16735
• chore(deps): bump actions/checkout from 6.0.2 to 7.0.1 by @dependabot[bot] in #16733
• chore(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 by @dependabot[bot] in #16734
• fix: resolve namespaceObject with live API fallback on informer cache miss by @realshuting in #16784
• fix(cli): evaluate mutateExisting mutating policies on admission in test by @rx18-eng in #16618
• feat(cli): support admission operation simulation for policy testing by @realshuting in #16787
• fix: honor full-exemption PolicyException when multiple exceptions match by @AftAb-25 in #16060
• fix: allow pod-level seccomp in restrict-seccomp-strict vpol by @Suhani95 in #16249
• fix(engine): honor per-rule failureAction in the admission block deci… by @rx18-eng in #16558
• Moving the mixed-OS (Hybrid) cluster solution from controller specific nodeSelectors to the global values by @kubeagon in #15873
• fix(helm): disable in-process cert controller when cert-manager delegation is enabled by @realshuting in #16804
• Fix image verification parity gaps by @JimBugwadia in #16800
• chore(deps): bump github.com/aptible/supercronic from 0.2.47 to 0.2.48 by @dependabot[bot] in #16802
• fix: IVPOL mutateDigest unimplemented stub by @lucchmielowski in #16815
• chore(deps): bump docker/login-action from 4.5.1 to 4.5.2 by @dependabot[bot] in #16818
• fix: enforce verifyDigest in ImageValidatingPolicy evaluator by @pyd-07 in #16817
• chore(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.2 by @dependabot[bot] in #16837
• chore(deps): bump Homebrew/actions/limit-pull-requests from 2026.07.20.1 to 2026.07.29.1 by @dependabot[bot] in #16836
• chore(deps): bump docker/login-action from 4.5.2 to 4.6.0 by @dependabot[bot] in #16834
• fix: sync GeneratingPolicy downstream in-place on trigger update and delete on no-longer-matching trigger by @realshuting in #16838
• fix: prevent autogen from rewriting namespaceObject in mpol by @lucchmielowski in #15947
• chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.0 by @dependabot[bot] in #16835
• fix: bump cel-go to v0.30.0 to resolve CVE-2026-GHSA-gcjh-h69q-9w9g by @itsvishalyadav in #16782
• fix: evaluate resource filters from background scanning jobs by @sagarkhandagre998 in #16469
• feat: surface deprecation of legacy kyverno.io policy types (warnings, helm notice, PSS default) by @realshuting in #16868
• feat: remove kyverno-json support from api by @eddycharly in #16792
• fix(dclient): use RESTMapper for GVK to GVR mapping by @FirePheonix in #16905
• Fix context propagation in MatchPolicyContext by @itsvishalyadav in #16910
• chore(deps): bump github/codeql-action/upload-sarif from 4.37.3 to 4.37.4 by @dependabot[bot] in #16913
• [Bug Fix] Fix data race and goroutine leak in policy_spec fuzzing on get bytes error by @itsvishalyadav in #16908
• chore(deps): Upgrade gotest.tools to v3 by @chimanjain in #16915
• chore(deps): bump cbrgm/cleanup-stale-branches-action from 1.2.11 to 1.2.12 by @dependabot[bot] in #16914
• chore(deps): bump github.com/sigstore/sigstore-go from 1.2.2 to 1.3.0 by @dependabot[bot] in #16912
• chore: cut release v1.19.0-rc.1 by @realshuting in #16922
• feat: remove kyverno-json from test api (Cherry-pick #16929) by @kyverno-pr-updater[bot] in #16971
• feat: remove chainsaw tests using kyverno-json (Cherry-pick #16963) by @kyverno-pr-updater[bot] in #16972
• feat: remove json scan command (Cherry-pick #16943) by @kyverno-pr-updater[bot] in #16973
• fix: IVPOL required has no effect (Cherry-pick #16853) by @kyverno-pr-updater[bot] in #16987
• fix(policy): preserve validation warnings for generate rules in validateAction (Cherry-pick #16821) by @kyverno-pr-updater[bot] in #17012
• feat(helm): add configurable lifecycle hooks to all controllers (Cherry-pick #16444) by @kyverno-pr-updater[bot] in #17011
• fix(validation): reject non-string values in request.operation conditions (Cherry-pick #16977) by @kyverno-pr-updater[bot] in #17013
• feat: remove reference to kyverno-json from go modules (cherry-pick #17005) by @realshuting in #17010
• Fix goroutine and ticker leak in metrics initialization (Cherry-pick #17024) by @kyverno-pr-updater[bot] in #17025
• Fix ticker leak in policyController background reconciliation loop (Cherry-pick #17027) by @kyverno-pr-updater[bot] in #17030
• Fix context leak in TTL controller reconcile loop (Cherry-pick #17032) by @kyverno-pr-updater[bot] in #17034
• Fix resource leak in sigstore fetchReferrers loop (Cherry-pick #17039) by @kyverno-pr-updater[bot] in #17042
• fix(gpol): scope SyncWatchers stale downstream deletion to the evaluated trigger (Cherry-pick #17020) by @kyverno-pr-updater[bot] in #17048
• fix(gpol): mark UpdateRequest as Failed when engine evaluation returns an error result (Cherry-pick #17061) by @kyverno-pr-updater[bot] in #17064
• fix(webhook): do not offload namespaceObject match conditions to the API server (Cherry-pick #17069) by @kyverno-pr-updater[bot] in #17072
• chore: cut release v1.19.0-rc.2 by @realshuting in #17073
• Fix ignored context in notary registry resolution (Cherry-pick #17078) by @kyverno-pr-updater[bot] in #17079
• fix(webhooks): handle nil RequestKind and RequestResource in trace middleware (Cherry-pick #17087) by @kyverno-pr-updater[bot] in #17091
• ci: add configurable code freeze check by @realshuting in #17095
• chore: cut release v1.19.0-rc.3 by @realshuting in #17094
• fix(imageverify): repopulate intoto payload on attestation cache hit (#17117) by @realshuting in #17195
• Release 1.19.0-rc.4 by @realshuting in #17209
• chore: cut release v1.19.0 by @realshuting in #17238

New Contributors

• @pulkitvats2007-crypto made their first contribution in #15827
• @williamclot made their first contribution in #15754
• @mastersans made their first contribution in #16181
• @the-technat made their first contribution in #16161
• @naseyro made their first contribution in #16207
• @s3onghyun made their first contribution in #16279
• @7se7en72025 made their first contribution in #16276
• @asiyani made their first contribution in #15824
• @senutpal made their first contribution in #16245
• @avoidik made their first contribution in #16280
• @Aneesh-Hegde made their first contribution in #16041
• @vmsilvamolina made their first contribution in #15872
• @Ebraam-Ashraf made their first contribution in #16130
• @Proximyst made their first contribution in #16301
• @dag-andersen made their first contribution in #16039
• @ObaidAbdullah16 made their first contribution in #16162
• @khiemdoan made their first contribution in #16405
• @Utkal059 made their first contribution in #16296
• @pyd-07 made their first contribution in #16258
• @1vanden made their first contribution in #16252
• @InsomniaCoder made their first contribution in #15865
• @hugolevino made their first contribution in #16298
• @AftAb-25 made their first contribution in #16087
• @volantebjb made their first contribution in #16239
• @p-fruck made their first contribution in #16490
• @rootp1 made their first contribution in #16544
• @Karthikk-18 made their first contribution in #16525
• @santhil-cyber made their first contribution in #16292
• @Goutham-Annem made their first contribution in #16630
• @Iqrima made their first contribution in #16625
• @farhan11166 made their first contribution in #16643
• @amarkdotdev made their first contribution in #16305
• @bhuvan-somisetty made their first contribution in #16694
• @Prachidg made their first contribution in #16431
• @tendinginfinity24 made their first contribution in #16438
• @rseleven made their first contribution in #16591
• @Jayashanker-Padishala made their first contribution in #16728
• @swastikCommits made their first contribution in #16751
• @kubeagon made their first contribution in #15873
• @FirePheonix made their first contribution in #16905
• @kyverno-pr-updater[bot] made their first contribution in #16971

Full Changelog: v1.18.2...v1.19.0

What's Changed

• fix: restart dynamic watchers in background reporting on 410 (Cherry-pick #16028) by @kyverno-bot in #16030
• fix: do not abort required validation on non-matching images (Cherry-pick #16208) by @kyverno-bot in #16218
• fix(cli): allow multiple CRDs in to be in the --crd-path file (Cherry-pick #16161) by @kyverno-bot in #16215
• fix(gpol,mpol): enforce namespace boundary in generator.apply() (backport GHSA-79gf-7frw-68m9 to release-1.18) by @realshuting in #16238
• feat(pss-helm): add image to allowed volumetypes (Cherry-pick #15906) by @kyverno-bot in #16332
• backport(release-1.18): security dependency bumps from #16340 by @realshuting in #16343
• fix(release-1.18): roll up codeql dependency and toolchain updates by @realshuting in #16395
• fix(reports): correct label prefix for mpol/dpol policies (Cherry-pick #16452) by @kyverno-bot in #16453
• chore: cut v1.18.2-rc.2 by @realshuting in #16517
• chore: cut v1.18.2 by @realshuting in #16526

Full Changelog: v1.18.1...v1.18.2